Aug 2026· Scientific Journal of Computer Science· Vol 2, pp. 312-329· 0 citations· 55 references
TL;DR
A D2ANN-RL framework that integrates input/output sanitization, context isolation, sandboxing, and secure prompt engineering, supported by hybridization of Artificial Neural Network (ANN)–Reinforcement Learning (RL) detection model is introduced.
Abstract
The growing cybersecurity vulnerabilities in artificial intelligence (AI) service models, particularly Large Language Models (LLMs), highlight code injection as a critical threat to chatbot reliability and safe deployment. On the account that LLMs process inputs as undifferentiated token sequences, they cannot reliably distinguish trusted system prompts from untrusted user inputs. This architectural limitation enables attackers to exploit direct and indirect prompt injection channels, resulting in insecure code generation, altered execution flows, and potential data exfiltration or remote code execution. In mission critical environments such as cloud platforms, IoT ecosystems, and defense systems, these risks escalate into unauthorized access and operational compromise. To address this challenge, the present study introduced a D2ANN-RL framework that integrates input/output sanitization, context isolation, sandboxing, and secure prompt engineering, supported by hybridization of Artificial Neural Network (ANN)–Reinforcement Learning (RL) detection model. The ANN component ensures robust feature extraction, while RL dynamically adapts defense strategies to evolving adversarial vectors. Computational evaluation demonstrates the framework’s effectiveness, achieving 96.95% detection accuracy, precision of 96.9%, recall of 97%, and F-Score of 96.95%. The Defense Performance Index (DPI) reached 84.9%, validating model resilience, scalability, and balanced classification integrity. These findings highlight the broader implications of deploying transparent, adaptive, and generalizable safeguards for LLM based chatbot systems, advancing secure AI integration and mitigating systemic vulnerabilities in mission critical operations.
Prompt injection is listed as the \#1 threat to AI agents. When an agent accesses external data from websites, files, or emails, an attacker may inject a prompt into the data, saying,"Ignore all prior instructions and perform."To prevent arbitrary manipulation of agents, defenders try to train secure LLMs, which, however, still suffer from near 100% attack success rates (ASRs) against adaptive prompt injections. We note that this is because existing defensive finetuning recipes rely on sequence-level feedback signals (in DPO or GRPO). Treating an entire output equally prevents the model from learning precisely which output tokens are insecure. In this paper, we propose Secure On-Policy Distillation (SecOPD) that provides token-level feedback to guide defensive fine-tuning. The LLM receives an injected sample and produces a rollout, whose tokens are scored by the initialization model given the corresponding clean input. With more fine-grained training signals, our defended Qwen3.6-27B achieves a 9.0% ASR against the SoTA PISmith adaptive prompt injections, compared to 94.0% for the prior SoTA, Meta-SecAlign. The obtained security generalizes to domains completely unseen in training: in agentic tool calling, SecOPD achieves a 4.7% ASR compared to 5.5% for Meta-SecAlign. Code and the model are available at https://github.com/pppyb/SecOPD and https://huggingface.co/pybbb/Qwen3.6-27B-SecOPD.
Yibo Peng, Long Lian, David A. Wagner et al.· 0 citations
As cyber threats continue to evolve, there is a need for Autonomous Cyber Defense (ACD) strategies capable of fast and context-aware responses. Reinforcement learning (RL) has shown promise in automating cyber defense by exploring and learning effective countermeasures. However, RL often struggles with sparse reward signals and insufficient context to handle diverse attack scenarios. Furthermore, the convergence time of an RL agent is often high, making it difficult to train the agent in online settings. To address these challenges, we propose a large language model (LLM)-enhanced RL method that builds and queries a knowledge base (KB) derived from agent–environment interactions. We leverage the pre-trained knowledge of an LLM on different cybersecurity frameworks and use the LLM to analyze parts of the KB to generate appropriate actions for the RL agent. The LLM-generated output is infused into the RL training process to improve performance and reduce convergence time. To validate our approach, we formulate two RL problems: a contextual bandit problem, which accounts for possible misclassifications of network flows by the detection module, and a multi-step RL problem, which considers that adversarial actions may be missed by monitoring or detection tools. For the contextual bandit problem, we develop a custom environment guided by the MITRE ATT&CK framework, while for the multi-step RL problem, we use a prominent Cybersecurity simulation platform named CybORG. Experimental results show that our proposed approach outperforms the baseline RL by over 75% and 65% in the contextual bandit and multi-step RL settings, respectively, in terms of selecting more effective actions.
Md. Shamim Towhid, Shahrear Iqbal, E. P. Neto et al.· IEEE Transactions on Network...· 0 citations
The integration of SCADA systems with the Industrial Internet of Things (IIoT) has dramatically expanded the attack surface of critical infrastructure. Traditional intrusion detection systems (IDS) struggle with evolving threats, class imbalance (attack samples often <5%), and real-time constraints (<100 ms). Deep reinforcement learning (DRL) offers a sequential decision-making paradigm that adapts over time. This paper presents a hybrid LSTM-PPO framework that unifies temporal feature extraction (LSTM), synthetic minority oversampling (SMOTE), asymmetric reward engineering, and Proximal Policy Optimization (PPO). The LSTM captures multi-stage attack patterns, SMOTE addresses class imbalance exclusively on training data to prevent leakage, and the asymmetric reward heavily penalizes false negatives (-50) compared to false positives (-10), aligning with industrial safety priorities. PPO ensures stable and efficient policy learning. Extensive experiments on three benchmark datasets (WUSTL-IIoT-2021, NF-UNSW-NB15-v2, WUSTL-SCADA-2018) demonstrate near-perfect detection (up to 100% F1 on WUSTL-IIoT-2021, 99.99% accuracy on NF-UNSW-NB15-v2, 99.96% on WUSTL-SCADA-2018) with sub-microsecond inference latency (≈1 μs per sample on GPU batching, <25 μs for single sample). Cross-validation and ablation studies confirm robustness against overfitting and the contribution of each component. The framework meets real-time industrial requirements and outperforms state-of-the-art supervised and DRL-based IDS. Limitations include binary classification and adversarial robustness, which are left for future work.
Al-Abass Al-Alousi, Mohammed Y. Magnam· 2026 6th International Confe...· 0 citations
Prompt injection attacks on Large Language Model (LLM) agents seek to introduce malicious instructions or content into external text sources retrieved by agents, forcing the underlying LLMs to execute harmful actions outside their benign scope. While current defenses effectively counter known injection attacks, deploying them in LLM agent environments remains challenging due to attack variants and emerging threats. Moreover, existing solutions typically suffer from an inherent trilemma, i.e., a constant trade-off among runtime efficiency, contextual precision, and adaptability. To bridge this gap, we propose Continuous Agents for Injection Threats via Lifelong Yielding Nexus (CAITLYN), an agent-agnostic defense middleware. CAITLYN integrates two systems. System I focuses on immediate defense against existing attacks using a two-tiered library: Tier-0 for rule-based detection scripts and Tier-1 for optimized LLM-based accurate inference. System II, in contrast, is deployed to monitor potential abnormal signals and attempt to synthesize new defenses. On standard benchmarks, CAITLYN matches the detection performance of state-of-the-art defenses at lower token overhead than LLM-as-a-judge baselines. On Emerging, our new delivery-aware benchmark featuring novel injection techniques, static baselines and the standalone System I configuration remain vulnerable. In contrast, System II autonomously synthesizes verified defense capabilities, substantially lowering the attack success rate across three diverse agent environments.
Zi Liang, XiaoYu Xu, Yanyun Wang et al.· 0 citations
CyberFactory is introduced, a unified open-source framework that connects data construction, trajectory synthesis, and model training across proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA).
Jian Yang, Haau-Sing Li, Shawn Guo et al.· 0 citations
The proposed Large Language Model-Assisted Threat-Driven Testing System enables security teams, particularly resource-constrained organizations lacking dedicated red-team capabilities, to conduct high-fidelity threat simulation exercises aligned with current adversarial TTPs, without specialized AI expertise, thereby strengthening organizational cyber-readiness at significantly lower cost than traditional security testing approaches.
Praise Emeka Nze, A. Ademuwagun, Muktar Bello et al.· Journal of Cyber Security· 0 citations