RESEARCH
February 2025: LLM agents with encrypted backdoors, booters that return, Dilithium keys
February 2025 is dominated by LLM agents: encrypted backdoors that evade audits, a defence against indirect prompt injection, AI search engines citing malicious sites and an agent that compromises an Active Directory network on its own. Beyond AI, the global seizure of DDoS-for-hire services has short-lived effects and the post-quantum Dilithium signature falls to a side channel.
Archive: reconstruction written in November 2026
1. DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent
arXiv · Pengyu Zhu, Zhenhong Zhou, Yuanhe Zhang, Shilinlu Yan et al. · AI & LLM Security
In short: Encrypted, fragmented backdoors in LLM agents reach nearly 100% success with zero detection.
Backdoors can be implanted in LLM agents through user queries or environment feedback, but audits of the reasoning process tend to catch them. DemonAgent dynamically encrypts the backdoor into benign content and splits it into several fragments. Across several datasets, including the new AgentBackdoorEval, success approaches 100% with a 0% detection rate.
Why it matters. Reasoning audits are not enough to certify an agent: adopters stay exposed to hidden behaviour that is hard to prove after an incident.
Read the paper · PDF · Code
2. MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
arXiv · Kaijie Zhu, Xianjun Yang, Jindong Wang, Wenbo Guo et al. · AI & LLM Security
In short: MELON detects indirect prompt injection by re-running the agent with the user's request masked.
In LLM agents, malicious instructions hidden in tool-retrieved data can hijack actions. MELON starts from one observation: when an attack succeeds, the next action depends more on the malicious task than on the user's. It re-executes the trajectory with a masked user prompt and flags an attack if the actions match. On AgentDojo it beats existing defences.
Why it matters. A defence that needs no retraining and keeps utility is easier to adopt for anyone wiring agents to email, documents or payments.
Read the paper · PDF · Code
3. Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search
USENIX Security Symposium · Zeren Luo, Zifan Peng, Yule Liu, Zhen Sun et al. · AI & LLM Security
In short: Seven production LLM-based search engines often cite malicious sites even for harmless queries.
First risk measurement on seven production AI search engines, using data from PhishTank, ThreatBook and LevelBlue. Answers often include malicious URLs even with benign keywords, and querying a URL directly raises the risk. Two real-world cases show how easily they are deceived by spoofed documents and phishing. An agent-based defence cuts the risk at a cost of about 10.7% of information.
Why it matters. AI search answers look vetted and lower users' guard: they become a new delivery channel for phishing and scams.
4. Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation
ACM Conference on Computer and Communications Security · Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari et al. · AI & LLM Security
In short: Thirty natural questions reveal whether a document is in a RAG datastore, without being noticed.
RAG systems leave model weights untouched, but retrieved documents enter the context and can leak. The Interrogation Attack writes natural questions that can only be answered if the target document is present: 30 queries suffice, at under $0.02 per document. Simple detectors flag earlier attacks up to about 76 times more often.
Why it matters. Knowing that a document sits in a corporate assistant's datastore can itself be a leak of confidential information, at negligible attack cost.
5. Can LLMs Hack Enterprise Networks? Autonomous Assumed Breach Penetration-Testing Active Directory Networks
arXiv · Andreas Happe, Jürgen Cito · Identity & Authentication
In short: An autonomous LLM-driven system compromises accounts in a test Active Directory network.
Enterprise penetration testing is costly and limited by scarce expertise. A prototype uses LLMs to run Assumed Breach simulations autonomously and compromises accounts in the GOAD Active Directory testbed. Across five models, the system adapts strategies, audits web apps and unstructured data, generates plausible passwords and fixes its own errors, at lower cost than a professional.
Why it matters. The cost of an insider attack on a Windows network falls: the Active Directory compromise scenario needs reassessing for frequency, not only severity.
6. Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services
USENIX Security Symposium · Anh V. Vu, Ben Collier, Daniel R. Thomas, John Kristoff et al. · Network Security
In short: The global seizure of DDoS-for-hire services cuts attacks, but sites return within one or two days.
Since December 2022, law enforcement in several countries has targeted DDoS-for-hire services with two waves of seizures and deceptive domains. Over half the first-wave sites return within a median of one day and all second-wave ones within two, but with 80-90% fewer visits. The first wave cuts global attack volume by 20-40%; the second has minimal effect.
Why it matters. Police operations lower DDoS risk only briefly: expected frequency should not be reduced for long after an announced takedown.
7. MANTIS: Detection of Zero-Day Malicious Domains Leveraging Low Reputed Hosting Infrastructure
IEEE Symposium on Security and Privacy · Fatih Deniz, Mohamed Nabeel, Ting Yu, Issa M. Khalil
In short: MANTIS spots newly registered malicious domains by watching reused hosting infrastructure.
Attackers use disposable domains that are often gone before detection or shielded by cloaking and captchas. Because they reuse the same hosting infrastructure, MANTIS builds a network graph linking it and flags new malicious domains without inspecting content. It reaches 99.7% precision and 86.9% recall, with a 0.1% false positive rate.
Why it matters. Blocking domains in their first hours reduces exposure to phishing and malware exactly when traditional blocklists are still empty.
8. URL Inspection Tasks: Helping Users Detect Phishing Links in Emails
USENIX Security Symposium · Daniele Lain, Yoshimichi Nakatsuka, Kari Kostiainen, Gene Tsudik et al. · Usable Security & Human Factors
In short: Small URL tasks before opening a link reduce the success of email phishing.
Phishing succeeds mostly through inattention rather than lack of training. The study adds short CAPTCHA-inspired tasks before a link opens: picking the right URL from a list, highlighting the domain name or retyping it. In an online study with 2,673 participants from three cultures and alphabets, the tasks significantly reduce successful phishing, especially with typo-squatted domains.
Why it matters. Slowing users down at the moment of the click works better than more training: a concrete control to weigh among email fraud measures.
9. Rejected Signatures' Challenges Pose New Challenges: Key Recovery of CRYSTALS-Dilithium via Side-Channel Attacks
IACR Transactions on Cryptographic Hardware and Embedded Systems · Yuanyuan Zhou, Weijia Wang, Yiteng Sun, Yu Yu · Post-Quantum Cryptography
In short: Dilithium's rejected signatures reveal the private key in seconds or minutes via a side channel.
In lattice signatures such as ML-DSA/Dilithium, rejection sampling makes signatures independent of the secret. The authors turn the leakage from rejected signatures into an integer linear programming problem and recover the private key at all three security levels, in seconds or minutes with 100% success. The needed information is extracted from a single side-channel trace.
Why it matters. The move to post-quantum cryptography shifts risk to implementation: signing devices and modules need checking against side channels too.
10. Chronus: Understanding and Securing the Cutting-Edge Industry Solutions to DRAM Read Disturbance
arXiv · Oğuzhan Canpolat, A. Giray Yağlıkçı, Geraldo F. Oliveira, Ataberk Olgun et al. · Hardware & Side Channels
In short: The RowHammer protection built into new DRAM has costs and weak spots; Chronus reduces them.
The first rigorous analysis of PRAC, the read-disturbance defence built into the latest DRAM chips, measures its security, performance, energy and cost. PRAC slows accesses and, to resist the wave attack, must be configured with very low thresholds, at prohibitive cost for future chips. Chronus updates counters concurrently and adjusts preventive refreshes, at near-zero overhead.
Why it matters. RowHammer remains a platform risk shared among cloud tenants: hardware defences need assessing for real effectiveness, not presence on a datasheet.
Read the paper · PDF · Code
Trends of the month
AI & LLM Security
276 papers this month on this topic
With 276 of 1,465 papers this month, AI security focuses on agents and systems that read external sources. Backdoors hide from audits, malicious instructions arrive through tool-retrieved data, AI search engines cite malicious sites and RAG datastores reveal what they hold. Defences exist but are still catching up.
Papers cited:
- DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent
- MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
- Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search
- Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation
Network Security
36 papers this month on this topic
Two papers look at attacker infrastructure. Seizing DDoS-for-hire services reduces attacks only briefly, since sites return within one or two days, while reuse of the same hosting makes it possible to block malicious domains as soon as they appear. In both cases speed of response matters more than any single blow.
Papers cited:
- Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services
- MANTIS: Detection of Zero-Day Malicious Domains Leveraging Low Reputed Hosting Infrastructure
Post-Quantum Cryptography
41 papers this month on this topic
As ML-DSA enters the standards, research moves from the algorithm to the implementation. Dilithium's rejected signatures, so far considered harmless, are enough to rebuild the private key from a single side-channel trace: compliance with the standard does not by itself guarantee the device is secure.
Papers cited:
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1465.