{"id":"https://openalex.org/W7225319065","doi":"https://doi.org/10.5281/zenodo.23986662","title":"RS-2026-092 The Data Layer is the Blind Spot: Empirical Bypasses of Kernel-Level Runtime Enforcement","display_name":"RS-2026-092 The Data Layer is the Blind Spot: Empirical Bypasses of Kernel-Level Runtime Enforcement","publication_year":2026,"publication_date":"2026-11-05","ids":{"openalex":"https://openalex.org/W7225319065","doi":"https://doi.org/10.5281/zenodo.23986662"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.23986662","doi":"https://doi.org/10.5281/zenodo.23986662","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23986662","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.23986662","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140680363","display_name":"Richard Barron","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Barron, Richard","raw_affiliation_strings":["Red Specter Security Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Red Specter Security Research","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5140680363"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ebpf","display_name":"eBPF","score":0.6430000066757202},{"id":"https://openalex.org/keywords/memory-poisoning","display_name":"memory poisoning","score":0.9639999866485596},{"id":"https://openalex.org/keywords/merkle-trees","display_name":"Merkle trees","score":0.7419999837875366},{"id":"https://openalex.org/keywords/ed25519","display_name":"Ed25519","score":0.8759999871253967},{"id":"https://openalex.org/keywords/ml-dsa","display_name":"ML-DSA","score":0.7749999761581421},{"id":"https://openalex.org/keywords/root-of-trust","display_name":"root of trust","score":0.6899999976158142}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7096999883651733},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.6449000239372253},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5730000138282776},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.5386000275611877},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.5349000096321106},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.475600004196167},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4490000009536743},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.3919999897480011},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3873000144958496},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.3781999945640564},{"id":"https://openalex.org/C199185054","wikidata":"https://www.wikidata.org/wiki/Q552299","display_name":"Chain (unit)","level":2,"score":0.37459999322891235},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.3693999946117401},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.33739998936653137},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.3296999931335449},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.32010000944137573},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.26969999074935913}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.23986662","doi":"https://doi.org/10.5281/zenodo.23986662","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23986662","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.23986663","doi":"https://doi.org/10.5281/zenodo.23986663","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23986663","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.23986662","doi":"https://doi.org/10.5281/zenodo.23986662","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23986662","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7163985071","https://openalex.org/W7162686927","https://openalex.org/W7155583891","https://openalex.org/W2575425722","https://openalex.org/W7160283515","https://openalex.org/W7204103328","https://openalex.org/W7204937353","https://openalex.org/W7167616632","https://openalex.org/W7097641080","https://openalex.org/W7215043104"],"abstract_inverted_index":{"Kernel-level":[0],"enforcement":[1,80,123],"mechanisms":[2],"\u2014":[3,9,59,68],"BPF":[4],"LSM,":[5],"eBPF,":[6],"in-memory":[7],"attestation":[8],"are":[10,148],"the":[11,15,33,37,39,79,95,97,101,138,141,143,169],"current":[12],"state":[13],"of":[14,25,132,140],"art":[16],"for":[17],"securing":[18],"high-assurance":[19],"AI":[20],"workloads.":[21],"The":[22,91],"core":[23],"assumption":[24,50],"these":[26],"systems":[27],"is":[28,41,51,93,153],"that":[29,48,69,120],"if":[30],"you":[31],"verify":[32],"binary":[34,86,98],"and":[35,64,115,118,174],"enforce":[36],"syscall,":[38],"execution":[40,102],"secure.":[42],"This":[43,106],"paper":[44],"presents":[45],"empirical":[46],"evidence":[47,159],"this":[49],"structurally":[52],"flawed.We":[53],"demonstrate":[54],"three":[55],"distinct":[56],"attack":[57,92,151],"classes":[58],"memory":[60],"poisoning,":[61,63],"knowledge-base":[62],"hallucination-based":[65],"supply-chain":[66],"injection":[67],"operate":[70],"entirely":[71],"through":[72],"legitimate,":[73],"authorized":[74],"syscalls.":[75],"In":[76],"every":[77],"case,":[78],"layer":[81],"observes":[82],"a":[83,109,156],"signed,":[84],"verified":[85,181],"performing":[87],"its":[88],"normal":[89],"function.":[90],"in":[94,182],"data":[96,142],"processes,":[99],"not":[100],"path":[103],"it":[104],"takes.":[105],"finding":[107],"establishes":[108],"hard":[110],"boundary":[111],"between":[112],"execution-layer":[113],"controls":[114],"data-layer":[116],"truth,":[117],"argues":[119],"any":[121],"durable":[122],"mechanism":[124],"must":[125],"bind":[126],"intent":[127],"to":[128],"an":[129],"out-of-band":[130],"root":[131],"trust":[133],"rather":[134],"than":[135],"relying":[136],"on":[137],"integrity":[139,179],"agent":[144],"reasons":[145],"over.All":[146],"findings":[147],"reproducible.":[149],"Each":[150],"class":[152],"accompanied":[154],"by":[155,168],"cryptographically":[157],"signed":[158],"chain":[160],"(Ed25519":[161],"+":[162],"ML-DSA-65,":[163],"SHA-256":[164],"Merkle":[165],"tree)":[166],"produced":[167],"SPECTER":[170,172,175],"HALLUBOT,":[171],"SHELL,":[173],"EMBEDDED":[176],"toolchain.":[177],"Chain":[178],"was":[180],"each":[183],"case.":[184]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-11-06T00:00:00"}