Fengqing Jiang, Yichen Feng, Yuetai Li, Luyao Niu, Basel Alomair, Radha Poovendran. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Application designers have moved to integrate large language models (LLMs) into their products. However, many LLM-integrated applications are vulnerable to prompt injections. While attempts have been made to address this problem by building prompt injection detectors, many are not yet suitable for practical deployment. To support research in this area, we introduce PromptShield, a benchmark for training and evaluating deployable prompt injection detectors. Our benchmark is carefully curated and includes both conversational and application-structured data. In addition, we use insights from our curation process to fine-tune a new prompt injection detector that achieves significantly higher performance in the low false positive rate (FPR) evaluation regime compared to prior schemes. Our work suggests that careful curation of training data and larger models can contribute to strong detector performance.

In the context of the rising interest in code language models (code LMs) and vulnerability detection, we study the effectiveness of code LMs for detecting vulnerabilities. Our analysis reveals significant shortcomings in existing vulnerability datasets, including poor data quality, low label accuracy, and high duplication rates, leading to unreliable model performance in realistic vulnerability detection scenarios. Additionally, the evaluation methods used with these datasets are not representative of real-world vulnerability detection. To address these challenges, we introduce Primevul, a new dataset for training and evaluating code LMs for vulnerability detection. Primevul incorporates a novel set of data labeling techniques that achieve comparable label accuracy to human-verified benchmarks while significantly expanding the dataset. It also implements a rigorous data de-duplication and chronological data splitting strategy to mitigate data leakage issues, alongside introducing more realistic evaluation metrics and settings. This comprehensive approach aims to provide a more accurate assessment of code LMs' performance in real-world conditions. Evaluating code LMs on Primevul reveals that existing benchmarks significantly overestimate the performance of these models. For instance, a state-of-the-art 7B model scored 68.26% Fl on BigVul but only 3.09% Fl on Primevul. Attempts to improve performance through advanced training techniques and larger models like GPT-3.5 and GPT-4 were unsuccessful, with results akin to random guessing in the most stringent settings. These findings underscore the considerable gap between current capabilities and the practical requirements for deploying code LMs in security roles, highlighting the need for more innovative research in this domain.

We improve upon our previous upper bound on the secrecy capacity of the wiretap channel with multiple transmit antennas and single-antenna receivers, with noisy main channel state information (CSI) at the transmitter (CSI-T). Specifically, we show that if the main CSI error does not scale with the power budget at the transmitter P̅, then the secrecy capacity is )bounded above essentially by log log (P̅ yielding a secure degree of freedom (sdof) equal to zero. However, if the main CSI error scales as O(P̅-β), for β ∈ [0,1], then the sdof is equal to β.

Abstract In this work, we look at authenticated encryption schemes from a new perspective. As opposed to focusing solely on the “security” implications of the different methods for constructing authenticated encryption schemes, we investigate the effect of the method used to construct an authenticated encryption scheme on the “performance” of the construction. We show that, as opposed to the current National Institute of Standards and Technology standard, by performing the authentication operation before the encryption operation, the computational efficiency of the construction can be increased, without affecting the security of the overall construction. In fact, we show that the proposed construction is even more secure than standard authentication based on universal hashing in the sense that the hashing key is resilient to key recovery attacks. Copyright © 2017 John Wiley & Sons, Ltd.

A Gaussian multiple-input single-output (MISO) fading channel is considered. We assume that the transmitter, in addition to the statistics of all channel gains, is aware instantaneously of a noisy version of the channel to the legitimate receiver. On the other hand, the legitimate receiver is aware instantaneously of its channel to the transmitter, whereas the eavesdropper instantaneously knows all channel gains. We evaluate an achievable rate using a Gaussian input without indexing an auxiliary random variable. A sufficient condition for beamforming to be optimal is provided. When the number of transmit antennas is large, beamforming also turns out to be optimal. In this case, the maximum achievable rate can be expressed in a simple closed form and scales with the logarithm of the number of transmit antennas. Furthermore, in the case when a noisy estimate of the eavesdropper's channel is also available at the transmitter, we introduce the SNR difference and the SNR ratio criterions and derive the related optimal transmission strategies and the corresponding achievable rates.

We study the problem of secret-key agreement between two legitimate parties, Alice and Bob, in the presence of an eavesdropper Eve. There is a public channel with unlimited capacity that is available to the legitimate parties and is also observed by Eve. Our focus is on Rayleigh fading quasistatic channels. The legitimate receiver and the eavesdropper are assumed to have perfect channel knowledge of their channels. We study the system in the high-power regime. First, we define the secret-key diversity gain and the secret-key multiplexing gain. Second, we establish the secret-key diversity multiplexing tradeoff (DMT) under no channel state information (CSI) at the transmitter (CSI-T). The eavesdropper is shown to “steal” only transmit antennas. We show that, like the DMT without secrecy constraint, the secret-key DMT is the same either with or without full channel state information at the transmitter. This insensitivity of secret-key DMT toward CSI-T features a fundamental difference between secret-key agreement and the wiretap channel, in which secret DMT depends heavily on CSI-T. Finally, we present several secret-key DMT-achieving schemes in case of full CSI-T. We argue that secret DMT-achieving schemes are also key DMT-achieving. Moreover, we show formally that artificial noise (AN), likewise zero-forcing (ZF), is DMT-achieving. We also show that the public feedback channel improves the outage performance without having any effect on the DMT.

We consider secret-key agreement with public discussion over multiple-input multiple-output (MIMO) Rayleigh fast-fading channels under correlated environment. We assume that transmit, legitimate receiver and eavesdropper antennas are correlated. The legitimate receiver and the eavesdropper are assumed to have perfect channel knowledge while the transmitter has only knowledge of the correlation matrices. First, we derive the expression of the secret-key capacity under the considered setup. Then, we prove that the optimal transmit strategy achieving the secret-key capacity consists in transmitting independent Gaussian signals along the eingenvectors of the transmit correlation matrix. The powers allocated to each channel mode are determined as the solution to a numerical optimization problem that we derive. A necessary and sufficient condition for beamforming (i.e., transmitting along the strongest channel mode) to be capacity-achieving is derived. Finally, we analyze the impact of correlation matrices on the system performance and provide closed-form expressions of the gain/loss due to correlation in the high power regime.

Submodular maximization enables efficient approximation of machine learning, networking, and language processing problems. Typically, these problems have been shown to have matroid constraints, which generalize matching and partition conditions. Developing scalable, distributed submodular optimization algorithms that guarantee the same performance as centralized techniques has been an active area of research. In this paper, we address the problem of developing scalable distributed algorithms for submodular maximization with a matroid constraint. Our key step is to construct an auxiliary function from the submodular objective function, and develop distributed exchange-based algorithms for optimizing the auxiliary function. We first introduce a distributed algorithm for maximizing a submodular function with a matroid constraint. We then develop an algorithm for maximizing time-varying submodular functions under partition matroid constraints, which arises in sensor placement and data caching. We prove that both algorithms provide (1-1/e) optimality bounds, and hence achieve the same guarantees as the best centralized algorithms.

We consider a wiretap channel consisting of a source with multiple antennas, a legitimate receiver and an eavesdropper with a single antenna each. The channels between the source and the receivers undergo fast fading. We assume that the transmitter, in addition to the statistics of both channels, is only aware of a noisy version of the CSI to the legitimate receiver referred to as main channel. The legitimate receiver is aware of both its instantaneous channel gain and the transmitter's estimate of the main channel. On the other hand, the eavesdropper's receiver, in addition to its instantaneous channel realization, is aware of the actual main CSI and the transmitter's estimate as well. While the capacity of this channel is still open even with perfect CSI at the transmitter, we provide in this paper upper and lower bounds on the secrecy capacity. The upper bound is tighter than the one corresponding to perfect main CSI and the gap between the two upper bounds is characterized in function of the channel estimation error variance, at high-SNR. Furthermore, we show that our upper and lower bounds coincide in the case of no main CSI providing a trivial secrecy capacity.

Maximization of submodular set functions arises in wireless applications such as scheduling, caching, and leader selection. For a centralized entity with oracle access to the submodular function, submodular maximization can be approximated up to a constant factor using polynomial-time algorithms; such an entity, however, may be unavailable in decentralized wireless networks. In this paper, we consider maximization of a time-varying submodular function by distributed, resource-constrained nodes. We present algorithms for unconstrained distributed submodular maximization, as well as monotone submodular maximization subject to cardinality constraints. For the unconstrained submodular maximization problem, our algorithm achieves an expected optimality gap of 1/3. For cardinality-constrained submodular maximization, our algorithm achieves an expected optimality gap of 1/2, while reducing the storage and communication overhead, as well as the computation requirements of the nodes, compared to existing techniques. We evaluate our approach through an experimental study using sensor scheduling data, and find that our approach is within ten percent of the best achievable utility in the unconstrained case and within five percent in the constrained case.

In cryptography, secure channels enable the confidential and authenticated message exchange between authorized users. A generic approach of constructing such channels is by combining an encryption primitive with an authentication primitive (MAC). In this work, we introduce the design of a new cryptographic primitive to be used in the construction of secure channels. Instead of using general purpose MACs, we propose the deployment of special purpose MACs, named ε-MACs. The main motivation behind this work is the observation that, since the message must be both encrypted and authenticated, there might be some redundancy in the computations performed by the two primitives. Therefore, removing such redundancy can improve the efficiency of the overall composition. Moreover, computations performed by the encryption algorithm can be further utilized to improve the security of the authentication algorithm. In particular, we will show how ε-MACs can be designed to reduce the amount of computation required by standard MACs based on universal hash functions, and show how ε-MACs can be secured against key-recovery attacks.

With today's technology, many applications rely on the existence of small devices that can exchange information and form communication networks. In a significant portion of such applications, the confidentiality and integrity of the communicated messages are of particular interest. In this work, we propose two novel techniques for authenticating short encrypted messages that are directed to meet the requirements of mobile and pervasive applications. By taking advantage of the fact that the message to be authenticated must also be encrypted, we propose provably secure authentication codes that are more efficient than any message authentication code in the literature. The key idea behind the proposed techniques is to utilize the security that the encryption algorithm can provide to design more efficient authentication mechanisms, as opposed to using standalone authentication primitives.

Anonymous wireless networks use covert relays to prevent unauthorized entities from determining communicating parties through traffic timing analysis. In a multipath anonymous network, the choice of which relay nodes should be covert, as well as the route selection by the network nodes, affect both the anonymity and network performance. Although assigning relays as covert and selecting routes composed of covert relays can provide higher anonymity, the selection of these two parameters will increase the packet dropping rate of the network. In this paper, we introduce an analytical framework for joint relay assignment and route selection in multi-path anonymous wireless networks. The main contributions of this work are two-fold. First, we show that joint relay assignment and route selection can be formulated as a convex optimization problem which guarantees global optimum solution. Second, as special cases of our formulation, we derive solutions for the problem of route selection to maximize anonymity when the relay configuration is given, as well as the problem of relay configuration for a given route selection.

In certain applications, the locations of events reported by a sensor network need to remain anonymous. That is, unauthorized observers must be unable to detect the origin of such events by analyzing the network traffic. Known as the source anonymity problem, this problem has emerged as an important topic in the security of wireless sensor networks, with variety of techniques based on different adversarial assumptions being proposed. In this work, we present a new framework for modeling, analyzing, and evaluating anonymity in sensor networks. The novelty of the proposed framework is twofold: first, it introduces the notion of "interval indistinguishability” and provides a quantitative measure to model anonymity in wireless sensor networks; second, it maps source anonymity to the statistical problem of binary hypothesis testing with nuisance parameters. We then analyze existing solutions for designing anonymous sensor networks using the proposed model. We show how mapping source anonymity to binary hypothesis testing with nuisance parameters leads to converting the problem of exposing private source information into searching for an appropriate data transformation that removes or minimize the effect of the nuisance information. By doing so, we transform the problem from analyzing real-valued sample points to binary codes, which opens the door for coding theory to be incorporated into the study of anonymous sensor networks. Finally, we discuss how existing solutions can be modified to improve their anonymity.

In anonymous networks, a subset of nodes is chosen to act as covert relays to hide timing information from unauthorized observers. While such covert relays increase anonymity, they cause performance degradation by delaying or dropping packets. In this paper, we propose flow allocation methods that maximize anonymity for multipath wireless networks with predetermined covert relay nodes, while taking into account packet-loss as a constraint. Using a rate-distortion framework, we show how to assign probabilities which split the flows from source to destination among all possible routes and show that selecting routes according to the assigned probabilities achieves maximum anonymity given the packet-loss constraint.

In RFID literature, most “privacy-preserving” protocols require the reader to search all tags in the system in order to identify a single tag. In another class of protocols, the search complexity is reduced to be logarithmic in the number of tags, but it comes with two major drawbacks: it requires a large communication overhead over the fragile wireless channel, and the compromise of a tag in the system reveals secret information about other, uncompromised, tags in the same system. In this work, we take a different approach to address time complexity of private identification in large-scale RFID systems. We utilize the special architecture of RFID systems to propose a symmetric-key privacy-preserving authentication protocol for RFID systems with constant-time identification. Instead of increasing communication overhead, the existence of a large storage device in RFID systems, the database, is utilized for improving the time efficiency of tag identification.

In this paper, we explore a new direction towards solving the identity authentication problem in RFID systems. We break the RFID authentication process into two main problems: message authentication and random number generation. For parties equipped with a good source of randomness and a secure cry ptographic primitive to authenticate messages, the literature of cryptography is rich with well-studied solutions for secure identity authentication. However, the two operations, random number generation and message authentication, can be expensive for low-cost RFID tags. In this paper, we lay down the foundations of a new direction towards solving these problems in RFID systems. We propose an unconditionally secure direction for authenticating RFID systems. We use the fact that RFID readers are computationally powerful devices to design a protocol that allows RFID readers to deliver random numbers to RFID tags in an unconditionally secure manner. Then, by taking advantage of the information-theoretic security of the transmitted messages, we develop a novel unconditionally secure message authentication code that is computed with a single multiplication operation. The goal of this work is to bring more research to the design of such unconditionally secure protocols, as opposed to the computationally secure protocols that have been proposed extensively, for the purpose of suiting the stringent computational capabilities of low-cost devices.

In RFID literature, most “privacy-preserving” protocols require the reader to search all tags in the system in order to identify a single tag. In another class of protocols, the search complexity is reduced to be logarithmic in the number of tags, but it comes with two major drawbacks: it requires a large communication overhead over the fragile wireless channel, and the compromise of a tag in the system reveals secret information about other, uncompromised, tags in the same system. In this work, we take a different approach to address time-complexity of private identification in large-scale RFID systems. We utilize the special architecture of RFID systems to propose the first symmetric-key privacy-preserving authentication protocol for RFID systems with constant-time identification. Instead of increasing communication overhead, the existence of a large storage device in RFID systems, the database, is utilized for improving the time efficiency of tag identification.

In this work, we investigate the security of anonymous wireless sensor networks. To lay down the foundations of a formal framework, we develop a new model for analyzing and evaluating anonymity in sensor networks. The novelty of the proposed model is twofold: first, it introduces the notion of ``interval indistinguishability" that is stronger than existing notions; second, it provides a quantitative measure to evaluate anonymity in sensor networks. The significance of the proposed model is that it captures a source of information leakage that cannot be captured using existing models. By analyzing current anonymous designs under the proposed model, we expose the source of information leakage that is undetectable by existing models and quantify the anonymity of current designs. Finally, we show how the proposed model can lead to a general and intuitive direction for improving the anonymity of current designs.