RESEARCH
March 2025: KyberSlash, encrypted backups that leak data, AI assistants that track
March 2025 brings the focus back to implementation. Kyber's reference code leaked the key through division timings, and five encrypted backup tools reveal content through their chunking. AI browser assistants send whole pages to their servers, Bluetooth and Wi-Fi SDKs track location, and pig-butchering scams are told by their victims.
Archive: reconstruction written in November 2026
1. KyberSlash: Exploiting secret-dependent division timings in Kyber implementations
IACR Transactions on Cryptographic Hardware and Embedded Systems · Daniel J. Bernstein, Karthikeyan Bhargavan, Shivam Bhasin, Anupam Chattopadhyay et al. · Post-Quantum Cryptography
In short: Two timing flaws in Kyber's reference code (ML-KEM) allow recovery of the secret key.
KyberSlash1 and KyberSlash2 exploit secret-dependent division timings in several Kyber implementations, including the reference code for the ML-KEM standard. On Raspberry Pi 2 and Cortex-M4 the key is recovered in minutes or a few hours. Libraries have been patched, and a modified Valgrind found further cases across more than 1,000 implementations.
Why it matters. Even the reference code of a post-quantum standard can hold exploitable bugs: crypto library updates need tracking like any security patch.
2. Breaking and Fixing Content-Defined Chunking
ACM Conference on Computer and Communications Security · Kien Tuong Truong, Simon-Philipp Merz, Matteo Scarlata, Felix Günther et al. · Cryptography
In short: Borg, Restic and Tarsnap: chunking in encrypted backups lets attackers recover the key and infer content.
Backup tools deduplicate data by splitting it into content-defined chunks; to prevent leakage, they mix a key into the process. The authors recover this key in five schemes used by Borg, Bupstash, Duplicacy, Restic and Tarsnap, with only weak known- or chosen-plaintext abilities, and show end-to-end attacks on Borg, Restic and Tarsnap. They propose a provably secure construction.
Why it matters. Backup encryption is a frequently required control: this work shows that how a product deduplicates must be checked, not just the stated algorithm.
3. Big Help or Big Brother? Auditing Tracking, Profiling, and Personalization in Generative AI Assistants
USENIX Security Symposium · Yash Vekaria, Aurelio Loris Canino, Jonathan Levitsky, Alex Ciechonski et al. · Web & Mobile Security
In short: The ten most popular AI browser assistants send whole pages, sometimes form inputs, to their servers.
The study analyses the traffic and behaviour of the ten most popular AI browser assistant extensions. They rely on server-side APIs that can fire without user action and send page content, often the full DOM and sometimes form inputs. Some share identifiers and prompts with third-party trackers such as Google Analytics, even on pages with health data.
Why it matters. An extension installed by one employee can pass customer or patient data to third parties: a privacy breach risk outside IT's control.
4. Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-scanning SDKs in Android
Proceedings on Privacy Enhancing Technologies · Aniketh Girish, Joel Reardon, Juan Tapiador, Srdjan Matic et al. · Network Security
In short: 86% of apps with Bluetooth and Wi-Fi scanning SDKs collect sensitive data, including location.
Bluetooth and Wi-Fi scans find peripherals and networks but also reveal location, for example via beacons in shopping centres. The first systematic analysis of 52 scanning SDKs shows that 86% of apps embedding them collect at least one sensitive data type, such as identifiers, email and GPS coordinates, with widespread SDK-to-SDK sharing and bridging of persistent and resettable IDs.
Why it matters. An app publisher answers for the third-party libraries it ships: hidden location collection is a concrete regulatory risk.
5. Prompt Inversion Attack against Collaborative Inference of Large Language Models
IEEE Symposium on Security and Privacy · Wenjie Qu, Yuguang Zhou, Yongji Wu, Tingsong Xiao et al.
In short: In collaborative LLM inference, a malicious participant rebuilds prompts from the activations it receives.
To cut costs, some platforms spread an LLM's layers across several users' GPUs, which pass intermediate activations along. The prompt inversion attack shows a malicious participant can rebuild the input prompt from those activations: it first optimises embeddings under a model-derived constraint, then recovers tokens through calibration and semantic speculation.
Why it matters. Spreading compute across third-party machines also spreads the data: users of such platforms should not send confidential information.
6. ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning
arXiv · Zhaorun Chen, Mintong Kang, Bo Li · Policy, Law & Society
In short: ShieldAgent checks other AI agents' actions against rules extracted from policy documents.
Autonomous agents remain vulnerable to malicious instructions, and chatbot guardrails do not fit their action sequences. ShieldAgent extracts verifiable rules from policy documents and checks the protected agent's trajectory through logical reasoning and formal verification. On a new 3,000-case benchmark it beats prior methods by 11.3% on average, with 90.1% recall.
Why it matters. Turning company policies into automatic checks on agent actions is the kind of control that makes an AI deployment assessable.
7. "Hello, is this Anna?": Unpacking the Lifecycle of Pig-Butchering Scams
arXiv · Rajvardhan Oak, Zubair Shafiq · Systems & Software Security
In short: Interviews with 26 victims trace the phases of pig-butchering scams, from romance to fake investments.
Pig-butchering scams combine romance, investment fraud and social engineering. The first qualitative analysis, based on interviews with 26 victims, describes an organised cycle: trust built step by step, fake financial platforms, invented returns and repeated pressure. Victims become more exposed to follow-up scams. The authors point to intervention points for social media and financial platforms.
Why it matters. Losses grow in stages, so banks get more than one chance to step in: relevant for fraud cover and customer guidance.
8. "We just did not have that on the embedded system": Insights and Challenges for Securing Microcontroller Systems from the Embedded CTF Competitions
ACM Conference on Computer and Communications Security · Zheyuan Ma, Gaoxiang Liu, Alex Eastman, Kai Kaufman et al. · Systems & Software Security
In short: MITRE eCTF competitions show why microcontroller systems remain hard to secure.
Microcontrollers run vehicles, medical devices and industrial controls. Analysing team designs from MITRE's 2023 and 2024 eCTF and interviewing participants, the study finds conceptual and practical hurdles: developers coming from microprocessor systems miss the specific attacks, Rust is poorly supported on microcontrollers, and weak entropy sources undermine cryptography.
Why it matters. Flaws arise during development and repeat across vendors: for product and liability risk, the maturity of the supplier's processes matters.
Trends of the month
Cryptography
173 papers this month on this topic
With 173 papers, cryptography is the month's second topic, and the two papers chosen share one message: the algorithm is sound, the implementation is not. Kyber, just standardised as ML-KEM, leaked the key in its reference code, and the encrypted backups of five popular products reveal information through deduplication.
Papers cited:
- KyberSlash: Exploiting secret-dependent division timings in Kyber implementations
- Breaking and Fixing Content-Defined Chunking
Privacy
67 papers this month on this topic
Privacy runs through components users do not see. AI browser assistants send whole pages to servers and third-party trackers, wireless-scanning SDKs infer location and link identifiers, and in collaborative LLM inference the exchanged activations reveal the prompt. In every case data leaves through a third-party piece added for convenience.
Papers cited:
- Big Help or Big Brother? Auditing Tracking, Profiling, and Personalization in Generative AI Assistants
- Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-scanning SDKs in Android
- Prompt Inversion Attack against Collaborative Inference of Large Language Models
AI & LLM Security
201 papers this month on this topic
With 201 papers, AI security remains the top topic. Alongside attacks, control systems are growing: ShieldAgent turns policy documents into verifiable rules on agent actions, an approach closer to how a company manages compliance than to content filters.
Papers cited:
- ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning
- Prompt Inversion Attack against Collaborative Inference of Large Language Models
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1414.