Skip to content
Log in

Author

Yasmeen Rawajfih

View on Semantic Scholar

2 papers indexed here

We haven’t gathered this author’s papers yet. Follow them and we’ll fetch their work.

Not the right person? Other researchers publish under this name.

Conference Jul 2026

Beyond Bypass: Measuring Vulnerability Regression in LLM-Generated Security Patches

Automated vulnerability repair with large language models is increasingly woven into security workflows, yet evaluation practice has focused almost entirely on a single question: does the patch eliminate the targeted weakness? However, an equally important question has received little systematic attention: has the patching act itself introduced new weaknesses into the function being repaired? Bypass testing and regression measurement are orthogonal properties, and neglecting the latter leaves a material blind spot in any assessment of patch quality.This paper presents an empirical study of vulnerability regression in LLM-generated security patches, applying differential static analysis to 479 complete C/C++ functions spanning eight CWE types. Patches are generated from three frontier models alongside developer-authored ground-truth fixes, for a total of 1,916 analyzed patch–function pairs. AI models fix targeted vulnerabilities at rates approaching human developers, yet they leave a meaningfully larger share of patches in a structurally neutral state, modifying code without engaging its underlying weakness. Across all three AI models, regression rule sets are more similar to each other than to human regression patterns, a consistency specific enough to target with shared automated validators. Finally, for human developers, successfully fixing a vulnerability is strongly associated with lower regression risk. However, this association is absent and not statistically detectable for AI patchers, a distinction with direct implications for how AI patch quality should be verified.

Yasmeen Rawajfih, Adiba Mahmud, Ross Arnold · 0 citations
Conference Jul 2026

Governance-Aware, Privacy-Preserving Retrieval-Augmented Large Language Models for Clinical Triage Decision Support

Large Language Models (LLMs) offer significant potential for clinical decision support, but their deployment is constrained by hallucination, privacy risks, and limited interpretability. Retrieval-Augmented Generation (RAG) improves reliability by grounding outputs in patient-specific electronic health records (EHRs); however, it introduces new challenges related to sensitive data exposure. This paper proposes a governanceaware, privacy-preserving RAG framework for clinical triage decision support using the MIMIC-IV-Ext dataset. The framework integrates retrieval-based grounding, differential privacy, explainability, and an agentic orchestration layer within a unified architecture. An $\epsilon$-ledger is introduced to track cumulative privacy expenditure, and a Privacy-Utility-Explainability (PUE) framework is used to systematically evaluate trade-offs. Experimental results demonstrate that the proposed approach improves classification performance (e.g., achieving up to 82% accuracy and 88% AUROC) and reduces under-triage risk, while privacy mechanisms introduce only modest performance degradation. Retrieval-based attribution further enhances interpretability by linking predictions to clinically relevant cases. These results highlight the effectiveness of combining retrieval, privacy, and explainability for developing trustworthy and deployable healthcare AI systems.

A. K. I. Riad, Md Abdul Barek, Hossain Shahriar et al. · 0 citations