In brief

  • TEE-shielded LLMs: Unilateral weight obfuscation is found to be insecure, with attacks recovering model functionality.
  • Reverse engineering with LLMs: LLMs are evaluated on reconstructing protobuf schemas for iOS location services, showing they are unreliable analysts but useful toolmakers.
  • LLM agent failures: Human interventions are used as labels to localize and steer computations behind LLM agent failures.

BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

  • Analyzes the security of unilateral weight obfuscation in TEE-shielded LLM partition.

  • Demonstrates that attacks on GroupCover and ArrowCloak can elevate attack accuracy to the black-box baseline, effectively recovering model functionality.

  • Proposes BiShield-TEE, which confines attack accuracy to the black-box level.

  • Notes that the parameter reconstruction stage of the attack is query-free, relying solely on obfuscated weights.

  • Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang, Zhu Zhang, Zhixing Tan, Yongheng Deng. “BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition.” arXiv — https://arxiv.org/abs/2610.21565

Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker

  • Evaluates using frontier models (Claude Opus 4.8, Codex GPT Sol 5.6) to reconstruct schemas of protobufs sent by iPhones to Apple’s location services.

  • Uses rooted phones and a man-in-the-middle attack to intercept and decrypt HTTPS traffic.

  • Finds that the great majority of the schemas generated by LLMs contain substantial errors that are hard to detect.

  • Observes that in 413 disagreements in which the LLM gives a type, Extractor is found to be correct.

  • Douglas Leith. “Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker.” arXiv — https://arxiv.org/abs/2610.21597

Human Interventions as Labels: Localizing, Steering, and (Sometimes) Editing the Computations Behind LLM Agent Failures

  • Treats human intervention in misbehaving LLM agents as a measurement pointing at the internal computation that failed.

  • Studies a controlled agent environment where the agent asks a clarifying question when the request was already unambiguous.

  • Finds that the models studied ask a question when the context already answered it on 82–93% of unambiguous requests.

  • Discovers that the site’s location of the failure varies widely across network depth (55–81%), but its existence and the sharpness of its onset do not.

  • Cesare Zavattari, Alessandro Tommasi, Giuseppe Prencipe. “Human Interventions as Labels: Localizing, Steering, and (Sometimes) Editing the Computations Behind LLM Agent Failures.” arXiv — https://arxiv.org/abs/2610.21708

Learning to Steer LLM Agents and Multi-Agent Systems

  • Proposes a steering agent that supervises execution on the fly and steers LLM-based multi-agent systems back on track when goal drift occurs.

  • Addresses the problem of systems deviating from the overall goal during long-horizon tool use and inter-agent collaboration.

  • Shows that the steering interface can achieve different steering granularities depending on the observation and action spaces.

  • Leyang Shen, Yaxin Gong, Yang Zhang, Chenxiao Fan, Jiakai Wang, Dong Wang, Yang Liu, Fuli Feng, Chun Kai Ling, Tat-Seng Chua. “Learning to Steer LLM Agents and Multi-Agent Systems.” arXiv — https://arxiv.org/abs/2610.22316

Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware

  • Establishes at source-code level where forensically relevant data reside on the microSD card of a HackRF One running Mayhem v2.0.1.

  • Notes that a single piece of hardware can work as both a receiver and a transmitter over a wide frequency range.

  • Identifies that unallocated clusters are not a directory but the area that the file system marks as free and in which deleted data may be found.

  • Duzgun Kucuk. “Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware.” arXiv — https://arxiv.org/abs/2610.20647

Also published

  • Miaobo Hu, Shuhao Hu, Xiaobo Guo, Xin Wang, Bokun Wang, Daren Zha, Jun Xiao. “CascadeLedger: Counterfactual Auditing of Information and Resource Integrity in LLM Cascades.” arXiv — https://arxiv.org/abs/2610.20668
  • Thuy Dung Nguyen, Jingyi Guo, Rana Seda Dubauskas, Sreepriya Damuluru, Taylor T. Johnson, Kevin Leach. “INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems.” arXiv — https://arxiv.org/abs/2610.20776
  • Joas Antonio dos Santos Barbosa. “Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents.” arXiv — https://arxiv.org/abs/2610.20902
  • Harsh Aaryan, Ce Zhou. “Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks.” arXiv — https://arxiv.org/abs/2610.21034
  • Jianchang Su, Dawei Xiang, Yifan Zhang, Wei Zhang. “Stronger Judges Do Not See More: Deployment-Integrity Blindness in LLM Evaluation.” arXiv — https://arxiv.org/abs/2610.21135