ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Linear”

20 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI research 38Vulnerability 38Industry 36Malware 33Policy & legal 27Research 20Ransomware 17Threat actor 14Phishing & fraud 13Model release 11Data breach 10AI safety & security 9Exploit / PoC 9AI tools & infra 8
SeverityAllcritical 65high 45medium 39low 64info 76

Shuffling is Not Enough: Breaking Permutation-Based Model Confidentiality in Hybrid FHE Inference

Attack breaks permutation-based model confidentiality in hybrid FHE inference, recovering all ResNet-20 linear layers exactly with d+1 queries per layer.

The paper shows output-permutation plus noise fails to protect model confidentiality in hybrid FHE inference: d+1 admissible queries recover an exact permutation-invariant summary of a d-input linear layer, and shuffle-model DP amplification premises cannot hold under correctness-bounded noise. The authors recovered all linear layers of a Safhire-style ResNet-20 end-to-end from TFHE transcripts with zero error, using 5,712 total queries. Exact per-layer recovery was also confirmed on pretrained ImageNet-scale CNNs and ViT-B/16. Leaked layer spectra enable model fingerprinting, lineage attribution, and improved logit-based extraction, while suppressing them destroys inference utility.

arXiv cs.CR · 4d agoResearch1

Proximity Gaps for Gabidulin Codes and Applications

Researchers prove proximity-gap bounds for rank-metric and Gabidulin codes, enabling the first polynomial commitment scheme framework based on rank-metric error-correcting codes.

The paper proves every linear rank-metric code admits a proximity gap for deltas up to (d-1)/(3n) with error at most q^(e+1)/q^m, and improves the gap to (d-1)/(2n) for Gabidulin codes with error at most 10q^(n-1)/q^m, matching bounds for Reed-Solomon codes. A constructed infinite family of constant-rate Gabidulin codes shows the (d-1)/(2n) bound is tight, and a counterexample establishes a lower bound on the error at the d/(3n) gap. Applications include an IOPP for interleaved Gabidulin codes adapted from the Ligero IOPP and a q-linearized polynomial commitment scheme adapted from Ligero-based PCS, reportedly the first PCS framework based on rank-metric codes.

arXiv cs.CR · 7d agoResearch

An Open-Source End-to-End FHE Implementation for Privacy-Preserving Llama 3 8B Inference

Odin runs Llama-3-8B fully homomorphic encrypted inference on a single H100 in 366 seconds, a 4.51x speedup over THOR.

Odin is an open-source end-to-end GPU CKKS implementation for privacy-preserving Llama-3-8B inference that co-designs ciphertext packing with model execution. A feature-major cross-layer layout unifies residual connections and layer interfaces, while transient intra-operator layouts serve linear projections and attention, avoiding intermediate repacking of QK^T softmax outputs. Minimax polynomial approximation with input-range control reduces polynomial degree and multiplicative depth for nonlinear ops. With 128-token input, Odin evaluates all 32 Transformer layers on one NVIDIA H100 80 GB in 366.4 s using 58.9 GiB peak memory, versus 1651.9 s for the THOR baseline, a 4.51x speedup.

arXiv cs.CR · 5d agoResearch

Machine Unlearning as Private Retroactive Algorithms

A cs.CR paper defines private retroactive algorithms, showing machine unlearning is a data-maintenance problem and giving DP constructions for linear statistics, clustering, histograms.

The paper argues that machine unlearning's requirement to emulate retraining from scratch carries no meaningful privacy semantics against adversaries observing sequences of releases, recasting it as a data-maintenance question addressed by retroactive algorithms. It defines private retroactive algorithms, combining retroactivity with differential privacy under continual observation. Constructions achieve privacy and retroactivity at no asymptotic cost over privacy alone for linear statistics, clustering, and histograms, alongside impossibility results.

arXiv cs.CR · 11d agoResearch

GAUGE: A Formal Framework for Measuring Cryptographic Security under Heterogeneous Adversary Cost Models

GAUGE frames cryptographic security as profiles over adversary cost models, certifying a ranking reversal between ML-KEM-512 and AES-128 from a 4–5% memory pricing shift.

GAUGE represents cryptographic security as a function over admissible adversary cost models (a security profile), proves profiles are piecewise-linear and concave, and establishes a rating trilemma when two profiles cross. A polynomial-time linear-programming procedure certifies whether the ranking of two schemes is robust, reverses under admissible models, or is genuinely incomparable. Applied to NIST post-quantum standards, the framework certifies a ML-KEM-512 versus AES-128 ranking reversal from a 4–5% shift in memory pricing and measures lattice-sieving cost drift of 9.79 bits per year over eight years. A hybrid X25519 + ML-KEM-768 handshake reduces combined-break probability twenty-fold at a 2.3 kilobyte cost.

arXiv cs.CR · 22h agoResearch

Hunting Vulnerabilities Using Frontier Models

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta Security · 8d agoResearch

Subgroup Packing for Batched PASTA Transciphering

Interleaved subgroup packing cuts PASTA homomorphic transciphering server cost by a median 1.60x at the expense of remaining noise capacity.

The paper studies how record word layout affects the cost of PASTA transciphering, where a server converts symmetrically encrypted records into homomorphic ciphertexts. A subgroup layout interleaves records so cyclic shifts preserve positions, reducing required displacements from 255 to 128 versus contiguous packing. In HElib across twelve paired corpora under six homomorphic keys, the median direct-to-subgroup server cost ratio is 1.60 including fresh generation, conversion, and two queries, but with less remaining noise capacity.

arXiv cs.CR · 5d agoResearch

TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories

Researchers introduce TrajMark, a training-free watermarking framework for coding-agent trajectories that recovers ownership, detects 95.5-100% of edits, and localizes tampered regions.

TrajMark is a training-free, symmetric-key, visible-only watermarking framework for coding-agent trajectories that separates robust ownership attribution from fragile local integrity verification. A sparse owner layer encodes a six-bit deployment identifier by rewriting keyed READ actions into masked linear equations, while a localization layer inserts linked Q12 seals that commit to protected critical-action segments. Across three coding-agent frameworks and three LLMs, it recovers the exact owner in all clean full-watermark batches, detects 95.5%-100% of single-site edits, and localizes 95.8% of random corruptions to an accepted protocol region. Owner marking adds no trajectory actions and matched Pass@1 is 26.9% versus 26.3% for unwatermarked runs.

arXiv cs.CR · 6d agoResearch1

When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning

Researchers show colluding nodes in decentralized federated learning can reconstruct private updates despite secure aggregation, using lattice-based attacks tied to the Hidden Subset Sum Problem.

Secure aggregation in decentralized federated learning is widely assumed to hide individual model updates. The authors show that sparse decentralized topologies give colluding semi-honest nodes asymmetric aggregate views exposing hidden linear combinations of honest participants' private states. They establish a formal connection to the Hidden Subset Sum Problem and design a lattice-based reconstruction approach combining lattice reduction with structural filtering. Evaluations on image, tabular, and text tasks show attackers recover local updates and can reconstruct private training data.

arXiv cs.CR · 8d agoResearch

Optimizing Credential Blast Radius Through Trust Boundaries and Delegation Under Post-Quantum Authentication Costs

Academic paper models credential blast radius optimization across trust domains under post-quantum latency costs, cutting expected impact by up to 36%.

The paper formulates the joint selection of trust domains and credential-derivation structures under policy and latency constraints as an NP-hard optimization problem, showing the scalarized two-domain direct-issuance case reduces to a weighted minimum cut. In 195 of 230 exhaustive synthetic comparisons, joint optimization produced lower credential blast radius than choosing boundaries first, especially under chained delegation. A trace-derived replay using measured post-quantum authentication costs found the best design reduced expected impact by up to 36% relative to a single domain within the latency budget.

arXiv cs.CR · 12d agoResearch

Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning

Researchers show malicious federated learning clients can probe broadcast classifiers to recover deleted samples, exposing exact label leakage on MNIST and CIFAR-10.

The paper shows that federated unlearning systems broadcasting updated linear classifiers leak compact additive training summaries to clients. A malicious client can submit known changes, identify server states from returned classifiers, and compare states around an isolated deletion to expose the deleted sample, class, or client summary, potentially enabling reinsertion. On MNIST and CIFAR-10, high-precision broadcasts allowed exact label recovery for every tested deletion, while lower precision sharply reduced fine-grained recovery.

arXiv cs.CR · 12d agoResearch