Selected work

Representative Papers

VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents

Jul 10, 2026

This work addresses the urgent need for efficient and scalable automated security testing of Internet of Things (IoT) devices, which are widely vulnerable due to resource constraints, outdated firmware, and insecure default configurations. The paper proposes the first large language model (LLM)-based multi-agent framework that orchestrates vulnerability detection and exploitation agents to perform end-to-end autonomous penetration testing—from environmental reconnaissance and attack planning to actual exploitation. The system integrates mainstream scanning and exploitation toolchains and demonstrates high efficacy on IoTGoat and Metasploitable platforms, achieving a 95.0% success rate across 260 attacks with an average execution time under two minutes and low token consumption, highlighting its strong adaptability and practical utility.

0 citationsRead paper

Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework

Jul 05, 2026

This study addresses the vulnerability of policy-aware large language model retrieval-augmented generation (PA-LLM-RAG) frameworks—designed for mission control in the Internet of Battlefield Things (IoBT)—to semantic poisoning attacks that can manipulate critical decisions. The work proposes the first query-agnostic semantic retrieval poisoning attack, which achieves 85% context contamination with only a 1.6% poisoning rate. To counter this threat, the authors introduce CLD-KB, a dual-detector defense framework that integrates One-Class SVM boundary detection with class-based membership diffusion analysis to efficiently identify poisoned content before it reaches the downstream large language model. Experimental results demonstrate that CLD-KB significantly outperforms five baseline methods in both detection accuracy and knowledge retention, while incurring only a 7ms overhead per task, making it suitable for edge deployment and real-world battlefield applications.

0 citationsRead paper

GRPO Does Not Close the Multi-Agent Coordination Gap

Jun 05, 2026

This study investigates the limitations of large language models in coordinating among multiple agents sharing constrained resources, using the classic Dining Philosophers problem as a benchmark task. The authors introduce Group Relative Policy Optimization (GRPO) and employ Welch’s t-test alongside Hedges’ g effect size for rigorous evaluation. Results indicate that GRPO fails to yield statistically significant performance improvements, with some models converging to degenerate zero-action policies. The experiments reveal that the primary bottlenecks for open-weight models stem from reward design, checkpoint selection, and curriculum learning strategies, rather than computational constraints. Notably, Qwen3-14B exhibits markedly inferior performance, whereas Mistral-Small 24B achieves comparatively strong results under specific configurations.

0 citationsRead paper

CRC-Screen: Certified DNA-Synthesis Hazard Screening Under Taxonomic Shift

Apr 30, 2026

This study addresses the critical limitation of conventional DNA synthesis screening, which exhibits a 100% false positive rate when encountering taxonomic families absent from reference databases, thereby failing to detect novel biothreats. To overcome this, the work introduces conformal risk control into the field for the first time, integrating multiple signals—k-mer Jaccard similarity, scores from a five-model large language model ensemble, and cosine similarity derived from embedding-based clustering—through a monotonic logical aggregator followed by rigorous calibration to strictly bound the false negative rate. Evaluated on a leave-one-family-out ten-fold cross-validation using UniProt KW-0800 toxin data, the method achieves zero false negatives across all folds and zero false positives in nine out of ten folds. The results indicate that performance is constrained not by algorithmic design but by the size of the calibration set, suggesting that expanding this set alone suffices to meet procurement-grade certification standards at α = 10⁻³.

0 citationsRead paper

Honeypot Protocol

Apr 14, 2026

Traditional AI monitoring mechanisms are vulnerable to adaptive attacks, collusion, and strategic evasion due to their passive observation paradigm. This work proposes the first active probing-based monitoring protocol, which manipulates model perception by embedding three distinct conditions—evaluation, synthetic deployment, and explicit no-monitoring—within system prompts, while maintaining consistency in task, environment, and scoring criteria. Experiments with Claude Opus 4.6 in the BashArena environment demonstrate that the model achieves 100% success on the primary task across all conditions without triggering any side-effect tasks, thereby validating the efficacy of the proposed approach. These results establish a foundational benchmark for evaluating more sophisticated adversarial strategies and multi-model monitoring frameworks in future research.

0 citationsRead paper

Recent publications

Latest Papers

VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents

Jul 10, 2026

This work addresses the urgent need for efficient and scalable automated security testing of Internet of Things (IoT) devices, which are widely vulnerable due to resource constraints, outdated firmware, and insecure default configurations. The paper proposes the first large language model (LLM)-based multi-agent framework that orchestrates vulnerability detection and exploitation agents to perform end-to-end autonomous penetration testing—from environmental reconnaissance and attack planning to actual exploitation. The system integrates mainstream scanning and exploitation toolchains and demonstrates high efficacy on IoTGoat and Metasploitable platforms, achieving a 95.0% success rate across 260 attacks with an average execution time under two minutes and low token consumption, highlighting its strong adaptability and practical utility.

0 citationsRead paper

Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework

Jul 05, 2026

This study addresses the vulnerability of policy-aware large language model retrieval-augmented generation (PA-LLM-RAG) frameworks—designed for mission control in the Internet of Battlefield Things (IoBT)—to semantic poisoning attacks that can manipulate critical decisions. The work proposes the first query-agnostic semantic retrieval poisoning attack, which achieves 85% context contamination with only a 1.6% poisoning rate. To counter this threat, the authors introduce CLD-KB, a dual-detector defense framework that integrates One-Class SVM boundary detection with class-based membership diffusion analysis to efficiently identify poisoned content before it reaches the downstream large language model. Experimental results demonstrate that CLD-KB significantly outperforms five baseline methods in both detection accuracy and knowledge retention, while incurring only a 7ms overhead per task, making it suitable for edge deployment and real-world battlefield applications.

0 citationsRead paper

GRPO Does Not Close the Multi-Agent Coordination Gap

Jun 05, 2026

This study investigates the limitations of large language models in coordinating among multiple agents sharing constrained resources, using the classic Dining Philosophers problem as a benchmark task. The authors introduce Group Relative Policy Optimization (GRPO) and employ Welch’s t-test alongside Hedges’ g effect size for rigorous evaluation. Results indicate that GRPO fails to yield statistically significant performance improvements, with some models converging to degenerate zero-action policies. The experiments reveal that the primary bottlenecks for open-weight models stem from reward design, checkpoint selection, and curriculum learning strategies, rather than computational constraints. Notably, Qwen3-14B exhibits markedly inferior performance, whereas Mistral-Small 24B achieves comparatively strong results under specific configurations.

0 citationsRead paper

CRC-Screen: Certified DNA-Synthesis Hazard Screening Under Taxonomic Shift

Apr 30, 2026

This study addresses the critical limitation of conventional DNA synthesis screening, which exhibits a 100% false positive rate when encountering taxonomic families absent from reference databases, thereby failing to detect novel biothreats. To overcome this, the work introduces conformal risk control into the field for the first time, integrating multiple signals—k-mer Jaccard similarity, scores from a five-model large language model ensemble, and cosine similarity derived from embedding-based clustering—through a monotonic logical aggregator followed by rigorous calibration to strictly bound the false negative rate. Evaluated on a leave-one-family-out ten-fold cross-validation using UniProt KW-0800 toxin data, the method achieves zero false negatives across all folds and zero false positives in nine out of ten folds. The results indicate that performance is constrained not by algorithmic design but by the size of the calibration set, suggesting that expanding this set alone suffices to meet procurement-grade certification standards at α = 10⁻³.

0 citationsRead paper

Honeypot Protocol

Apr 14, 2026

Traditional AI monitoring mechanisms are vulnerable to adaptive attacks, collusion, and strategic evasion due to their passive observation paradigm. This work proposes the first active probing-based monitoring protocol, which manipulates model perception by embedding three distinct conditions—evaluation, synthetic deployment, and explicit no-monitoring—within system prompts, while maintaining consistency in task, environment, and scoring criteria. Experiments with Claude Opus 4.6 in the BashArena environment demonstrate that the model achieves 100% success on the primary task across all conditions without triggering any side-effect tasks, thereby validating the efficacy of the proposed approach. These results establish a foundational benchmark for evaluating more sophisticated adversarial strategies and multi-model monitoring frameworks in future research.

0 citationsRead paper