Pruning is a common deployment step for deep neural networks, reducing model size and inference cost. Recent work has shown, however, that pruning can introduce a new security risk: pruning-conditional backdoors (PCBs). In this setting, a compromised dense model appears benign before pruning, including on trigger-bearing inputs, but the hidden backdoor becomes active after pruning. As a result, the backdoored model can pass pre-deployment inspection, since conventional defenses may fail to detect this dormant malicious behavior.

In this thesis, we investigate PCBs and show that they exploit a behavioral gap between the dense model and its pruned counterpart. Based on this insight, we propose SNIP (Safe Network Inference after Pruning), a pruning-aware mitigation method against PCBs. SNIP uses a small clean calibration set and the intended pruning configuration to align post-pruning behavior with the benign pre-pruning predictions of the dense model. The repair is performed through a two-stage procedure that combines clean-label supervision with pruning-aware self-distillation.

Experiments across multiple image-classification datasets and convolutional architectures show that SNIP achieves a stronger security–utility trade-off than representative existing backdoor mitigation defenses, reducing attack success rate by 94.98 percentage points with a 5.56 percentage-point decrease in clean accuracy at a 30% pruning ratio. These results highlight the need to consider deployment transformations that may activate dormant malicious behavior when designing backdoor defenses. ... Read more

Multi-step attacks pose a significant challenge for intrusion detection systems due to their temporal structure and the dependencies between individual attack steps. Detecting such attacks during their early stages is particularly important, as it enables defenders to intervene before an attack reaches its final objective.

This thesis presents a neuro-symbolic framework for real-time multi-step attack detection based on DeepProbLog. The proposed approach combines neural attack-step classification with symbolic temporal reasoning, integrating knowledge of attack progression directly into the learning and inference process. By enforcing temporal constraints, the system aims to improve both attack-step detection and the consistency of predicted attack progressions.

The proposed approach is evaluated on two multi-step attack datasets: DARPA 2000 and AIT-LDS V2. Experimental results show that incorporating symbolic knowledge consistently improves detection performance compared to neural and symbolic baselines. In particular, the neuro-symbolic models achieve higher macro F1-scores, lower false alarm rates, and more temporally consistent predictions. The results further indicate that symbolic constraints improve data efficiency and generalization while maintaining low inference latency.

Overall, this thesis demonstrates that integrating symbolic knowledge of attack progression into neural intrusion detection models provides an effective framework for multi-step attack detection, supporting accurate and timely identification of attacks across multiple stages. ... Read more

Vulnerability prioritization in financial infrastructure depends on both public vulnerability signals and organization-specific context, such as affected assets, ownership, exposure, compliance status, and remediation constraints. Generic LLM-based systems can help analysts summarize and explain such information, but their direct use in regulated security workflows raises concerns about grounding, traceability, reliability, and control.

This thesis designs and evaluates a context-aware orchestration framework for LLM-supported vulnerability prioritization. The framework separates deterministic enterprise-data retrieval from LLM-based synthesis. For each analyst query, predefined workflows retrieve and join relevant vulnerability, asset, ownership, exposure, and compliance records, prune unnecessary metadata, and validate the generated output before presenting it as analyst-facing decision support.

The framework was evaluated against an autonomous-agent baseline in a controlled offline proof-of-concept environment using an approved static production-derived CSV snapshot from selected operational security systems. The benchmark covered 14 questions across three vulnerability-management use cases: contextual asset triage, risk justification, and remediation guidance. The parametric framework achieved a mean weighted accuracy of 98.4%, compared with 90.0% for the autonomous baseline, with the largest difference in contextual asset triage. It also consumed fewer tokens and showed less degradation under stochastic workflow noise.

The results suggest that constrained, context-aware orchestration can improve grounding, traceability, robustness, and operational efficiency for structured vulnerability-prioritization tasks. The findings should be interpreted as proof-of-concept evidence for the selected benchmark, not as evidence of production-scale deployment performance.
... Read more

Secure group communication must balance cryptographic security with the efficiency required for large-scale deployments. Current secure group communication protocols exist on two extremes of a server/trust spectrum. On the one hand, the IETF's MLS (Messaging Layer Security) protocol views servers as untrusted relays providing end-to-end security at a price of O(log n) update costs. On the other hand, Telegram's MTProto views servers as trusted entities which manage all client keys resulting in O(1) sender side complexity and loss of many security guarentees. However, the design space between these extreme server trust positions remains undefined.

This thesis fills that gap by defining five distinct server trust levels. Zero Trust, Structural Trust, Aggregation Trust, Partial Key Trust, and Full Trust. We construct a Tamarin Prover model for each. Across the models, security lemmas covering group key secrecy, forward secrecy, post-compromise security, state agreement, and message authentication are proved or disproved. The finding is that state agreement is the first property to fail as server authority increases. A malicious server at our Level 3 can silently partition the group without violating message secrecy, and members have no means of detecting this inconsistency. Thus, we also devise a commitment-hardened variant of Level 3. It restores state agreement by detecting the attack at the cost of one transcript hash per commit.

The results are complemented by a simulation quantifying bandwidth and message complexity across group sizes of up to 128 members. The simulation additionally confirms that the Level 2 filtering optimisation reduces update bandwidth by up to 3.6x relative to Level 1 at no security cost, and that Level 3 aggregation reduces catch-up bandwidth by approximately 88% relative to Level 2 with 20 missed epochs. Together, the formal verification and simulation provide a principled structure for visualizing the security efficiency trade off as server authority grows, and offer design guidance for practitioners. ... Read more

Quantum attacks threaten the public-key cryptography that underpins modern distributed systems, including permissioned blockchains. This thesis investigates the practicality of post-quantum cryptography (PQC) in enterprise settings by integrating CRYSTALS-Kyber (Key Encapsulation Mechanism) and CRYSTALS-Dilithium (digital signatures) into a Fabric-based banking application. A protocol is designed for account creation and authenticated transactions where clients register with a Kyber public key, and the server encapsulates a shared secret used to authenticate the transactions. All balance, deposit, withdrawal, and transfer messages are signed with Dilithium and verified. The implementation comprises server, client, and chaincode components, integrated via Fabric Private Chaincode (FPC), and performance is evaluated against an RSA baseline in terms of key, ciphertext, and signature sizes.

The evaluation demonstrates that PQC integration is feasible with modest overheads. The replacement from RSA to Dilithium for transaction authentication and Kyber for key establishment performs better in most situations and maintains system throughput within operational bounds. Predictable trade-offs are observed between larger key and signature artifacts and reduced verification complexity. Message sizes for each cryptographic stage (key generation, encapsulation/decapsulation, signature/verification) are quantified. The system resists chosen-ciphertext and chosen-message attacks under the Module-LWE/SIS assumptions and achieves strong unforgeability for application messages.

This work provides an end-to-end blueprint covering APIs, message formats, chaincode logic, and deployment scripts for migrating Fabric-style ledgers to post-quantum security and ideas to improve upon the work in the future. ... Read more

MEGA is a popular cloud storage provider in both commercial and consumer markets [2][1]. MEGA claims to provide secure storage, in a threat model where even the storage provider should be unable to tamper with a user’s data undetected [5]. Previous work by Backendal et. al., as well as other follow-up research works, discovered several attacks that an adversarial storage provider could perform to covertly read and write a user’s storage [7]. MEGA’s patches to the attacks solve the initial attacks that allow for the attack chain to take place, but did not solve the fundamental problems in the security architecture that enabled these attacks [6]. This work provides 5 attacks on user’s contact relationships and folder sharing, that even after the patches, allow for an adversarial storage provider to manipulate a user’s contact list, and forge data in their secure storage. ... Read more

The development of quantum computing poses a significant threat to currently deployed cryptographic primitives. To address this challenge, we design and implement a system to communicate and store data using post-quantum secure algorithms for a distributed blockchain environment. Specifically, we combine the Crystal-Dilithium digital signature scheme and an Updatable Encryption scheme based on the Learning With Errors problem in the context of a Hyperledger Fabric network. The Crystal-Dilithium scheme ensures authenticity and integrity of transmitted data, while the Updatable Encryption scheme provides confidentiality and integrity to transmitted data as well as allowing key rotation and ciphertext updates without requiring data re-encryption from scratch. An end-to-end prototype of the system is developed, including client-side modules, a Hyperledger Fabric gateway and smart contract modules that can be deployed on a Hyperledger Fabric network, with all components implemented in Python and Golang. The system is evaluated through functional integration tests and performance benchmarks. Results demonstrate that the Crystal-Dilithium scheme achieve sub-second execution for key generation, signing, and verification for multiple different parameter sets. For the Updatable Encryption scheme, encryption, decryption, and ciphertext updates exhibit linear scalability in time complexity with respect to the size and dimensions of input parameters, while token generation emerges as the most computationally demanding step in the algorithm. Additional experiments highlight the practical limits of repeated key rotations due to accumulated error growth. ... Read more

This work addresses the challenge of performing expressive, multi-dimensional range queries directly over encrypted data while balancing query efficiency against privacy leakage. Existing searchable encryption and encrypted multi-map (EMM) schemes either reveal access or volume patterns or incur substantial overhead by fully hiding all leakage (e.g. via ORAM) making them unpractical. Building on the static, multi-dimensional EMM framework of Falzon et al., we introduce a family of five EMM variants that provide tunable leakage profiles, spanning from full access- and volume-pattern exposure to near-complete concealment through adaptive padding and dummy-access techniques. The empirical evaluation of our
five EMM variants reveals a clear, quantifiable spectrum of privacy-performance trade-offs. On large-range workloads, the access-hiding schemes offer the best overall balance, with measured average latency slopes of ≈ 0.012 ms/label. For workloads dominated by small result sets, a volume hiding scheme excels, achieving an even lower slope of 0.0032 ms/label by tuning its padding to realistic occupancy bounds. In contrast, fully padded schemes like incur substantially higher overheads, up to two orders of magnitude greater, making them suitable only when maximal leakage resilience is required. These results allow cloud providers with quantitative guidance to deploy encrypted range search that meets both privacy requirements and performance expectations in real-world, multi-attribute database services. ... Read more

Searchable Encryption (SE) has shown a lot of promise towards enabling secure and efficient queries over encrypted data. In order to achieve this efficiency, SE inevitably leaks some information, and a big open question is how dangerous this leakage is. While prior reconstruction attacks have demonstrated effectiveness in one-dimensional settings, extending them to high-dimensional datasets remains challenging. Existing methods either demand excessive query information (e.g. an attacker that has observed all possible responses) or produce low-quality reconstructions in sparse databases.
In this work, we present REMIN, a new leakage-abuse attack against SE schemes in multi-dimensional settings, based on access and search pattern leakage from range queries. Our approach leverages unsupervised representation learning to transform query co-occurrence frequencies into geometric signals, allowing the attacker to infer relative spatial relationships between records. This enables accurate and scalable reconstruction of high-dimensional datasets under minimal leakage. Furthermore, we introduce REMIN-P, a practical variant of the attack that incorporates a poisoning strategy. By injecting a small number of auxiliary anchor points—either known or intentionally leaked—REMIN-P significantly improves reconstruction quality, particularly in sparse or boundary regions.
We evaluate our attacks extensively on both synthetic and real-world structured datasets. Compared to state-of-the-art reconstruction attacks, our reconstruction attack achieves up to 50% reduction in mean squared error (MSE), all while maintaining fast and scalable runtime. When the poisoning strategy is chosen properly, our poisoning attack further reduces MSE by an additional 50% on average. To the best of our knowledge, these are the first attacks that enables accurate multi-dimensional reconstruction under low-leakage conditions for any type of database. ... Read more

Blockchain technology has significantly impacted digital transactions and data management by providing a decentralized, transparent, and immutable ledger. Private blockchains, unlike public blockchains, are restricted to a pre-selected group of participants, making them more suitable for controlled environments such as enterprises, governments, or academic institutions. Hyperledger Fabric (HLF) is a widely used framework for private blockchain technology, designed for enterprise use.

With quantum computers on the rise, commonly used cryptographic algorithms are increasingly at risk of becoming obsolete. Blockchain networks rely extensively on these primitives, making them particularly vulnerable to advances in quantum computing. To counter this vulnerability, post-quantum algorithms have gained popularity within the cryptographic community.

This thesis focuses on securing private blockchains built on HLF against potential quantum adversaries using post-quantum cryptographic primitives. We implement ML-DSA, Vesper, and TDUE as smart contracts for digital signing, zero-knowledge proofs, and updatable encryption, respectively, and report on their performance. Furthermore, we build on top of Fabric Private Chaincode to maintain the confidentiality of the contract application state. While overall performance is not yet competitive with classical cryptographic primitives, our findings indicate that post-quantum primitives have promising potential for use in private blockchains. ... Read more

Neural Networks have become standard solutions in many real-life relevant applications, such as healthcare. Yet, their vulnerability to backdoor attacks is a concern. These attacks modify a small portion of the data or the model to insert hidden triggered behaviors. Neuro-symbolic (NeSy) models, which integrate neural networks with symbolic reasoning, have been proposed as more robust and explainable AI models. However, their resilience against backdoor attacks has not been examined. This research investigates the robustness of Logic Tensor Networks (LTNs), representative NeSy models, against BadNet attacks, a simple and stealthy class of data poisoning backdoor attacks. Through empirical evaluations, we analyze how LTNs are affected by a bigger focus on symbolic reasoning and in different settings of an LTN model and BadNet attack, we measure the attack success rate (ASR). Our findings aim to provide a first insight into the vulnerability of NeSy systems to backdoor attacks. ... Read more

Neuro-Symbolic (NeSy) models combine the generalization ability of neural networks with the interpretability of symbolic reasoning. While the vulnerability of neural networks to backdoor data poisoning attacks is well-documented, their implications for NeSy models remain underexplored. This paper investigates whether adding a semantic loss component to a neural network improves its robustness against BadNets backdoor attacks. We evaluate multiple semantic loss models trained on the CelebA dataset with varying constraints, semantic loss weights, and backdoor trigger configurations. Our results show that incorporating a semantic loss model with constraints that involve the target label significantly reduces the attack success rate. Additionally, we found that increasing the weight of the semantic loss component can enhance robustness, although at the cost of balanced accuracy. Interestingly, changes in the size and placement of the trigger had minimal effect on attack performance. These findings suggest that while semantic loss can improve robustness to some extent, its effectiveness is highly dependent on the nature and relevance of the constraints used as well as on the weight assigned to the semantic loss component. ... Read more

The growing reliance on Artificial Intelligence (AI) systems increases the need for their understandability and explainability. As a reaction, Neuro-Symbolic (NeSy) models have been introduced to separate neural classification from symbolic logic. Traditional deep learning models are known to be susceptible to data
poisoning adversarial attacks, such as data poisoning. However, the impact of these attacks on NeSy models remains under-explored. Most work on the subject records the attack effects by measuring Attack Success Rate (ASR) or Benign Accuracy (BA). Because of the separate neural and symbolic components within NeSy models, a backdoor attack can specifically target the models’ reasoning capabilities. The knowledge of how potential reasoning is affected by such a model after an attack is unavailable. This research delves into how BadNets backdoor attacks influence the reasoning of the DeepProbLog (DPL) Neuro-Symbolic (NeSy) framework.

This study employed a novel, generalisable benchmarking suite to quantify the upper bound of the Reasoning Shortcut Risk for various tasks. Experiments were conducted across multiple model instances to perform a comparative review of the Reasoning Shortcut Risk between these settings.

The findings reveal that BadNets attacks generally increase the upper bound of the Reasoning Shortcut Risk in DPL models. This means that the existence of this backdoor in such a model can be identified based on this metric. Additionally, it was discovered that even model hyperparameter tuning on the DPL model itself can increase the Reasoning Shortcut Risk. This suggests that optimisation for higher accuracies may inadvertently lead these models to exploit new reasoning shortcuts. No significant correlation was observed between the accuracy of the DPL model and its upper bound of Reasoning Shortcut Risk. The results indicate that default metrics fail to define whether a DPL model behaves as desired. DPL models can appear functionally correct while internally suffering from faulty reasoning.

This research found a higher upper bound for the Reasoning Shortcut Risk after a BadNets attack for tasks that rely more on the neural component of the DPL NeSy model. Furthermore, the research found that optimising poisoning parameters can influence the upper bound of the Reasoning Shortcut Risk. This highlights the importance of the threat model under analysis when researching reasoning in DPL NeSy models after applying a backdoor attack.

In conclusion, BadNets backdoor attacks fundamentally compromise the reasoning process in DPL NeSy models. This increase in Reasoning Shortcut Risk is often worsened by routine model optimisation. The research highlights the need for integrity metrics in addition to traditional performance indicators. These insights are vital for creating NeSy models that act according to why they are used, to be robust, trustworthy, and explainable. ... Read more

Backdoor attacks targeting Neural Networks face little to no resistance in achieving misclassifications thanks to an injected trigger. Neuro-symbolic architectures combine such networks with symbolic components to introduce semantic knowledge into purely connectionist designs. This paper aims to benchmark the robustness of such models against state-of-the-art backdoor attacks. In doing so it explores how semantic knowledge can be extracted from datasets and how various constraint sets fare against differing strength attacks. The paper concludes that building knowledge into the models can indeed induce robustness against adversarial poisoning attacks, but it also reflects on the conditions necessary for success. ... Read more

In this work, we propose a general solution to address the non-IID challenges that hinder many defense methods against backdoor attacks in federated learning. Backdoor attacks involve malicious clients attempting to poison the global model. While many defense methods effectively filter out these malicious clients using clustering techniques, their effectiveness diminishes when the federated learning process involves non-IID datasets. In such cases, clustering methods struggle to distinguish between benign and malicious clients due to the inherent variability in the clients' data distributions.
Our proposed solution leverages data generation to mitigate the non-IID nature of clients' local datasets. By generating synthetic data, the datasets become more IID, enabling defense methods to once again effectively counter backdoor attacks. Evaluations are carried out on standard datasets in the image classification fields, like MNIST and CIFAR-10. The results show that the data generation solution can effectively improve the performance of defense methods and filter out malicious clients again. Although the generated data samples may suffer from low quality and limited diversity due to constraints in training the generative adversarial networks (GANs), our approach demonstrates significant improvements in defending against backdoors. ... Read more

This thesis paper addresses the vulnerability of Deep Neural Networks (DNNs) to adversarial attacks. We introduce Multi-Scale Inpainting Defense (MSID), a novel adversarial purification method leveraging a pre-trained diffusion denoising probabilistic model (DDPM) for targeted perturbation removal. MSID employs a four-step process: (1) multi-scale superpixel segmentation, (2) occlusion sensitivity map generation at multiple scales to identify important regions for inference, (3) targeted inpainting using the DDPM, and (4) artifact removal using Variance Preservation Sampling. We investigate the effectiveness of diffusion-based inpainting for robust defense, the impact of multi-scale occlusion sensitivity mapping, and the robustness of MSID against a set of adversarial attacks, including color-based attacks. Our experiments demonstrate that MSID outperforms existing adversarial purification methods, achieving robustness improvements of up to 5.42% on CIFAR-10 and 10.75% on ImageNet against AutoAttack, with further gains against PGD and unseen attacks, while maintaining high standard accuracy. This paper, to the best of our knowledge, is the first to apply DDPM inpainting for targeted adversarial purification and demonstrates its effectiveness in purifying a range of adversarial attacks. ... Read more

This thesis investigates how reliably Large Language Model (LLM)-generated data can be used to train deep learning-based Intrusion Detection Systems (IDS) beyond traditional, real-traffic datasets. In the context of a small distributed environmental measurement application, application-layer sensor data (temperature, humidity, and particulate matter) and corresponding HTTP Network Traffic Telemetry (NTT) were collected over one week using Raspberry Pi measurement stations and Zeek. Two Long-Short-Term Memory (LSTM) models were trained: an Application Model (AM) for sensor anomalies and a Network Traffic Model (NTM) for network anomalies, combined in a voting-based IDS that outputs a trust score per source. Using a structured prompting strategy, a publicly available LLM was then employed to generate synthetic AM and NTT datasets. The similarity between real and synthetic data distributions was quantified using the Wasserstein distance, after which two experiment series were conducted: (1) progressively replacing real samples with synthetic ones while keeping training set size fixed, and (2) augmenting the real data with increasing fractions of synthetic samples. Results show that replacing more than roughly 10% of the AM training data degrades detection performance, whereas the NTM remains robust until real data is nearly fully replaced. In contrast, augmenting (rather than replacing) real data preserves, and in some cases modestly improves, IDS performance. Overall, the findings indicate that LLM-generated data can effectively complement—but not fully replace—real measurements when carefully integrated into IDS training pipelines. ... Read more

Neuro-Symbolic (NeSy) models promise better interpretability and robustness than conventional neural networks, yet their resilience to data poisoning backdoors is largely untested. This work investigates that gap by attacking a Logic Tensor Network (LTN) with clean-label triggers. Two attack strategies are benchmarked on MNIST addition and modulo tasks: (i) a targeted Projected Gradient Descent (PGD) variant that minimises the loss towards a target class, and (ii) a weighted pixel-blending (naïve) method. Furthermore, three trigger placements suited to the task (left, right, or both images), poison rates (0.5%-20%), and blend ratios (10%-90%) are benchmarked while reporting benign accuracy and attack-success rate (ASR). Results show that PGD can reach ≈ 15% ASR on the harder modulo task when both images are poisoned, but has negligible impact on the simpler addition task. Additionally, the naïve attack never exceeds 5% ASR unless the blend is large enough to be recognisable during visual inspection. Increasing the poison rate beyond 10% does not increase attack success rate. Overall, clean-label backdoors remain low-yield against LTNs, but even a modest ASR is a concern for safety-critical deployments. Extending this work to include dirty-label poisoning reveals a sharp trade-off: ASR increases to ≈ 75% on the modulo task at the cost of reduced stealth, without benign accuracy being affected. Clean-label poisoning reduced addition task accuracy by roughly 35% while keeping ASR near 10%. Clean-label attacks remain low-yield yet stealthy, whereas dirty-label strategies achieve higher efficacy but expose the attack to detection through accuracy degradation. These findings highlight that even modest attack success rates pose risks in safety-critical settings. The findings demonstrate that backdoor potency and collateral effects are governed by task structure, underscoring the necessity of task-aware defence strategies. ... Read more

Big data is generated daily from diverse sources and devices, significantly transforming our lives through machine learning. However, it also presents major challenges, particularly for individuals and organizations with limited storage and computational resources. As a result, cloud services have gained increasing popularity over the past decades, enabling users to outsource storage and complex analysis tasks while focusing on data utilization. However, due to the potential curiosity of cloud servers and external attackers, directly uploading private data to the cloud is not a viable option. Instead, sensitive data must be encrypted before being outsourced.
This thesis investigates cryptographic solutions for secure and efficient cloud services, addressing key challenges in security, efficiency, and functionality. We focus on three core areas: updatable encryption (UE) to ensure long-termsecurity for stored data, fully homomorphic encryption (FHE) for efficient computation over encrypted data, and searchable encryption (SE) to maintain search functionality over outsourced encrypted data.... ... Read more