Digital and Cyber Forensics

Latest papers

• CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion

  Zhen Liang, Hai Huang, Wentao Chen · 1 October 2026

  Large language models have achieved remarkable capabilities across diverse domains, yet their safety alignment remains vulnerable to jailbreak attacks. In this work, we identify a previously underexplored failure mode - safety generalization lag - where alignment trained predominantly on natural lan…

• SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs

  Wenyu Chen, Li Wang, Chuanchao Zang, Xiangtao Meng, Xinyu Gao, Jianing Wang, Zheng Li, Shanqing Guo · 1 October 2026

  Video Multimodal Large Language Models (Video-MLLMs) support reasoning over video inputs, yet remain vulnerable to jailbreak attacks that elicit policy-violating responses. Existing video jailbreaks primarily manipulate how harmful queries are visually presented, thereby treating video merely as a c…

• Controlled Decoding Attacks on Black-Box LLMs

  Jesson Wang, Shawn Li, Wei Yang, Franck Dernoncourt, Ryan A. Rossi, Charith Peris, Yue Zhao · 30 September 2026

  Manipulating next-token probabilities during generation can bypass the safety alignment of large language models. Existing approaches, however, rely on access to model weights or numerical token probabilities and therefore do not apply to interfaces that return only sampled text. Reconstructing prob…

• Does the Unsafe Gradient Survive a Conversation? On the Fragility of Gradient-Based Jailbreak Detection in Multi-Turn Dialogue

  Omar Sheta, Rinku Deuja, Hadi Masoudi, Minghong Fang · 30 September 2026

  Safety-aligned language models are commonly deployed as multi-turn assistants, which lets adversaries spread unsafe intent across several user turns instead of a single prompt. Gradient-based jailbreak detectors such as GradSafe were developed for single prompts: they score an input by the alignment…

• Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning

  Julian Schulz · 28 September 2026

  Chain-of-thought (CoT) monitoring is a promising safety technique for reasoning models, enabling detection of problematic reasoning before models act. A key concern is encoded reasoning, where models hide their true reasoning in ways that monitors and humans cannot interpret. Optimization pressure f…

• SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration

  Md Jueal Mia, Yanzhao Wu, Selcuk Uluagac, M. Hadi Amini · 14 September 2026

  Large language models (LLMs) are rapidly evolving from conversational assistants into agentic AI systems that reason, plan, invoke tools, maintain persistent memory, communicate with other agents, and execute multi-step tasks. At the same time, modern models exhibit substantially stronger native saf…

• An Empirical Measurement of Jailbreaking Evaluators

  Yujie Mu · 11 September 2026

  Expert evaluation of jailbreak responses is costly and difficult to scale, so the community increasingly relies on automated evaluators to determine whether an attack succeeds. However, jailbreak studies typically validate their chosen evaluator independently, repeatedly spending resources on simila…

• Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning

  Thomas Rivasseau · 10 September 2026

  Large language model safety and security research is preoccupied with, among other things, detecting and preventing jailbreak attacks: alignment bypasses that allow an adversarial user to elicit unwanted or harmful outputs from models. Arbitrary cipher, or covert communication, attacks are one such …

• Validity-Aware Jailbreak Evaluation for Large Language Models

  Qilong Wu, Sahil Wadhwa, Pranab Mohanty, Giri Iyengar, Varun Chandrasekaran · 2 September 2026

  Jailbreak robustness has become central to large language model (LLM) safety evaluation, yet prevailing methodologies rely primarily on refusal behavior, semantic resemblance, and intent-matching heuristics that emphasize linguistic plausibility rather than correctness. We identify a key limitation …

• Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks

  Aaditya Pratap, Harsh Kasyap, Somanath Tripathy · 25 August 2026

  Locally deployed Large Language Models (LLMs) via inference engines such as Ollama run without the moderation and abuse detection present in API-served models. Therefore, the safety of LLMs depends on the defense mechanisms used, and their effectiveness depends on the assumptions on which they were …

• PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies

  Zeyu Feng, Qingyu Wu, Yuzhe Luo, Hua Cheng · 25 August 2026

  Large language models (LLMs) are increasingly deployed in education, healthcare, policy advising, and other interactive settings, where users engage them as sustained social interlocutors rather than one-shot query engines. This shift makes jailbreaks a growing safety threat, yet most research empha…

• `From Prompt to Perturbation': An Adaptive Framework for Voice-Based Jailbreaks on Audio LLMs

  Linghan Huang, Bo Li, Huaming Chen, Kim-Kwang Raymond Choo · 21 August 2026

  As large language models (LLMs) are increasingly integrated into audio-based applications, growing concerns have emerged regarding their vulnerability to audio-based adversarial attacks. These systems typically follow two architectural paradigms: cascaded pipelines, where automatic speech recognitio…

• Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets

  Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou, Peng Yu, Jiajia Li, Chaochao Lu, Qiaosheng Zhang · 19 August 2026

  Reliable jailbreak evaluation is essential for assessing LLM safety, but most existing studies rely solely on attack success rate (ASR) without accounting for its dependence on attack budgets, resulting in unfair comparisons across methods. Existing compute-aware evaluations reduce heterogeneous res…

• A Framework for Using and Evaluating LLMs as Surrogate Experts in Security Surveys: Reliability, Bias, and Implications

  Despoina Giarimpampa, Roland Meier, Tegawend\'e F. Bissyand\'e, Vincent Lenders, Jacques Klein · 19 August 2026

  Expert surveys are widely used in security research to study practitioner workows and decision-making, yet recruiting domain experts - especially in Security Operations Centres (SOCs), where analysts face high workload, burnout and confidentiality constraints - is difficult and often results in smal…

• JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills

  Xiaoyu Wen, Jiajia Li, Zhida He, Peng Yu, Chenxu Wang, Han Qi, Ziyuan Zhou, Cheng Jin, Ying Wen, Xingcheng Xu, Shuyue Hu, Tianhang Zheng, Chaochao Lu, Qiaosheng Zhang · 18 August 2026

  Automated red-teaming has produced a growing collection of attack strategies, yet they typically remain scattered across prompts and workflows, making them difficult to systematically integrate, reuse, and improve at scale. We introduce \textsc{JailbreakSkill}, a skill-centric framework for scaling …

• TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

  Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu, Ruihong Huang · 18 August 2026

  Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails. Existing defenses lack the reasoning capacity to identify evolving manipulation patterns, often trading helpfulness f…

• NeuroBreak: Unveil Internal Jailbreak Mechanisms in Large Language Models

  Chuhan Zhang, Ye Zhang, Bowen Shi, Yuyou Gan, Tianyu Du, Shouling Ji, Dazhan Deng, Yingcai Wu · 11 August 2026

  In deployment and application, large language models (LLMs) typically undergo safety alignment to prevent illegal and unethical outputs. However, the continuous advancement of jailbreak attack techniques, designed to bypass safety mechanisms with adversarial prompts, has placed increasing pressure o…

• Can Small Language Models Reliably Resist Jailbreak Attacks? A Comprehensive Evaluation

  Zhibo Wang, Wenhui Zhang, Huiyu Xu, Zeqing He, Ziqi Zhu, Kui Ren · 4 August 2026

  Small language models (SLMs) have emerged as promising alternatives to large language models (LLMs) due to their low computational demands, enhanced privacy guarantees, and comparable performance in specific domains. Deploying SLMs on edge devices, such as smartphones and smart vehicles, has become …

• AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation

  Saifur Rahman Tamim, Amir Labib Khan · 20 July 2026

  Governments are increasingly mandating that LLM-generated content carry watermarks. The EU AI Act calls for markings that are "sufficiently reliable and robust." California's SB 942 requires disclosure that is "permanent or extraordinarily difficult to remove." Both mandates rest on an untested assu…

• CHARLIE: An On-Premise Multi-Agent Retrieval-Augmented Generation System for Evidential Reasoning in Forensic Science

  Leandro D. Carneiro, Andre L. S. Meirelles, Juliano de A. Gomes, Rafael C. A. Cabral · 8 July 2026

  We present Charlie, an on-premise multi-agent Retrieval-Augmented Generation (RAG) system for structured evidential processing in digital forensic environments. Contemporary forensic workflows must handle large volumes of heterogeneous and unstructured documents under strict requirements of traceabi…

• From Forgeries to Foundation Models: A Systematic Survey of Identity Document Attack and Detection

  Gourab Das, Pavan Kumar C, Raghavendra Ramachandra · 3 July 2026

  Identity document forgery has undergone a fundamental capability shift: generative AI tools now enable high-fidelity document synthesis and field-level manipulation with minimal technical expertise, while detection methods remain constrained by benchmarks that do not reflect this threat. The resulti…

• Forensic-Oriented Intrusion Detection Using Synthetic Network Traffic Data and Explainable Artificial Intelligence

  Jose Luis Vela Alonso, Carmen Pellicer · 2 July 2026

  Digital forensic investigations of network intrusions require analytical outputs that are traceable, reproducible, and court-defensible - requirements existing machine learning pipelines do not satisfy, since they treat original evidence as training data and produce opaque classifications without in…

• Forensic Trajectory Signatures for Agent Memory Poisoning Detection

  Jun Wen Leong · 30 June 2026

  We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating se…

• MetaBreak: Jailbreaking Online LLM Services via Special Token Manipulation

  Wentian Zhu, Zhen Xiang, Wei Niu, Le Guan · 29 June 2026

  Unlike regular tokens derived from existing text corpora, special tokens are artificially created to annotate structured conversations during the fine-tuning process of Large Language Models (LLMs). Serving as metadata of training data, these tokens play a crucial role in instructing LLMs to generat…

• Black-Box Forensics for Conversational LLM Agents

  Isadora White, Yasaman Jafari, Taylor Berg-Kirkpatrick · 23 June 2026

  As LLM-powered scams proliferate, black-box forensics for conversational LLM agents offers a path to accountability for systems hidden behind anonymous endpoints. Identifying the base model behind a chatbot endpoint (attribution), without model parameter access or knowledge of the hidden system prom…