27 CISPA- PAper AT The ACM CCS 2026

Authors: Soheil Khodayari (Independent Researcher); Xuenan Zhang,CISPA Helmholtz Center for Information Security; Bhupendra Acharya, University of Louisiana; Giancarlo Pellegrino; CISPA Helmholtz Center for Information Security

LLM web agents increasingly rely on web content as input, exposing them to indirect prompt injection embedded in webpages. While prior work has shown such attacks in controlled settings, it remains unclear whether prompt injection is already deployed in the wild and what role it plays in the web ecosystem. In this paper, we conduct the first large-scale empirical study of in-page prompt injection. Analyzing 1.2B URLs across 24.8M hosts, we identify 15.3K validated prompt injections, with a small set of reused templates accounting for the majority of cases. Our analysis reveals a multi-stakeholder phenomenon, with injections serving diverse offensive and defensive objectives, including system disruption, reputation manipulation, data protection, and AI bot detection, and target a range of agents from web crawlers and search systems to customer-support and HR automation pipelines. Most injections (70%) are delivered in non-visible channels like HTTP headers, JS comments, or HTML-embedded hidden content. We assess their effectiveness through 5,200 systematic experiments across 13 models and four page representations, observing up to 8% effectiveness for smaller models on plain-text inputs, with lower effectiveness for other representations. Overall, our results show that in-page prompt injection is emerging as an important source of friction between LLM-based agents and the broader web ecosystem.

Authors: Maria Hellenthal, CISPA Helmholtz Centre for Information Security; Thorsten Helfer, CISPA Helmholtz Center for Information Security; Doreen Riepel , CISPA Helmholtz Center for Information Security; Annabelle Walle, CISPA Helmholtz Center for Information Security; Jannik Zeiser, CISPA Helmholtz Center for Information Security; Til Dralle, CISPA Helmholtz Center for Information Security; Sascha Fahl, CISPA Helmholtz Center for Information Security

While cryptography is often positioned as inherently pro-social, its methods and deployments can have both beneficial and harmful effects on users and society. Despite the dual-use nature of cryptographic research, it remains unclear whether the cryptographic community shares a common operational account of the ethical responsibilities its researchers adhere to. We conducted semi-structured interviews with 20 cryptography researchers, spanning theory and applied cryptography, and including junior and senior community members. Using qualitative data analysis, we examine how participants relate their research to ethics, the role of normative and ethical considerations in motivating their work, and how they reflect on the broader social and political responsibility of cryptography.

Our findings indicate that ethics in cryptographic research is largely implicit, distributed, and conditional rather than explicit. Ethical considerations rarely serve as primary motivations; instead, they emerge situationally, shaped by proximity to application, and by uncertainty about downstream impact. Considerations of responsibility and public good are present but articulated unevenly across participants and contexts. Drawing on participants' perspectives, we outline actionable recommendations and community-level mechanisms, such as venue-specific guidance and repositories of exemplar cases, that encourage ethical reflection and responsibility in cryptographic research while addressing researchers' concerns about potential constraints on scientific progress.

Authors: Morio, Kevin; Ivanov, Yavor ; Künnemann, Robert, CISPA Helmholtz Center for Information Security

Tamarin and ProVerif are two prominent tools for the formal verification of security protocols. They share the same high-level goal but differ significantly in their underlying formalisms and verification techniques, making a systematic comparison challenging: Tamarin uses multiset rewrite rules with sound and complete verification, whereas ProVerif employs an extension of the applied-pi calculus that provides fast but potentially incomplete results.

We present a sound translation from Tamarin to ProVerif that enables a rigorous comparison of the two tools. It introduces techniques for formula rewriting, encoding multiset rewrite semantics, and handling simultaneous events, supporting a large subset of Tamarin's features, including multiset rewrite rules, lemmas, and restrictions, while precisely characterizing the cases where faithful translation is not possible. We provide formal proofs: within the faithful fragment, soundness ensures that any property verified in ProVerif also holds in the original Tamarin model, and completeness ensures that exists-trace properties not involving attacker knowledge are preserved. Best-effort encodings, in particular XOR, are reported separately and are outside these guarantees.

Finally, we evaluate our translation on 121 Tamarin models. The ProVerif front end accepts executable translations for 523 of 566 lemma tasks. Among non-XOR tasks with definitive results from both tools, 237 of 238 agree, with the remaining verdict explicitly flagged as using an incomplete model. Among the 344 tasks for which Tamarin returns a Boolean result and ProVerif completes with a logical result, ProVerif is faster in 316 cases (91.9%), with median per-task runtime and peak-memory ratios of 6.74x and 6.13x, respectively.

Authors: Timo Treitz, Saarland University; Robert Künnemann, CISPA Helmholtz Center for Information Security

Certificate Transparency (CT) aims to reduce the trust required in Certificate Authorities (CAs) within the TLS certificate ecosystem. It is supported by all major browsers. The protocol obliges all CAs to record the certificates they issue in a public log, which itself is monitored for compliance and consistency by third parties. Given this complex set of checks between the four roles-CA, loggers, monitor but also the end user's client-it is very hard to provide a precise account of how CT eliminates trust assumptions in exchange for complex infrastructure. Analyses both in the Dolev-Yao paradigm and the computational paradigm only regard a very simplified model and feature definitions adapted specifically to CAs, essentially capturing design features rather than the target property.

The present paper posits accountability as the main goal of CT and presents a thorough analysis in the Dolev-Yao model. We start with the vanilla PKI and, step by step, move to CT, finally analyzing proposed extensions for SCT Auditing and Gossiping. We show that plain CT relies on an honest log, but provides accountability under this assumption. Furthermore, we show that the SCT Auditing extension can eliminate this assumption, while the Gossiping extension cannot.

Authors: Cremers, Cas, CISPA Helmholtz Center for Information Security; Peltonen, Aleksi, CISPA Helmholtz Center for Information Security; Zhao, Mang, Independent Researcher

Despite decades of work on threshold signature schemes, there is still limited agreement on their desired properties and threat models. In this work we significantly extend and repair previous work to give a unified syntax for threshold signature schemes and a new hierarchy of security notions for them. Moreover, our new hierarchy allows us to develop an automated analysis approach for protocols that use threshold signatures, which can discover attacks on protocols that exploit the details of the security notion offered by the used scheme, which can help choose the correct security notion (and scheme that fulfills it) that is required for a specific protocol. Unlike prior work, our syntax for threshold signatures covers both non-interactive and interactive signature schemes with any number of key generation and signing rounds, and our hierarchy of security notions additionally includes elements such as various types of corruption and malicious key generation.

We show the applicability of our hierarchy by selecting representative threshold signature schemes from the literature, extracting their core security features, and categorizing them according to our hierarchy. As a side effect of our work, we show through a counterexample that a previous attempt at building a unified hierarchy of unforgeability notions does not meet its claimed ordering, and show how to repair it without further restricting the scope of the definitions. Based on our syntax and hierarchy, we develop the first systematic, automated analysis method for higher-level protocols that use threshold signatures. We use a symbolic analysis framework to abstractly model threshold signature schemes that meet security notions in our hierarchy, and implement this in the Tamarin prover. Given a higher-level protocol that uses threshold signatures, and a security notion from our hierarchy, our automated approach can find attacks on such protocols that exploit the subtle differences between elements of our hierarchy.

Our approach can be used to formally analyze the security implications of implementing different threshold signature schemes in higher-level protocols.

Authors: Nasrabadi, Faezeh, CISPA Helmholtz Center for Information Security; Künnemann, Robert, CISPA Helmholtz Center for Information Security;Nemati, Hamed, KTH Royal Institute of Technology

Formal verification of cryptographic protocols typically relies on symbolic models that abstract away compiled code and microarchitectural side channels, leaving a gap between verified specifications and deployed executables. We present a toolchain that extracts protocol-relevant models from real binaries and analyzes them under explicit leakage contracts for constant-time and Spectre-PHT-style speculative observations. Starting from a selected binary region, we lift machine code to an intermediate representation, instrument it with leakage contracts, symbolically execute it to obtain event/observation traces, and translate these traces into Sapic+ for analysis with Tamarin, ProVerif, and DeepSec.

As case studies, we extract models of WhatsApp Desktop's session-management and double-ratchet components from its binary and analyze forward secrecy and post-compromise security under a state-cloning compromise. For side-channel analysis, we study the Basic Access Control (BAC) protocol used in e-passports and WhatsApp's session establishment. Under our observation models, we identify an instruction-cache side channel in WhatsApp Desktop enabling social-graph inference, and we reproduce known unlinkability issues in BAC under microarchitectural observations.

Authors: Hsu, Chia-Yi, National Yang Ming Chiao Tung University; Tsai, Yu-Lin, University of California, Berkeley; Zhe, Yu, RIKEN Center for Advanced Intelligence Project; Chen, Yan-Lun, National Yang Ming Chiao Tung University; Lin, Chih-Hsun, National Chengchi University; Yu, Chia-Mu, National Yang Ming Chiao Tung University; Zhang, Yang, CISPA Helmholtz Center for Information Security; Huang, Chun-Ying, National Yang Ming Chiao Tung University; Sakuma, Jun, Institute of Science Tokyo

Task arithmetic in large-scale pre-trained models enables agile adaptation to diverse downstream tasks without extensive retraining. By leveraging task vectors (TVs), users can perform modular updates through simple arithmetic operations like addition and subtraction. Yet, this flexibility presents new security challenges. In this paper, we investigate how TVs are vulnerable to backdoor attacks, revealing how malicious actors can exploit them to compromise model integrity. By creating composite backdoors that are designed asymmetrically, we introduce BadTV, a backdoor attack specifically crafted to remain effective simultaneously under task learning, forgetting, and analogy operations. Extensive experiments show that BadTV achieves near-perfect attack success rates across diverse scenarios, posing a serious threat to models relying on task arithmetic. We also evaluate current defenses, finding they fail to detect or mitigate BadTV. Our results highlight the urgent need for robust countermeasures to secure TVs in real-world deployments.

Authors: Soneji, Ananta, University of Nebraska at Omaha; Nath, Souradip, Arizona State University; Schloegel, Moritz, CISPA Helmholtz Center for Information Security; Shoshitaishvili, Yan, Arizona State University; Ahn, Gail-Joon, Arizona State University; Doupé, Adam, Arizona State University; Rubio-Medrano, Carlos, Texas A&M University-Corpus Christi

Zero Trust has emerged as a prominent paradigm for addressing the limitations of perimeter-based security, gaining momentum through policy mandates, industry adoption, academic interest, and broader public discourse. Yet, little to none is known about how cybersecurity professionals understand and interpret Zero Trust for translation into practice and what roadblocks they perceive.

In this work, we present the first study that investigates the human side of Zero Trust through 27 semi-structured interviews with cybersecurity professionals from U.S. government, industry, and academia. Across sectors, participants consistently describe Zero Trust as a promising shift in security thinking, while expressing skepticism about the term itself and the impressions it creates.

When translating Zero Trust into practice, they reported recurring patterns that span perceiving value, planning, execution, and measuring progress. Our participants highlighted several challenges stemming from ambiguity in guidance, organizational culture, and domain-specific constraints. Our results highlight the socio-technical nature of Zero Trust adoption and identify opportunities for cross-sector collaboration, policy guidance, and future research to better support the translation and realization of abstract security paradigms in practice.

Authors: Debant, Alexandre, Université de Lorraine, CNRS, Inria; Künnemann, Robert, CISPA Helmholtz Center for Information Security; Müller, Johannes, Independent researcher

Vote privacy is a fundamental property of secure e-voting protocols. This is usually accomplished using mix nets, which shuffle and thus anonymize the votes cast. To distribute trust regarding vote privacy, mix nets with multiple servers are often required, especially in high-stakes elections. Formal, computer-aided verification has become a well-established method for verifying whether e-voting protocols ensure vote privacy. Numerous studies in this field have significantly advanced our understanding of vote privacy. However, existing studies of e-voting protocols based on verifiable mix nets have a significant limitation: they idealize the mix net’s functionality or consider only a single mix server that is fully trusted regarding vote privacy. While this is understandable given the limitations of existing verification tools, it restricts the class of protocols that can be accurately analyzed. Previous research shows that this abstraction can result in overlooked vote privacy attacks. To address this open research problem, we present the first formal fine-grained model of a mix net which allows us to consider an arbitrary number of mixers. Using the ProVerif tool, we applied this model to verify that the Helios protocol, its variants Belenios and BeleniosRF, and the Perfectly Private Audit Trail (PPAT) protocol all provide vote privacy when considering this more accurate modeling of multi-server mix nets.

Authors: Dutta, Aneet Kumar, CISPA Helmholtz Center for Information Security; Dixit, Mihirraj, Saarland University; Gni, Kevin, CISPA Helmholtz Center for Information Security; Lueks, Wouter, CISPA Helmholtz Center for Information Security; Singh, Mridula, CISPA Helmholtz Center for Information Security

Smartphones simultaneously transmit temporary identifiers over LTE, WiFi, and BLE. Existing privacy defenses analyze identifier randomization per protocol, implicitly assuming that these protections compose across protocols. We show that they do not: Even when each protocol leaks only temporary identifiers and the adversary is fully passive, unsynchronized identifier rotations allow cross-protocol stitching of device traces. We present CrossLink, an uncertainty-aware tracing algorithm that links identifiers across time, space, and protocols under noisy localization and mobility. We evaluate CrossLink using controlled lab experiments with commodity devices and large-scale mobility simulation. Under large-scale mobility simulation, CrossLink reconstructs full traces for 83% of users, versus 22% for the best single-protocol baseline, showing that location privacy must be analyzed jointly across protocols. We further show that CrossLink remains effective under partial coverage: strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions retain sufficient cross-protocol evidence to bridge observation gaps, achieving substantially higher linkability than random deployments.

Authors: Shao, Bo, CISPA Helmholtz Center for Information Security; Shen, Xinyue, CISPA Helmholtz Center for Information Security; Zhang, Yang, CISPA Helmholtz Center for Information Security

As generative AI models gain widespread adoption, an urgent question arises: are they being exploited to produce hateful content in online communities? We present the first large-scale, multi-modal measurement study to investigate this question, drawing on 465M text posts spanning 2016-2026 and 16.9M images spanning 20212025 from 4chan’s/pol/board.Specifically,wefocusedontwohate targets with long-established phenomena in parallel: anti-Indian hate and anti-Semitic hate. By benchmarking five text and five image AI detectors on hateful content, we deploy the best-performing detectors on over 31K long-form hateful posts and approximately 50K hateful images to measure AI-generated content prevalence. We find that the two targets exhibit different growth patterns: antiIndian hate is substantially self-sustaining, with 46.15% of detected peaks driven by organized community campaigns rather than external events, against only 5.88% for anti-Semitic hate, which is instead largely reactive, with 94.12% of peaks triggered by real-world events such as the October 7 Hamas attack. AI-generated hateful posts have grown steadily since late 2022, reaching 1.42% of long-form posts by 2025. More importantly, AI adoption diverges across the two targets. For anti-Indian hate, AI content prevalence correlates significantly with slur frequency, nearly doubles during hate peaks, and AI-generated posts are 55.72% more toxic than human-written ones. Anti-Semitic hate, by contrast, shows no significant AI-hate correlation, indicating that AI tools are more widely adopted in campaign-driven hate than in established hate discourse. Lead-lag analysis reveals that hate campaigns precede AI adoption by approximately three months, suggesting that generative AI serves as an accelerator for existing hate movements rather than an independent driver.

Authors: Giacomello, Anna, CISPA Helmholtz Center for Information Security; Lassak, Leona, Max Planck Institute for Security and Privacy; Hielscher, Jonas, CISPA Helmholtz Center for Information Security; Golla, Maximilian, CISPA Helmholtz Center for Information Security

The passkey ecosystem lacks a way to invalidate access across authenticators and relying parties, as required in scenarios such as device theft, offboarding, or account unsharing. Although cryptographic revocation protocols have been proposed, they are not yet part of the ecosystem. Currently, users must sign in to each service and manually delete passkeys while tracking them across devices and passkey providers. In this work, we investigate passkey revocation from both technical and user perspectives.

We systematize existing passkey revocation proposals and derive four revocation mechanisms that abstract cryptographic protocols into user-facing interaction models. We then conduct an online survey (n=308) to examine when users would consider revoking access across scenarios, complemented by semi-structured interviews (n=20) exploring users' awareness, concerns, and preferences regarding the four revocation mechanisms. We find that revocation intention closely follows perceived severity, with high-risk scenarios eliciting near-universal willingness to revoke, while lower-risk scenarios show more varied responses. Our qualitative results show that users perceive the available revocation flow as cumbersome and difficult to manage at scale, but also share conflicting opinions on the proposed mechanisms, none of which represents a ready-to-use solution. Our results highlight the need to design more usable revocation mechanisms, for which we provide recommendations.

Authors: Terzo, Noemi, Max Planck Institute for Security and Privacy (MPI-SP); Cremers, Cas, CISPA Helmholtz Center for Information Security; Gonzalez, Ruben, Neodyme AG; Schwabe, Peter, Max Planck Institute for Security and Privacy (MPI-SP), Radboud University Nijmegen; Yarom, Yuval, Ruhr University Bochum; Zhang, Zhiyuan, Max Planck Institute for Security and Privacy (MPI-SP)

We perform the first formal security analysis of the cryptographic core of Olvid, an end-to-end encrypted messaging app notably used by French government officials, including ministers. Despite its deployment in sensitive contexts and its role in critical communications infrastructure, Olvid's cryptographic security has received little independent analysis. To address this gap, we develop detailed models of Olvid's authenticated key exchange and continuous key agreement protocols. We formally verify that our protocol models achieve security properties such as mutual authentication, session-key secrecy, forward secrecy, and replay protection, under an active Dolev-Yao network adversary model that can compromise parties. While we constructively prove that the protocol design meets core security guarantees, our analysis also reveals that, contrary to its claims, the protocol does not meet strong modern security properties that are met by other state-of-the-art secure-messaging protocols, such as Signal. For example, we show in our formal analysis that Olvid is not secure in modern security models such as eCK. Along the way, we uncover a potential timing leakage, and discuss Olvid's anonymity claims.

Authors: Said, Moustafa, CISPA Helmholtz Center for Information Security; Naska, Aurora, CISPA Helmholtz Center for Information Security; Morio, Kevin, CISPA Helmholtz Center for Information Security; Künnemann, Robert, CISPA Helmholtz Center for Information Security

The Signal protocol is a prominent messaging protocol that secures communication for billions of users. It powers WhatsApp, the most widely used messaging application worldwide, and the Signal app, popular among privacy-conscious users. Extensive research in the computational and Dolev-Yao settings provides strong formal security guarantees for the protocol itself. However, a gap remains between the guarantees of the protocol specification and the implementation’s actual behavior at runtime.

In this work, we bridge this gap by applying SpecMon, a recently proposed runtime monitor, to check whether observed executions conform to formal protocol models. To this end, we instrument two applications (WhatsApp Web and Signal Desktop) to capture their interactions with the network and the cryptographic components. Using this instrumentation, we develop two multiset-rewrite models that are compatible with Tamarin, thus enabling verification. We derive the first model of WhatsApp Web’s implementation of the Signal protocol and the most detailed model to date of Signal’s original protocol. Monitoring establishes that observed executions conform to these models, relative to the trusted event extraction and the symbolic abstraction. For the core components of the Signal protocol, we verify authentication and secrecy properties. Finally, monitoring reveals previously undocumented differences between the original libsignal library and WhatsApp’s fork.

We evaluate our methodology and demonstrate its reproducibility. Developing the WhatsApp Web model, instrumenting the app, adding fuzzing, and running the experiments took three person-weeks. We also demonstrate efficient monitoring of real-world applications and detection of deliberately injected security faults, with low overhead in our measured setting.

Authors: Cosler, Matthias, CISPA Helmholtz Center for Information Security; Cremers, Cas, CISPA Helmholtz Center for Information Security; Finkbeiner, Bernd, CISPA Helmholtz Center for Information Security; Ghanem, Mohamed, CISPA Helmholtz Center for Information Security; Medinger, Niklas, CISPA Helmholtz Center for Information Security

Tools like Tamarin and ProVerif have achieved notable success in analyzing and verifying complex real-world protocols such as EMV, 5G, and WPA2, even detecting zero-day exploits. Despite these successes, verifying such protocols remains a time-consuming, challenging task, often requiring significant human effort and expertise. In this paper, we present a reinforcement learning (RL) framework inspired by AlphaZero and AlphaProof that implements a new style of proof search for Tamarin. We have developed a stateless API for Tamarin that acts as a classical RL environment. We guide a Monte Carlo Tree Search (MCTS) by a neural heuristic that learns from completed subproofs. We evaluate our framework on 16 case studies, ranging from classical protocol models to challenging state-of-the-art protocol models from recent publications.

Our method finds more proofs automatically than Tamarin's standard search and produces shorter proofs than both the standard and human-engineered heuristics. Our pipeline is applicable out of the box to assist Tamarin users in active research, reducing the human effort required. Moreover, our standardized interface provides a programmatic way for users to interact with Tamarin. Finally, our work demonstrates the promising potential of adapting RL-based methods to the Tamarin domain.

Authors: Baldimtsi, Foteini, George Mason University, Mysten Labs; Hanzlik, Lucjan, CISPA Helmholtz Center for Information Security; Nguyen, Quan, George Mason University; Yadav, Aayush, George Mason University

Anonymous tokens with private metadata bit (ATPM) have received increased interest as a method for anonymous user authentication while also allowing the issuer to embed trust signals inside the token that are only readable by the authority who holds the secret key. A drawback of all existing ATPM constructions is that they require interaction between the client and the issuer during the issuance process. In this work, we build the first non-interactive anonymous tokens (NIAT) with private metadata bit, inspired by the recent work of Hanzlik (Eurocrypt '23) on non-interactive blind signatures. We discuss how the property of non-interactivity during issuance allows for more efficient protocols that avoid the need for online signing. We construct an efficient NIAT scheme based on Structure-preserving Signatures on Equivalence Classes (SPS-EQ) and experimentally evaluate its performance. We also present an extension to our NIAT construction that allows the identification of clients who attempt to double-spend a token (i.e., present the same token twice) and argue that non-interactive schemes are uniquely positioned to offer this essential feature.

Authors: Mengascini, Andrea, CISPA Helmholtz Center for Information Security; Aurelio, Ryan, CISPA Helmholtz Center for Information Security; Polakis, Jason, University of Illinois Chicago; Pellegrino, Giancarlo, CISPA Helmholtz Center for Information Security

Metaverse platforms increasingly derive their success from user-generated virtual worlds: self-contained social and interactive environments, which can be created by any ordinary user and scale to billions of visits. Platforms such as Roblox, Horizon Worlds, and VRChat now host millions of creator-built worlds that govern how users see, hear, and interact with one another. While this model enables rapid growth and creativity, it fundamentally delegates control over social interactions and world behavior to untrusted users. In this paper, we present the first systematic security and privacy assessment of metaverse world creators. We survey 25 platforms that support user-created worlds and analyze their world-creation capabilities. Guided by this analysis, we design and implement five novel attacks that exploit creator-provided tools to violate spatial, visual, and auditory constraints in immersive environments, enabling covert user surveillance and manipulation without software vulnerabilities or developer-level privileges. We further show that five previously-proposed attacks can be replicated using only standard world-creation features. Finally, we find that existing platform vetting, runtime protections, and creator policies are insufficient to mitigate malicious world-creator behavior, revealing a fundamental mismatch between users' privacy expectations and the powers granted to world creators.

Authors: Zhang, Xinyu, CISPA Helmholtz Center for Information Security; Yang, Ziqing, CISPA Helmholtz Center for Information Security; Backes, Michael, CISPA Helmholtz Center for Information Security; Zhang, Yang, CISPA Helmholtz Center for Information Security

Authors: Wang, Meng, CISPA Helmholtz Center for Information Security; Ma, Yue, University of Electronic Science and Technology; Garoosi, Majid, CISPA Helmholtz Center for Information Security; Fan, Wenting, Shanghai Jiao Tong University; Guo, Liwei, University of Electronic Science and Technology; Wang, Jianqiang, Max Planck Institute for Security and Privacy; Abbasi, Ali, CISPA Helmholtz Center for Information Security

The rapid expansion of the Python ecosystem has fueled two distinct but converging threats: adversaries increasingly target the software supply chain via the Python Package Index (PyPI), while also building evasive, cross-platform malicious binaries compiled from source code written in Python. Current program analysis techniques struggle to address this dual threat. Static analysis based tools are often blinded by runtime obfuscation and compiled bytecode, while dynamic analysis based ones are fragile, prone to evasion by environmental guardrails, and often terminates prematurely due to unsatisfied dependencies.

To overcome these limitations, we present PyFEX, a resilient forced-execution engine. PyFEX explores a program's behavioral space systematically by forcing execution across all conditional branches to bypass evasion checks. To address the fragility of dynamic execution, it introduces a novel resilient crash recovery mechanism that synthesizes dummy objects to satisfy failed operations at the runtime, allowing analysis to proceed past fatal errors, and employs path merging to mitigate path explosion. PyFEX further incorporates an automated entry identification mechanism that proactively discovers and invokes dormant functions, exposing malicious logic hidden within uncalled APIs. To demonstrate the efficacy of this engine, we built PyFEXScan, a proof-of-concept malware detector built on top of PyFEX. Evaluated against both known malicious PyPI packages and real-world compiled binaries, PyFEX exposes critical behaviors missed by the existing state-of-the-art tools. In a live deployment on PyPI, PyFEXScan discovered 212 previously unknown malicious packages accounting for over 91,648 downloads, underscoring the necessity of resilient, exhaustive analysis for securing the Python ecosystem.

Authors: Zhang, Yage, CISPA Helmholtz Center for Information Security; Shen, Xinyue, University of Waterloo; Jiang, Yukun, CISPA Helmholtz Center for Information Security; Backes, Michael, CISPA Helmholtz Center for Information Security; Zhang, Yang, CISPA Helmholtz Center for Information Security

Otome-Spiele, ein Romantik-Simulationsgenre, das sich in erster Linie an Frauen richtet, haben sich zu einer bedeutenden Kraft auf dem globalen Spielemarkt entwickelt und ziehen Hunderte Millionen Spieler:innen sowie Milliardenumsätze an. Trotz ihrer Beliebtheit sind Otome-Spiel-Communities mit weit verbreiteter Online-Toxizität konfrontiert, die bislang weitgehend unerforscht geblieben ist. In dieser Arbeit präsentieren wir die erste groß angelegte Erhebung von toxischem Verhalten in Otome-Game-Communities auf verschiedenen sozialen Plattformen. Wir stellen OtomeSCAN vor, ein Framework zur Erfassung, Bewertung und Analyse von 620.045 Beiträgen aus Weibo und Reddit über einen Zeitraum von 18 Monaten.

Um eine robuste Analyse zu ermöglichen, haben wir einen Ground-Truth-Datensatz mit 4.308 Beiträgen manuell annotiert und dabei acht Zielgruppen identifiziert, darunter Spieler:innen und Spieleentwickler:innen. Wir bewerten sieben Detektoren für toxisches Verhalten anhand des Datensatzes, darunter Allzweckmodelle und unsere vorgeschlagenen LLM-basierten Detektoren, wobei unser bestes Modell F1-Werte von 0,82 (Weibo) und 0,78 (Reddit) erreicht. Unsere Analyse zeigt signifikante plattformspezifische Unterschiede hinsichtlich toxischen Verhaltens: 22,20 % der Otome-bezogenen Beiträge auf Weibo sind toxisch, verglichen mit 3,71 % auf Reddit. Zudem können reale Ereignisse wie Konflikte innerhalb der Community die Toxizität rasch eskalieren lassen: Während eines externen Angriffs auf Weibo stieg der Toxizitätsanteil innerhalb von nur 72 Stunden auf 37,09 %. Wir haben außerdem 191 potenzielle Koordinationscluster in Otome-Spiel-Communities identifiziert, von denen 64,40 % auf Spieleentwickler abzielen, wobei mehrere Accounts wiederholt in verschiedenen Clustern aktiv waren.

Wir hoffen, dass unsere Arbeit zu weiteren Forschungen über communityspezifische Toxizität anregt und dazu beiträgt, gesündere Online-Räume für marginalisierte Gaming-Communities zu schaffen.

Authors: Zhang, Yage, CISPA Helmholtz Center for Information Security; Shen, Xinyue, University of Waterloo; Jiang, Yukun, CISPA Helmholtz Center for Information Security; Backes, Michael, CISPA Helmholtz Center for Information Security; Zhang, Yang, CISPA Helmholtz Center for Information Security

Access to frontier large language models (LLMs), such as GPT-5 and Gemini-2.5, is often hindered by high pricing, payment barriers, and regional restrictions. These limitations drive the proliferation of shadow APIs, third-party services that claim to provide access to official model services without regional limitations via indirect access. Despite their widespread use, it remains unclear whether shadow APIs deliver outputs consistent with those of the official APIs, raising concerns about the reliability of downstream applications and the validity of research findings that depend on them. In this paper, we present the first systematic audit between official LLM APIs and corresponding shadow APIs. We first identify 17 shadow APIs that have been utilized in 187 academic papers, with the most popular one reaching more than 5,900 citations and 58,000 GitHub stars by December 6, 2025. Through multidimensional auditing of three representative shadow APIs across utility, safety, and model verification, we uncover widespread behavioral inconsistency and fingerprint-based evidence consistent with deceptive model claims in a subset of audited endpoints. Specifically, we reveal performance divergence reaching up to 47.21%, significant unpredictability in safety behaviors, and identity verification failures in 45.83% of fingerprint tests. These practices critically undermine the reproducibility and validity of scientific research, harm the interests of shadow API users, and damage the reputation of official model providers. By the time of writing, 4 of the 17 providers have already ceased operations, underscoring the operational volatility of this market. Meanwhile, unverifiable compliance claims and independent model-substitution testing platforms have emerged in the ecosystem, reflecting growing community awareness of this risk.

Authors: Hantke, Florian, CISPA Helmholtz Center for Information Security; Mrowczynski, Rafael, CISPA Helmholtz Center for Information Security; Dralle, Til, CISPA Helmholtz Center for Information Security; Stock, Ben, CISPA Helmholtz Center for Information Security

Research ethics is a controversial and emotionally charged topic in the security and privacy community, sparking discussions at conferences and on social media. In recent years, some of the leading conferences have introduced interventions such as mandatory ethics sections, with mixed reactions within the community. Program committee chairs and steering committees increasingly emphasize ethics, yet there is limited empirical validation on ethics procedures and interventions, as well as no explicitly communicated goals. To support a shared understanding in our community and guide informed decisions at the conference level, we examined past ethics policies at the top-four conferences and conducted in-depth semistructured interviews with senior and junior (n=20) community members, including some (former) chairs of program and research ethics committees. In these, we explored reasons for and goals of ethics procedures and discussed existing ethics interventions as well as possible new approaches proposed by our team. While the community appears to be evolving toward the identified goals, i.e., raising ethical awareness and preventing the publication of unethical work, we identified the lack of ethical education within the community itself as a major obstacle to further progress on this matter. Ethical education is often passed to the universities. Interviewees also mentioned challenges with the complexity of ethics policies and the lack of consistency across different conferences, as well as policies changing year-to-year. Several participants warned that over-regulation may lead to backlash, encouraging mere compliance, such as people turning to LLMs for ethics sections rather than undertaking in-depth consideration. In response, we suggest a coordinated, community-wide ethics steering.

Authors: Calmbach, Anna, CISPA Helmholtz Center for Information Security; Guthoff, Carolyn, CISPA Helmholtz Center for Information Security; Fassl, Matthias, The George Washington University; Krombholz, Katharina, CISPA Helmholtz Center for Information Security

Young adults increasingly seek intimacy and express their sexuality online. At the same time, harmful experiences such as image-based sexual abuse are also on the rise. To counter this, Meta has introduced safety tools for Instagram Direct Messages in early 2024 that blur intimate images and display informational pop-ups when receiving, sending, or forwarding them. While these safety measures exist, we do not know how they are received and if they support users' intuitive threat evaluation. We conducted qualitative, scenario-based interviews with 17 participants aged 18 to 21 to identify detection factors for threat assessment and gather insights into users' perceptions of these safety tools. We present the identified detection factors and suggest how this information can be used to contextualize future safety measures and guide users during risk assessment. Grounded in participant feedback, we argue for providing adequate user agency without offloading responsibility, and for greater reliability and transparency of safety tools.

Authors: Cebere, Bogdan, CISPA Helmholtz Center for Information Security; Kumar, Prateek, CISPA Helmholtz Center for Information Security; Chatel, Sylvain, CISPA Helmholtz Center for Information Security; Lueks, Wouter, CISPA Helmholtz Center for Information Security; Rossow, Christian, CISPA Helmholtz Center for Information Security

Website fingerprinting (WF) attacks can infer which webpage a user visits from encrypted HTTPS traffic alone, compromising privacy even without decryption. WF defenses commonly shape traffic through noise, padding, delays, or flow splitting, yet they are most often studied from the perspective of encapsulating protocols like Tor or VPN rather than at the application layer (HTTP).

In this work, we focus on application-layer defenses enabled by the most widely deployed version of HTTP, HTTP/2. We demonstrate how known defenses can be emulated through HTTP/2 features at the client side (HTTPOS, LLaMA, FRONT, Tamaraw) and the server side (ALPaCA, Tamaraw). We further show that HTTP/2 features, such as proactive resource suggestion, multiplexing, and flow control, offer untapped potential for lightweight yet effective defenses deployable at both endpoints.

We evaluate these defenses using a unified blueprint that calibrates defense parameters per dataset, then combines practical attacks, information-theoretic leakage estimates, and overhead measurements. For each defense, this framework identifies the strongest hyperparameter-tuned fingerprinting model and estimates the residual uncertainty induced by the defense using two information-theoretic leakage estimators, all while accounting for the defense's privacy-overhead trade-offs.

Authors: Lyu, Zhuoer, Arizona State University; Bitaab, Marzieh, Amazon; Huang, Shuyi, Arizona State University; Karimi, Alireza, Arizona State University; Robertson, William, Arizona State University; Yu, Zeming, Arizona State University; Schloegel, Moritz, CISPA Helmholtz Center for Information Security; Shoshitaishvili, Yan, Arizona State University; Ahn, Gail-Joon, Arizona State University; Soneji, Ananta, University of Nebraska at Omaha; Wang, Ruoyu, Arizona State University; Doupé, Adam, Arizona State University; Bao, Tiffany, Arizona State University

Despite stricter regulations being gradually enforced in telecommunications, potentially unwanted calls (PUCs), including telemarketing and vishing, remain a persistent and evolving threat. However, understanding how PUCs operate in practice has been limited by the lack of real-world datasets with rich conversational content, hindering the development of effective defenses. To fill this gap, we developed an LLM-based phone call honeypot for collecting realworld PUCs, to our knowledge among the first systems to collect such data in the wild. Based on the development, we conducted thematic analysis on 115 hours of conversations collected over 20 months, where we understand how PUCs operate in practice by studying the conversational structure, content, and campaign operations. Our analysis reveals that PUC conversations are highly structured across diverse call topics. We identify a widespread early-call pattern, which we term the hook phase, that callers use to engage and prescreen targets before eliciting sensitive information. Within this phase, we identify an emerging entity, call-to-interaction robocalls. Unlike call-to-action robocalls, which rely on prerecorded audio, call-to-interaction robocalls sustain engagement through interactive questioning, more closely resembling human agents. Beyond the hook phase, we find that malicious callers progressively escalate the sensitivity of personal information over the course of conversations while using persuasion techniques to establish authority and rapport. Our longitudinal analysis further identifies eight major topics that remain present throughout the nearly two year study period (e.g., Medicare), along with major campaigns that stay active over time, suggesting that PUC operations are durable and underscoring the need for stronger interventions against them.

Authors: Zhang, Xuenan, CISPA Helmholtz Center for Information Security; Yang, Yuqing, CISPA Helmholtz Center for Information Security; Pellegrino, Giancarlo, CISPA Helmholtz Center for Information Security

Web measurement studies rely on domain datasets such as Tranco to quantify the prevalence and impact of security issues at scale, but exhaustively analyzing these datasets is often infeasible because of the cost of advanced analysis techniques, requiring the use of sampling. Despite its widespread use, sampling remains largely guided by convention– most commonly Top N domain selection – rather than evidence, and its influence on the validity and generalizability of security findings has received little systematic evaluation. Consequently, it remains unclear whether common sampling strategies introduce systematic bias, distort observed vulnerability rates, or limit comparability across studies. In this work, we undertake, to the best of our knowledge, the first comprehensive investigation into how sampling methodologies affect the measurements and the conclusions. Through a comprehensive literature review and large-scale measurements of 500k Tranco and 24.8M Common Crawl hosts, we perform a comparative evaluation of datasets and sampling strategies. We show that, while Top N sampling may be a rational strategy, the researchers have to bear in mind that Top N does not reflect the overall distribution of the web. Instead, probability-based strategies yield stable, unbiased estimates for prevalence and many impact objectives. Hybrid sampling provides no advantages over pure probability sampling, as its deterministic prefix consistently contributes negatively to accuracy. Building on these results, we provide data-backed guidance for future studies, proposing to use an adaptive probability-based sampling strategy that remains effective even when the prevalence of the target issue is unknown.