RESEARCH
January 2025: trojaned LLM plugins, LiDAR spoofed at speed, IoT attacked via Tor
Supply chainOT and industrial security
January 2025 brings the NDSS proceedings. Open-model adapters can hide trojans, and the shared cache of LLM servers leaks other users' prompts. An autonomous car's LiDAR is spoofed at 60 km/h from 110 metres, attackers use Tor to hit cloudless IoT devices, and CSS alone is enough to fingerprint browsers and email clients.
Archive: reconstruction written in November 2026
1. The Philosopher's Stone: Trojaning Plugins of Large Language Models
Network and Distributed System Security Symposium · Tian Dong, Minhui Xue, Guoxing Chen, Rayne Holland et al. · AI & LLM Security
In short: An infected LoRA adapter makes an LLM output attacker-chosen content and misuse tools.
Open models are specialised with low-rank adapters that anyone can download. Two new attacks, POLISHED and FUSION, build trojan adapters that, on a trigger, make the LLM output chosen content or use tools: a compromised agent installs malware or launches spear phishing. Utility is preserved and none of the three defences tested is fully effective.
Why it matters. An adapter downloaded from a public hub is third-party code: whoever plugs it into an agent with tool access inherits its behaviour.
2. I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving
Network and Distributed System Security Symposium · Guanlong Wu, Zheng Zhang, Jianyu Niu, Weili Wang et al. · Hardware & Side Channels
In short: KV-cache sharing in multi-tenant LLM servers lets an attacker reconstruct other users' prompts.
Frameworks such as vLLM and SGLang share the Key-Value cache across users for identical token sequences, saving memory and compute. The first study of multi-tenant LLM serving risks shows this mechanism opens a side channel: the PROMPTPEEK attack reconstructs other users' prompts in three scenarios with different levels of attacker knowledge.
Why it matters. A performance optimisation becomes a data leak between customers of the same service: multi-tenant set-ups need to be assessed as a security boundary.
3. Membership Inference Attacks Against Vision-Language Models
USENIX Security Symposium · Yuke Hu, Zheng Li, Zhihao Liu, Yang Zhang et al. · AI & LLM Security
In short: Five samples are enough to tell whether data were used to train a vision-language model.
Instruction-tuning data for vision-language models may contain sensitive or unauthorised information. The first membership inference study on these models exploits how responses change with temperature over a set of samples. Four methods cover different levels of background knowledge and reach an AUC above 0.8 on LLaVA with only 5 samples.
Why it matters. The technique serves attackers and auditors alike: it lets one check whether proprietary or confidential data ended up in a model's training.
4. On the Realism of LiDAR Spoofing Attacks against Autonomous Driving Vehicle at High Speed and Long Distance
Network and Distributed System Security Symposium · Takami Sato, Ryō Suzuki, Yuki Hayakawa, Kazuma Ikeda et al. · CPS & IoT Security
In short: First LiDAR spoofing against an autonomous vehicle at 60 km/h, launched from 110 metres.
LiDAR spoofing attacks had only been shown in controlled settings. The MVS system detects and tracks the vehicle, auto-aims the laser and injects fake pulses; the new A-HFR attack removes objects even against LiDARs with pulse fingerprinting. It is the first successful spoofing of a vehicle moving at 60 km/h, with the attack launched from 110 metres.
Why it matters. Physical risk to autonomous-driving sensors leaves the lab: it matters for assessing fleets and manufacturer liability.
5. TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network
USENIX Security Symposium · Y. C. Pan, Zhen Ling, Yue Zhang, Hongze Wang et al. · Privacy
In short: Twelve months of Tor traffic reveal 45 exploited flaws in cloudless IoT, 29 of them zero-days.
Cloudless IoT devices are exposed directly to the Internet. Noticing heavy Tor traffic aimed at them, the authors build TORCHLIGHT, which filters traffic and uses LLMs to identify threats. Over 12 months and 26 TB analysed it finds 45 vulnerabilities, including 29 zero-days with 25 CVEs, affecting about 12.7 million devices in 148 countries.
Why it matters. Zero-day exploitation of IoT is already under way and hidden behind anonymity: exposure estimates based only on known CVEs remain incomplete.
6. Hidden and Lost Control: on Security Design Risks in IoT User-Facing Matter Controller
Network and Distributed System Security Symposium · Haoqiang Wang, Yiwei Fang, Yichen Liu, Ze Jin et al. · CPS & IoT Security
In short: Design flaws in Matter controllers take device control away from smart-home users.
Matter is the standard unifying the smart home. The study identifies a new class of design flaws, UMCCI, in the interfaces users rely on to control and monitor Matter devices. An automatic tool, aided by an LLM for UI analysis, detects them without hardware; proof-of-concept attacks on 11 devices from 8 vendors confirm they are practical and common.
Why it matters. An interoperability standard replicates mistakes across many vendors at once: the flaw becomes a supply-chain issue, not a single-device one.
7. CounterSEVeillance: Performance-Counter Attacks on AMD SEV-SNP
Network and Distributed System Security Symposium · Stefan Gast, Hannes Weissteiner, Robin Leander Schröder, Daniel Gruss · Hardware & Side Channels
In short: Performance counters leak secrets from AMD SEV-SNP confidential VMs, even on patched systems.
SEV-SNP promises VM confidentiality even on shared hosts. CounterSEVeillance shows that 228 performance-counter events are visible to a malicious hypervisor and reads them instruction by instruction, recovering the outcome of secret-dependent branches. On patched systems it extracts a full RSA-4096 key from a single Mbed TLS signature in under 8 minutes.
Why it matters. Confidential computing is sold as protection from the cloud provider: these side channels limit that guarantee and belong in contract terms.
8. The Skeleton Keys: A Large Scale Analysis of Credential Leakage in Mini-apps
Network and Distributed System Security Symposium · Yizhe Shi, Min Yang, Kangwei Zhong, Guangliang Yang et al. · Identity & Authentication
In short: Mini-app credentials across 21 super-apps can leak and unlock payments and sensitive data.
Super-apps delegate sensitive services such as payments and analytics to mini-app servers, protected by credentials. The first systematic study of this mechanism finds 21 popular platforms using seven credential types, exposed to leakage by malicious users. The KeyMagnet tool assesses the impact of leaked credentials on platforms and servers.
Why it matters. In the app-in-app ecosystem, one developer's exposed credential can give access to payments and data of many users.
9. Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting
Network and Distributed System Security Symposium · Leon Trampert, Daniel Weber, Lukas Gerlach, Christian Rossow et al. · Web & Mobile Security
In short: CSS alone, with no JavaScript, tells apart 98% of browser-OS combinations and also works in email.
Privacy-focused browsers such as Tor and email clients disable JavaScript to curb tracking. Three techniques based on CSS container queries, arithmetic functions and complex selectors infer application, OS and hardware: they distinguish 97.95% of 1,176 browser-OS combinations and work on 8 of 21 email clients. The authors propose two defences.
Why it matters. Tracking reaches HTML email, where it was thought ruled out: relevant for anyone assessing privacy risk in communications and campaigns.
10. Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples
Network and Distributed System Security Symposium · Adrian Shuai Li, Arun Iyengar, Ashish Kundu, Elisa Bertino et al. · Malware & Threat Intelligence
In short: Learning features that stay stable over time helps detect evolving Windows malware.
Malware evolves and trained classifiers fail on new samples. Current retraining techniques fall short when recent samples are scarce. The proposed method uses graph neural networks with adversarial domain adaptation to learn control-flow-graph features that stay stable, improving detection on benchmarks and on real-world malware from 2024.
Why it matters. A detector that degrades silently gives false confidence: robustness over time is a criterion to ask of defence vendors.
Trends of the month
AI & LLM Security
282 papers this month on this topic
With 282 papers, AI security is again the broadest topic, and attention shifts from the model's answer to its supply chain and serving. Downloadable adapters can carry trojans, the servers' shared cache reveals other users' prompts, and a handful of samples is enough to tell whether data were used in training.
Papers cited:
- The Philosopher's Stone: Trojaning Plugins of Large Language Models
- I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving
- Membership Inference Attacks Against Vision-Language Models
CPS & IoT Security
83 papers this month on this topic
Physical and home systems leave the lab. LiDAR spoofing works on a moving vehicle, attackers already exploit zero-days against cloudless IoT while hiding behind Tor, and the Matter standard spreads the same design flaws across vendors. For risk assessment, accumulation across identical devices weighs more than any single vulnerability.
Papers cited:
- On the Realism of LiDAR Spoofing Attacks against Autonomous Driving Vehicle at High Speed and Long Distance
- TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network
- Hidden and Lost Control: on Security Design Risks in IoT User-Facing Matter Controller
Web & Mobile Security
75 papers this month on this topic
On the web and mobile, assumed defences give way in unexpected places. Disabling JavaScript no longer stops fingerprinting, which reaches email through CSS alone, and in super-apps the credentials protecting payments and data can leak from the mini-app side.
Papers cited:
- Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting
- The Skeleton Keys: A Large Scale Analysis of Credential Leakage in Mini-apps
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 2656.