• Title: Special Topics on Advanced Security
• Provided by: Dept. of Computer Engineering, Myongji University
• Lead by: Minho Shin (mhshin@mju.ac.kr, Rm5736)
• Period: Fall semester, 2026
• Location: 5701at 5th Engineering Building
• Time: Wed 10am-1pm
• Type: Graduate Seminar
• Goal of the class
  • This class aims to familiarize students with current research topics in Advanced Security & Privacy area
  • This class also aims to train students with their communication skills including oral presentation, discussion, writing, and collaboration
• Resources for researchers from Publishing Campus of Elsevier
  • Learning Center
  • Setting sail on your research journey

TBD

* order: MG --> KC --> SY
* # of presentations per person: 8

• Rules for the class
  • We have 24 presentations in total by three students
  • Each present 8 presentations throughout the semester
  • Two presentation per day
  • The presenter announces the paper to present at least one week ahead
  • The presenter prepares a powerpoint slides for 30-60min talk
  • The other students prepare at least one question for each presentation
  • The presentation should contain:
    • (Motivation) What are the motivations for this particular problem? What is the backgrounds for understanding the problem? Why is this important?
    • (Problem) What is, on earth, the exact problem the authors aim to address, and why on earth, is the problem important?
    • (Related work) What has been done by other researchers to address the same or similar problem on the table? Why the existing work is not enough to call done?
    • (Method) What is their main methodology to address the problem? How did they actually solve the problem in detail?
    • (Evaluation) What are the evidences for their success found in the paper? What is missing in their evaluation?
    • (Contribution) What is the contribution of the paper and what is not their contributions? Are there any limitations in their result? How would you evaluate the value of the paper?
    • (Future work) What is the remaining problems that were only partially addressed or never covered by the paper? What will be a possible approach to the problem?
  • Evaluation
    • As a Presenter
      • Slide Quality
      • Talk Quality
      • Knowledge Level
      • Critic

• Group 1: Prompt Injection and LLM Application Attacks
• Group 2: Jailbreaking and Automated Red-Teaming
• Group 3: Membership Inference and Privacy Attacks
• Group 4: Model Extraction and Intellectual Property Theft
• Group 5: Backdoors, Data Poisoning, and the ML Supply Chain
• Group 6: Adversarial Robustness and Certified Defenses
• Group 7: AI for Offensive Security
• Group 8: Hardware Security and Side Channels
• Group 9: Watermarking, Deepfakes, and Content Provenance
• Group 10: Network and Web Security
• Group 11: Applied Cryptography and Secure Protocols
• Group 12: Systems and Binary Exploitation
• Group 13: Usable Security, Human Factors, and Internet Measurement
• Group 14: Automotive, Mobility, and Unmanned Systems Security
• Group 15: Robotics and Humanoid Robot Security

1. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
   • Authors: Wei Zou, Runpeng Geng (Pennsylvania State University), Binghui Wang (Illinois Institute of Technology), Jinyuan Jia (Pennsylvania State University)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: 17
   • Difficulty: 3/5
   • Keywords: RAG, retrieval poisoning, knowledge corruption, black-box attack
   • PDF: https://www.usenix.org/system/files/usenixsecurity25-zou-poisonedrag.pdf (USENIX Open Access)
   • Summary: PoisonedRAG shows how an attacker can add a small number of malicious documents to a large RAG knowledge base so that the system returns attacker-chosen answers. It separates the attack into making a document easy to retrieve and making its content control the model's answer.
2. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
   • Authors: Kai Greshake (Saarland University / Sequire Technology), Sahar Abdelnabi (CISPA Helmholtz Center for Information Security), Shailesh Mishra (Saarland University), Christoph Endres (Sequire Technology), Thorsten Holz (CISPA), Mario Fritz (CISPA)
   • Venue: ACM Workshop on Artificial Intelligence and Security (AISec, co-located with CCS) — Workshop
   • Year: 2023 | Pages: 14
   • Difficulty: 2/5
   • Keywords: indirect prompt injection, LLM-integrated applications, real-world exploitation
   • PDF: https://dl.acm.org/doi/10.1145/3605764.3623985 ; https://arxiv.org/abs/2302.12173
   • Summary: This paper introduces indirect prompt injection, where harmful instructions are hidden in content that an LLM application later reads. The hidden text can redirect the application even when the attacker cannot access the system prompt or model.
3. Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
   • Authors: Mark Russinovich, Ahmed Salem, Ronen Eldan (Microsoft)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~18
   • Difficulty: 3/5
   • Keywords: jailbreaking, multi-turn attacks, safety alignment, red-teaming
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/russinovich (USENIX Open Access)
   • Summary: Crescendo builds a jailbreak across several conversation turns, beginning with harmless questions and gradually moving toward a request the model would normally refuse. It shows why testing only single prompts misses important safety failures.
4. StruQ: Defending Against Prompt Injection with Structured Queries
   • Authors: Sizhe Chen (UC Berkeley), Julien Piet (UC Berkeley), Chawin Sitawarin (UC Berkeley), David Wagner (UC Berkeley)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~18
   • Difficulty: 3/5
   • Keywords: prompt injection defense, structured queries, instruction-data separation
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/chen-sizhe (USENIX Open Access)
   • Summary: StruQ separates trusted instructions from untrusted data and trains the model to respect that boundary. The paper evaluates whether this structure can reduce prompt injection while keeping the application useful.

1. Universal and Transferable Adversarial Attacks on Aligned Language Models (GCG)
   • Authors: Andy Zou (Carnegie Mellon University), Zifan Wang (Center for AI Safety), J. Zico Kolter (Carnegie Mellon University / Bosch Center for AI), Matt Fredrikson (Carnegie Mellon University)
   • Venue: arXiv preprint, later presented in condensed form at multiple venues; the canonical citation is the original technical report
   • Year: 2023 | Pages: 15 (main paper)
   • Difficulty: 4/5
   • Keywords: adversarial suffixes, gradient-based jailbreaking, transferability
   • PDF: https://arxiv.org/abs/2307.15043 — code and demo: https://llm-attacks.org
   • Summary: The GCG attack uses gradients to search for short text suffixes that make safety-aligned language models answer prohibited requests. Suffixes created for open models can sometimes transfer to different and closed models.
2. h4rm3l: A Dynamic Benchmark of Composable Jailbreak Attacks for LLM Safety Assessment
   • Authors: Moussa Koulako Bala Doumbouya (Stanford University), Ananjan Nandi (Stanford), Gabriel Poesia (Stanford), Davide Ghilardi, Anna Goldie, Federico Bianchi, Dan Jurafsky, Christopher D. Manning (Stanford University)
   • Venue: International Conference on Learning Representations (ICLR) — Conference, top-tier ML venue
   • Year: 2025 | Pages: ~10 (+ appendix)
   • Difficulty: 4/5
   • Keywords: automated red-teaming, jailbreak program synthesis, LLM safety benchmarking
   • PDF: https://openreview.net/forum?id=904aac1c930c196f1c71533d4d9dc31a (OpenReview, fully open)
   • Summary: h4rm3l represents jailbreaks as small programs made from reusable prompt transformations. It searches combinations of these transformations to build and continually update a jailbreak benchmark.
3. STAR: Strategy-Driven Automatic Jailbreak Red-Teaming for Large Language Models
   • Authors: Jianing Zhu, Jiangchao Yao, Bo Han (Hong Kong Baptist University / Shanghai Jiao Tong University, plus collaborators — TEA Lab / NESA)
   • Venue: International Conference on Learning Representations (ICLR) — Conference, top-tier
   • Year: 2025 | Pages: ~10 (+ appendix)
   • Difficulty: 4/5
   • Keywords: latent-space red-teaming, jailbreak strategy search, activation-space attacks
   • PDF: https://openreview.net/forum?id=c2BygWVqag (OpenReview, fully open)
   • Summary: STAR searches a model's internal activation space for jailbreak strategies instead of searching only over prompt text. This approach aims to find a wider variety of safety failures.
4. Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming
   • Authors: Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, Christopher Olah, Jared Kaplan, Ethan Perez, and others (Anthropic)
   • Venue: arXiv / Anthropic technical report, with an accompanying evaluation program; frequently cited alongside peer-reviewed jailbreak-defense work
   • Year: 2025 | Pages: ~30
   • Difficulty: 3/5
   • Keywords: classifier-based defense, constitutional AI, universal jailbreak resistance
   • PDF: https://arxiv.org/abs/2501.18837
   • Summary: Constitutional Classifiers use a written safety policy to create training data for classifiers that screen model inputs and outputs. The authors evaluate the defense through extensive automated and human red teaming.

1. Towards Label-Only Membership Inference Attack against Pre-trained Large Language Models
   • Authors: Yu He, Boheng Li, Liu Liu, Zhongjie Ba, Wei Dong, Yiming Li, Zhan Qin, Kui Ren, Chun Chen (Zhejiang University)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~18
   • Difficulty: 4/5
   • Keywords: membership inference, label-only attacks, pre-trained LLMs
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/he-yu (USENIX Open Access)
   • Summary: This paper studies membership inference when an attacker sees only generated text rather than probability scores. It tests whether that limited output can still reveal if a sample appeared in an LLM's training data.
2. SoK: Membership Inference Attacks on LLMs Are Rushing Nowhere (and How to Fix It)
   • Authors: Matthieu Meeus, Igor Shilov, Shubham Jain, Manuel Faysse, Marek Rei, Yves-Alexandre de Montjoye (Imperial College London)
   • Venue: IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) — Conference
   • Year: 2025 | Pages: ~17
   • Difficulty: 3/5
   • Keywords: systematization of knowledge, membership inference, methodology critique, LLMs
   • PDF: https://arxiv.org/pdf/2406.17975 (arXiv preprint of the SaTML '25 paper)
   • Summary: This systematization argues that many reported LLM membership attacks confuse training-set membership with differences between older and newer text. It proposes evaluation practices that better isolate real privacy leakage.
3. Membership Inference Attacks Against Vision-Language Models
   • Authors: Yuke Hu, Zheng Li, Zhihao Liu, Jian Lou, Zhan Qin, Kui Ren (Zhejiang University), Chun Chen (Zhejiang University)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~18
   • Difficulty: 3/5
   • Keywords: vision-language models, instruction-tuning data, membership inference, multimodal privacy
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/hu-yuke (USENIX Open Access)
   • Summary: This paper extends membership inference to vision-language models and asks whether an image-text example was used for instruction tuning. It studies privacy leakage across both visual and textual inputs.
4. Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation
   • Authors: Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, Amir Houmansadr (Northeastern University / University of Massachusetts Amherst)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~15
   • Difficulty: 4/5
   • Keywords: RAG, membership inference, knowledge base privacy, black-box attack
   • PDF: https://arxiv.org/pdf/2502.00306 (arXiv preprint, full 27-page version; ACM DL version at doi.org/10.1145/3719027.3744840 is paywalled)
   • Summary: Riddle Me This asks whether a particular document exists in a private RAG knowledge base. It designs indirect queries intended to reveal membership without making the attack obvious.

1. Stealing Machine Learning Models via Prediction APIs
   • Authors: Florian Tramèr (Ecole Polytechnique Fédérale de Lausanne, EPFL), Fan Zhang (Cornell University), Ari Juels (Cornell Tech), Michael K. Reiter (University of North Carolina at Chapel Hill), Thomas Ristenpart (Cornell Tech)
   • Venue: 25th USENIX Security Symposium (USENIX Security '16) — Conference, CORE A*/CCF-A
   • Year: 2016 | Pages: 17
   • Difficulty: 3/5
   • Keywords: model extraction, prediction APIs, model stealing, equation-solving attacks
   • PDF: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer (USENIX Open Access)
   • Summary: This paper formalizes model extraction through prediction APIs. It shows that carefully chosen queries and returned predictions can reveal model parameters or reproduce a model's behavior.
2. Stealing Part of a Production Language Model
   • Authors: Nicholas Carlini (Google DeepMind), Daniel Paleka, Krishnamurthy (Dj) Dvijotham, Thomas Steinke, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Eric Wallace, David Rolnick, Florian Tramèr (Google DeepMind / ETH Zürich / University of Washington / Carnegie Mellon University / McGill University)
   • Venue: International Conference on Machine Learning (ICML) — Conference, top-tier ML venue
   • Year: 2024 | Pages: ~19
   • Difficulty: 4/5
   • Keywords: model extraction, embedding-dimension recovery, production LLM attack, API security
   • PDF: https://proceedings.mlr.press/v235/carlini24a.html (open access via PMLR)
   • Summary: This paper recovers structural information and parts of the final layer of production language models through API queries. The attack uses the low-rank structure of model outputs rather than simple trial-and-error copying.
3. A Survey on Model Extraction Attacks and Defenses for Large Language Models
   • Authors: Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, Yushun Dong (Florida State University / Northwestern University / Duke University / University of Southern California)
   • Venue: ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~10 (survey format)
   • Difficulty: 3/5
   • Keywords: survey, model extraction, LLM security, taxonomy
   • PDF: https://dl.acm.org/doi/10.1145/3711896.3736573 ; https://arxiv.org/abs/2506.22521
   • Summary: This survey organizes model extraction attacks against LLMs by what the attacker steals, what access the attacker has, and how the copy is evaluated. It also reviews defenses and their limitations.
4. SoK: Neural Network Extraction Through Physical Side Channels
   • Authors: Péter Horváth, Dirk Lauret, Zhuoran Liu, Lejla Batina (Radboud University Nijmegen)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: ~18
   • Difficulty: 5/5
   • Keywords: side-channel attacks, model extraction, hardware security, SoK
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/horvath (USENIX Open Access)
   • Summary: This systematization covers physical side channels that reveal neural-network architecture, settings, or weights while a device runs inference. The observed signals include timing, power use, and electromagnetic leakage.

1. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
   • Authors: Tianyu Gu, Brendan Dolan-Gavitt, Siddharth Garg (New York University)
   • Venue: IEEE Access (workshop version first appeared at NeurIPS Workshop; journal version widely cited) — Journal, SCIE-indexed
   • Year: 2019 (journal) / 2017 (original workshop) | Pages: 12
   • Difficulty: 2/5
   • Keywords: backdoor attacks, supply-chain security, trigger patterns, outsourced training
   • PDF: https://arxiv.org/pdf/1708.06733 (arXiv preprint; the IEEE Access journal version is also fully open access)
   • Summary: BadNets defines the machine-learning backdoor threat: a compromised model behaves normally on ordinary inputs but changes its prediction when a hidden trigger appears. The paper demonstrates the idea with image and traffic-sign models.
2. Instruction Backdoor Attacks Against Customized LLMs
   • Authors: Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes (CISPA), Yun Shen (NetApp / previously Visa Research), Yang Zhang (CISPA Helmholtz Center for Information Security)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 18
   • Difficulty: 4/5
   • Keywords: backdoor attacks, custom GPTs, instruction tuning, LLM customization platforms
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/zhang-rui (USENIX Open Access)
   • Summary: This paper shows how a customized LLM can contain a trigger and hidden behavior in its natural-language instructions. The attacker can create the backdoor without changing the model's weights.
3. PEFTGuard: Detecting Backdoor Attacks Against Parameter-Efficient Fine-Tuning
   • Authors: Zhen Sun, Tianshuo Cong, Yule Liu, Chenhao Lin, Xinlei He, Rongchang Chen, Xingshuo Han, Xinyi Huang (Wuhan University / Hong Kong University of Science and Technology (Guangzhou) / collaborators)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P / "Oakland") — Conference, CORE A*/CCF-A, one of the "Big Four"
   • Year: 2025 | Pages: 19
   • Difficulty: 4/5
   • Keywords: LoRA, parameter-efficient fine-tuning, backdoor detection, PEFT security
   • PDF: https://arxiv.org/pdf/2411.17453 (arXiv preprint; also author-hosted at tianshuocong.github.io/files/sp25-peftguard.pdf). IEEE Xplore version is paywalled.
   • Summary: PEFTGuard studies backdoors in parameter-efficient fine-tuning modules such as LoRA adapters. It learns patterns in adapter parameters that help distinguish clean adapters from backdoored ones.
4. An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection (CodeBreaker)
   • Authors: Shenao Yan, Shen Wang, Yue Duan, Hanbin Hong, Kiho Lee, Doowon Kim, Yuan Hong (University of Illinois at Chicago / University of Tennessee, Knoxville / University of Connecticut)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 18
   • Difficulty: 4/5
   • Keywords: code-completion models, backdoor attacks, poisoned training data, static analysis evasion
   • PDF: https://www.usenix.org/system/files/usenixsecurity24-yan.pdf (USENIX Open Access)
   • Summary: CodeBreaker uses an LLM to create poisoned training examples that teach code-completion models to suggest vulnerable code. The generated examples are designed to evade common code-security detectors.
5. CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization
   • Authors: Nay Myat Min, Long H. Pham, Yige Li, Jun Sun (Singapore Management University)
   • Venue: International Conference on Machine Learning (ICML) — Conference, top-tier ML venue
   • Year: 2025 | Pages: ~11 (+ appendix)
   • Difficulty: 4/5
   • Keywords: backdoor removal, internal consistency, LLM defense, fine-tuning-based mitigation
   • PDF: https://proceedings.mlr.press/v267/min25b.html (PMLR, fully open) or https://arxiv.org/pdf/2411.12768
   • Summary: CROW removes LLM backdoors by fine-tuning the model so that nearby internal layers produce more consistent representations. The method does not require the defender to know the attack trigger in advance.

1. Towards Evaluating the Robustness of Neural Networks
   • Authors: Nicholas Carlini, David Wagner (University of California, Berkeley)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P / "Oakland") — Conference, CORE A*/CCF-A, one of the "Big Four"
   • Year: 2017 | Pages: 19
   • Difficulty: 3/5
   • Keywords: adversarial examples, C&W attack, robustness evaluation, defense-breaking
   • PDF: https://arxiv.org/pdf/1608.04644 (arXiv preprint; IEEE Xplore version paywalled)
   • Summary: The Carlini-Wagner attack reformulates adversarial-example generation as an optimization problem and uses it to test defensive distillation. The results show that a defense must face an attack designed specifically for its assumptions.
2. Certified Robustness to Adversarial Examples with Differential Privacy (PixelDP)
   • Authors: Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, Suman Jana (Columbia University)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P) — Conference, CORE A*/CCF-A
   • Year: 2019 | Pages: 17
   • Difficulty: 4/5
   • Keywords: certified robustness, differential privacy, randomized smoothing, provable defense
   • PDF: https://arxiv.org/pdf/1802.03471 (arXiv preprint; IEEE Xplore version paywalled)
   • Summary: PixelDP uses ideas from differential privacy to place a mathematical bound on how much a model's output can change under small input changes. This bound gives a certificate that predictions remain robust within a stated threat model.
3. SoK: Certified Robustness for Deep Neural Networks
   • Authors: Linyi Li (University of Illinois Urbana-Champaign), Tao Xie (Peking University), Bo Li (University of Illinois Urbana-Champaign)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P) — Conference, CORE A*/CCF-A
   • Year: 2023 | Pages: 20
   • Difficulty: 4/5
   • Keywords: systematization of knowledge, certified robustness, verification, randomized smoothing
   • PDF: https://arxiv.org/pdf/2009.04131 (arXiv preprint; IEEE Xplore version paywalled)
   • Summary: This systematization organizes methods that certify neural-network robustness, including exact verification, relaxed bounds, and randomized methods. It compares what each guarantee covers and what it costs.
4. Cutting through Buggy Adversarial Example Defenses: Fixing 1 Line of Code Breaks SABRE
   • Authors: Nicholas Carlini (Google DeepMind)
   • Venue: arXiv technical report / widely cited as a reproducibility case study; the original SABRE defense it breaks was published at IEEE S&P 2024
   • Year: 2024 | Pages: 9
   • Difficulty: 3/5
   • Keywords: gradient masking, reproducibility, defense evaluation, adversarial robustness auditing
   • PDF: https://arxiv.org/abs/2405.03672 (fully open)
   • Summary: This paper re-examines the SABRE adversarial defense and finds that implementation bugs created a false appearance of robustness. Correcting the attack code reduces the reported robust accuracy to zero in the tested setting.

1. PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing
   • Authors: Gelei Deng (Nanyang Technological University), Yi Liu (Nanyang Technological University), Víctor Mayoral-Vilches (Alias Robotics), Peng Liu (Nanyang Technological University), Yuekang Li (University of New South Wales), Yuan Xu, Tianwei Zhang (Nanyang Technological University), Yang Liu (Nanyang Technological University), Martin Pinzger (Alpen-Adria-Universität Klagenfurt), Stefan Rass (Johannes Kepler University Linz)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 18
   • Difficulty: 3/5
   • Keywords: automated penetration testing, LLM agents, self-interacting modules, CTF benchmarking
   • PDF: https://www.usenix.org/system/files/usenixsecurity24-deng.pdf (USENIX Open Access)
   • Summary: PentestGPT divides a penetration test among LLM components for reasoning, command generation, and result parsing. The design helps the system keep track of a long, multi-step security task.
2. LLM Agents Can Autonomously Exploit One-Day Vulnerabilities
   • Authors: Richard Fang, Rohan Bindu, Akul Gupta, Daniel Kang (University of Illinois Urbana-Champaign)
   • Venue: arXiv technical report, widely cited and influential in policy discussions; methodology closely mirrors the authors' peer-reviewed companion paper on zero-day exploitation
   • Year: 2024 | Pages: 12
   • Difficulty: 4/5
   • Keywords: autonomous exploitation, one-day vulnerabilities, CVE reproduction, LLM agents
   • PDF: https://arxiv.org/abs/2404.08144 (fully open)
   • Summary: This study gives an LLM agent tools and public CVE descriptions, then tests whether it can exploit known but recently disclosed vulnerabilities. It reports a large capability gap between GPT-4 and the other tested models and scanners.
3. PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
   • Authors: Xiaokui Shen, Ling Wang, Zhewei Li, Yijie Chen, Weibin Zhao, Dan Sun, Jing Wang, Wenke Ruan (Zhejiang University of Technology / collaborators)
   • Venue: ACM Asia Conference on Computer and Communications Security (AsiaCCS) — Conference, CORE A/CCF-C (regional flagship, competitive)
   • Year: 2025 | Pages: 17
   • Difficulty: 3/5
   • Keywords: automated penetration testing, LLM agents, retrieval-augmented planning, CTF benchmark
   • PDF: https://arxiv.org/pdf/2411.05185 (arXiv preprint). ACM DL version paywalled.
   • Summary: PentestAgent adds retrieval-supported planning to an automated penetration-testing agent. The paper evaluates the system on vulnerable targets and Hack The Box challenges of different difficulty levels.
4. SoK: Measuring What Matters for Closed-Loop Security Agents
   • Authors: Mudita Khurana, Raunak Jain
   • Venue: arXiv technical report / SoK-style systematization, useful as a map even though not yet at a peer-reviewed venue at time of writing
   • Year: 2025 | Pages: 11
   • Difficulty: 4/5
   • Keywords: systematization of knowledge, security agents, evaluation methodology, closed-loop pentesting
   • PDF: https://arxiv.org/abs/2510.01654 (fully open)
   • Summary: This systematization examines how researchers evaluate closed-loop security agents. It highlights problems such as benchmark leakage, changing target environments, and unclear definitions of success.
5. EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities
   • Authors: Talor Abramovich, Meet Udeshi, Minghao Shao, Kilian Lieret, Haoran Xi, Kimberly Milner, Sofija Jancheska, John Yang, Carlos E. Jimenez, Farshad Khorrami, Prashanth Krishnamurthy, Brendan Dolan-Gavitt, Muhammad Shafique, Karthik Narasimhan, Ramesh Karri, Ofir Press (New York University / Princeton University)
   • Venue: International Conference on Machine Learning (ICML) — Conference, top-tier ML venue
   • Year: 2025 | Pages: ~14
   • Difficulty: 4/5
   • Keywords: CTF agents, tool-use, interactive vulnerability discovery, agent-computer interfaces
   • PDF: https://proceedings.mlr.press/v267/abramovich25a.html (PMLR, fully open) or https://arxiv.org/pdf/2409.16165
   • Summary: EnIGMA studies how the tools given to an LLM agent affect its ability to solve security challenges. Structured interfaces and interactive feedback help the agent investigate vulnerabilities more effectively.

1. Spectre Attacks: Exploiting Speculative Execution
   • Authors: Paul Kocher (Independent), Jann Horn (Google Project Zero), Daniel Genkin (University of Pennsylvania / University of Maryland), Mike Hamburg (Rambus), Moritz Lipp (Graz University of Technology), Stefan Mangard (Graz University of Technology), Thomas Prescher (Cyberus Technology), Michael Schwarz (Graz University of Technology), Yuval Yarom (University of Adelaide / Data61)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P) — Conference, CORE A*/CCF-A
   • Year: 2019 | Pages: 19
   • Difficulty: 4/5
   • Keywords: speculative execution, transient execution attacks, microarchitectural side channels, CPU vulnerabilities
   • PDF: https://spectreattack.com/spectre.pdf (author-hosted, fully open). IEEE Xplore version paywalled.
   • Summary: Spectre abuses speculative execution so a processor performs operations that normal program rules would forbid. Although the processor discards the results, cache timing can reveal secret data left by those operations.
2. HyperTheft: Thieving Model Weights from TEE-Shielded Neural Networks via Ciphertext Side Channels
   • Authors: Yuanyuan Yuan, Zhibo Liu, Sen Deng, Yanzuo Chen, Shuai Wang (Hong Kong University of Science and Technology), Yinqian Zhang (Southern University of Science and Technology), Zhendong Su (ETH Zürich)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: ~15
   • Difficulty: 5/5
   • Keywords: trusted execution environments, TEE, model weight extraction, ciphertext side channels
   • PDF: https://yuanyuan-yuan.github.io/files/ccs24-HyperTheft-full.pdf (author-hosted extended version, fully open). ACM DL version paywalled.
   • Summary: HyperTheft studies neural networks protected by a trusted execution environment and finds that encrypted memory traffic still leaks model structure. The attack uses this ciphertext side channel to recover model weights.
3. SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel
   • Authors: Lukas Maar, Stefan Gast, Martin Unterguggenberger, Mathias Oberhuber, Stefan Mangard (Graz University of Technology)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: ~17
   • Difficulty: 5/5
   • Keywords: kernel exploitation, heap exploitation, cross-cache attacks, Linux kernel security
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/maar (USENIX Open Access)
   • Summary: SLUBStick combines a Linux kernel heap bug with cross-cache manipulation to turn limited corruption into a powerful memory-write primitive. The paper demonstrates reliable exploitation despite modern kernel defenses.
4. Breaking the Barrier: Post-Barrier Spectre Attacks
   • Authors: Johannes Wikner, Kaveh Razavi (ETH Zürich)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~16
   • Difficulty: 5/5
   • Keywords: speculative execution, Spectre mitigations, memory barriers, CPU microarchitecture
   • PDF: https://comsec-files.ethz.ch/papers/ibpb_sp25.pdf (author-hosted, fully open). IEEE Xplore version paywalled.
   • Summary: This paper shows how speculative-execution attacks can continue past barriers intended to stop them. It identifies post-barrier behavior that weakens widely used Spectre mitigations.

1. SoK: Watermarking for AI-Generated Content
   • Authors: Xuandong Zhao (UC Santa Barbara), Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanmi Koyejo, Kamalika Chaudhuri, Mihir Bellare, Nicolas Papernot, Somesh Jha, Yu-Xiang Wang (multi-institution: UC Santa Barbara / UC Berkeley / Columbia / Google DeepMind / Stanford / UC San Diego / University of Toronto / Vector Institute / University of Wisconsin–Madison — full author list on paper)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~19
   • Difficulty: 3/5
   • Keywords: watermarking, systematization of knowledge, AI-generated content, provenance
   • PDF: https://arxiv.org/abs/2411.18479 (arXiv author copy; camera-ready on IEEE Xplore)
   • Summary: This systematization explains watermarking methods for AI-generated text, images, and audio. It compares threat models, security definitions, evaluation methods, and limits on what watermarks can prove.
2. Evading Watermark-based Detection of AI-Generated Content
   • Authors: Zhengyuan Jiang, Jinghuai Zhang, Neil Zhenqiang Gong (Duke University)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2023 | Pages: 20
   • Difficulty: 3/5
   • Keywords: watermark evasion, adversarial perturbation, AI-generated content detection
   • PDF: https://dl.acm.org/doi/10.1145/3576915.3623189 ; https://arxiv.org/abs/2305.03807 (open)
   • Summary: This paper studies attacks that remove watermarks from generated content and attacks that add a false watermark to human-created content. Both cases show that detection errors can be created deliberately.
3. Watermarking Language Models for Many Adaptive Users
   • Authors: Aloni Cohen (University of Chicago), Alexander Hoover, Gabe Schoenbach (University of Chicago)
   • Venue: IEEE Symposium on Security and Privacy (IEEE S&P) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~16
   • Difficulty: 4/5
   • Keywords: LLM watermarking, multi-user schemes, adaptive adversaries, cryptographic watermarking
   • PDF: https://arxiv.org/abs/2405.11109 (arXiv author copy; camera-ready on IEEE Xplore)
   • Summary: This paper designs language-model watermarks for services with many users, including users who adapt their queries or work together. It provides formal definitions for detecting a watermark and tracing it to a user.
4. Zero-Shot Visual Deepfake Detection: Can AI Predict and Prevent Fake Content Before It's Created?
   • Authors: Ayan Sar, Sampurna Roy, Tanupriya Choudhury, Ajith Abraham
   • Venue: Foundations and Trends in Signal Processing — Journal
   • Year: 2025 | Pages: 50
   • Difficulty: 3/5
   • Keywords: deepfake detection, zero-shot generalization, generative model forensics, survey
   • PDF: https://arxiv.org/abs/2509.18461 (fully open)
   • Summary: This survey reviews visual deepfake detectors that must recognize output from generators they did not see during training. It focuses on why zero-shot generalization remains difficult.

1. Robust Defenses for Cross-Site Request Forgery
   • Authors: Adam Barth (Stanford University), Collin Jackson (Stanford University), John C. Mitchell (Stanford University)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2008 | Pages: 14
   • Difficulty: 2/5
   • Keywords: CSRF, web security, Origin header, defense-in-depth
   • PDF: https://seclab.stanford.edu/websec/csrf/csrf.pdf (Stanford author-hosted, fully open). ACM DL version paywalled.
   • Summary: This paper analyzes cross-site request forgery and proposes defenses based on the source of a web request, including the Origin header. Its design influenced later browser defenses against unwanted authenticated requests.
2. Spider-Scents: Grey-box Database-aware Web Scanning for Stored XSS
   • Authors: Eric Olsson, Benjamin Eriksson, Adam Doupé, Andrei Sabelfeld
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 18 (pp. 6741–6758)
   • Difficulty: 3/5
   • Keywords: stored XSS, web application scanning, grey-box testing, access-control-aware vulnerability detection
   • PDF: https://www.usenix.org/system/files/usenixsecurity24-olsson.pdf (USENIX Open Access — free permanently)
   • Summary: Spider-Scents injects test values into a web application's database and traces where they appear in webpages. This grey-box method finds stored cross-site scripting paths that black-box scanners may miss.
3. SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications
   • Authors: Malte Wessels, Simon Koch (TU Braunschweig), Giancarlo Pellegrino (CISPA Helmholtz Center for Information Security), Martin Johns (TU Braunschweig)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 18 (pp. 6777–6794)
   • Difficulty: 3/5
   • Keywords: SSRF, PHP, developer study, web application security, defense measurement
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/wessels (USENIX Open Access)
   • Summary: This paper studies how PHP developers try to prevent server-side request forgery and tests whether those defenses work. It finds recurring gaps between the intended policy and the requests an attacker can still cause.
4. Exposing and Circumventing SNI-based QUIC Censorship of the Great Firewall of China
   • Authors: Ali Zohaib (University of Massachusetts Amherst), Qiang Zao (GFW Report), Jackson Sippe, Abdulrahman Alaraj (University of Colorado Boulder), Amir Houmansadr (University of Massachusetts Amherst), Zakir Durumeric (Stanford University), Eric Wustrow (University of Colorado Boulder)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~17
   • Difficulty: 3/5
   • Keywords: Internet censorship, QUIC, Great Firewall of China, protocol measurement
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/zohaib (USENIX Open Access)
   • Summary: This paper measures how the Great Firewall of China detects and blocks QUIC connections using information in initial packets. It also develops practical ways to make that filtering harder.
5. Securing BGP ASAP: ASPA and Other Post-ROV Defenses
   • Authors: Justin Furuness, Cameron Morris, Reynaldo Morillo, Arvind Kasiliya, Bing Wang, Amir Herzberg (University of Connecticut)
   • Venue: Network and Distributed System Security Symposium (NDSS) — Conference, CORE A*/CCF-B (top routing-security venue)
   • Year: 2025 | Pages: ~17
   • Difficulty: 4/5
   • Keywords: BGP, route origin validation, ASPA, routing security, path hijacking
   • PDF: https://nlab.engr.uconn.edu/papers/Furuness-2025-ASPA-NDSS.pdf (author-hosted, fully open; NDSS papers are also permanently free at ndss-symposium.org)
   • Summary: This paper evaluates BGP path-security defenses that go beyond Route Origin Validation, with emphasis on ASPA. It asks whether these defenses stop path manipulation under realistic deployment conditions.

1. A Formal Security Analysis of the Signal Messaging Protocol
   • Authors: Katriel Cohn-Gordon, Cas Cremers, Benjamin Dowling, Luke Garratt (University of Oxford), Douglas Stebila (McMaster University)
   • Venue: IEEE European Symposium on Security and Privacy (EuroS&P) — Conference (extended version later in Journal of Cryptology, Springer, SCIE-indexed)
   • Year: 2017 (EuroS&P) / 2020 (extended Journal of Cryptology version) | Pages: 16 (conference) / ~48 (journal)
   • Difficulty: 4/5
   • Keywords: Signal protocol, X3DH, Double Ratchet, secure messaging, formal verification
   • PDF: https://eprint.iacr.org/2016/1013 (IACR ePrint, fully open) — journal version: https://doi.org/10.1007/s00145-020-09360-1
   • Summary: This paper gives a formal security analysis of Signal's X3DH and Double Ratchet design. It defines properties for a conversation whose keys change over time, including recovery after a temporary compromise.
2. Formal Verification of the PQXDH Post-Quantum Key Agreement Protocol for End-to-End Secure Messaging
   • Authors: Karthikeyan Bhargavan (Cryspen / Inria), Charlie Jacomme (Inria Nancy), Franziskus Kiefer (Cryspen), Rolfe Schmidt (Signal Foundation)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: ~18
   • Difficulty: 5/5
   • Keywords: post-quantum cryptography, Signal protocol, PQXDH, formal verification, key agreement
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/bhargavan (USENIX Open Access)
   • Summary: This paper formally verifies PQXDH, Signal's key-agreement protocol designed to add protection against future quantum attackers. Machine-checked proofs test the protocol under clearly stated assumptions.
3. Comparse: Provably Secure Formats for Cryptographic Protocols
   • Authors: Theophile Wallez, Jonathan Protzenko, Karthikeyan Bhargavan (Inria Paris / Microsoft Research)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2023 | Pages: 15
   • Difficulty: 5/5
   • Keywords: message formats, formal verification, parsing security, protocol implementation
   • PDF: https://eprint.iacr.org/2023/1390 (IACR ePrint, fully open). ACM DL version paywalled.
   • Summary: Comparse generates message formats and parsers whose encoding is unambiguous by construction. The goal is to prevent protocol attacks caused by two components interpreting the same bytes differently.
4. Divide and Surrender: Exploiting Variable Division Instruction Timing in HQC Key Recovery Attacks
   • Authors: Robin Leander Schröder (Fraunhofer SIT, Darmstadt / Fraunhofer Austria, Vienna), Stefan Gast (Graz University of Technology), Qian Guo (Lund University)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 18 (pp. 6669–6686)
   • Difficulty: 5/5
   • Keywords: post-quantum cryptography, HQC, timing side channel, key recovery, NIST PQC standardization
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/schröder (USENIX Open Access)
   • Summary: This paper finds a timing side channel in an optimized implementation of the post-quantum HQC algorithm. A compiler-generated variable-time division instruction leaks information that supports secret-key recovery.

1. AddressSanitizer: A Fast Address Sanity Checker
   • Authors: Konstantin Serebryany, Derek Bruening, Alexander Potapenko, Dmitry Vyukov (Google)
   • Venue: USENIX Annual Technical Conference (USENIX ATC) — Conference, CORE A/CCF-B, the standard systems venue for tooling papers
   • Year: 2012 | Pages: 13
   • Difficulty: 2/5
   • Keywords: memory safety, sanitizers, dynamic instrumentation, compiler tooling
   • PDF: https://www.usenix.org/conference/atc12/technical-sessions/presentation/serebryany (USENIX Open Access)
   • Summary: AddressSanitizer adds checks around program memory and uses shadow memory to detect invalid accesses at runtime. It finds common memory bugs with overhead low enough for regular testing.
2. My ZIP Isn't Your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP Parsers
   • Authors: Yufan You, Jianjun Chen (Tsinghua University; Zhongguancun Laboratory), Qi Wang, Haixin Duan (Tsinghua University; Zhongguancun Laboratory)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A/CCF-A — Distinguished Paper Award winner*
   • Year: 2025 | Pages: ~18
   • Difficulty: 3/5
   • Keywords: file format parsing, semantic gaps, differential fuzzing, format ambiguity
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/you (USENIX Open Access)
   • Summary: This paper compares many ZIP parsers and finds byte sequences that different programs interpret in different ways. Attackers can use these semantic gaps to bypass checks performed by one parser before another parser opens the archive.
3. Nothing Is Unreachable: Automated Synthesis of Robust Code-Reuse Gadget Chains for Arbitrary Exploitation Primitives
   • Authors: Nicolas Bailluet (Univ Rennes, Inria, CNRS, IRISA), Emmanuel Fleury (Univ Bordeaux, CNRS, LaBRI), Isabelle Puaut, Erven Rohou (Univ Rennes, Inria, CNRS, IRISA)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A/CCF-A — Distinguished Artifact Award winner*
   • Year: 2025 | Pages: ~17
   • Difficulty: 5/5
   • Keywords: code-reuse attacks, ROP, gadget chain synthesis, automated exploit generation
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/bailluet (USENIX Open Access)
   • Summary: This paper automates the construction of code-reuse gadget chains under a wider range of memory-corruption conditions. It supports exploitation primitives beyond the classic assumption that the attacker controls the stack.
4. SLUBStick: Arbitrary Memory Writes Through Practical Software Cross-Cache Attacks Within the Linux Kernel
   • Authors: Lukas Maar, Stefan Gast, Martin Unterguggenberger, Mathias Oberhuber, Stefan Mangard (Graz University of Technology)
   • Venue: 33rd USENIX Security Symposium (USENIX Security '24) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: ~17
   • Difficulty: 5/5
   • Keywords: kernel exploitation, heap exploitation, cross-cache attacks, Linux kernel security
   • PDF: https://www.usenix.org/conference/usenixsecurity24/presentation/maar (USENIX Open Access)
   • Summary: SLUBStick combines a Linux kernel heap bug with cross-cache manipulation to turn limited corruption into a powerful memory-write primitive. The paper demonstrates reliable exploitation despite modern kernel defenses.

1. Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0
   • Authors: Alma Whitten (Carnegie Mellon University), J. D. Tygar (Carnegie Mellon University / UC Berkeley)
   • Venue: 8th USENIX Security Symposium (USENIX Security '99) — Conference, CORE A*/CCF-A
   • Year: 1999 | Pages: 16
   • Difficulty: 2/5
   • Keywords: usable security, PGP, user study, encryption adoption
   • PDF: https://www.usenix.org/legacy/events/sec99/whitten.html (USENIX Open Access)
   • Summary: This user study shows that people often fail to encrypt and sign email correctly with PGP 5.0 even when they want to do so. The authors argue that security fails when the interface does not match the user's task and mental model.
2. From TOTPs to Security Keys: Studying the Reality of Passwordless FIDO2 Authentication With PIN and Biometrics in a Corporate Environment
   • Authors: Leona Lassak, Nicklas Lindemann, Marvin Kowalewski
   • Venue: 21st Symposium on Usable Privacy and Security (SOUPS), co-located with USENIX Security — Conference, peer-reviewed, USENIX Association
   • Year: 2025 | Pages: 20 (including appendices)
   • Difficulty: 3/5
   • Keywords: FIDO2, passwordless authentication, field study, phishing resistance, corporate security
   • PDF: https://www.usenix.org/system/files/soups2025-lassak.pdf (USENIX Open Access)
   • Summary: This five-week company field study compares passwords plus one-time codes with FIDO2 security keys using PINs or biometrics. It measures login behavior and user experience, including practical problems with hardware and company infrastructure.
3. Can You Walk Me Through It? Explainable SMS Phishing Detection Using LLM-Based Agents
   • Authors: Yizhu Wang, Haoyu Zhai, Chenkai Wang, Qingying Hao (University of Illinois Urbana-Champaign), Nick A. Cohen, Roopa Foulger, Jonathan A. Handler (OSF Healthcare), Gang Wang (University of Illinois Urbana-Champaign)
   • Venue: 21st Symposium on Usable Privacy and Security (SOUPS) — Conference, peer-reviewed, USENIX Association
   • Year: 2025 | Pages: 20 (pp. 37–56)
   • Difficulty: 3/5
   • Keywords: phishing detection, explainability, LLM agents, usable security, older-adult users
   • PDF: https://www.usenix.org/system/files/soups2025-wang.pdf (USENIX Open Access)
   • Summary: SmishX uses LLM agents and external evidence to detect SMS phishing and explain the warning in plain language. A user study tests whether the explanations help people make better decisions.
4. IRBlock: A Large-Scale Measurement Study of the Great Firewall of Iran
   • Authors: Jonas Tai, Karthik Nishanth Sengottuvelavan (University of British Columbia), Peter Whiting (University of Waterloo), Nguyen Phong Hoang (University of British Columbia)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~18
   • Difficulty: 3/5
   • Keywords: Internet censorship, measurement, DNS poisoning, Iran, circumvention
   • PDF: https://www.usenix.org/conference/usenixsecurity25/presentation/tai (USENIX Open Access)
   • Summary: IRBlock measures Internet censorship across Iran over several months and many network locations and domains. It documents techniques such as DNS poisoning and UDP disruption and studies where blocking occurs.

1. Comprehensive Experimental Analyses of Automotive Attack Surfaces
   • Authors: Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage (University of California, San Diego); Karl Koscher, Alexei Czeskis, Franziska Roesner, Tadayoshi Kohno (University of Washington)
   • Venue: 20th USENIX Security Symposium (USENIX Security '11) — Conference, CORE A*/CCF-A
   • Year: 2011 | Pages: 16
   • Difficulty: 3/5
   • Keywords: automotive security, remote exploitation, attack surface, telematics, Bluetooth, cellular
   • PDF: https://www.usenix.org/conference/usenix-security-11/comprehensive-experimental-analyses-automotive-attack-surfaces (USENIX Open Access)
   • Summary: This paper maps remote and local attack paths into automotive systems and demonstrates attacks through interfaces such as Bluetooth and cellular connections. It shows how a compromise can cross internal vehicle networks and affect safety-relevant functions.
2. On the Realism of LiDAR Spoofing Attacks Against Autonomous Driving Vehicles at High Speed and Long Distance
   • Authors: Takami Sato, Ryo Suzuki, Yuki Hayakawa, Kazuma Ikeda, Ozora Sako, Rokuto Nagata, Ryo Yoshida (Keio University), Qi Alfred Chen (University of California, Irvine), Kentaro Yoshioka (Keio University)
   • Venue: Network and Distributed System Security Symposium (NDSS) — Conference, CORE A*/CCF-B
   • Year: 2025 | Pages: ~17
   • Difficulty: 4/5
   • Keywords: LiDAR spoofing, autonomous driving, physical adversarial attack, sensor security
   • PDF: https://www.ndss-symposium.org/wp-content/uploads/2025-628-paper.pdf (NDSS Open Access)
   • Summary: This paper tests whether LiDAR spoofing remains practical when a target vehicle moves quickly and the attacker operates from farther away. The experiments reveal which assumptions from earlier stationary demonstrations still hold.
3. You Can't See Me: Physical Removal Attacks on LiDAR-Based Autonomous Vehicles Driving Frameworks
   • Authors: Yulong Cao (University of Michigan), Sri Hrushikesh Varma Bhupathiraju, Pirouz Naghavi, Takeshi Sugawara (University of Electro-Communications, Japan), Z. Morley Mao (University of Michigan), Sara Rampazzi (University of Florida)
   • Venue: 32nd USENIX Security Symposium (USENIX Security '23) — Conference, CORE A*/CCF-A
   • Year: 2023 | Pages: 18
   • Difficulty: 4/5
   • Keywords: LiDAR, object removal attack, autonomous vehicle perception, laser spoofing
   • PDF: https://www.usenix.org/conference/usenixsecurity23/presentation/cao (USENIX Open Access)
   • Summary: This paper manipulates LiDAR processing so a real object disappears from an autonomous vehicle's perception output. The attack exploits automatic filtering stages rather than adding a fake object.
4. PhySense: Defending Physically Realizable Attacks for Autonomous Systems via Consistency Reasoning
   • Authors: Zhiyuan Yu, Ao Li, Ruoyao Wen, Yijia Chen, Ning Zhang (Washington University in St. Louis)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2024 | Pages: 15 (pp. 3853–3867)
   • Difficulty: 4/5
   • Keywords: autonomous vehicles, physical adversarial defense, consistency reasoning, real-time perception
   • PDF: https://zhiyuanyu.org/uploads/ZhiyuanYu_CCS24_PhySense.pdf (author-hosted, fully open). ACM DL version paywalled.
   • Summary: PhySense checks whether detected objects and their motion remain physically consistent over time. It uses these relationships to detect physically realizable attacks within real-time driving constraints.
5. Current Affairs: A Security Measurement Study of CCS Electric Vehicle Charging Deployments
   • Authors: Marcell Szakály, Sebastian Köhler, Ivan Martinovic (University of Oxford)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: ~17
   • Difficulty: 3/5
   • Keywords: electric vehicle charging, ISO 15118, TLS deployment, Internet measurement, CCS charging standard
   • PDF: https://arxiv.org/abs/2404.06635 (author preprint, fully open) — USENIX listing: https://dl.acm.org/doi/10.5555/3766078.3766488
   • Summary: This measurement study examines real Combined Charging System deployments and compares their security with protections described in the standards. It finds that many chargers do not use the available TLS protection.
6. ConfuSense: Sensor Reconfiguration Attacks for Stealthy UAV Manipulation
   • Authors: Alessandro Erba (KASTEL Security Research Labs, Karlsruhe Institute of Technology), John H. Castellanos (Hitachi Energy Research, Germany), Sahil Sihag (CISPA Helmholtz Center for Information Security), Saman Zonouz (Georgia Institute of Technology), Nils Ole Tippenhauer (CISPA Helmholtz Center for Information Security)
   • Venue: 3rd USENIX Symposium on Vehicle Security and Privacy (VehicleSec '25), co-located with USENIX Security — Conference, peer-reviewed, USENIX Association
   • Year: 2025 | Pages: 18 (pp. 45–62)
   • Difficulty: 4/5
   • Keywords: UAV security, sensor spoofing, IMU, Kalman filter, drone crash, stealthy attack
   • PDF: https://www.usenix.org/system/files/vehiclesec25-erba.pdf (USENIX Open Access)
   • Summary: ConfuSense sends a malicious command that changes how a drone sensor operates, causing stale or incorrect data to reach state estimation. A single reconfiguration can disrupt flight while avoiding detectors built for continuous sensor spoofing.
7. An Experimental Study of GPS Spoofing and Takeover Attacks on UAVs
   • Authors: Harshad Sathaye, Martin Strohmeier, Vincent Lenders, Aanjhan Ranganathan (Northeastern University / armasuisse Science and Technology)
   • Venue: 31st USENIX Security Symposium (USENIX Security '22) — Conference, CORE A*/CCF-A
   • Year: 2022 | Pages: 18 (pp. 3503–3520)
   • Difficulty: 4/5
   • Keywords: GPS spoofing, UAV takeover, GNSS security, drone hijacking
   • PDF: https://www.usenix.org/conference/usenixsecurity22/presentation/sathaye (USENIX Open Access)
   • Summary: This paper builds a closed-loop GPS spoofing system that gradually takes control of a UAV's path without immediately triggering its consistency checks. It studies the timing and physical-plausibility constraints needed for takeover.

1. A Spotlight on Security and Privacy Risks with Future Household Robots: Attacks and Lessons
   • Authors: Tamara Denning, Cynthia Matuszek, Karl Koscher, Joshua R. Smith, Tadayoshi Kohno (University of Washington)
   • Venue: 11th International Conference on Ubiquitous Computing (UbiComp '09) — Conference, CORE A/CCF-B
   • Year: 2009 | Pages: 10 (pp. 105–114)
   • Difficulty: 2/5
   • Keywords: household robots, robot security, privacy, IoT, foundational threat model
   • PDF: https://tamaradenning.net/files/papers/denning-ubicomp-2009-spotlight-security-privacy-risks-household-robots.pdf (author-hosted, fully open)
   • Summary: This early study tests security and privacy risks in commercial household robots. It organizes attacks such as unauthorized control, camera or microphone access, and unsafe physical behavior.
2. On the (In)Security of Secure ROS2
   • Authors: Gelei Deng, Guowen Xu (Nanyang Technological University), Yuan Zhou, Tianwei Zhang (Princeton University; Nanyang Technological University), Yang Liu (Nanyang Technological University)
   • Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) — Conference, CORE A*/CCF-A
   • Year: 2022 | Pages: 15 (pp. 739–753)
   • Difficulty: 4/5
   • Keywords: ROS2, SROS2, DDS, robot middleware security, access control
   • PDF: https://tianweiz07.github.io/Papers/22-ccs-2.pdf (author-hosted, fully open). ACM DL version paywalled.
   • Summary: This paper analyzes the security layer of ROS2 and finds ways to bypass intended authentication, access control, or availability protections. The attacks affect communication among robot components and can change physical behavior.
3. Jailbreaking LLM-Controlled Robots
   • Authors: Alexander Robey, Zachary Ravichandran, Vijay Kumar, Hamed Hassani, George J. Pappas (University of Pennsylvania)
   • Venue: IEEE International Conference on Robotics and Automation (ICRA) — Conference, the flagship robotics venue (alongside IROS), highly competitive
   • Year: 2025 | Pages: 9 (pp. 11948–11956)
   • Difficulty: 4/5
   • Keywords: jailbreaking, LLM-controlled robots, RoboPAIR, physical AI safety
   • PDF: https://arxiv.org/pdf/2410.13691 (arXiv preprint). IEEE Xplore version paywalled.
   • Summary: RoboPAIR adapts automated jailbreak methods to robots controlled by language models. The experiments show that harmful prompts can lead to unsafe physical actions on several robot platforms.
4. Automated Discovery of Semantic Attacks in Multi-Robot Navigation Systems
   • Authors: Doguhan Yeke, Kartik A. Pant (Purdue University), Muslum Ozgur Ozmen (Arizona State University), Hyungsub Kim (Indiana University Bloomington), James M. Goppert, Inseok Hwang, Antonio Bianchi, Z. Berkay Celik (Purdue University)
   • Venue: 34th USENIX Security Symposium (USENIX Security '25) — Conference, CORE A*/CCF-A
   • Year: 2025 | Pages: 20 (pp. 3959–3978)
   • Difficulty: 4/5
   • Keywords: multi-robot systems, false data injection, collision avoidance, swarm security, falsification testing
   • PDF: https://www.usenix.org/system/files/usenixsecurity25-yeke.pdf (USENIX Open Access)
   • Summary: Raven searches for small false position reports that make groups of robots deadlock, collide, or move as an attacker wants. The attacks stay close to normal sensor noise so simple anomaly detectors may miss them.
5. SoK: Cybersecurity Assessment of Humanoid Ecosystem
   • Authors: Priyanka Prakash Surve, Asaf Shabtai, Yuval Elovici (Ben-Gurion University of the Negev)
   • Venue: arXiv technical report / SoK-style systematization, not yet at a peer-reviewed venue at time of writing — see eligibility note below
   • Year: 2025 | Pages: ~15
   • Difficulty: 4/5
   • Keywords: humanoid robots, systematization of knowledge, attack-defense matrix, ROS, Pepper, Unitree G1, Digit
   • PDF: https://arxiv.org/pdf/2508.17481 (fully open)
   • Summary: This systematization organizes humanoid-robot security across layers from hardware to human interaction. It maps known attacks and defenses and applies the framework to several commercial humanoid platforms.