30
30
30
30
30
60
30
42
45
50
30
42
PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift
PIDS-Bench shows prompt-injection detectors scoring F1 above 0.98 still misclassify about one-third of external benign security-adjacent prompts, revealing provenance-sensitive over-defense.
PIDS-Bench is a frozen multi-axis benchmark that jointly evaluates prompt-injection detectors on attack detection and benign false-positive behavior at fixed thresholds, spanning in-distribution inputs, hard-benign prompts, obfuscated attacks, and domain/structural distribution shifts. It evaluates seven detectors plus a rule-based lower-bound reference. A detector exceeding F1 = 0.98 on held-out data still misclassifies roughly one-third of an externally-sourced benign security-adjacent subset, and no internal detector reaches F1 >= 0.95 with hard-benign FPR <= 0.10 on the stress distribution. Hard-negative augmentation nearly eliminates over-defense on curated stress inputs but leaves it intact on externally-sourced prompts, a pattern termed provenance-sensitive over-defense.
38
What Makes Adversarial Examples Transfer Across Deepfake Detectors?
A controlled study of 60 deepfake detectors shows adversarial example transfer depends heavily on source-target compatibility, with source averaging understating vulnerability.
The study evaluates adversarial example transferability across 60 deepfake detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using AutoAttack (AA) and Carlini-Wagner with Expectation over Transformation (CW-EOT). Transfer rises sharply when source and target share an exact backbone, architecture family, pretraining regime, or training data, with the dominant factor depending on the attack. Mean attack success rate is 7.21% under AA and 19.52% under CW-EOT for single sources, while a multi-source oracle reaches 64.48% after excluding exact matches, showing source averaging can substantially understate target vulnerability. The authors release 240,000 adversarially perturbed images, pairwise transfer results, detector configurations, and evaluation code.
40
30
30
42
57
Vulnerability Spotlight: Vulnerabilities in metal detector peripheral could allow attackers to manipulate security devices
60
42
30
30
55
30
55
47
30
30
30
Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic
Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.
Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.
40
60
30
30
42
30
30
Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
Reprompt watermark forgery reproduces on Stable Diffusion XL using free-tier T4 GPUs, with forged images accepted by the genuine detector 5 of 6 times.
The authors reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring watermarking on Stable Diffusion XL using the released code on free-tier dual T4 GPUs with 14.6 GB usable memory, versus the A40 hardware of the original study. Over six trials, the genuine detector flagged genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 seconds per attack. They also recovered the detector's discarded non-central chi-square statistic and built two natural scores separating forged images from the clean null at AUC 0.861 and 0.972. The notebook, pinned fork, and all measurement artifacts are released with the paper.
30
Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness
Researchers model industrial Windows malware detection as a Compound AI System, quantifying trade-offs between detection accuracy, efficiency, and adversarial robustness under tiered attacker knowledge.
Industrial Windows malware detectors combine rule-based mechanisms with ML-based static and dynamic analyses, but their architectures are rarely publicly disclosed. The authors propose a methodology balancing detection performance, computational cost, and robustness, plus system-level threat models capturing whole-pipeline evasion rather than isolated components. Experiments on real-world data show training time reductions with marginal detection loss, while more knowledgeable attackers craft increasingly effective adversarial examples. The paper derives deployment guidelines from the observed efficiency-robustness trade-off.
42
45
60