Dual-Adversarial Safety Alignment: Cultivating Intrinsic Threat Comprehension in LRMs
大型推理模型（LRMs）在复杂任务上表现优异，但仍易受恶意提示诱导生成不安全输出。现有对齐方法通常依赖直接拒绝或安全理由，但往往聚焦于提示模式而非内在攻击机制，导致难以泛化到多种越狱攻击，鲁棒性和推理效用受限。本文提出 AdvSafe，一种
2026-08-12 归档
今日共收录 1910 条安全情报，包含 1065 个 CVE，437 篇安全通告，以及 97 篇研究论文。
← 返回归档列表A Content-Aware Pure Permutation with Intrinsic Avalanche Effect: Breaking the Diffusion-Permutation Dichotomy
本文针对图像处理与图像加密领域中的一个长期假设提出挑战：传统观点认为，仅靠像素置换（permutation）无法产生差分敏感性（differential sensitivity），即改变一个像素只会使该像素在输出中移位，不会引发雪崩效应。作
Track me if you can: Ephemeral coin tracing
该论文研究隐私保护支付系统在受监管场景（如央行数字货币CBDC、机构稳定币及其他合规支付基础设施）中的应用困境。尽管隐私保护支付系统在技术上已较为成熟，但因其可能被用于洗钱等非法活动，监管机构对其采用持谨慎态度。为打击金融犯罪，监管机构通常
Joint Lyapunov Certificates for K-Agent Generative AI Governance: Stochastic Stability, Emergent Ensemble Risk, and Zero-Knowledge Governance Attestation
本文提出一个面向多智能体生成式AI系统治理的数学框架，聚焦于模型风险管理（MRM）下的联合稳定性证明问题。研究指出，当K个自适应的生成式AI模型通过交互矩阵存在元学习耦合时，传统的单智能体Lyapunov分析不再充分：每个模型个体可能各自满
A Complexity-Theoretic Approach to Proofs of Space
本文提出了一种基于复杂度理论构建空间证明（Proof of Space, PoS）协议的通用框架。空间证明由Dziembowski等人于CRYPTO 2015引入，是一种两阶段协议，允许证明者向验证者证明其已分配大量持久内存来存储特定信息。
IoXT: The Internet of Explainable Things. Why Explainability in IoT Requires a New System-Level Paradigm and Protocol Design
本文提出“可解释物联网（IoXT）”这一系统级新范式。传统物联网系统将感知、通信、人工智能（AI）决策与执行器控制相结合，但现有的可解释AI（XAI）方法只能解释模型自身的预测，无法完整解释从传感器证据到物理动作的端到端因果路径。IoXT的
Differential Privacy for Markov Chain State Trajectories
本文针对数据驱动系统中马尔可夫链状态轨迹的隐私泄露问题，提出了一种基于差分隐私的在线隐私化框架。在许多应用中，系统需要依赖马尔可夫链的状态轨迹（如产品信用风险、用户物理位置、上网行为等）进行决策，但这些轨迹往往包含敏感的用户信息。现有方法通
A Blueprint for Collaborative Cybersecurity Operations Centres with Capacity for Shared Situational Awareness, Coordinated Response, and Joint Preparedness
随着数字技术融入社会方方面面，识别和管理网络安全威胁变得至关重要。在欧盟内部，多项倡议正在推进，旨在激励、规范并最终协调网络安全能力的建设，提升态势感知、事件响应和应急准备能力，尤其关注重要服务运营商和承担网络安全职责的国家行为体。在此背景
Strategies to Avoid Illegal Data Access
本文是一篇关于企业防止非法数据访问的策略性综述研究。随着技术发展，未授权数据访问的风险持续上升，企业必须采取主动防御措施来保护敏感数据。论文从三个维度系统分析了防止未授权访问的方法：技术解决方案、员工培训和制度政策执行。在技术层面，重点介绍
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits n...
CVE-2026-73249
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{librar
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-70339
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially fo...
CVE-2026-18697
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce
Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Kernel may allow info...
CVE-2026-20917
Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Proce
Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combin...
CVE-2026-20901
Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Sta
Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user ...
CVE-2026-20712
Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disc
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-65813
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
CVE-2026-62915
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a net
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-62914
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-62913
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
CVE-2026-62912
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a netw