Category
1,407 papers
The MAL Simulator, a cyber operation simulator based on the Meta Attack Language (MAL), found that the trained attacker policy could reach the designated targets more efficiently than the compared search methods, and that the trained defender agent induced lower costs than a naive heuristic agent under noisy alert cond...
We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents. The goal of the defensive agents is to prevent hosts i...
An algorithm is proposed which leverages disentangled semantic factors to generate adversarial perturbation by altering controlled semantic attributes to fool the learner towards various "adversarial" targets.
In the United States, management of cybercrime-related consumer complaints increasingly falls on state and city governments given de-staffing of federal agencies. AI, and in particular, large language models (LLMs), shows promise for detecting cybercrime in text complaints, but often via specialized models that local g...
Reach audiences
Advertise in front of researchers, engineers, and readers.
Two universal tool-based defenses are introduced: Attacker Tool Filtering, which uses anomaly detection to identify and remove suspicious tools, and Normal Tool Recalling, a white-box method that restores the agent's original toolset prior to planning.
Retrieval-Augmented Generation (RAG) has emerged as a powerful paradigm for improving the quality of generated contents of Large Language Models (LLMs) by grounding responses in external knowledge, thus reducing hallucinations and factual errors. However, recent studies have highlighted a critical vulnerability: advers...
This work formalizes agent reconnaissance by modeling the process and identifying the knowledge assets it seeks to extract, and instantiates KYA, a framework that automates black-box, reconnaissance-driven pentesting by probing agents, building target profiles, and using those profiles to craft stronger attacks.
Shielded analysis turns a safety-game solution into a comparative instrument: it determines whether a defense exists, characterizes what that defense requires, and identifies which system changes strengthen it.
This paper proposes LLM-based neural distinguishers through a prompt design and conducts extensive experiments with them on SPECK-32/64 to investigate whether LLMs can strengthen neural distinguishers and shows that the performance of LLM-based neural distinguishers can be significantly improved by incorporating only t...
Streaming intrusion-detection studies assemble evaluation streams from network captures by interleaving capture days, pooling captures, or replaying records round robin. We show on two benchmarks that this assembly is an uncontrolled experimental treatment changing what the evaluation measures. On CICIDS2017, reorderin...
A risk-calibrated approach to streaming intrusion detection that couples Bayesian Online Changepoint Detection (BOCPD) with decision thresholds aligned to Site Reliability Engineering (SRE) error budgets and results indicate improved precision-recall at mid to high recall and better probability calibration relative to...
Speaker verification models are trained on large-scale public datasets whose licenses usually prohibit unauthorized commercial use, yet such infringement is difficult to detect or deter. Dataset ownership verification (DOV) is the mainstream countermeasure: it can watermark a dataset with backdoor attacks so that model...
Research Manager Mike Walker reflects on a career spanning hacker culture, cybersecurity, and AI, sharing lessons about trust, teamwork, leadership, and why solving difficult problems requires curiosity, judgment, agility—and an understanding of the rules. The post Learn the rules: The hacker mindset appeared first on Microsoft Research.
GPT-Lab
· gpt-lab.eu
Oct 30, 2026
Critical flaws, compromised release channels and agentic AI threats landed within days of each other in mid-October 2026. Why “Black October” may say more about how well we now find weaknesses than about the attacks themselves. The post Black October? The Week AI Changed the Cybersecurity Conversation appeared first on GPT-Lab.
Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.
Gemini 3.8 Flash and 3.8 Flash Cyber deliver next-generation intelligence for agentic workflows and cybersecurity.
Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model to find and patch vulnerabilities.
Students from the MIT Cybersecurity Clinic help local governments and other vulnerable organizations defend against digital threats.
We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.
