RESEARCH
LLM safety in focus, secrets stolen over NVLink and XSS through DoH
A week dominated by LLM security: defenses for agents, for fine-tuning and for Android apps that integrate them, plus watermarking of generated text. On hardware, side channels on the NVLink interconnect between GPUs and a Spectre-v2 attack in JIT engines. A new class of XSS via DoH, mobile single sign-on defects and the verification of Signal's post-quantum ratchet round out the edition.
1. NVBleed: Covert and Side-Channel Attacks on NVIDIA Multi-GPU Interconnect
ACM Conference on Computer and Communications Security · Yicheng Zhang, Ravan Nazaraliyev, Sankha Baran Dutta, Andrés Márquez et al. · Hardware & Side Channels
In short: NVBleed shows that NVLink connections between GPUs leak information, enabling covert channels and side-channel attacks, even across VMs on Google Cloud.
The authors analyse NVLink V1-V3 and find two leakage sources: contention-induced timing variations and performance counters, both visible from a remote GPU. They build a covert channel above 70 kbps and side-channel attacks that fingerprint applications with F1 up to 96.77%. Leakage also occurs across VMs on GCP, with F1 above 88% on Blender.
Why it matters. Shared multi-GPU cloud servers often host sensitive machine learning workloads. The GPU interconnect belongs in the attack surface of isolation models.
For insurers. For insurers of cloud providers or firms training models on shared GPUs, tenant isolation is weaker than assumed. A flaw in widely deployed hardware can create accumulation across similar exposures.
2. Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory
ACM Conference on Computer and Communications Security · Yuhui Wang, Tanqiu Jiang, Jiacheng Liang, Charles Fleming et al. · AI & LLM Security
In short: ShadowMem protects LLM agents from attacks that unfold over many steps, using a safety-focused memory inspired by the shadow stack.
Long-horizon attacks exploit extended user-agent-environment interactions to pursue goals unlikely in a single turn. ShadowMem keeps safety-critical context in a separate memory across the whole execution and assesses each pending action's risk before it runs. The authors report better detection than existing defenses, early detection for most attacks and negligible overhead.
Why it matters. Defenses that look at one message miss an attack spread over many steps. A separate safety memory is a simple pattern for teams building agents.
For insurers. For firms handing real tasks to AI agents, controls tested on single prompts can give false comfort. It is a useful question when assessing controls on AI use.
3. Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries
ACM Conference on Computer and Communications Security · Sander Wiebing, Yuhui Zhu, Alessandro Biondi, Cristiano Giuffrida · Hardware & Side Channels
In short: Branch Target Reuse is the first practical Spectre-v2 attack in JIT engines, reusing stale branch prediction entries after code regeneration.
Processors restore code coherence after self-modification but do not always invalidate indirect branch prediction entries. In JIT engines these stale entries outlive the code and get reused. The authors evaluate it on SpiderMonkey, GraalVM and the Linux kernel cBPF JIT, recovering the root password hash in minutes despite deployed mitigations.
Why it matters. Existing Spectre mitigations do not cover this reuse of stale entries in JIT engines. It is a reminder that transient execution remains an open problem on widely deployed hardware.
For insurers. For insurers, an attack that extracts secrets while bypassing known mitigations undercuts controls taken as effective. Given how common JIT engines are, it is also an accumulation scenario.
4. An Empirical Study of Observability Limits in Advanced Software Supply Chain Attacks
ACM Conference on Computer and Communications Security · Zhuoran Tan, Wenbo Guo, Jiewen Luo, Taylor Brierley et al. · Software Supply Chain
In short: SynthChain is a multi-source dataset with ground truth for advanced software supply-chain attacks and shows the limits of runtime observability.
Advanced supply-chain attacks leave fragmented evidence across hosts, services and build layers. The authors release SynthChain, covering seven scenarios across PyPI, npm and C++, with 2,919 verified indicators of compromise across 22 log files. No single source reconstructs more than 40% of the steps; fusing two improves reconstruction by about 1.6x, but which sources matter more than how many.
Why it matters. Reconstructing an attack chain needs multiple telemetry sources, not just more data. The work offers telemetry-planning guidelines useful to defenders.
For insurers. For supply-chain claims and forensics, a single log source is often insufficient to reconstruct what happened. Insurers can weigh telemetry coverage among required controls.
5. PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants
ACM Conference on Computer and Communications Security · Ruofan Liu, Yun Lin, Yuxin Wang, Xiwen Teoh et al. · AI for Security
In short: PiMRef detects LLM-generated spear-phishing emails by verifying the sender's claimed identity against a knowledge base of facts.
The authors show LLMs generate convincing spear-phishing that fools detectors. PiMRef finds the sender's claimed identity, verifies its domain against an expandable knowledge base, and infers call-to-action instructions. It cuts false positives to 0.81% with 90.7-93.1% recall, and reaches 86.4% on SpearMail (14,672 LLM-generated emails).
Why it matters. LLM-generated spear-phishing defeats rule- and feature-based detectors. Checking disprovable facts about the sender is an approach that holds up better as attacks evolve.
For insurers. Phishing is a frequent trigger of cyber claims, from ransomware to fraud. Detection that holds against LLM spear-phishing bears on the email controls insurers rely on.
6. XSS-over-DoH: On the Adverse Side Effects of DoH on Web Security
ACM Conference on Computer and Communications Security · Matthias Gierlings, Lukas Knittel, Jörg Schwenk, Christian Mainka · Web & Mobile Security
In short: XSS-over-DoH is a new class of web attacks that abuses DNS-over-HTTPS to achieve XSS and bypass Content Security Policy.
DoH introduces HTTP as an extra protocol and reuses port 443 without requiring essential headers. The authors show Direct-XSS-over-DoH, achieving XSS even without markup injection, and CSP-Bypass-over-DoH, circumventing even a strong CSP. Across 3M+ domains they find 1,297 DoH servers, 72% with insecure headers, and 2,265 vulnerable CSPs, including a case on Proton Mail.
Why it matters. A feature introduced to improve DNS privacy can invalidate established web defenses like CSP. New web components need thorough study before adoption.
For insurers. CSP is a control many rely on to contain XSS. If DoH bypasses it, insurers should weigh DoH server and header configuration among web risk factors.
7. Automated Side-Channel Analysis of Cryptographic Protocol Implementations
ACM Conference on Computer and Communications Security · Faezeh Nasrabadi, Robert Künnemann, Hamed Nemati · Formal Methods & Verification
In short: A toolchain extracts protocol models from real binaries and analyses them for side channels, finding a cache leak in WhatsApp Desktop.
The authors bridge the gap between verified specs and executables: they lift machine code, instrument it with leakage contracts for constant-time and Spectre-PHT-style speculation, and translate traces for Tamarin, ProVerif and DeepSec. On WhatsApp Desktop components they identify an instruction-cache side channel that enables social-graph inference.
Why it matters. Formal verification usually ignores compiled code and microarchitectural channels. Starting from real binaries finds leaks that symbolic models miss.
For insurers. Direct insurance relevance is limited. The work does show that a widely used messaging app can expose relationship metadata through side channels, useful for assessing privacy risk.
8. Understanding and Preserving Safety in Fine-Tuned LLMs
ACM Conference on Computer and Communications Security · Jiawen Zhang, Yangfan Hu, Kejia Chen, Lipeng He et al. · AI & LLM Security
In short: SPF preserves LLM safety alignment during fine-tuning by removing gradient components that conflict with a low-rank safety subspace.
Fine-tuning can degrade safety even with harmless data. The authors find safety gradients lie in a low-rank subspace, often conflicting with utility gradients, and estimable from a single sample. SPF removes conflicting components, guaranteeing utility convergence while bounding safety drift, even under adversarial fine-tuning.
Why it matters. The safety-utility dilemma has made fine-tuning fragile. A lightweight method that keeps both helps teams applying LLMs to specific tasks.
For insurers. For insurers of LLM fine-tuning services, a control that preserves alignment reduces the risk of a model losing its safeguards. It points to a concrete technical measure.
9. One Click to Leak: Characterizing the Real-World Usage and Threat Impact of MNO-based Single Sign-On Websites
ACM Conference on Computer and Communications Security · Jiasheng Huang, Mingxuan Liu, Pei Chen, Baojun Liu et al. · Identity & Authentication
In short: A study of Mobile Network Operator-based Single Sign-On (MSSO) on the web finds trust defects that let a single visit leak phone numbers.
The authors identify three trust defects in the MSSO flow and demonstrate One-Click-to-Leak, where one page visit exposes a phone number. In a one-year study of 116,852 URLs across 729 domains, 73.6% show at least one defect: 69.4% expose developer credentials and 27.1% issue privileged tokens before consent. They link an underground ecosystem later seized by law enforcement.
Why it matters. Password-free login via mobile operators is spreading on the web, but its implementations expose identity data. User consent often comes after the token is issued.
For insurers. Leaked phone numbers feed fraud and SIM swap, triggers of cyber claims. For insurers, MSSO implementations are an authentication control to verify, not a given.
10. A Formal Analysis of Signal's Sparse Post-Quantum Ratchet Protocol and its Implementation
ACM Conference on Computer and Communications Security · Karthikeyan Bhargavan, Maxime Buyse, Graeme Connell, Franziskus Kiefer et al. · Formal Methods & Verification
In short: First formal specification and analysis of SPQR, the ML-KEM-based post-quantum ratchet Signal deployed to production in 2025.
SPQR combines with the Double Ratchet for hybrid forward secrecy and post-compromise security: these hold unless both the elliptic curve and the post-quantum KEM break. The authors verify the design with ProVerif across compromise scenarios and integrate the hax toolchain into Signal's CI to prove runtime safety of the production implementation, used by millions.
Why it matters. It is a rare case of formal verification applied by the project to a protocol shipped to millions. It shows how to tie design guarantees to the real implementation.
For insurers. Direct insurance relevance is low. The work is a reference, though, on how formal verification can reduce defect risk in critical messaging software.
11. Janus: Characterizing Bidirectional Privacy and Security Risks in LLM-Integrated Android Apps
ACM Conference on Computer and Communications Security · Junhua Guo, Zongze Li, Haipeng Cai · Web & Mobile Security
In short: Janus is a static analysis that measures privacy and security risks in LLM-integrated Android apps, finding them widespread.
LLM integrations are bidirectional: sensitive data flows into prompts and generated text flows into app logic, UI and APIs. Janus recovers end-to-end pipelines and classifies risks. It finds recurring issues: client-side exposure of API keys and system prompts, sending sensitive data to third-party LLM services without disclosure, and prompt-injection-prone handling.
Why it matters. LLM-integrated apps create a risk class distinct from traditional integrations. Client-side exposed keys and prompts are a concrete, common problem.
For insurers. For insurers of mobile app developers, LLM integration widens the data-leak surface. Controls can ask how the insured handles keys, data sent out, and model outputs.
12. PURA: Provably Unbiased and Robust Multi-Bit Watermarking for AI-Generated Text Attribution
ACM Conference on Computer and Communications Security · Yaofei Wang, Jinyang Guo, Shuchao Du, Chao Wang et al. · AI & LLM Security
In short: PURA is multi-bit watermarking for AI-generated text that preserves the model's distribution and stays recoverable after edits.
Fine-grained attribution of AI text needs high-capacity, robust watermarks. PURA embeds the payload in the latent sampling space and recovers it by treating observed tokens as interval evidence. Per-bit error decays exponentially with length. Embedding 36 bits in 200 tokens, it reaches 91.7% match, over three times the strongest baseline, with millisecond verification.
Why it matters. Attributing AI-generated text supports accountability and auditing. A watermark that survives edits without degrading quality makes attribution more reliable.
For insurers. Direct insurance relevance is limited. The topic does touch AI-content governance and traceability, useful where disinformation or content-based fraud is a risk.
How this digest is made
New papers are collected every day and selected every week from arXiv, the IACR ePrint archive and the main security conferences and journals (IEEE S&P, USENIX Security, ACM CCS, NDSS, CRYPTO, PoPETs, IEEE TIFS and others). A score based on source, topic and early signals picks the candidates; an AI model assesses them and writes the summaries. Summaries are based on the abstracts: the original paper is the reference for details.
New papers assessed for this edition: 799.