Search: “shapley-attribution”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42Aug 17, 10:52 UTC · Aug 17, 2026Research

Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?

arXiv paper shows SHAP gives unreliable standalone explanations for malware detection, with attribution dilution and sign reversal in dependent PE feature spaces.

The paper argues SHAP's formal guarantees are insufficient for reliable malware interpretation because the explained feature-coalition game is fixed only by analyst choices, not by malware behavior in the data. In static Portable Executable feature spaces, dependent feature groups cause conditional SHAP to dilute credit by a factor of 1/m across redundant features, attribute importance to features the model never uses, and even reverse attribution signs; interventional SHAP queries off-manifold coalitions no real executable exhibits. Experiments on EMBER-2018, EMBER-2024, and BODMAS with fixed LightGBM and XGBoost detectors confirm these effects. The authors position SHAP as a limited diagnostic requiring explicit data-distribution statements and domain validation, not a standalone explanation framework.

arXiv cs.CRSep 4, 02:00 UTC · 13d agoResearch1

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker NewsSep 3, 10:36 UTC · 13d agoMalware in the wild1

DynSHAP: Towards Explainable Dynamic Survival Analysis

DynSHAP extends SHAP explainability to dynamic survival analysis, treating time-feature pairs as Shapley players for longitudinal clinical predictions.

DynSHAP adapts marginal SHAP estimators to dynamic survival analysis by treating time-feature pairs as players in the Shapley game, handling longitudinal irregular inputs and functional survival outputs. Temporal DynSHAP learns linear feature dependencies over time and addresses them with conditional sampling. On synthetic data with ground-truth attributions it recovers temporally dependent features more accurately than marginal estimators, and it produces faithful attributions on two real-world clinical datasets across two DSA architectures.

arXiv cs.AI / cs.LG / cs.CLSep 11, 16:39 UTC · 5d agoAI research

MeClear: Cooperative Game-Theoretic Attribution and Risk-Aware Memory Clearance for Long-Horizon LLM Agents

MeClear uses cooperative Shapley attribution to clear harmful memories from long-horizon LLM agents, boosting task recovery by 25.5 points over baselines.

The paper introduces MeClear, a task-conditioned memory clearance framework for long-horizon LLM agents that identifies and selectively suppresses memories with negative downstream utility without permanently altering the persistent memory bank. It combines Leave-One-Out screening with sampled cooperative Shapley attribution to distribute utility across interacting evidence, resolving redundant conflict masking that single-removal evaluations miss. Across ten long dialogue memory pools it achieves 85.9% target recall and 82.3% overall task recovery, a 25.5 percentage-point improvement over LOO baselines.

arXiv cs.AI / cs.LG / cs.CLSep 8, 17:46 UTC · 8d agoAI research

Australian cops cuff alleged TeamPCP masterminds

Australian police, with FBI assistance, arrested the alleged masterminds behind the Shai-Hulud worm and related supply chain attacks.

Australian law enforcement, working with the FBI, arrested suspects alleged to be the masterminds behind the Shai-Hulud worm and other software supply chain attacks. The group is referred to as TeamPCP. The report did not specify charges, the number of suspects arrested, or affected victims.

The Register · SecurityAug 28, 03:33 UTC · 20d agoPolicy & legal

Root-Cause Attribution Is a Search Problem: Continual Search for Long-Horizon Agent Failures

Continual Search framework iteratively prompts LLM judges to keep searching agent execution logs, boosting long-horizon failure root-cause attribution accuracy.

The paper frames automated root-cause attribution (RCA) for long-horizon AI agent failures as a search problem, since relevant evidence is sparse and distributed across massive execution traces. The authors propose Continual Search, an iterative framework that nudges an LLM judge across successive turns to keep hunting unresolved diagnostic evidence instead of settling on an early plausible diagnosis. They introduce MegaRCA-Mix, a benchmark of 50 human-annotated failure trials on long-horizon, execution-heavy tasks. On MegaRCA-Mix, Continual Search improves GPT-5.5's F1 from 0.349 to 0.498 (over 40% gain), and lower-tier models can surpass higher-tier counterparts when search is effective.

Hugging Face daily papersSep 10, 20:00 UTC · 6d agoAI research1

Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)

ArXiv paper shows the trusting-trust compiler backdoor technique can compromise an entire Linux distribution via the strip utility.

The paper (arXiv 2607.24888) demonstrates that Ken Thompson's trusting-trust attack, long viewed as a compiler-specific threat, can backdoor an entire Linux distribution by targeting the strip utility. A compromised tool reproduces its backdoor in subsequent rebuilds of itself, generalizing the attack surface beyond compilers. The finding has supply-chain implications for build reproducibility and distribution trust, though it is a research result with no observed real-world exploitation.

Lobsters · securitySep 5, 10:58 UTC · 11d agoResearch

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.

Huntress uncovered a phishing campaign targeting attendees after Black Hat and DEF CON. Attackers used X direct messages pointing to a malicious Google Doc as the delivery vehicle. Payloads include AMOS, a macOS infostealer, and the NetSupport RAT, among other malware.

HuntressAug 19, 13:00 UTC · 28d agoPhishing & fraud

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense

CiteShade attack makes RAG models cite trusted sources for attacker-chosen wrong answers, raising wrong-answer rate from 0.01 to 0.68.

CiteShade is presented as the first citation laundering attack against multi-source retrieval-augmented generation: an attacker controlling a single source induces a wrong answer falsely attributed to a trusted source, even while correct evidence remains in context. The attack is formalized via three necessary conditions (retrieval, generation, citation) constructible without any instructions, raising wrong-answer rate from 0.01 to 0.68 on multi-hop QA, with source deletion confirming the malicious source as causal driver. Vulnerability tracks a model's citation propensity rather than scale, reaching CLR 0.84 with explicit instruction and 0.64 without on the most citation-prone model. Perplexity filtering and citation-support checking prove insufficient; the authors propose a counterfactual defense verifying which source actually drove the answer.

arXiv cs.CRSep 14, 14:41 UTC · 2d agoAI safety & security1

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.

Mandiant's September 2026 report describes an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider, then getting a poisoned package recommendation accepted and installing an infostealer via a malicious PyPI package. The attacker stole GitHub OAuth tokens, deployed the self-spreading Shai-Hulud worm across approximately 100 internal repositories, and stole repository secrets and product source code. Poisoning a package in the company's official namespace caused a second employee to pull the compromised version and become infected. Mandiant recommends verifying AI-recommended dependencies against checksums and allowlists, keeping secrets out of extension reach, and routing dependency traffic through internal repositories.

The Hacker NewsSep 16, 13:37 UTC · 14h agoData breach in the wild

An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment

Researchers propose an evidence claim model defining which trust and audit claims agentic AI systems can support, mapping claims to mechanisms, assumptions, and threats.

The paper proposes an evidence claim model for agentic AI processes that exchange messages, invoke tools, request approvals, and modify shared artifacts. It distinguishes claim types such as artifact integrity, provenance, approval evidence, and policy assessment, mapping each to mechanisms, assumptions, limitations, and threats. It stresses that hashes, signatures, and external anchors do not establish semantic truth, authorization, or capture completeness. The contribution is conceptual, offering vocabulary for what an agentic black box can and cannot evidence and which controls must surround it.

arXiv cs.CRSep 8, 09:25 UTC · 8d agoAI safety & security

[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)

0day Rubbish disclosed an unauthenticated Hessian deserialization flaw in Accurate Online Private Cloud on-prem allowing JNDI remote class loading, rated 9.8.

The 0day Rubbish Research Team publicly disclosed an unauthenticated Hessian deserialization vulnerability in the current on-premises release of Accurate Online Private Cloud. The flaw lets unauthenticated attackers trigger JNDI remote class loading, a path that typically yields remote code execution. The issue carries a CVSS 9.8 rating. No CVE identifier or evidence of in-the-wild exploitation was included in the disclosure.

Full DisclosureSep 8, 17:31 UTC · 8d agoVulnerability

Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning

Researchers show malicious federated learning clients can probe broadcast classifiers to recover deleted samples, exposing exact label leakage on MNIST and CIFAR-10.

The paper shows that federated unlearning systems broadcasting updated linear classifiers leak compact additive training summaries to clients. A malicious client can submit known changes, identify server states from returned classifiers, and compare states around an isolated deletion to expose the deleted sample, class, or client summary, potentially enabling reinsertion. On MNIST and CIFAR-10, high-precision broadcasts allowed exact label recovery for every tested deletion, while lower precision sharply reduced fine-grained recovery.

arXiv cs.CRSep 3, 20:59 UTC · 13d agoResearch

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Wiz highlights personal developer repositories as a supply chain blind spot leaking corporate secrets, offering correlation-based risk validation and remediation.

Wiz argues that developers' personal code repositories are a blind spot in software supply chain security where corporate secrets quietly escape. The company describes an approach that correlates personal repositories to specific developers, validates the actual risk, and drives remediation. No specific incident or vulnerability is disclosed in the announcement.

Wiz BlogAug 13, 13:48 UTC · Aug 13, 2026Tools2

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm CenterSep 3, 02:02 UTC · 14d agoTools1

From Reweighting to Rewriting: Unlocking the Intervention Effects of Influential Samples in Training Data Attribution

Study shows rewriting responses of influence-selected training examples shifts LLM behavior more strongly than reweighting the same samples.

The paper examines training data attribution, arguing that influence functions identify high-leverage examples whose value goes unrealized under conventional weight-based reweighting interventions. It introduces influence-guided response rewriting, which replaces the responses of influence-selected examples with behavior-aligned or behavior-opposed supervision while keeping instructions fixed, tested across four open-weight LLMs using epistemic abstention as the primary testbed. Rewriting produces stronger, more persistent, and bidirectional behavioral shifts, including on safety refusal, while reweighting the same examples yields weak, inconsistent effects. The results motivate intervention-aware evaluation of TDA methods.

Hugging Face daily papersSep 1, 20:00 UTC · 15d agoAI research

PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift

PIDS-Bench shows prompt-injection detectors scoring F1 above 0.98 still misclassify about one-third of external benign security-adjacent prompts, revealing provenance-sensitive over-defense.

PIDS-Bench is a frozen multi-axis benchmark that jointly evaluates prompt-injection detectors on attack detection and benign false-positive behavior at fixed thresholds, spanning in-distribution inputs, hard-benign prompts, obfuscated attacks, and domain/structural distribution shifts. It evaluates seven detectors plus a rule-based lower-bound reference. A detector exceeding F1 = 0.98 on held-out data still misclassifies roughly one-third of an externally-sourced benign security-adjacent subset, and no internal detector reaches F1 >= 0.95 with hard-benign FPR <= 0.10 on the stress distribution. Hard-negative augmentation nearly eliminates over-defense on curated stress inputs but leaves it intact on externally-sourced prompts, a pattern termed provenance-sensitive over-defense.

arXiv cs.CRSep 14, 04:28 UTC · 2d agoAI safety & security

Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys

Researchers show split-LLM training leaks privacy via zero-valued gradients on decoy rows, exposing which activations are real despite passing forward-channel checks.

A systems-security case study of a two-node split-LLM training setup found that the returned output gradient from an Untrusted Cloud Node is exactly zero for decoy rows, revealing which rows are real. Across nine seeds, zero patterns identified real rows in 4,096 of 4,096 frames per run, and an attack on frame contents recovered 0.65 to 1.50 percentage points of extra tokens over a baseline. Both datasets passed forward-channel privacy and quality checks but failed once the returned gradient was included. Row-wise gradient clipping and noise closed the leak for roughly 0.01 nats of held-out cross-entropy, though five unmeasured attack classes remain.

Hugging Face daily papersSep 2, 20:00 UTC · 14d agoAI safety & security

Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing

A study of 180 US workers found each LLM phishing personalization level raised click-intention odds by 28%, but credibility depends on context fit.

The arXiv paper evaluates how personalized pretexts in LLM-generated spear phishing affect perceived credibility, using 180 US working adults across 1,436 evaluations of emails with four cumulative personalization levels, from workplace context to shared-project details. Convincingness rose 2.40 points per level in sensitivity analysis and click-intention odds increased 28% per level, while non-clickers shifted toward deleting rather than reporting. Qualitative coding showed details matching the recipient's role and routines supported credibility, whereas incorrect, vague, or channel-inappropriate details raised suspicion. The authors argue personalization effectiveness depends on pretext fit, with implications for workplace security training.

arXiv cs.CRSep 3, 19:21 UTC · 13d agoResearch

One Symptom, Three Levers: A Critical Review of On-Policy Self-Distillation

A review paper frames on-policy self-distillation collapse as governed by three levers: token weighting, privileged information, and guidance decay.

The paper critically reviews On-Policy Self-Distillation (OPSD), where a language model trains on its own generations scored token-by-token by a teacher conditioned on privileged information such as reference solutions or environment feedback. It identifies collapse, the progressive narrowing of producible reasoning paths, as the dominant failure mode and analyzes it through three levers: signal weighting, the nature of privileged information, and teacher dynamics. The review is restricted to mathematical reasoning, reports no new experiments, and offers a shared vocabulary separating settled findings from disputed ones.

Hugging Face daily papersAug 25, 20:00 UTC · 22d agoAI research

Tracking Shai-Hulud: Inside the ChainDrop NPM Worm

ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.

On August 4, 2026, the self-propagating ChainDrop worm entered the npm ecosystem through a compromised maintainer account, poisoning packages including keyv, cacheable, and flat-cache. ChainDrop is a variant of Mini Shai-Hulud linked to the actor TeamPCP. It anchors its C2 infrastructure in an Ethereum smart contract, allowing domain rotation with a single blockchain transaction and defeating domain-based blocklists. The compromised keyv maintainer's GitHub account caused the project's own GitHub Actions release pipeline to publish malicious package versions.

Zscaler ThreatLabzAug 11, 21:21 UTC · Aug 11, 2026Malware in the wild

When LLM judges agree, should we believe them?

Amazon ICML paper uses Ising models to correct correlated LLM-judge votes, beating accuracy-weighted panels by 9-14%.

Amazon Science describes an ICML paper, "Dependence-aware label aggregation for LLM-as-a-judge via Ising models," addressing how correlated judge outputs inflate majority-vote confidence. The unsupervised method models pairwise dependence between judges, learning both reliability and similarity without human reference labels. Tested on relevance, toxicity, and summarization tasks with 10 judge models at temperature zero, it outperformed accuracy-weighted voting by 9% to 14%.

Hacker News · AISep 14, 16:29 UTC · 2d agoAI research HN 41↑ · 23 comments

Cost-Aware Hierarchical Multi-Agent Ransomware Detection and Family Attribution

Researchers propose a hierarchical multi-agent system that cuts ransomware analysis cost by 44% while reaching 96.57% detection accuracy.

An arXiv paper (2609.04820) presents a Cost-Aware Hierarchical Multi-Agent System (HMAS) for adaptive ransomware detection and family attribution. Specialized agents run static analysis first, with dynamic and memory modalities invoked only when confidence is insufficient or specialists disagree; a Meta Orchestrator balances accuracy against computational cost via a cost model, and a locally deployed LLM verifies difficult cases. The system achieved 96.57% accuracy, 0.96 F1-score, and 0.99 ROC-AUC for binary detection, and 0.90 macro-F1 for multiclass family attribution. Average analysis cost dropped 43.97% versus exhaustive analysis, with 56.05% of cases resolved using static evidence alone.

arXiv cs.CRSep 4, 07:17 UTC · 12d agoResearch

I Am No One: Style-Aware Paraphrasing for Text Anonymization

Prompt-driven style-aware paraphrasing with LLMs cuts authorship attribution F1 by 60-70% while preserving content quality.

The paper proposes a style-aware, prompt-driven anonymization approach using pretrained LLMs to build compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. It addresses stylometric re-identification risks in anonymized text, including ASR transcripts of meetings and call-center calls where leakage persists after acoustic anonymization. Across blog and review datasets, the approach reduces authorship attribution F1 by 60-70%, substantially outperforming both DP-based and non-DP baselines while maintaining readability.

arXiv cs.CRSep 11, 02:07 UTC · 6d agoResearch

HyQuant: Hybrid-Precision Quantization for LLM Attention

HyQuant keeps most LLM attention states low-bit while preserving vertical-line tokens and local windows in high precision, maintaining near-lossless accuracy.

HyQuant is a hybrid-precision quantization framework for LLM attention that quantizes most attention states to low bits while keeping accuracy-critical vertical-line tokens and local-window states in full precision, selected via lightweight attention-pattern signals. In the prefill stage it uses a hybrid-precision attention operator, and in the decode stage it applies the same principle to KV-cache compression with fused dequantization and attention computation. Across diverse tasks, models, and datasets it maintains nearly lossless accuracy; code is available on GitHub.

Hugging Face daily papersAug 27, 20:00 UTC · 20d agoAI tools & infra1

InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation

InceptionRAG fragments malicious payloads into dormant passages that trigger LLMs to self-deduce misinformation via multi-hop reasoning, bypassing existing RAG poisoning defenses.

Researchers introduce InceptionRAG, a stealthy corpus poisoning attack against retrieval-augmented generation that splits a malicious payload into a chain of individually harmless dormant passages. When retrieved together, the passages induce LLMs to self-deduce target misinformation through multi-hop reasoning, achieving over 80% attack success rate across three datasets and three LLMs under rigorous adversarial constraints. A zeroth-order suffix optimization (ZOSO) method automates authoritative suffix generation in black-box settings. The authors also propose HODOR, a document isolation defense that decouples adversarial logical dependencies.

arXiv cs.CRSep 15, 08:22 UTC · 1d agoResearch

Thought without systematicity? Evaluating reasoning models on rule induction tasks

Study finds reasoning models often fail on structurally equivalent variants of tasks they solve, suggesting their reasoning lacks systematicity.

The paper extends rule induction tasks from cognitive science using task isomorphisms such as recombination and substitution to test systematicity in reasoning models. Despite solving tasks correctly, models frequently fail on structurally equivalent variants of the same task. The authors conclude many model behaviors lack systematicity, making it difficult to establish cognitive abilities beyond the specific evaluation contexts.

Hugging Face daily papersSep 11, 20:00 UTC · 5d agoAI research

Necessary or Sufficient? Evaluating LLM Explanations With Behavioural Evidence

New framework tests whether LLM-cited explanation factors are necessary or sufficient, finding weak correlation across Claude, GPT, and Gemini models.

An arXiv paper introduces black-box intervention tests measuring whether factors LLMs cite in their explanations are necessary or sufficient for their outputs in agent oversight workflows. Across eight models from the Claude, GPT, and Gemini families, Spearman correlations between cited rankings and measured influence ranged from 0.349-0.354 (advisor recommendation) to 0.431-0.580 (prompt monitoring). Uncited factors scored above the lowest cited factor in up to 57.6% of advisor responses, showing cited top-three factors do not reliably identify the most influential inputs.

arXiv cs.AI / cs.LG / cs.CLSep 4, 17:37 UTC · 12d agoAI safety & security1

Bag of Tricks or Bag of Myths? Reducing Modeling Complexity with Task Knowledge in Explainable Suicide Risk Assessment

Researchers audit 31 NLP techniques for clinician-annotated suicide risk prediction, finding only 5 of 31 comparisons yield reliable gains.

A study of 1,635 clinician-annotated social media posts ran roughly 300 controlled experiments across 7 methodological families, auditing techniques such as model scaling, synthetic data, ensembling, and threshold tuning under severe class imbalance. The proposed system reformulates risk factor prediction as entailment between posts and codebook definitions, using architecturally diverse ensembles with class-balanced training and deployment-consistent calibration. It scores 0.8203 for risk, 0.7953 for evidence, and 0.7045 macro-F1 for factors, ranking third among 53 teams.

arXiv cs.AI / cs.LG / cs.CLSep 7, 17:14 UTC · 9d agoAI research