Selected work

Representative Papers

Document Retrieval Augmented Fine-Tuning (DRAFT) for safety-critical software assessments

May 02, 2025

In safety-critical software compliance assessment, manual review suffers from low efficiency, inaccurate evidence citation, and weak reasoning robustness. To address these challenges, this paper proposes DRAFT—a novel framework featuring a dual-path collaborative retrieval-augmented paradigm that jointly retrieves software documentation and regulatory standards. We introduce a semi-automated data generation method incorporating distractors to realistically model expert cognitive load during evaluation. DRAFT integrates retrieval-augmented generation (RAG), supervised fine-tuning, and lightweight adaptation of GPT-4o-mini. Evaluated in highly regulated settings, DRAFT improves assessment accuracy by 7%, significantly enhancing evidence traceability, response structuring, and domain-specific reasoning stability. It establishes a reproducible, verifiable pathway for high-assurance AI-assisted compliance review.

0 citationsRead paper

Multi-Stage Retrieval for Operational Technology Cybersecurity Compliance Using Large Language Models: A Railway Casestudy

Apr 18, 2025

To address low efficiency and expert shortages in operational technology (OT) cybersecurity compliance verification for critical infrastructure (e.g., railways), this paper proposes and validates the Parallel Compliance Architecture (PCA)—the first automated OT cybersecurity standard (OTCS) verification framework integrating context-enhanced reasoning over standard textual specifications, supporting IEC 62443 and IEC 63452. Methodologically, PCA unifies multi-stage semantic retrieval, a compliance knowledge graph, retrieval-augmented generation (RAG), and standardized prompt engineering, leveraging GPT-4o and Claude-3.5-haiku for precise, auditable inference. Its novelty includes a three-dimensional evaluation metric assessing correctness, logical coherence, and hallucination detection. Experiments demonstrate that PCA significantly outperforms baselines in response accuracy and reasoning quality; retrieval augmentation effectively mitigates hallucinations, and overall assessment efficiency improves by 3.2×. PCA establishes a scalable, verifiable, AI-augmented paradigm for OTCS compliance validation.

0 citationsRead paper

Recent publications

Latest Papers

Document Retrieval Augmented Fine-Tuning (DRAFT) for safety-critical software assessments

May 02, 2025

In safety-critical software compliance assessment, manual review suffers from low efficiency, inaccurate evidence citation, and weak reasoning robustness. To address these challenges, this paper proposes DRAFT—a novel framework featuring a dual-path collaborative retrieval-augmented paradigm that jointly retrieves software documentation and regulatory standards. We introduce a semi-automated data generation method incorporating distractors to realistically model expert cognitive load during evaluation. DRAFT integrates retrieval-augmented generation (RAG), supervised fine-tuning, and lightweight adaptation of GPT-4o-mini. Evaluated in highly regulated settings, DRAFT improves assessment accuracy by 7%, significantly enhancing evidence traceability, response structuring, and domain-specific reasoning stability. It establishes a reproducible, verifiable pathway for high-assurance AI-assisted compliance review.

0 citationsRead paper

Multi-Stage Retrieval for Operational Technology Cybersecurity Compliance Using Large Language Models: A Railway Casestudy

Apr 18, 2025

To address low efficiency and expert shortages in operational technology (OT) cybersecurity compliance verification for critical infrastructure (e.g., railways), this paper proposes and validates the Parallel Compliance Architecture (PCA)—the first automated OT cybersecurity standard (OTCS) verification framework integrating context-enhanced reasoning over standard textual specifications, supporting IEC 62443 and IEC 63452. Methodologically, PCA unifies multi-stage semantic retrieval, a compliance knowledge graph, retrieval-augmented generation (RAG), and standardized prompt engineering, leveraging GPT-4o and Claude-3.5-haiku for precise, auditable inference. Its novelty includes a three-dimensional evaluation metric assessing correctness, logical coherence, and hallucination detection. Experiments demonstrate that PCA significantly outperforms baselines in response accuracy and reasoning quality; retrieval augmentation effectively mitigates hallucinations, and overall assessment efficiency improves by 3.2×. PCA establishes a scalable, verifiable, AI-augmented paradigm for OTCS compliance validation.

0 citationsRead paper