Open research questions in Security and Verification in Computing
151 gap statements mined from Security and Verification in Computing papers in our 7.9M-paper local library, which holds 960 papers on the topic — drawn mostly from each paper's own stated research gap, future-work, challenge and limitation notes, and its abstract. The ones listed below are a selection still marked open; each names the study that raised it, with a DOI link where the paper has one.
Choosing where to publish on Security and Verification in Computing? See the ranked Computer Science journals.
What the literature leaves open
The backdoor remains effective after clean fine-tuning and across model scales and versions, revealing an underexplored supply-chain privacy risk in RAG systems.
RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation · 2026TEEs meet some of these requirements, but simply running models inside a TEE is insufficient as we need compliance mechanisms.
KNOX: Hardware-assisted Regulatory Sandbox for Generative Models · 2026This is primarily due to insufficient definition of SGX-specific vulnerability patterns and the limited precision in function call chain construction. To address these challenges, we propose a novel approach, ParaTaintGX.
ParaTaintGX: Detecting Memory Corruption Vulnerabilities in SGX Applications via Parameter-Taint Model · 2026 · DOIThe need for a structured self-healing abstraction layer in Linux systems. The lack of a secure and safe conversational assistance module in existing Linux systems.
The current intent-driven architecture operates within a predefined intent scope; the paper identifies integration of adaptive inference models as a future path but does not specify what machine learning model architectures (transformer-based NLU, recurrent networks, etc.) will replace the rigid parsing and routing layers or how incremental intent addition will be validated without operational disruption.
We emphasize that false-positive behavior under realistic TD workloads with frequent page faults remains an open issue that can only be resolved by empirical study; the operational guidance above should therefore be read as a starting point for such a study rather than as a validated configuration policy.
RandDelay: Mitigating Fine-Grained Timing-Based Controlled-Channel Attacks on Intel TDX via Randomized SEAMCALL Latency · 2026 · DOILimited systematic evidence across a broad range of attack surfaces, malicious goals, and LLM backbones. Lack of a benchmark for IPI risk in a production-like environment.
LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injectio · 2026The apparent blocked recall of 2/2 is limited by the very small number of actual blocked cases and is not treated as a full-corpus recall estimate. Production-classified verify-completed evidence is limited to 17 verify-completed events in the rotation-aware evidence slice. Production-classified verify evidence remains limited to 17 verify-completed events.
Verify-Gated Completion as Admission Control in a Governed Multi-Agent Runtime: A Bounded Architecture Case Study · 2026There is a need for computable metrics through rigorous testing to determine the applicability of the system to the task. Current ethical embodied AI frameworks are mostly qualitative and do not provide measurable, objective, computable metrics.
REBAR: Reference Ethical Benchmark for Autonomy Readiness · 2026There is a lack of benchmarks for measuring overeager behavior in coding agents. The existing benchmarks do not provide construction-time validity and generalization across coding agents and base models. The paper aims to fill this gap by presenting OverEager-Gen.
Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks · 2026Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: Section 4 explicitly discusses all major limitations: the framework is scoped to single-agent systems, treats the LLM as a fixed black box requiring re-estimation of probability bounds upon model change, and identifies three open problems—bound estimation from non-i.
Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment · 2026It is an open question whether such defenses can be made robust to the diversity of meltdown behaviors documented in this paper. Separately, our error scenarios are currently limited to a fixed set of individual error conditions, leaving compounded and dynamically generated errors largely unexamined.
Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents · 2026The evaluation is limited to four language models. The tasks are intentionally small and original, which may not be representative of real-world scenarios. The evaluation does not consider the potential impact of safety alignment on other aspects of autonomous security agents.
Measuring Safety Alignment Effects in Autonomous Security Agents · 2026The current benchmarks for evaluating safety alignment are insufficient for autonomous security agents. The effects of safety alignment on the performance of autonomous security agents are not well understood.
Measuring Safety Alignment Effects in Autonomous Security Agents · 2026Future research should investigate the vulnerability in other cryptographic implementations and architectures. Future research should evaluate the effectiveness of the proposed resolution and optimized implementation. Future research should consider the implications of the vulnerability for the security of cryptographic protocols.
The vulnerability in Xtensa-based ESP32 chips running ephemeral-static X25519 implementations is not well understood. The paper aims to address this gap by studying the vulnerability and proposing a resolution. The gap is significant, as the vulnerability has important practical implications for the security of cryptographic implementations.
The lack of a low-overhead tracing tool for production systems. The need for a tool that can provide visibility into the kernel without perturbing the system.
Moreno et al. critically review that this reinforcement learning and recommender systems are already being used to support autonomy in penetration testing, although remain important regarding generalization, environment realism, and reward design.
Evolutionary Computation-Enhanced White-Box Penetration Testing for Lateral-Movement Prevention in Zero-Trust Architectures · 2026 · DOIRunPBA achieves low overhead using off-the-shelf processors and is designed as an extension of the Trusted Firmware-M project, with the goal of facilitating easy integration into real-world systems.
Each AI-generated mitigation step is traceable to the specific D3FEND document that sourced it; supports audit and compliance review…
Multi-Vector Adversarial Testing of an AI-Orchestrated Zero Trust Methodology on Constrained Edge Hardware · 2026 · DOIEmpirical validation on production AMD SEV-SNP hardware - Extension of EHV to other domains…
Ethical Hyper-Velocity (EHV): A Provably Deterministic Governance-Aware JIT Compiler Architecture for Agentic Systems · 2026Lack of mechanistic, hardware-rooted enforcement for high-frequency policy updates in autonomous agentic systems - Existing standards introduce 14-30 day…
Ethical Hyper-Velocity (EHV): A Provably Deterministic Governance-Aware JIT Compiler Architecture for Agentic Systems · 2026Additional defended runs across all backbones. Evaluation of the defense across a broader range of attack surfaces and malicious goals. Investigation of other potential vulnerabilities in AI agents.
LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injectio · 2026Extending OVEREAGER-GEN with LLM-judge augmentation for non-shell sinks and non-enumerable authorization boundaries. Improving the benchmark to handle more complex scenarios and coding agents. Using the benchmark to evaluate and improve the behavior of coding agents.
Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks · 2026The three-layer architecture proposed here is the minimum viable certification structure that follows from this, and whether it becomes a deployable standard depends on the community treating the open problems of Section 4 not as limitations to acknowledge but as the primary research agenda to pursue: the field is currently producing safety mechanisms faster than the theoretical infrastructure to compose and certify…
Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment · 2026
Most-cited papers in Security and Verification in Computing
- A note on the confinement problem · Communications of the ACM · 1973 · 999 citations
- Protection in operating systems · Communications of the ACM · 1976 · 689 citations
- Reflections on trusting trust · Communications of the ACM · 1984 · 410 citations
- Making components contract aware · Computer · 1999 · 298 citations
- Spectre attacks · Communications of the ACM · 2020 · 240 citations
- Self-adaptive software needs quantitative verification at runtime · Communications of the ACM · 2012 · 215 citations
- RowHammer: A Retrospective · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · 2020 · 203 citations
- Operating system protection through program evolution · Computers & Security · 1993 · 188 citations
- Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions · ACM Transactions on Software Engineering and Methodology · 2026 · 171 citations
- Building the IBM 4758 secure coprocessor · Computer · 2001 · 168 citations
Most recent work
- Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions · ACM Transactions on Software Engineering and Methodology · 2026
- Tool-Entropy Collapse: A Cross-Architecture Signature of Agent WANDERING Failure · Open MIND · 2026
- False Execution Status in LLM-Guided Processes: From Functional Substitution to Pseudo-Trace Contamination · Zenodo (CERN European Organization for Nuclear Research) · 2026
- SAFE-Matter™ Runtime Admissibility and Trust Governance Specification Deterministic Runtime State Governance, Trust Computation, and Execution Authority for Life-Critical Systems · Zenodo (CERN European Organization for Nuclear Research) · 2026
- SCU5.0 Beta Release: Security Hardening, Asynchronous Optimization, and Defect Elimination Across 28 Issues in a Conversational AI Agent Platform · Zenodo (CERN European Organization for Nuclear Research) · 2026
- The Authorization Direction: A Late-Layer Direction that Detects and Controls an Agent's Commitment to Unauthorized Irreversible Actions, Across Architectures · Zenodo (CERN European Organization for Nuclear Research) · 2026
- Felt, Not Granted: An Internal Authorization Probe Inherits the Agent's Judgment Error and Is Operationally Blind to Realistic Model-Origin Over-Reach, Where an External Task-Grounded Check Is Not · Zenodo (CERN European Organization for Nuclear Research) · 2026
- SAFE-Matter™ Reference Runtime Architecture A Deployable Architecture for Admissibility, Evidence Processing, Trust Computation, and Deterministic Enforcement · Zenodo (CERN European Organization for Nuclear Research) · 2026
- TrustTiny-HAR: Selective, Open-Set, and Calibrated Activity Recognition on Microcontrollers · IEEE Transactions on Artificial Intelligence · 2026
- A Decade of Docker Containers · Communications of the ACM · 2026
Find a gap in your own Security and Verification in Computing sub-topic
This page shows what the Security and Verification in Computing literature already flags as unresolved. To narrow it to your specific question, search the Research Gap Finder: the search is free with a free account and lists the papers closest to your topic first. Unlocking that topic (50 credits, charged once) fills the comparison table from our 7.9M-paper local library and writes the gaps from its rows.
Open the Research Gap Finder →