Attackers exploit SiteGuard WAF flaw for root and SYSTEM commands
Published 7:01 AM · 120 articles from 13 sources · about 6 min to read in full
CS & research
A thin day for research proper. Terence Tao's essay on AI and mathematics and an AI-assisted verified-crypto system stand out, along with low-level hardware and emulator write-ups.
What happened
Terence Tao essays on whether AI will bring a golden or dark age for mathematics and science. The summary gives no thesis beyond the question. Hacker News (front page) ↗
CryptoProver, an AI system, synthesizes specifications and Verus-checked proofs for production cryptographic libraries such as curve25519-dalek without changing the executable code. arXiv cs.CR (Cryptography & Security) ↗
A deep technical walkthrough of how the Intel 8087 floating-point coprocessor implements addition and subtraction in hardware and microcode. Lobsters ↗
A post describes superoptimizing the code of a floating-point unit emulator to improve its performance. Lobsters ↗
A digital collections team reflects on a year of handling crawler traffic, request floods and server fleet management. Lobsters ↗
A paper models mining gaps in proof-of-work blockchains under a stochastic mempool as block subsidies decline, arguing capital costs protect the network. arXiv cs.CR (Cryptography & Security) ↗
Aspire presents an encrypted database design that supports batch queries on dynamic data with full leakage suppression, aimed at leakage-abuse attacks. arXiv cs.CR (Cryptography & Security) ↗
A Lobsters post presents programming language fundamentals implemented in the Agda proof assistant. Lobsters ↗
Articles the model saw · 15
CryptoProver, an AI system, synthesizes specifications and Verus-checked proofs for production cryptographic libraries like curve25519-dalek without changing executable code.
arXiv cs.CR (Cryptography & Security)formal-verificationcryptographyllmarxivFeed excerpt
arXiv:2608.00965v2 Announce Type: replace Abstract: Cryptographic code is critical infrastructure that must be correct, yet formally verifying production libraries remains difficult. Existing language-model proof systems solve isolated obligations with specifications and premises already given, leaving production-library verification unresolved. We present CryptoProver, an AI-based system that synthesizes internal specifications and Verus-checked proofs from high-level API contracts. Without changing executable code, CryptoProver constructs a new independent proof of curve25519-dalek and verifies RustCrypto's previously unverified chacha20 implementation against an RFC 8439 specification. These cryptographic lineages underpin deployed systems including Signal and Shadowsocks; Signal has an estimated 218M global downloads. The original developers report a focused five-month, three-person effort to verify curve25519-dalek. Given the API contracts and a fixed trusted library of field specifications, arithmetic facts, axioms, and vstd, CryptoProver synthesizes the internal specifications and proofs in 11.4 hours with USD 466.99 in recorded API cost. CryptoProver follows a trust-first d…
A deep technical walkthrough of how the Intel 8087 floating-point coprocessor implements addition and subtraction in hardware.
Lobstershardwarefloating-pointhistoryFeed excerpt
Comments
MIT Technology Review explainer on the limits of computing, revisiting Feynman's 1959 lecture on bottom-up nanoscale engineering.
MIT Technology ReviewexplainercomputingFeed excerpt
MIT Technology Review Explains: Let our writers untangle the complex, messy world of science and technology to help you understand what’s coming next. You can read more from the series here. On the evening of December 29, 1959, at an American Physical Society meeting at Caltech, the physicist Richard Feynman gave a lecture called “There’s…
Digital collections team reflects on a year of handling crawler traffic, request floods, and server fleet management.
Lobstersweb-crawlersinfrastructuredigital-librariesFeed excerpt
Comments
A Lobsters post presents programming language fundamentals implemented in the Agda proof assistant.
Lobstersagdaprogramming-languagestutorialFeed excerpt
Comments
Researchers propose an electric network frequency based framework to authenticate video against generative AI forgeries.
arXiv cs.CR (Cryptography & Security)forensicsdeepfakevideoFeed excerpt
arXiv:2610.22440v1 Announce Type: new Abstract: Generative models now synthesise video that is hard to distinguish from genuine footage, and learned detectors that key on a generator's artefacts degrade sharply on unseen models. This paper develops a forensic framework that authenticates video by a signal that generation does not control: the electric network frequency (ENF), the mains-driven hum in audio and flicker in video. A unified two-channel detector extracts the ENF from audio and from rolling-shutter video through one second harmonic estimator and a shared network; a synthetic-injection training method, driven by an Ornstein-Uhlenbeck drift model and anchored to real recordings, overcomes the scarcity of labelled ENF data; a reference-matching channel verifies a claimed time of recording and recovers an unknown one; and a two-axis agentic orchestrator fuses recording authenticity with content-manipulation evidence under an asymmetric rule, escalating expensive detectors only when needed. A central finding reframes the task: an ENF-band flicker is present in generated video at a prominence indistinguishable from real footage, so its presence is not proof of authenticity, an…
A paper models mining gaps in Proof-of-Work blockchains under a stochastic mempool as block subsidies decline.
arXiv cs.CR (Cryptography & Security)blockchainbitcoinminingFeed excerpt
arXiv:2610.22451v1 Announce Type: new Abstract: Proof-of-Work blockchains increasingly rely on transaction fees to keep miners engaged as block subsidies decline. An immediate outcome of this is that miners may sit idle at the start of a round until enough high-fee transactions accumulate in order to make mining worthwhile. This idle period is known as the mining gap. We model the high-fee transaction backlog as a Lindley-type recursion under a two-tier fee market and use its stationary distribution to characterize the mining gap. Under Bitcoin's difficulty-adjustment mechanism, the expected gap grows strictly with the hashpower active on the network and consumes the entire round as that hashpower grows without bound. A free-entry condition determines a unique long-run equilibrium hashpower. Capital cost caps the equilibrium hashpower and prevents the mining gap from occupying the entire round. We further characterize how the block subsidy, transaction fees, and operating cost shape the equilibrium hashpower and the mining gap.
A paper proposes a method for removing video watermarks that avoids the flickering of prior image-domain removal techniques.
arXiv cs.CR (Cryptography & Security)watermarkingvideogenerative-aiFeed excerpt
arXiv:2610.22457v1 Announce Type: new Abstract: Recent advances in video generation have increased the demand for reliable watermarking for copyright protection, yet the robustness of video watermarks against removal attacks remains underexplored. Most watermark-removal methods originate from the image domain: signal optimization injects imperceptible pixel-domain perturbations, whereas generative resynthesis produces a visually similar instance through diffusion synthesis. When extended to videos, the former introduces temporally varying noise that causes visible flickering, while the latter regenerates fine-grained structures inconsistently across frames, leading to structural motion inconsistency. To evaluate video watermark robustness, we propose PoseRegen, a pose-consistent reconstruction framework that removes watermarks while preserving the original content and motion. PoseRegen first applies a temporally shared viewpoint transformation to disrupt watermark-bearing spatial patterns and then jointly reconstructs the transformed sequence with a pose-conditioned video model. A frozen video DiT processes the complete sequence with its reference-video latent, and full-sequence Fl…
StratFL proposes a game-theoretic federated learning defense against intermittent covert model poisoning attacks.
arXiv cs.CR (Cryptography & Security)federated-learningpoisoningFeed excerpt
arXiv:2610.22626v1 Announce Type: new Abstract: Advanced persistent threats (APTs) are a major concern in federated learning (FL) deployments in critical sectors such as healthcare, and finance. Traditional defense mechanisms fail to contain APTs due to their intermittent attacking behavior. This paper addresses a specific type of APT called covert model poisoning (CMP) where the attacker intermittently injects poisoned model updates in a covert manner. The interaction between the FL server and a CMP attacker is modeled as an imperfect repeated game where both players cannot observe each other's actions. A novel adversarial search algorithm called StratFL is designed alongside novel belief update algorithms at both the server and adversary. Experiments are designed using MNIST and CIFAR-10 datasets to evaluate and compare StratFL's performance against state-of-the-art methods. Empirical convergence of belief update algorithms is demonstrated across various security vignettes. At the same time, StratFL is found to exhibit an improved accuracy of 10% compared to state-of-the-art methods.
RAMP proposes a service framework for QKD key distribution that decouples key generation from providers to limit trust.
arXiv cs.CR (Cryptography & Security)quantumcryptographyarxivFeed excerpt
arXiv:2610.22879v1 Announce Type: new Abstract: Quantum key distribution (QKD) offers a security foundation independent of computational hardness assumptions. However, its reliance on specialized hardware limits access by ordinary users. Turning QKD into a service poses a fundamental trust challenge, as the providers that supply QKD-derived material themselves could retain knowledge of the keying inputs of users. This makes end-to-end confidentiality solely depend on the trustworthiness of the service infrastructure. We present RAMP, a service-oriented framework that decouples QKD material generation from key consumption. Providers operate QKD infrastructure and supply raw-key materials, while users securely acquire, mask, and locally process them into final keys without operating QKD devices. RAMP employs reconciliation-preserving masking compatible with both DV- and CV-QKD. It mitigates the trust dependence by separating the QKD-service and user-side masking domains. We formalize complementary confidentiality guarantees: RAMP protects the final key even if colluding providers expose their complete raw-key views, provided the masking domain remains secure; conversely, exposing the…
Aspire presents an encrypted database design supporting batch queries on dynamic data with leakage suppression against leakage-abuse attacks.
arXiv cs.CR (Cryptography & Security)encryptiondatabasesarxivFeed excerpt
arXiv:2610.23057v1 Announce Type: new Abstract: Leakage-abuse attacks against encrypted database systems exploit semantic leakage and pose a severe threat to the confidentiality of plaintext data and queries. To address this problem, we propose a zero-leakage encrypted database that rules out leakage-abuse attacks, which fundamentally rely on semantic leakage. We first distinguish between two kinds of zero-leakage security. Ideal zero-leakage forbids the disclosure of any information beyond public parameters, whereas restricted zero-leakage additionally permits the leakage of metadata (such as database size and query timing). We show that restricted zero-leakage is sufficient to thwart leakage-abuse attacks and is achievable in practice. We then formally define adaptive restricted zero-leakage security and present Aspire, an encrypted database that satisfies this notion. Aspire integrates probabilistic batch code and minimal perfect hashing to support efficient batch keyword queries and dynamic updates while revealing only non-semantic metadata. Experimental results demonstrate the practicality and efficiency of Aspire, showing that Aspire can achieve an amortized query latency of …
Preprint analyzes how cross-chain flows between multiple blockchains can destabilize EIP-1559-style adaptive base fee mechanisms.
arXiv cs.CR (Cryptography & Security)blockchaineip-1559arxivFeed excerpt
arXiv:2610.23305v1 Announce Type: new Abstract: EIP-1559 has become the dominant transaction fee mechanism in permissionless blockchains, regulating scarce block space through an adaptive base fee. The design balances a trade-off between responsiveness to demand fluctuations and stability of long-term resource usage. On a single chain, this trade-off is well understood and empirically stable. In multi-chain systems, however, cross-chain flows introduce delayed economic interactions across otherwise independent fee markets. These interactions alter the control dynamics and create stability risks that existing models do not capture. Deployed systems have already polarized. Polkadot enforces conservative update rates, effectively disabling fee adaptivity and reverting the market to inefficient first-price auctions. Cosmos adopts aggressive update rates without formal guarantees. To fill this gap, we propose a control-theoretic framework that formalizes multi-chain fee markets as a nonlinear dynamical system with delayed feedback. We identify delay-amplified over-correction as the structural root of instability. Experiments show that cross-chain coupling erodes stability relative to mo…
Paper derives an optimal token-level attribution rule for multi-key Gumbel-max LLM watermarks under a Type I error constraint.
arXiv cs.CR (Cryptography & Security)watermarkingllmstatisticsFeed excerpt
arXiv:2610.23601v1 Announce Type: new Abstract: A watermark verifier may hold many modes, i.e., secret keys, and a document may mix spans of different modes with unwatermarked text. Directly reporting the mode with the largest pivotal statistic (pivot) inflates the Type I error, and restoring the nominal level reduces power as candidate modes are added. We formulate token-level multi-mode attribution for the Gumbel-max watermark as maximizing correct-label power under a Type I error constraint given a mode prior. We show that the optimal rule reports the mode with the largest prior-weighted alternative density and rejects when this density exceeds one common threshold. Based on this rule, we propose the Belief-weighted Likelihood Attribution with Density Estimation (BLADE) detector. It estimates the mode prior from neighboring pivots and the alternative density from reference token probabilities. Under a conditional product model of the pivots, it keeps the exact Type I error. We further show that BLADE approaches the optimal rule as its prior and density estimates improve, with a sharp coefficient on the density error. On OPT-1.3B and other open-weight large language models, BLADE…
Paper gives communication complexity results for concrete functions in private simultaneous quantum messages, including quantum advantages for equality.
arXiv cs.CR (Cryptography & Security)quantumcryptographycomplexityFeed excerpt
arXiv:2610.23090v1 Announce Type: cross Abstract: Private simultaneous quantum messages (PSQM) provide a minimal model of noninteractive secure multiparty quantum computation, yet their communication complexity for concrete functions remains poorly understood. We show that familiar total functions already exhibit both genuine quantum advantages and strong structural limitations. For three-party equality on $n$-bit inputs, which determines whether the players' $n$-bit strings are identical, we construct an entanglement-assisted protocol with asymptotic communication $(1.633\ldots)n$ qubits, whereas every perfectly correct protocol without prior entanglement requires at least $3n$ qubits. For three-bit majority, one shared GHZ state and one transmitted qubit per player suffice for perfect correctness and perfect privacy, reducing the communication from the optimal classical cost of six bits to three qubits. Three-bit AND behaves differently. No perfectly correct and perfectly private protocol exists when the players share an arbitrary three-qubit state, apply arbitrary local unitary encodings, and transmit one qubit each. However, increasing the local dimension overcomes this obstruc…
A post describes superoptimizing the code of a floating-point unit emulator to improve its performance.
LobstersoptimizationemulationcompilersFeed excerpt
Comments