RESEARCH
October 2024: LLM agents under test, fragile encrypted cloud, DDoS data that disagree
October 2024 brings the first broad benchmarks of LLM agent security: attacks often succeed and defenses hold up poorly. In applied cryptography, four out of five encrypted cloud storage services show serious flaws and compilers undo constant-time protections. A study compares industry and academic DDoS data and finds diverging views.
Archive: reconstruction written in November 2026
1. Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
arXiv · Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao et al. · AI & LLM Security
In short: A broad benchmark shows LLM agents fall to many attacks and current defenses help little.
Agent Security Bench covers 10 scenarios, including finance and e-commerce, over 400 tools and 27 attack and defense methods, tested on 13 models. Prompt injection, memory poisoning and a new planning backdoor hit every stage of the agent. The highest average attack success rate reaches 84.3%, while the 11 defenses tested show limited effectiveness.
Why it matters. It provides a common yardstick for agent risk, useful when assessing companies that give agents tools, data and memory.
Read the paper · PDF · Code
2. Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
arXiv · Donghyun Lee, Mo Tiwari · AI & LLM Security
In short: In multi-agent systems a malicious prompt replicates from one agent to the next, like a virus.
Security research has focused on single LLMs. Prompt Infection instead shows LLM-to-LLM injection: the malicious prompt self-replicates across connected agents and spreads silently, causing data theft, scams, misinformation and outages. The systems tested are highly exposed even when agents do not share all communications. The LLM Tagging defense greatly reduces the spread.
Why it matters. A single malicious input can spread through a company's whole automation: a systemic, not isolated, risk.
3. SecAlign: Defending Against Prompt Injection with Preference Optimization
ACM Conference on Computer and Communications Security · Sizhe Chen, Arman Serikuly Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri et al. · AI & LLM Security
In short: Training the model to prefer the safe answer cuts prompt injection success below 10%.
SecAlign builds a dataset of injected inputs, secure outputs that follow the legitimate instruction and insecure outputs that follow the injected one, then applies preference optimization. It is the first known method to bring several prompt injections below 10% success, even against attacks more sophisticated than those seen in training, while keeping similar utility.
Why it matters. It shows resistance to prompt injection can be improved in the model itself: something to ask vendors about.
Read the paper · PDF · Code
4. End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem
ACM Conference on Computer and Communications Security · Jonas Hofmann, Kien Tuong Truong
In short: Four out of five end-to-end encrypted cloud storage services have serious cryptographic flaws.
The authors analyse Sync, pCloud, Icedrive, Seafile and Tresorit, with over 22 million users combined, assuming a malicious server. Four have serious vulnerabilities: the server can inject files into encrypted storage, tamper with file data and in some cases read the content. Many attacks hit several providers in the same way, pointing to common design failures.
Why it matters. A provider's claim of end-to-end encryption is not a guarantee on its own: marketing promises do not always survive analysis.
5. Breaking Bad: How Compilers Break Constant-Time Implementations
arXiv · Moritz Schneider, Daniele Lain, Ivan Puddu, Nicolas Dutly et al. · Hardware & Side Channels
In short: Compiler optimizations break constant-time defenses even in the most hardened cryptographic libraries.
Constant-time code avoids secret-dependent operations to resist timing attacks, but the protection only counts if it survives compilation. With a new tool, the authors run dynamic analysis on 44,604 targets across six architectures, from x86-64 to RISC-V. They find compiler-introduced secret-dependent operations in some of the most highly regarded libraries.
Why it matters. A library's claimed security also depends on how it is compiled: an often overlooked link in the chain.
6. The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments
arXiv · Raphael Hiesgen, Marcin Nawrocki, Marinho Pilla Barcellos, Daniel Kopp et al. · Network Security
In short: Industry and academia see different DDoS trends, depending on sources, vantage points and methods.
A joint study analyses 24 industry reports from 2022 and ten industry and academic data sets from 2019 to 2023, covering direct-path and reflection-amplification attacks. A new method shares a list of targets with companies, which join it with their private data, revealing the blind spots of academic sources. Discrepancies stem from sources, vantage points, methods and parameters.
Why it matters. DDoS statistics used to estimate frequency and severity are not neutral: read them knowing which observatory they come from.
7. Characterizing the MrDeepFakes Sexual Deepfake Marketplace
arXiv · Catherine Han, Anne Li, Deepak Kumar, Zakir Durumeric · Policy, Law & Society
In short: The main sexual deepfake marketplace analysed: rules barely enforced and new tactics to obtain resources.
The paper systematically characterises MrDeepFakes, the best-known marketplace for buying and selling sexual deepfakes: its economics, the people targeted and user discussions on how to create them. It finds little enforcement of posted rules, such as limiting targets to celebrities, previously undocumented motivations and new tactics for acquiring computing resources.
Why it matters. For reputational and liability covers, deepfakes are an organised market, not a marginal phenomenon.
8. Persistent Pre-Training Poisoning of LLMs
arXiv · Yiming Zhang, Javier Rando, Ivan Evtimov, Jianfeng Chi et al.
In short: Poisoning 0.1% of pre-training data is enough to leave effects that survive fine-tuning.
LLMs are trained on web-scraped text that attackers can poison. The authors pre-train models from 600 million to 7 billion parameters from scratch under four goals: denial of service, belief manipulation, jailbreaking and prompt stealing. With 0.1% poisoned data, three of four attacks persist after alignment; denial of service needs only 0.001%.
Why it matters. Training data provenance becomes a risk issue for companies embedding third-party models in their processes.
9. OT-PCA: New Key-Recovery Plaintext-Checking Oracle Based Side-Channel Attacks on HQC with Offline Templates
IACR Transactions on Cryptographic Hardware and Embedded Systems · Haiyue Dong, Qian Guo · Hardware & Side Channels
In short: A new side-channel attack on HQC recovers the key with far fewer device queries.
OT-PCA uses HQC's public decoder to build offline templates that extract information on hundreds of secret positions with a single query. Required calls drop 2.4-fold for hqc-128 and more for higher levels; with a 95% accurate oracle the reduction reaches 7.6. Power analysis on a Cortex-M4 confirms practical feasibility.
Why it matters. Post-quantum schemes heading for standardization also need side-channel protection before deployment.
10. Zero day ransomware detection with Pulse: Function classification with Transformer models and assembly language
Computers & Security · Matthew Gaber, Mohiuddin Ahmed, Helge Janicke · Malware & Threat Intelligence
In short: A Transformer model recognises never-seen ransomware from its assembly code.
Pulse uses ransomware assembly instructions captured by Peekaboo, a dynamic instrumentation tool that defeats evasion techniques. These instructions follow Zipf's law like natural language, which suits Transformer models. By removing any functionality shared between test and training samples, the model must recognise malicious behaviour from context alone, and does so with high accuracy.
Why it matters. Detecting new ransomware before encryption is where a control actually reduces the loss.
Trends of the month
AI & LLM Security
254 papers this month on this topic
With 254 papers classified, AI security is the month's broadest topic, almost double September. The first common measuring tools arrive, such as Agent Security Bench, along with the first systemic scenarios, with prompts spreading between agents like a virus. The most promising defenses act on model training, but pre-training data poisoning shows risk can enter at the source.
Papers cited:
- Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
- Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
- SecAlign: Defending Against Prompt Injection with Preference Optimization
- Persistent Pre-Training Poisoning of LLMs
Cryptography
196 papers this month on this topic
The common thread in applied cryptography is the gap between promise and reality. Encrypted cloud services with millions of users do not withstand a malicious server, and carefully written constant-time defenses are undone by the compiler. In both cases the algorithm is sound but the implementation is not. For anyone assessing risk, an encryption claim says little without independent verification.
Papers cited:
- End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem
- Breaking Bad: How Compilers Break Constant-Time Implementations
Post-Quantum Cryptography
37 papers this month on this topic
After ML-KEM and ML-DSA, attention extends to HQC, the code-based scheme NIST later selected in March 2025 as a second key encapsulation mechanism. A side-channel attack sharply reduces the work needed to recover its key on a microcontroller. Research thus runs ahead of implementations: anyone planning migration can demand countermeasures from the first versions.
Papers cited:
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1491.