To authors: Both regular and dataset/tool paper presentations are 20 minutes in total (including 5 minutes Q&A).

June 23 - June 24 - June 25


June 23


Welcome

8:40-9:00

Keynote 1

9:00-10:00

Preneel

30+ Years of Malicious Cryptography

Moti Yung, Google and Columbia University

Abstract

Cryptography has been used both, historically and in modern times, as a tool to protect and authenticate information: encryption of messages and storage, and protecting information in usage as well. For the last 30+ years, the notion of Malicious Cryptography has been developed and evolved. The idea behind the notion is that when a cryptographic system is implemented in a larger system, then it can be repurposed to perform tasks beyond its specified goals. Repurposing means that the system’s goal as specified, and algorithms as designed to adhere to the specification, change covertly to achieve extended goals, originally involving service of malicious activity. The notion and various subareas of malicious cryptography, call for revision of the relationships of model and specifications of cryptographic systems on the one hand, and their implementations and proof of correctness and security, on the other hand.


Short Bio

Moti Yung is a Distinguished Research Scientist with Google, and a Senior Adjunct Research Faculty Member in the Computer Science Department at Columbia University. He received his PhD from Columbia University in 1988. Previously, he worked at IBM Research, CertCo/Bankers Trust, RSA Laboratories (EMC), and Snap. He is a Fellow of IEEE, ACM, IACR, and EATCS, and his research interests focus on security, privacy, and cryptography.

Coffee Break

10:00-10:20

Session 1: Access Control

10:20-11:40

Mining for the Minimum Number of Roles from Hard Inputs
Puneet Gill (University of Waterloo), Mahesh Tripunitara (University of Waterloo).
Towards Securing Access Control in 5G and Beyond with Zero Trust
Sudip Maitra (Virginia Tech), Kenechukwu Nwodo (Virginia Tech), Tolga Atalay (A2 Labs), Angelos Stavrou (Virginia Tech, A2 Labs), Haining Wang (Virginia Tech).
From See to Shield: ML-Assisted Fine-Grained Access Control for Visual Data
Mete Harun Akcay (Nokia Bell Labs & Åbo University), Buse Gul Atli (Linköping University & Nokia Bell Labs), Siddharth Prakash Rao (Nokia Bell Labs), Alexandros Bakas (Nokia Bell Labs).
Active Learning of Negative Relationship-Based Authorizations
Ferhat Demirkiran (University at Albany), Amir Masoumzadeh (University at Albany - SUNY).

Lunch Break

11:40-13:00

Session 2: Privacy-Preserving Techniques

13:00-14:20

Explainability-Driven Image Anonymization in Latent Space (EDIALS)
Younas Khan (University of Rovira i Virgili), Anna Monreale (University of Pisa), Carlo Metta (University of Pisa), David Sanchez (University of Rovira i Virgili), Josep Domingo-Ferrer (University of Rovira i Virgili).
MoE-T: Dependency Graph-Gated Mixture of Experts for Tabular Generation with Functional Dependency
Mary Dhooghe (University of Texas at Dallas), Murat Kantarcioglu (Virginia Tech), Bhavani Thuraisingham (University of Texas at Dallas).
Secure Sparse Matrix Multiplications and their Applications to Privacy-Preserving Machine Learning
Marc Damie (University of Twente), Florian Hahn (University of Twente), Andreas Peter (Carl von Ossietzky Universität Oldenburg), Jan Ramon (Inria).
Hidden Elo: Private Matchmaking through Encrypted Rating Systems
Mindaugas Budzys (Tampere University), Bin Liu (Tampere University), Antonis Michalas (Tampere University).

Coffee Break

14:20-14:40

Session 3: (In)secure Software

14:40-16:00

VRSafe: A Secure Virtual Keyboard to Mitigate Keystroke Inference in Virtual Reality
Yijun Yuan (University of Pittsburgh), Na Du (University of Pittsburgh), Adam J. Lee (University of Pittsburgh), Balaji Palanisamy (University of Pittsburgh).
Demystifying LLM API Misuses: A Lifecycle-Based Empirical Study on Real-world Android Apps
Jinghang Wen (City University of Hong Kong), Qingchuan Zhao (City University of Hong Kong).
Infrastructure as Compromise: Abusing Residual Trust in Infrastructure as Code Tools
Ruining Yang (Stony Brook University), Narong Chaiwut (Stony Brook University), Nick Nikiforakis (Stony Brook University).
VSMEx: A Collection Tool and a Dataset of Malicious VS Code Extensions
Kotaiba Alachkar (TU Delft), Dirk Gaastra (Independent Researcher), Olga Gadyatskaya (Leiden University), Eduardo Barbaro (TU Delft), Michel Van Eeten (TU Delft), Yury Zhauniarovich (TU Delft).

Poster session

16:00-17:00

June 24


Keynote 2

9:00-10:00

Paola Inverardi

The Ethical Dimension of Privacy in the Digital Space

Paola Inverardi, Gran Sasso Science Institute

Abstract

The world we inhabit is increasingly shaped and structured by digital technologies that act autonomously, both on our behalf and to fulfill our needs. This transformation raises profound ethical concerns about the potential impact of interactions between humans and autonomous systems on the values underpinning our societies. Over the past decades, the implications of digital technologies for privacy have been widely examined from both technical and regulatory perspectives. Yet privacy, unlike security, is fundamentally an ethical notion: it concerns the individual's right to retain meaningful control over personal information. This perspective calls for a shift in how we design and deploy technology towards systems that actively empower individuals to protect and manage their privacy in digital environments. In this talk, I will discuss selected technologies and approaches that embody this vision, highlighting the key research directions and technical challenges involved in developing privacy-preserving solutions that place individuals at the center.


Short Bio

Paola Inverardi is Rector of Gran Sasso Science Institute since September 2022. Before she was a professor of Computer Science and rector at the University of L’Aquila. Paola Inverardi's research focuses on software architectures, mobile applications, and adaptive and autonomous systems. Currently, her research focuses on the ethics of autonomous systems, with a particular emphasis on their interactions with society and human beings. Inverardi served on the editorial boards of IEEE, ACM, Springer and Elsevier Journals. She has served as general or program chair of leading software engineering conferences (e.g., ASE, ICSE, ESEC/FSE) and as chair of the ICSE and ESEC Steering Committees. She has received honorary doctorates from Mälardalen University in Sweden and Shibaura Institute of Technology in Tokyo, Japan. She is an ACM Fellow and has received the 2013 IEEE TCSE Distinguished Service Award.

Coffee Break

10:00-10:20

Session 4: Security in the Era of AI

10:20-11:40

Measuring the Robustness of Audio Deepfake Detection under Real-World Corruption
Xiang Li (Fordham University), Pin-Yu Chen (IBM Research), Wenqi Wei (Fordham University).
SecRL-Prune: Structured Reinforcement Learning–Based Pruning of CodeLLMs for Preserving Adversarial Code Mutation
Parsa Memarzadehsaghezi (Ontario Tech University), Pooria Madani (Ontario Tech University), Khalil El-Khatib (Ontario Tech University).
An Evolutionary Black-Box Framework for Adversarial Prompt Generation in Large Language Models
Qiyang Sun (University of Southampton), Erisa Karafili (University of Southampton).
Optimus: A Robust Defense Framework for Mitigating Toxicity while Fine-Tuning Conversational AI
Aravind Cheruvu (Virginia Tech), Shravya Kanchi (Virginia Tech), Sifat Muhammad Abdullah (Virginia Tech), Nicholas Ka-Shing Kong (Virginia Tech), Daphne Yao (Virginia Tech), Murtuza Jadliwala (The University of Texas at San Antonio), Bimal Viswanath (Virginia Tech).

Lunch Break

11:40-13:00

Session 5: Data Privacy

13:00-14:20

Local Privacy Laws in a Globalized World
Shantanu Sharma (New Jersey Institute of Technology), Ethan Myers (Colorado State University), Lorenzo De Carli (University of Calgary), Ritwik Banerjee (Stony Brooks University), Indrakshi Ray (Colorado State University).
Leaky Apps: Targeted Deanonymization on Mobile Phones
Robert Blacha (New Jersey Institute of Technology), Yossi Oren (Ben-Gurion University of the Negev), Reza Curtmola (New Jersey Institute of Technology).
Does Anonymity Love the Chat Groups?
Marc Roßberger (University of Regensburg), Dogan Kesdogan (University of Regensburg).
Post-Processing for Utility Improvement under Personalized Local Differential Privacy
Cagdas Parlak (Boğaziçi University), Dicle Ceylan (Yıldız Technical University), Berkay Kemal Balioglu (Koç University), Alireza Khodaie (Koç University), Emre Gursoy (Koç University).

Coffee Break

14:20-14:40

Session 6: Software Security

14:40-16:00

Practical Type Inference: High-Throughput Recovery of Real-World Structures and Function Signatures
Lukas Seidel (Binarly, Inc. & TU Berlin), Sam Thomas (Binarly, Inc.), Konrad Rieck (TU Berlin & BIFOLD).
A Reality Check on SBOM-based Vulnerability Management: An Empirical Study and A Path Forward
Li Zhou (KAUST), Marc Dacier (KAUST), Charalambos Konstantinou (KAUST).
BinType: Type based Indirect Call Target Refinement on Binary Programs
Sun Hyoung Kim (Rebellions Inc), Dongrui Zeng (Palo Alto Networks, Inc.), Monika Santra (The Pennsylvania State University), Gang Tan (The Pennsylvania State University).
How Practitioners Assess Software System Security
Arina Kudriavtseva (Leiden University), Olga Gadyatskaya (Leiden University).

Panel (TBD)

16:00-17:00

June 25


Session 7: AI for Security

9:00-10:20

Security Barriers to Trustworthy AI-Driven Cyber Threat Intelligence in Finance: Evidence from Practitioners
Emir Karaosman (University of Liechtenstein), Advije Rizvani (University of Liechtenstein), Irdin Pekaric (University of Liechtenstein).
A Modular HRL Agent for Automated Pentesting with Specialized Policies: A Maritime use case
Marc-Antoine Faillon (Polytechnique Montreal), Julien Francq (Naval Group, Naval Cyber Laboratory, 199 Av. Pierre-Gilles de Gennes, 83190 Ollioules France), Nora Boulahia-Cuppens (Polytechnique Montreal), Frédéric Cuppens (Polytechnique Montreal), Reda Yaich (IRT SystemX).
KnitFuzz: LLM-guided Kernel Fuzzing via Context-Sensitive Socket System Calls
Siwei Zhang (Syracuse University), Endadul Hoque (Syracuse University).
AUTOMal: An LLM-Based Automated Feature Engineering Framework for Efficient Malware Detection at the Edge
Nguyen Khanh Son (University of Insubria), Christian Rondanini (University of Insubria), Barbara Carminati (University of Insubria), Elena Ferrari (University of Insubria).

Coffee Break

10:20-10:40

Session 8: Web Security

10:40-11:40

Formal Verification of Peer-Assisted FIDO2 Passkey Recovery Protocol with Tamarin
Murat Sekmen (Istanbul Technical University), Kemal Bicakci (Istanbul Technical University).
DeCerts: Secure and Fine-grained CDN Delegation
Ethan Thompson (Carleton University), Ali Sadeghi Jahromi (Carleton University), AbdelRahman Abdou (Carleton University).
A Comparative Analysis of Third-Party Script Behaviour in Consent-Based and Implicit Web Tracking
Chongwen Ma (University of Nottingham Ningbo China), Yuan Cheng (University of Nottingham Ningbo China).

Closing Remarks

11:40-11:50