Selected work

Representative Papers

Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations

Jul 30, 2026

This study addresses the challenges faced by reinforcement learning (RL) agents in early-stage autonomous cyber defense, including high exploration costs, weak decision-making capabilities, and behavioral instability. To overcome these limitations, the work proposes an online policy distillation framework that leverages a prompt-engineered large language model (LLM) specialized in cybersecurity as a teacher policy. The framework efficiently transfers knowledge from the LLM to a lightweight RL agent containing only 64,910 parameters. Evaluated in multi-scale CybORG network environments with 4 to 12 hosts, the distilled agent closely replicates the teacher’s performance and significantly outperforms baseline RL methods. Despite a five-order-of-magnitude reduction in parameter count, the agent maintains robust defensive capabilities, demonstrating the feasibility of deploying state-of-the-art security models in resource-constrained settings.

0 citationsRead paper

Deep Sigma Point Processes for RCS Modeling in Spaceborne SAR Imagery

Jul 23, 2026

This study addresses the challenge of uncertainty in radar cross-section (RCS) modeling for spaceborne SAR imagery, which arises from complex nonlinear relationships. To this end, the authors propose a Deep Sigma Point Process (DSPP) model that, for the first time, integrates hierarchical Gaussian processes with Bayesian inference for RCS prediction. By leveraging a Matérn kernel and automatic relevance determination (ARD), the framework establishes an end-to-end probabilistic prediction system that outputs full predictive distributions rather than point estimates. This enables rigorous uncertainty quantification and feature importance ranking, thereby advancing RCS modeling from deterministic equations toward a probabilistic paradigm. Evaluated on the RADARSAT-2 dataset, the method reduces root mean square error by 20.83%, improves R² by 25.89%, and decreases residual dispersion by 44.4% compared to a linear regression baseline, significantly enhancing prediction accuracy, robustness, and interpretability.

0 citationsRead paper

Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning

Jul 10, 2026

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.

0 citationsRead paper

Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP

May 15, 2026

This study addresses the lack of systematic guidance on how contextual representation, reasoning mechanisms, and task hierarchies affect performance and inference costs of composite large language model (LLM) agents in adversarial partially observable environments, such as the CybORG CAGE-2 cyber defense POMDP. Through controlled experiments evaluating five model categories, six instances, and twelve configurations, the work reveals that procedural state abstraction yields the highest return per token and identifies a “reasoning cascade” phenomenon: stacking complex reasoning within hierarchical structures significantly degrades performance. Procedural state tracking improves average return by up to 76%, while hierarchical architectures without explicit reasoning achieve the best absolute performance; adding reasoning layers reduces returns by 3.4× and increases token consumption by 1.8–2.7×. These findings establish a design principle prioritizing investment in procedural infrastructure over deep monolithic reasoning.

0 citationsRead paper

FORGE: Self-Evolving Agent Memory With No Weight Updates via Population Broadcast

May 15, 2026

This work addresses the challenge of enhancing the performance of large language model (LLM) agents in complex decision-making tasks without requiring weight updates. It introduces the FORGE protocol, which for the first time enables gradient-free, self-evolving natural language memory through collective broadcasting, a graduation-and-freezing mechanism, and multi-model collaborative evaluation. Within a hierarchical ReAct framework, FORGE dynamically optimizes hybrid memory composed of rules and examples. Integrated with a Reflexion-style inner loop, the approach substantially boosts the capabilities of weaker models. On the CybORG CAGE-2 benchmark, it achieves 1.7–7.7× higher average returns compared to zero-shot baselines and 29%–72% improvements over Reflexion, while reducing catastrophic failure rates to approximately 1%.

0 citationsRead paper

Recent publications

Latest Papers

Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations

Jul 30, 2026

This study addresses the challenges faced by reinforcement learning (RL) agents in early-stage autonomous cyber defense, including high exploration costs, weak decision-making capabilities, and behavioral instability. To overcome these limitations, the work proposes an online policy distillation framework that leverages a prompt-engineered large language model (LLM) specialized in cybersecurity as a teacher policy. The framework efficiently transfers knowledge from the LLM to a lightweight RL agent containing only 64,910 parameters. Evaluated in multi-scale CybORG network environments with 4 to 12 hosts, the distilled agent closely replicates the teacher’s performance and significantly outperforms baseline RL methods. Despite a five-order-of-magnitude reduction in parameter count, the agent maintains robust defensive capabilities, demonstrating the feasibility of deploying state-of-the-art security models in resource-constrained settings.

0 citationsRead paper

Deep Sigma Point Processes for RCS Modeling in Spaceborne SAR Imagery

Jul 23, 2026

This study addresses the challenge of uncertainty in radar cross-section (RCS) modeling for spaceborne SAR imagery, which arises from complex nonlinear relationships. To this end, the authors propose a Deep Sigma Point Process (DSPP) model that, for the first time, integrates hierarchical Gaussian processes with Bayesian inference for RCS prediction. By leveraging a Matérn kernel and automatic relevance determination (ARD), the framework establishes an end-to-end probabilistic prediction system that outputs full predictive distributions rather than point estimates. This enables rigorous uncertainty quantification and feature importance ranking, thereby advancing RCS modeling from deterministic equations toward a probabilistic paradigm. Evaluated on the RADARSAT-2 dataset, the method reduces root mean square error by 20.83%, improves R² by 25.89%, and decreases residual dispersion by 44.4% compared to a linear regression baseline, significantly enhancing prediction accuracy, robustness, and interpretability.

0 citationsRead paper

Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning

Jul 10, 2026

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.

0 citationsRead paper

Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP

May 15, 2026

This study addresses the lack of systematic guidance on how contextual representation, reasoning mechanisms, and task hierarchies affect performance and inference costs of composite large language model (LLM) agents in adversarial partially observable environments, such as the CybORG CAGE-2 cyber defense POMDP. Through controlled experiments evaluating five model categories, six instances, and twelve configurations, the work reveals that procedural state abstraction yields the highest return per token and identifies a “reasoning cascade” phenomenon: stacking complex reasoning within hierarchical structures significantly degrades performance. Procedural state tracking improves average return by up to 76%, while hierarchical architectures without explicit reasoning achieve the best absolute performance; adding reasoning layers reduces returns by 3.4× and increases token consumption by 1.8–2.7×. These findings establish a design principle prioritizing investment in procedural infrastructure over deep monolithic reasoning.

0 citationsRead paper

FORGE: Self-Evolving Agent Memory With No Weight Updates via Population Broadcast

May 15, 2026

This work addresses the challenge of enhancing the performance of large language model (LLM) agents in complex decision-making tasks without requiring weight updates. It introduces the FORGE protocol, which for the first time enables gradient-free, self-evolving natural language memory through collective broadcasting, a graduation-and-freezing mechanism, and multi-model collaborative evaluation. Within a hierarchical ReAct framework, FORGE dynamically optimizes hybrid memory composed of rules and examples. Integrated with a Reflexion-style inner loop, the approach substantially boosts the capabilities of weaker models. On the CybORG CAGE-2 benchmark, it achieves 1.7–7.7× higher average returns compared to zero-shot baselines and 29%–72% improvements over Reflexion, while reducing catastrophic failure rates to approximately 1%.

0 citationsRead paper