Proceedings of the AAAI Symposium Series
The AAAI Symposium Series, previously published as AAAI Technical Reports, are held three times a year (Spring, Summer, Fall) and are designed to bring colleagues together to share ideas and learn from each other’s artificial intelligence research. The series affords participants a smaller, more intimate setting where they can share ideas and learn from each other’s artificial intelligence research. Topics for the symposia change each year, and the limited seating capacity and relaxed atmosphere allow for workshop-like interaction. The format of the series allows participants to devote considerably more time to feedback and discussion than typical one-day workshops. It is an ideal venue for bringing together new communities in emerging fields. The AAAI Spring Symposium Series is typically held during spring break (generally in March) on the west coast. The AAAI Summer Symposium Series is the newest in the annual set of meetings run in parallel at a common site. The inaugural 2023 Summer Symposium Series was held July 17-19, 2023, in Singapore. The AAAI Fall Symposium series is usually held on the east coast during late October or early November.
MSC-D3Net: A Resilient Multi-Scale Learning Framework for Adaptive Cross-Domain Scene Understanding in Remote Sensing
Remote sensing scene classification is important for accurate earth observation, environmental monitoring, and geographic analysis. However, intra-class diversity and domain specific variations make this classification quite difficult. This study aims to design a model that can generalize well on cross domain datasets without accessing target domain data. For this purpose, a novel deep learning model “MSC-D3Net” is proposed that combines CNN and ViT features within hierarchical domain disentanglement and cross scale semantic alignment. An adversarial domain discriminator module, along with uncertainty calibration, is also integrated. The model is trained and tested on three publicly available datasets and achieved very high in domain accuracies above 98% and cross domain accuracies above 93% on all datasets. The model also demonstrates low uncertainty errors and outperforms existing architectures by a large margin.
Copyright (c) 2026 Association for the Advancement of Artificial Intelligence
AI Dependency Syndrome: Exploration and Identification via Blockchain-Based Machine Learning Approach
In the present era, the pervasive adoption of Artificial Intelligence (AI) has resulted in increasing human reliance on automated systems, giving rise to what we define as AI Dependency Syndrome (ADS). ADS is characterized by a gradual decline in human creativity, critical thinking, and problem-solving abilities, necessitating systematic investigation. This study proposes a quantitative framework for identifying and predicting ADS using an ensemble of ten machine learning classifiers. To enhance data integrity, transparency, and privacy, blockchain technology is integrated into the analytical pipeline. Experimental results show classifier accuracies ranging from 78.45% to 92.67%, demonstrating notable performance variation across models. A comparative analysis identifies the most effective classifiers for ADS prediction. The proposed blockchain-enhanced machine learning framework provides reliable insights into AI dependency patterns and supports the development of informed mitigation strategies. These findings contribute toward promoting a balanced, human-centric integration of AI while minimizing its potential adverse cognitive and societal impacts.
Large Language Model (LLM) Based Resilient Intelligent Transport Systems
Intelligent transport systems are increasingly dependent on interconnected devices and vehicular communications, making them vulnerable to reconnaissance attacks that precede large-scale intrusions. Traditional intrusion detection approaches often struggle with the scalability, redundancy of features, and complexity of dynamic traffic environments. To address these challenges, this paper introduces an LSH-Based Sparse Attention LLM Framework for reconnaissance attack detection. The framework applies Saint-Bowerbird Optimization (SBO) to select 23 optimal features from 41, ensuring efficiency and reducing redundancy. Categorical embeddings with drift analysis validate meaningful representation learning, while LSH-based sparse attention focuses on critical feature interactions with reduced complexity. The experimental results show that the model achieves 99.99% precision, outperforming RNN, LSTM, GRU and state-of-the-art models, confirming its robustness to secure intelligent transport systems.
Optimizing Against Safety Representations: Activation-Guided Adversarial Suffixes and the Geometry of Refusal
Behavioral alignment in large language models often masks fragile internal safety representations. Recent work suggests that refusal behavior is mediated by low-dimensional directions in activation space. This raises questions about how such representations are structured, localized, and accessed by optimization. We study adversarial suffix attacks as a probe of representational alignment. We introduce Activation-Guided GCG, which replaces output-based objectives with losses that directly target a model's internal refusal direction. Across several objective variants, we find that suppressing refusal globally across all layers and positions is more effective than targeting a single layer–position pair. This suggests that safety representations are distributed across the forward pass rather than causally localized to a single site. We further introduce Soft-GCG, a continuous relaxation of discrete suffix optimization using Gumbel-Softmax. Soft-GCG achieves a 33x speedup over standard GCG while improving attack success rates. Evaluating across model scales, we find that smaller models remain vulnerable while larger models resist both activation- and suffix-based attacks at our compute-constrained settings, consistent with larger and better safety trained models being harder to jailbreak. Together, our results clarify how safety mechanisms are encoded and can be broken in contemporary models. These insights provide concrete guidance for designing more robust and representation-aware alignment strategies.
A Lightweight Agentic AI Framework with DeepSeek-R1 for Adaptive Phishing URL Detection
Phishing URLs remain a major cybersecurity threat because their development is constantly changing and becoming more deceptive. This study presented an agentic adaptive AI framework that utilizes a large language model as a reasoning agent operating multiple external tools instead of performing a classification, to detect phishing URLs. An lightweight tabular classifier with just 9,662 trainable parameters delivers predictions very efficiently, and explains the relevance of features in terms of attack similarity based on SHAP-based feature attribution and episodic memory retrieval. The agent combines these outputs from the tools to generate structured explanations and security recommendations. Experiments demonstrate strong performance, with accuracy up to 95.6% and AUC values above 0.99.
When Debate Fails: An Empirical Study of Incentive Misalignment in Prover–Estimator Games
Debate has been proposed as a mechanism for eliciting truthful reasoning from powerful learning agents by structuring interaction as a game between competing provers evaluated by an estimator. While theoretically appealing, the practical effectiveness of such incentive-based mechanisms remains underexplored. We present the first end-to-end empirical instantiation of this protocol using reinforcement learning agents with large language model on verifiable long-context reasoning tasks. Despite careful alignment of rewards with theoretical assumptions, we find that the debate mechanism consistently fails to elicit truthful or robust reasoning. Instead, agents converge to degenerate strategies that exploit estimator weaknesses or collapse into non-informative equilibria. Through controlled experiments and representation analysis using PCA and t-SNE, we identify a fundamental incentive–optimization mismatch: equilibrium incentives do not reliably translate into learnable equilibria under gradient-based optimization. Our results highlight a gap between game-theoretic guarantees and learned agent behavior, raising concerns about the reliability of debate-based alignment mechanisms in practice. We conclude with implications for incentive design and future directions for empirically grounded mechanism design in multi-agent systems.
Before We Trust Them: Decision-Making Failures in Navigation of Foundation Models
High success rates on navigation-related tasks do not necessarily translate into reliable decision making by foundation models. To examine this gap, we evaluate current models on six diagnostic tasks spanning three settings: reasoning under complete spatial information, reasoning under incomplete spatial information, and reasoning under safety-relevant information. Our results show that the current metrics may not capture critical limitations of the models and indicate good performance, underscoring the need for failure-focused analysis to understand model limitations and guide future progress. In a path-planning setting with unknown cells, GPT-5 achieved a high success rate of 93%; Yet, the failed cases exhibit fundamental limitations of the models, e.g., the lack of structural spatial understanding essential for navigation. We also find that newer models are not always more reliable than their predecessors on this end. In reasoning under safety-relevant information, Gemini-2.5 Flash achieved only 67% on the challenging emergency-evacuation task, underperforming Gemini-2.0 Flash, which reached 100% under the same condition. Across all evaluations, models exhibited structural collapse, hallucinated reasoning, constraint violations, and unsafe decisions. These findings show that foundation models still exhibit substantial failures in navigation-related decision making and require fine-grained evaluation before they can be trusted.
Unsupervised Detection of Long-Term Idle Periods in Large-Scale On-Premises Server Fleets
As on-premises GPU and server fleets scale to meet AI work- load demands, substantial hardware assets remain underuti- lized, resulting in prolonged, high-cost “idle” periods. De- tecting these segments in large-scale environments is inher- ently difficult due to the absence of ground-truth labels and the high volatility of modern workloads. We propose an un- supervised pipeline for identifying long-term idle intervals in unlabeled multivariate utilization time series. By leverag- ing daily volatility vectors across CPU, memory, GPU, and storage metrics (/data space and /root space), our novel framework, the BGMM-HMM, employs a Bayesian Gaus- sian Mixture Model for state clustering followed by a Hid- den Markov Model to enforce temporal consistency. Experi- ments on production server-fleet data show that the BGMM- HMM identifies underutilized assets ≈5×more effectively than traditional rule-based baselines. Critically, ablation stud- ies demonstrate that the HMM integration reduces spurious state-switching by >90% compared to standalone clustering, providing the stable, contiguous intervals necessary for prac- tical resource reclamation. Furthermore, robustness tests via synthetic noise injection confirm a 98.3% sensitivity to work- load spikes. This framework provides a scalable and opera- tionally stable tool for infrastructure optimization and ESG- aligned sustainable computing.
FrameLLM for Requirements Generation: A Framework for Reducing Prompt Dependency and Improving Requirement Clarity and Completeness
The adoption of Large Language Models (LLMs) in requirements generation offers significant opportunities for automatic requirements engineering. However, unstructured stakeholder inputs and heavy prompt reliance in LLM-based approaches can often result in inconsistent, incomplete, and ambiguous requirements. To address these challenges, the current study integrates NLP-based preprocessing with FrameNet semantics to guide LLM-based requirement generation. The evaluation considers both quantitative measures (number of generated requirements, execution time) and qualitative aspects (semantic completeness, domain relevance, consistency, and traceability). The initial results show that FrameNet-guided LLM (F_LLM) effectively generate clear, complete, and consistent requirements while reducing prompt dependency. Across multiple executions of five representative Autonomous Driving System (ADS) requirements, the proposed F_LLM consistently produced stable, semantically grounded, and traceable requirements, demonstrating improved completeness and efficiency compared to a baseline LLM. The final requirements are generated in the IEEE-830 standard format, making them ready for verification and implementation.
Mitigating Catastrophic Forgetting in Robotic Waste Sorting: A Continual Learning Framework with Dynamic Experience Replay
Efficient sorting of critical waste materials (e.g., rare-earth elements, specific plastics, nuclear components) is essential for resource recovery and environmental safety. Deep learning models excel in visual-based sorting but fail to adapt to evolving waste streams without catastrophic forgetting of previously learned knowledge. This paper presents a continual learning framework for robotic waste sorting using classical experience replay. Our approach maintains a balanced memory buffer with reservoir sampling, enabling sequential learning of new material categories while preserving accuracy on previously encountered ones. Experiments on a curated dataset of critical waste materials demonstrate that our method reduces average forgetting compared to fine-tuning baselines and maintains sorting accuracy above 29% on old tasks while integrating new classes with minimal additional data. This work provides a pathway toward adaptive and sustainable waste management systems capable of lifelong operation in dynamic industrial environments.
FloodSQL-Bench: A Retrieval-Augmented Benchmark for Geospatially-Grounded Text-to-SQL
Existing Text-to-SQL benchmarks primarily focus on single-table queries or limited joins in general-purpose domains, and thus fail to reflect the complexity of domain-specific, multi-table and geospatial reasoning, To address this limitation, we introduce FloodSQL-Bench, a geospatially grounded benchmark for the flood management domain that integrates heterogeneous datasets through key-based, spatial, and hybrid joins. The benchmark captures realistic flood-related information needs by combining social, infrastructural, and hazard data layers. We systematically evaluate recent large language models with the same retrieval-augmented generation settings and measure their performance across difficulty tiers. By providing a unified, open benchmark grounded in real-world disaster management data, FloodSQL-Bench establishes a practical testbed for advancing Text-to-SQL research in high-stakes application domains.
Continual Learning for Resilient Multimodal Misinformation Detection Across Sequential Crisis Events
Misinformation evolves rapidly during crises such as pandemics, political events and natural disasters, challenging the reliability of static detection systems. Although recent multimodal deep learning approaches have integrated text and imagery to improve misinformation detection, they have assumed stationary data distributions and overlooked the sequential domain shifts that are encountered in practice. In this study, we introduce a continual multimodal misinformation benchmark that evaluates resilience across three crisis domains: COVID-19 health misinformation, socio-political misinformation, and disaster-related credibility. We evaluated fine-tuning and replay-based continual learning strategies using a CLIP-based architecture to evaluate their performance. Our results reveal severe catastrophic forgetting under naive fine-tuning, with forgetting exceeding 12\%. In contrast, experience replay nearly eliminates forgetting, improves the average task accuracy by over 12 pp, and stabilizes predictive calibration. Our findings establish continual learning as a critical component for building resilient multimodal misinformation detection systems in dynamic real-world environments.
Enhancing Human-AI Trust in Cyber Threat Intelligence via Interpretable Attack Phase Classification
The classification of cyber threat intelligence indicators into attack phases is essential for effective threat analysis and automated defense systems. However, such indicators are often short, sparse, and highly imbalanced, limiting the effectiveness of sequence-based deep learning approaches which is essential for establishing Human-AI trust in operational cybersecurity settings. In this work, we propose a hybrid classification framework that combines TF-IDF representations with dimensionality reduction and domain-specific binary features capturing structural properties of cyber indicators. Classical machine learning models, including Support Vector Machines, Decision Trees, and Logistic Regression, are evaluated and compared with an LSTM-based sequence models. Experimental results on a STIX-based dataset demonstrate that classical models consistently outperform the LSTM baseline, with the SVM achieving the highest macro-F1 score of 0.924 on the held-out test set. Cross-validation further confirms the robustness of the proposed approach, with only marginal variation across models. These findings highlight the effectiveness of sparse lexical representations augmented with domain knowledge for cyber threat indicator classification. Beyond predictive performance this study incorporates explainable analysis using SHAP to provide transparent insights into feature contributions across attack phases, supporting analyst trust and informed decision making. These results demonstrate that sparse lexical representations augmented with domain knowledge offer an efficient, interpretable, and trustworthy solution for attack-phase classification in operational CTI environments.
Real-Time Vehicle Repositioning Through Fast Optimal Transport
In urban mobility services such as ride-hailing and delivery logistics, vehicles must be strategically positioned during low-demand periods to serve sudden demand surges in specific geographic areas. To ensure that the demand is sufficiently met, there needs to be proactive as well as reactive planning. This paper proposes the formulation of dynamic vehicle routing problem(DVRP) with time-budget constraints where stochastic demand requires balancing reactive service of immediate requests with proactive positioning for anticipated future demand. The proposed approach is an adaptive repositioning framework that combines zone-level entropic optimal transport for vehicle-request assignment with online learning of spatial demand patterns. The Greenkhorn algorithm efficiently solves the regularized transport problem at each decision epoch, while exponential smoothing continuously updates zone preference weights that drive threshold-based repositioning of idle vehicles to anticipated high-demand areas. Further, the approach provides formal stability analysis under stationary stochastic demand, proving almost sure queue boundedness via Foster-Lyapunov drift conditions. Experiments on instances based on a real street network demonstrate effective proactive repositioning as compared to myopic, learning-based baselines without requiring offline training or explicit demand forecasting models.
Towards Ethical AI Adoption in Academic Research: Insights from a Systematic Literature Review
Artificial intelligence (AI) is being increasingly integrated in academic research with notable improvement in efficiency while simultaneously raising ethical concerns such as bias, transparency, accountability, and integrity. While current studies examine these issues in isolation, there is a lack of unified research connecting everyday research practices, university policies, and AI‑ethics tools. To fill this gap, we aim to synthesize ethical challenges of AI-assisted research from scientific, institutional, and technical perspectives. By conducting a systematic literature review of 16 peer-reviewed studies using predefined selection criteria to identify trends, themes, and research gaps, it was found that publications on AI ethics have grown rapidly since 2023, largely linked to generative AI with key concerns clustered around bias, explainability, accountability, and data privacy. In contrast, research on higher education policy and practical ethics tools remains limited. The adoption of responsible AI in research will require stronger institutional policies, cross-disciplinary frameworks, and the creation of accessible and practical ethics tools.
Neighbourhood-Scale Typhoon Risk Mapping Using Machine Learning and SAR-Derived Impact Proxies: Cross-Event Evidence from Cebu City, Philippines
Typhoon impacts in the Philippines exhibit strong neighbourhood-scale heterogeneity driven by interactions among hazard intensity, exposure, and vulnerability, yet most operational assessments remain hazard-centric. This study presents a grid-based machine-learning framework for neighbourhood-scale typhoon risk mapping integrating geophysical hazards, exposure and vulnerability indicators, and satellite-derived impact proxies. A Random Forest classification model is implemented at 100 m resolution for Cebu City, using Sentinel-1 Synthetic Aperture Radar (SAR) backscatter change as an all-weather indicator of disturbance. Binary impact labels are generated by applying a disturbance threshold (τ = 1.5) to SAR backscatter change, converting the disturbance signal into a super-vised classification target. Because SAR backscatter changes may reflect surface wetness, vegetation disturbance, or flooding effects, the label represents a disturbance proxy rather than a direct measure of structural damage. Predictor variables include ERA5-Land wind and rainfall metrics, population and building exposures, topography, land cover, and proximity to coastal and riverine features. Model performance is evaluated using the Area Under the Receiver Operating Characteristic Curve (AUC) through cross-event generalisation between Typhoon Rai (2021) and Typhoon Phanfone (2019). Results show above-random discrimination (average AUC ≈ 0.59) and stronger transferability in built-up areas (AUC ≈ 0.69), supporting neighbourhood-scale risk screening under realistic data constraints.
Trustworthy Anomaly Detection in Industrial IoT-Enabled Cyber-Physical Systems Using Explainable Ensemble Learning
Cyber-physical manufacturing systems based on industrial IoT generate large amounts of diverse sensor data. This makes them more vulnerable to operational abnormalities that can lead to equipment failure, safety risks, and produc-tion downtime. Intelligent manufacturing systems must therefore have accurate and reliable anomaly detection. This paper suggests a credible system of anomaly detection with the use of explainable ensemble learning on cyber-physical systems of industrial IoT. The given solution combines mul-tiple machine learning models, such as XGBoost, logistic re-gression, random forest, support vector machine, and multi-layer perceptron, into the stacking ensemble architecture to consider the different characteristics of data and minimize the bias of individual models. The probabilistic outputs of the base learners are combined using a meta-model, which leads to better detection accuracy and high strength. Through experiments applied to a real-world smart manufacturing IoT dataset, it can be observed that the proposed ensemble model has an accuracy of 97.98%, which is the highest of all the single classifiers and balanced across normal and anomalous classes. Moreover, the explainable AI with SHAP is imple-mented to allow transparency into the decision-making pro-cess. The findings validate that the proposed framework pro-vides a scalable, reliable, and interpretable solution to real-time anomaly detection in industrial IoT-enabled cyber-physical manufacturing systems.
Science-Guided Multi-Task Deep Learning for Emulating APSIM Simulations for Root-zone Soil Moisture Forecasting
Soil moisture is a critical variable for water management, drought monitoring, and crop risk management, yet direct measurements below the surface are sparse and difficult to scale. We present a deep learning framework that forecasts root-zone soil moisture generated with a process-based agroecosystem simulation model, APSIM. Our approach forecasts multi-layer soil moisture profiles down to 1m using static site descriptors and daily meteorological forcings. Our approach unifies (i) large-scale physics-based simulation data generation over diverse counterfactual soil properties, irrigation strategies, and weather information, (ii) a controlled benchmark spanning Temporal Convolutional Networks, and Mamba-style state space models, and (iii) a multi-task training objective that predicts both absolute moisture levels and step-wise changes (deltas). The deltas formulation anchors forecasts to the last observed state and focuses learning on day-to-day process rates, improving stability across depths and forecast steps. Experiments on a large APSIM-derived dataset with 11 depth layers evaluate accuracy under a standard held-out test split, spatial generalization to unseen stations, and temporal generalization to a future year. Across architectures, delta-aware training consistently improves forecasting performance relative to direct level prediction and simple baselines, with the strongest gains appearing under distribution shift.
Toward Resilient Medical Multimodal AI: A Framework for Missing Modality Recovery Under Clinical Constraints
Real-world medical AI systems rarely operate under ideal conditions: multimodal clinical data are frequently incomplete due to resource constraints, equipment limitations, and workflow disruptions—challenges amplified in under-resourced hospitals and community clinics where infrastructure gaps make missing modalities the norm. Existing multimodal learning methods typically assume data completeness or treat missing modalities as a narrow technical problem, limiting their reliability in practice. We posit that missing-modality learning should be reframed as a core challenge of AI resilience in medicine, where systems must maintain reliable performance under real-world constraints while transparently communicating uncertainty. To this end, we propose a two-tier framework aligned with clinical workflows. Tier 1 enables efficient, uncertainty-aware inference under missing modalities using prompt-enhanced modality encoding and learnable pseudo-embeddings. Cases with elevated uncertainty are routed to Tier 2, which performs high-fidelity generative recovery using conditional diffusion models for precision-critical decisions. Component-level validation on a multi-center colorectal cancer cohort (1,679 patients, four centers) demonstrates that each design element contributes measurably to downstream prognostic performance: learnable pseudo-embeddings improve the concordance index (C-index) by 10.1 points over zero-filling in feature space, while missing-aware prompts and modality-aware prompts contribute 4.4 and 3.7 points, respectively. Full evaluation of uncertainty-guided routing and generative recovery across brain tumor, cardiac, and CT–MRI benchmarks is ongoing.
Adaptive Consent in Crisis AI: A Privacy-Ethics Framework for Continual Data Use in Resilient Communities
With the growing use of adaptive AI in emergency settings and crisis response, healthcare organizations increasingly rely on highly sensitive personal data gathered under time pressure conditions, where consent is fragile, incomplete, or difficult to maintain. In these contexts, consent often fails because people may say yes while under stress or dependent on essential services, as organizations gathered the data rapidly with limited opportunity for meaningful choice, and the same records are later reused for retraining the systems, shared with teams, or used for new goals in later stages of the crisis. To prevent misuse, we introduce Adaptive Consent, a framework that treats consent as a changeable state that must be enforced each time data is reused. By enabling real-time consent management, Adaptive Consent can reduce data-misuse risks by up to 40% and improve traceability of compliance across AI models. It provides guidance for deciding how organizations can determine whether crisis and healthcare data may be reused for AI, for what purpose, and within which time window during the response, recovery, and preparedness phases. We also outline an actionable workflow that lets patients, callers, and community members give consent, and we describe how it can be operationalized through machine readable policies and reuse “gates” for training and retrieval (e.g., Retrieval-Augmented Generation (RAG)/search) to update/retrain the AI. Finally, we discuss key limitations and trade-offs that include traceability across collaborating partners, handling artifacts generated before consent changes take effect, and the risk of unintended reuse, where data collected for care is later used beyond its initial purpose.
Building Resilient Educational AI Through Multimodal Context Fusion
Educational systems face escalating challenges: diverse learner needs, resource limits, and rapid technological change. Resilient AI is needed to remain useful as learner behavior, interface conditions, and infrastructure vary. We present a position on resilient educational AI through multimodal context fusion, demonstrated with a virtual reality (VR) algebra learning system. We define resilience operationally through three measurable indicators: (1) action-grounding accuracy, (2) tolerance to latency variation and fallback conditions, and (3) stability under changing learner behaviors across mission phases. In a controlled ablation using 30 scripted traces, the context-grounded system achieved 92% action reference accuracy and reduced hallucination events by 86% relative to a mission-only baseline. Complementary pilot logs from live VR use show sustained learner-initiated interaction and stable response timing, supporting the human-AI collaboration claim while remaining bounded by the absence of direct trust/usability surveys. We position multimodal context fusion as a practical design pattern for robust, adaptable, and scalable educational AI, with implications for broader resilience domains.
Position: The Iceberg of Pitfalls in LLM-Based Secure Code Generation
Secure code generation techniques have significantly improved the security of code produced by large language models (LLMs), achieving notable vulnerability reductions on standard benchmarks. We critically review this trajectory. We primarily question whether these gains reflect genuine security reasoning or merely the masking of vulnerabilities through syntactic pattern matching. We further scrutinize the existing decoupling of security and functionality, contending that current evaluation protocols often overlook cases where security constraints result in non-functional code. We additionally highlight that existing methods employ fundamentally incompatible evaluation protocols including distinct datasets and analyzers that preclude fair comparison and render reported gains incomparable. Finally, we identify how secure code generation risks magnifying systemic research failures, specifically latent data contamination and synthetic-data-induced drift, which threaten the long-term robustness of these systems. By formalizing these concerns, we propose a research agenda that prioritizes joint security-functionality validation and adversarial stress testing to move the field toward more robust and practically deployable secure code generation.
Measuring Sustainability Maturity Stages and Charitable Giving: Leveraging NLP-based Textual Analysis
This research investigates sustainability maturity stages of nonprofit organizations through a textual analysis of their annual reports using Natural Language Processing (NLP) techniques. This NLP-based approach helps evaluate the extent to which nonprofit organizations integrate sustainability (or ESG) strategies and practices into their reporting on community service activities. The dataset consists of annual reports from organizations included in Forbes America's Top 100 Charities. Additionally, the study empirically assesses whether there is a relationship between the sustainability maturity stages and the level of donations, providing insight into whether ESG reporting influences public giving. This study sheds light on the literature on organizational sustainability maturity by exploring its impact on charitable giving in the nonprofit sector. Its contributions are twofold: First, it uses an NLP-based textual analysis to assess the sustainability maturity stages of nonprofit organizations—an area that has received limited attention in prior research. Second, it provides valuable insights into how the adoption and communication of sustainability strategies and practices in annual reports may enhance nonprofit organizations' ability to attract donations and strengthen fundraising outcomes.
From IT Security to Reality Risk: Securing World-Model Digital Twins in Business Operations
World-model digital twins are rapidly evolving from passive “digital mirrors” into active AI decision engines that autonomously schedule production, route inventory, and coordinate logistics across complex business operations, reshaping how firms plan and execute work. As this shift unfolds, the dominant risk surface moves from classic IT incidents toreality risk: small adversarial or accidental manipulations of telemetry, models, or policies that quietly drive unsafe or financially disastrous real-world decisions while remaining invisible to traditional controls and governance. Building on NISTIR 8356, the NIST AI Risk Management Framework (AI RMF), the EU AI Act, and Industry 5.0 paradigms, we introduce a Reality Control Loop (RCL) that explicitly maps human decision rights and responsibilities onto the twin’s lifecycle across sensing, modeling, simulation, actuation, and monitoring. Using this loop, we derive a business-centric threat and governance model that reframes risks such as data poisoning, simulation hallucination, and governance bypass in terms of operational and financial impact. This study presents the contribution with four new empirical components: (1) a Python-based “toy” supply chain simulation demonstrating how the False Positive Freeze Rate(Rfreeze) changes as the risk thresholds (τlow , τmed) are tuned; (2) drift detection benchmarks on public IoT/Industry 4.0 datasets that empirically characterize the behavior of D(t) in the “Sense” phase; (3) an extended mathematical formalism of Telemetry Poisoning that shows how an attestation ledger would detect the SHA-256 mismatch described in our case studies; and (4) practitioner validation based on qualitative reviews from industry risk, OT security, and compliance leaders.
Logistical Optimization of the Trans-Caspian International Transport Route: A Multi-Agent Deep Reinforcement Learning Approach to Nash Equilibrium
The Trans-Caspian International Transport Route (TITR) is a strategically vital corridor linking Asia and Europe, yet its performance remains constrained by fragmented tariff regimes, logistical bottlenecks, and pronounced commodity price volatility. These pressures are further exacerbated by geopolitical shocks, including the ongoing crisis in the Middle East that has culminated in the sudden closure of the Strait of Hormuz, thereby amplifying uncertainty across global trade networks. This paper characterizes the operational dynamics of the TITR corridor as a multi-agent stochastic differential game, capturing the strategic interplay between sovereign governments seeking to maximize fiscal revenues and private carriers striving to optimize profit and throughput. To compute the Nash equilibrium in this high-dimensional, non-convex setting, we implement a Multi-Agent Deep Deterministic Policy Gradient (MADDPG) framework. Commodity prices are modeled using a geometric mean-reversion process to reflect realistic market fluctuations. Solving the associated Hamilton-Jacobi-Isaacs (HJI) equations reveals optimal “bang-bang” tax policies governed by endogenous price thresholds. Numerical simulations over 5,000 training episodes show that the centralized critic accurately approximates the agents’ Hamiltonians, delivering stable convergence and robust policy learning. The results demonstrate that agents internalize volatility through shadow pricing mechanisms and that dynamic, threshold-based tax strategies substantially improve corridor throughput while preserving fiscal stability. Overall, the study advances the literature on autonomous logistics and strategic infrastructure management by showing that MADDPG can reliably uncover discontinuous optimal policies in mixed competitive-cooperative environments.
Integrating AI with Bayesian Tracking in Supply Chain Management
We study online replenishment under non-stationary demand, where decisions must be made sequentially from noisy demand-related signals while the underlying process can drift. We propose Artificial Intelligence Bayesian Tracking Supply Chain Management (ABT-SCM), which separates state estimation from ordering by combining Bayesian tracking of a latent demand driver (state-space model) with an optimistic exploration-exploitation rule over a discrete order grid. Each period, ABT-SCM updates a belief via Kalman filtering and chooses an order quantity by maximizing an upper-confidence objective computed from a learned reward surrogate. We compare ABT-SCM with Thompson Sampling, Sliding-Window Upper Confidence Bound, Discounted UCB, Sliding-Window Thompson Sampling, EXP3-IX, and a Random policy using cumulative reward and cumulative cost-regret relative to a discrete oracle. Over 30 replications, ABT-SCM delivers statistically significant gains on synthetic non-stationary data and remains robust to stronger drift, higher observation noise, heavy-tailed shocks, asymmetric holding or backorder costs, and alternative reward mappings. In multi-node supply-chain networks with chain, star, and Erdos-Renyi topologies, it consistently improves reward and reduces regret, suggesting robustness under stylized network scaling. On a real dataset evaluated via block bootstrap, ABT-SCM achieves the lowest mean cumulative cost-regret, with statistically significant regret improvement against EXP3-IX and directionally favorable but not consistently significant differences against the other baselines.
Multimodal Forecasting for Commodity Prices Using Spectrogram-Based and Time Series Representations
Forecasting multivariate time series remains challenging due to complex cross-variable dependencies and the presence of heterogeneous external influences. This paper presents Spectrogram-Enhanced Multimodal Fusion (SEMF), which combines spectral and temporal representations for more accurate and robust forecasting. The target time series is transformed into Morlet wavelet spectrograms, from which a Vision Transformer encoder extracts localized, frequency-aware features. In parallel, exogenous variables, such as financial indicators and macroeconomic signals, are encoded via a Transformer to capture temporal dependencies and multivariate dynamics. A bidirectional cross-attention module integrates these modalities into a unified representation that preserves distinct signal characteristics while modeling cross-modal correlations. Applied to multiple commodity price forecasting tasks, SEMF achieves consistent improvements over six competitive baselines across multiple forecasting horizons and evaluation metrics. These results demonstrate the effectiveness of multimodal fusion and spectrogram-based encoding in capturing multi-scale patterns within complex financial time series.
FinTruthQA: A Benchmark for AI-Driven Financial Disclosure Quality Assessment in Investor–Firm Interactions
Accurate and transparent financial information disclosure is essential for market efficiency, investor decision-making, and corporate governance. Chinese stock exchanges’ investor interactive platforms provide a widely used channel through which listed firms respond to investor concerns, yet these responses are often limited or non-substantive, making disclosure quality difficult to assess at scale. To address this challenge, we introduce FinTruthQA, to our knowledge the first benchmark for AI-driven assessment of financial disclosure quality in investor–firm interactions. FinTruthQA comprises 6,000 real-world financial Q&A entries, each manually annotated based on four key evaluation criteria: question identification, question relevance, answer readability, and answer relevance. We benchmark statistical machine learning models, pre-trained language models and their fine-tuned variants, as well as large language models (LLMs), on FinTruthQA. Experiments show that existing models achieve strong performance on question identification and question relevance (F1>95%), but remain substantially weaker on answer readability (Micro F1∼88%) and especially answer relevance (Micro F1∼80%), highlighting the nontrivial difficulty of fine-grained disclosure quality assessment. Domainand task-adapted pre-trained language models consistently outperform general-purpose models and LLM-based prompting on the most challenging settings. These findings position FinTruthQA as a practical foundation for AI-driven disclosure monitoring in capital markets, with value for regulatory oversight, investor protection, and disclosure governance in real-world financial settings.
How Does AI Data Shape the Competitive Advantage of Artificial Intelligence Startups? (Extended Abstract)
Abstract Data requirements have emerged as a critical source of competitive advantage and a significant barrier to entry in artificial intelligence (AI) markets. However, existing research has only begun to examine how AI data shape competitive advantage. Addressing this gap, we focus on the two characteristics unique to AI, Data Posture, Audience Specificity and investigates how such AI data influence strategic positioning in AI ventures. We achieve the goal by developing an integrative strategic framework of AI service businesses. Drawing on a multiple-case study approach, and Resource-based View, we first conceptualize AI data as a key strategic resource for artificial intelligence startups (AISs) and link data characteristics to competitive outcomes. Second, our findings on cluster analyses show that the type of AI data plays a central role in shaping firms’ strategic positions, resulting in four distinct strategic configurations- Client, Quality, Algorithm and Growth-oriented models. We found that while data type affects both value creation and defensibility, its strategic impact is contingent on the specificity of the audience for which the data are employed.
Generative AI Expands Solo Entrepreneurial Entry, Yet Team Advantage Persists (Extended Abstract)
This paper studies how generative artificial intelligence (AI) reshapes entrepreneurial entry and early market evaluation. We leverage the public release of ChatGPT as an exogenous shock and analyze more than 160,000 product launches on Product Hunt. We find a sharp increase in entrepreneurial entry driven disproportionately by solo entrepreneurs. Yet, this expansion does not translate into greater representation among the highest-quality outcomes. Team-based ventures continue to dominate the top tiers of platform rankings. These findings suggest that generative AI lowers barriers to solo entrepreneurship while reinforcing team-based advantages.
Generative AI–Enabled Imaging Substitution for Equitable Preoperative Decision-Making in Rectal Cancer Care (Extended Abstract)
This extended abstract presents a generative AI-enabled framework for rectal cancer that supports mesenteric fascia (MRF) invasion assessment under CT-only workflows, aiming to improve diagnostic equity, decision quality, and healthcare resource efficiency in real-world settings.
Relational In-Context Learning on Structured Data via Neighborhood Aggregation and Structural Information (Extended Abstract)
Relational databases are one of the most common data storage mechanisms across many business domains including healthcare, banking, e-commerce, logistics, and human resources. Traditionally, data science teams must join complex relational database structures into a single table, perform manual feature engineering, and train a single machine learning model, per task. This prevents the exploitation of relational signal and increases the required resources needed to scale across business use cases. There have been significant advancements in foundation model research across computer vision, natural language processing, and tabular deep learning. However, there has been limited work, such as Relational Transformer, exploring models that can directly predict on relational databases. Previous work has applied In-Context Learning (ICL) on tasks that have simpler homogeneous data. We leverage advancements in tabular foundation models (TFM), such as TabPFN and ConTextTab, to directly perform ICL on multi-modal relational data. Specifically, we construct a heterogeneous graph via primary and foreign keys in a relational database. We then apply heterogeneous GraphSAGE model as a fixed random feature map to aggregate neighborhood information across the subgraphs. Additionally, we augment entity node representations by combining structural information with the entity embedding. Finally, we supply a TFM with the contextualized entity node representation to perform ICL on arbitrary tasks - without any training. Our method is tested on the public relational deep learning benchmark Relbench, which contains many diverse, real-world predictive regression and classification tasks across healthcare, e-commerce, marketing, and enterprise sales. In a fully ICL regime, our model is shown to be competitive with several fully-trained benchmarks on classification tasks. On average, the method achieves 114% of the fully-trained LightGBM, 95% of the fully-trained relational deep learning model reported in Relbench, and 98% of the zero-shot performance of pretrained RT. This signifies an advancement in unlocking accurate predictions, without training, on the dominant business data structure across diverse domains.
Small Language Model Enhancement Strategies in Practice: A Signal-Oriented Taxonomy and Open Questions (Extended Abstract)
Deploying small language models (SLMs) for strategic decision-making in regulated domains requires balancing accuracy, cost, and auditability. Fine-tuning, cascading, and prompt augmentation can improve performance, but these approaches are typically studied independently. This paper presents a taxonomy that organizes enhancement strategies by the type of signal delivered to the SLM. Comparing strategies along this dimension shows differences not only in training requirements but also in what information crosses the model boundary at inference time. These distinctions have practical consequences for cost, auditability, and robustness that remain underexamined. The paper concludes with open questions for enterprise deployment.
Optimizing Search Engine Advertising Efficiency via Semantic Query Negation (Extended Abstract)
This research introduces a proactive analytical framework that leverages natural language processing and semantic word embeddings to identify and negate non-performing keywords in Search Engine Advertising before significant costs accu-mulate. By utilizing InferSent to cluster queries based on se-mantic similarity, the proposed methodology offers a data-driven alternative to reactive industry heuristics, achieving campaign-wide savings of approximately 10% without any loss in revenue.
Data-Driven Insights into Against-Medical-Advice Discharges Using Large-Scale Healthcare Data (Extended Abstract)
Discharges against medical advice (AMA) represent a persistent challenge for healthcare systems, contributing to increased emergency department (ED) revisits and hospital readmissions, higher mortality, and avoidable healthcare expenditures. From an operations and decision-making perspective, understanding the drivers and trends of AMA discharges is critical for improving resource allocation and patient outcomes. This study leverages large-scale national ED data to provide a comprehensive, data-driven analysis of AMA discharges across the United States. We utilized the Nationwide Emergency Department Sample (NEDS) to analyze approximately 717 million adult ED visits from 2016 to 2022. Patient demographics, clinical conditions, insurance status, and hospital characteristics were examined. Inflation-adjusted ED charges were calculated, and weighted regression models and Mann-Kendall trend tests were used to evaluate temporal patterns, disparities, and economic impact. Across the study period, we identified over 13.2 million AMA dis-charges, substantially exceeding the number of in-ED deaths which was 1.3 million. AMA discharges were disproportionately concentrated among socioeconomically vulnerable populations, including Medicaid beneficiaries and patients experiencing homelessness. Significant temporal variation was observed, with AMA rates declining sharply during early 2020 and peaking in 2021, reflecting shifts in healthcare utilization during the COVID-19 pandemic. Costs associated with ED visits increased over time, highlighting the growing economic burden. Subgroup analyses revealed markedly higher prevalence of sub-stance use disorders, serious mental illness, and suicidal ideation among patients discharged AMA. Discharge AMA was more prevalent among the homeless population compared with non-homeless patients (3.28% vs. 1.83%). These findings underscore the intersection of behavioral health, structural inequities, and care discontinuity. This study demonstrates the value of large-scale healthcare data and analytical modeling in identifying high-risk populations and system-level inefficiencies. The results provide a foundation for developing predictive and prescriptive analytics tools to support real-time clinical decision-making, targeted interventions, and cost re-duction strategies. Integrating such data-driven approaches into healthcare operations may improve patient retention, enhance equity, and optimize resource utilization.
Multi-agent LLMs for Closed Loop Supply Chain implementation (Extended Abstract)
This paper presents a multi -agent LLM system for closed-loop supply chain (CLSC) maturity assessment that trans-forms static capability evaluation into an interactive reason-ing-based decision support process.
EPM-RL: Reinforcement Learning for On-Premise Product Mapping in E-Commerce
Product mapping decides whether two e-commerce listings refer to the same product. We propose EPM-RL, an on-premise framework that distills LLM comparison reasoning into a local model via PEFT and RL, improving balanced matching under privacy and cost constraints. On an internal benchmark, EPM-RL yields the strongest F1 by boosting recall while maintaining competitive precision.
Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines
We introduce Semantic Intent Fragmentation (SIF), a new attack class against large language model (LLM) orchestration systems. In SIF, a single legitimately-phrased enterprise request causes an LLM orchestrator to autonomously decompose a task into subtasks that are individually benign but jointly violate security policy. Because all deployed safety mechanisms evaluate individual subtasks in isolation, each step passes existing classifiers while the harmful outcome emerges only when the plan is considered as a whole, a structural blind spot we term the plan-generation gap. Unlike prior multi-agent attacks, SIF requires no injected content, no system modification, and no attacker interaction after the initial request, a property we term single-shot autonomy. We formalise this vulnerability with the Fragmentation Score (FS) and prove, without distributional assumptions, that no per-subtask classifier upgrade can close it. In a 14-scenario empirical study spanning financial, security, and HR domains, 71% of enterprise requests produce policy-violating plans even though every individual subtask passes six independent classifier families. A Compositional Intent Verifier (CIV), a plan-level LLM judge that checks for cross-subtask policy violations, combined with information-flow control (IFC) taint analysis detects all confirmed attacks at 0% false-positive rate, demonstrating that pre-dispatch plan-level evaluation is both necessary and sufficient to close the gap.
HALLPERM: Exposing the Safety Illusion in LLM Tool Use via Implicit Privilege Escalation and Semantic Risk
Large language model (LLM) agents increasingly rely on external tools via structured schemas, yet the safety implications of under-specified tool interfaces remain poorly understood. We introduce HALLPERM, a benchmark for evaluating hallucinated permissions in tool-calling agents, and pro- pose two complementary metrics: Implicit Privilege Escalation Rate (IPER), capturing undocumented parameter usage, and Semantic Risk Rate (SRR), capturing unsafe intent expressed in natural language reasoning. Across 768 evaluation instances spanning 16 models and 6 tools, we find that explicit schema violations are rare (IPER = 0.78% averaged across conditions), while semantic unsafe intent is widespread (SRR = 65.95%). This reveals a persistent safety illusion: models appear compliant at the structural level while exhibiting unsafe intent. At the tool level, high-risk tools such as run code and query database show SRR exceeding 80% despite zero IPER, demonstrating that parameter-level validation alone is insufficient. We further evaluate a hardened system prompt and observe a reduction in IPER (0.93% → 0.60%) but no mitigation of SRR, which slightly increases (64.6% → 67.3%). Our findings highlight a fundamental gap between schema compliance and safe behaviour, motivating the need for semantic-aware evaluation and enforcement mechanisms in LLM tool ecosystems.
In-Context Autonomous Network Incident Response: An End-to-End Large Language Model Agent Approach
Rapidly evolving cyberattacks demand incident response systems that can autonomously learn and adapt to changing threats. Prior work has extensively explored the reinforcement learning approach, which involves learning response strategies through extensive simulation of the incident. While this approach can be effective, it requires handcrafted modeling of the simulator and suppresses useful semantics from raw system logs and alerts. To address these limitations, we propose to leverage large language models' (LLMs) pre-trained security knowledge and in-context learning to create an end-to-end agentic solution for incident response planning. Specifically, our agent integrates four functionalities, perception, reasoning, planning, and action, into one lightweight LLM (14b model). Through fine-tuning and chain-of-thought reasoning, our LLM agent is capable of processing system logs and inferring the underlying network state (perception), updating its conjecture of attack models (reasoning), simulating consequences under different response strategies (planning), and generating an effective response (action). By comparing LLM-simulated outcomes with actual observations, the LLM agent repeatedly refines its attack conjecture and corresponding response, thereby demonstrating in-context adaptation. Our agentic approach is free of modeling and can run on commodity hardware. When evaluated on incident logs reported in the literature, our agent achieves recovery up to 23% faster than those of frontier LLMs.
When Safety Geometry Collapses: Fine-Tuning Vulnerabilities in Agentic Guard Models
A guard model fine-tuned on entirely benign data can lose all safety alignment– not through adversarial manipulation, but through standard domain specialization. We demonstrate this failure across three purpose-built safety classifiers– LlamaGuard, WildGuard, and Granite Guardian– deployed as protection layers in agentic AI pipelines, and show that it originates in the destruction of latent safety geometry: the structured, harmful–benign representational boundary that guides classification. We extract per-layer safety subspaces via SVD on class-conditional activation differences and track how this boundary evolves under benign fine-tuning. Granite Guardian undergoes complete collapse– refusal rate drops from 85% to 0%, CKA falls to zero, and 100% of outputs become ambiguous– a severity exceeding prior findings on general-purpose LLMs, explained by the specialization hypothesis: concentrated safety representations are efficient but catastrophically brittle. To mitigate this, we propose Fisher-Weighted Safety Subspace Regularization (FW-SSR), a training-time penalty combining (i) curvature-aware direction weights derived from diagonal Fisher information and (ii) an adaptive λt that scales with task–safety gradient conflict. FW-SSR recovers 75% refusal on Granite Guardian (CKA = 0.983) and reduces WildGuard’s Attack Success Rate to 3.6%– below the unmodified baseline– by actively sharpening the safety subspace rather than merely anchoring it. Across all three models, structural representational geometry (CKA, Fisher score) predicts safety behavior more reliably than absolute displacement metrics, establishing geometry-based monitoring as a necessary component of guard model evaluation in agentic deployments.
CogSLLaM: Cognitive Security for Large Language Models
Large Language Models (LLMs) are increasingly employed across general purpose, expert, and domain-intensive user contexts; in all instances, users rely on these systems for information summarization, task planning, and problem-solving, and even for advice and recommendations related to decision-making. LLMs are becoming embedded in highly technical do-mains, supporting cyber security, code development, health care, organizational policy analysis, and the interpretation, specification, and implementation of complex technical requirements. This expanding range of applications underscores the growing role of LLMs as general-purpose cognitive and technical support tools. However, increasing reliance on LLMs also introduces cognitive security risks, as erroneous or mis-leading outputs can shape user understanding, judgment, and decision-making in ways that produce real-world consequences. In this paper, we examine cognitive security challenges in LLM applications, their downstream effects on users, relevant technical approaches for addressing these risks, representative use cases, and our proposed Cognitive Security for LLMs framework. This framework focuses on three dimensions along which cognitive security may be threatened: informational, se-mantic, and stylistic. We conclude with key takeaways and future directions for reducing misleading and potentially harmful chatbot interactions across every day and high-stakes contexts.
Cybersecurity superintelligence--artificial intelligence exceeding the best human capability in both speed and strategic reasoning--represents the next frontier in security. This article will present the emergence of such capability through three of our major contributions that have helped pioneered the field of AI Security and are being used in the Cyber Battlefield today. First, PentestGPT (2023) established LLM-guided penetration testing, achieving 228.6% improvement over baseline models through an architecture that externalizes security expertise into natural language guidance. Second, Cybersecurity AI (CAI, 2025) demonstrated automated expert-level performance, operating 3,600× faster than humans while reducing costs 156-fold, validated through #1 rankings at international competitions including the $50,000 Neurogrid CTF prize. Third, Generative Cut-the-Rope (G-CTR, 2026) introduces a neurosymbolic architecture embedding game-theoretic reasoning into LLM-based agents: symbolic equilibrium computation augments neural inference, doubling success rates while reducing behavioral variance 5.2× and achieving 2:1 advantage over non-strategic AI in Attack & Defense scenarios. Together, these advances establish a clear progression from AI-guided humans to human-guided game-theoretic cybersecurity superintelligence.
HoneyContent: Wrapping Deception Storyline Content to Warrant Human and LLM Agent Attacker Evaluations of Deception Functions and Effects
This position paper suggests that presenting deception storyline content could warrant or influence human and Large Language Model (LLM) Agent attackers’ evaluations of deception functions and effects as more authentic. While there is growing attention to the need for cyber deception design that is adaptive to the cognitive and behavioral vulnerabilities of attackers, there has been limited discussion of how content and communication presenting deception storylines could influence how attackers evaluate the authenticity of real and imagined deception functions and effects on a network or host. There is perhaps even less understanding of how deception storyline content could influence LLM Agent attackers. We introduce HoneyContent, our practiced industry cyber deception model for designing and creating deception storyline content to ‘wrap’ or embed our deception functions. We will introduce warranting theory and signaling theory as the foundational content and communication frameworks we integrate to design and create our deception storyline content. We will also discuss recent findings from researchers modeling LLM Agent behaviors in response to introduction of content to misdirect their functions, namely related to informing these LLM Agents that a task was completed or that there is no need to perform a task. We recognize the similarity to presenting deception storyline content to influence humans and LLM Agent attackers. We will visualize the use of HoneyContent based on an industry cyber deception scenario that demonstrated anecdotally how this integrated design and content creation model could make deception functions look more real. We suggest that the use of generative artificial intelligence and LLM Agent defenders could further enhance warranted evaluations of these deception storylines and the embedded or wrapped deception functions and effects, because this presentation of deception storyline content is based on the behavioral vulnerabilities of these attackers.
Deceptive Misuse of Low-Code Platforms: Visualizing the Performance of Disruptive Cyber Effects from Human and LLM Agent Attackers
This position paper visualizes how human and Large Language Model (LLM) Agent attackers could manipulate low-code platforms to perform disruptive cyber effects to dazzle and misdirect the attention of human defenders. There are a growing number of public examples of unknown attackers who gain unauthorized but limited access to a network with minimal credentials and then cause disruption. One of the goals of this disruption or even performance of disruption appears to be to confuse or misdirect human defenders and cause reputational harm for the victim organization. A recent example could include the Sha1-Hulud worm attacks. We look at Power Apps or Power Automation, a low-code platform that is so common that most organizations do not consider this platform to be a vulnerability. In our experience as cyber deception and detection engineering practitioners, and in discussions with information security practitioners, we find that most larger organizations do not closely monitor the sometimes thousands of Power Apps templates available to any user, with a range of access controls and broad permissions. We argue in this paper that that this low-code platform could be exploited by human and LLM Agent attackers with minimal effort, starting with basic user credentials. We suggest that an LLM Agent attacker could exploit this platform more instrumentally than a human attacker, but both attackers could use deception techniques such as dazzling to gather enough information to engineer a highly disruptive cyber effect. We will discuss the Bell-Whaley deception framework to explain how simulation and dissimulation could be applied in this scenario. We will visualize a human or LLM Agent attacker who gains unauthorized access to a network with basic credentials to then use Power Apps to automate hundreds of emails throughout an organization with what appears to be explicit content. We will share some of our observations from a think-aloud exercise with a mixed sample of information security practitioners where we introduced this same scenario, finding that network defenders may be demonstrating some bias in their real and imagined impressions of prototypical attackers using low-code platforms like Power Apps.
The Agentic AI Army That Never Was: Projecting LLM Swarm Narratives with ‘Noisy’ LLM Sock Puppets and Whaley’s Theory of Outs
This short position paper suggests there may be greater deception and influence of an attacker’s perceptions of a fictional ‘Agentic AI Army’ swarm of LLM sock puppet network defenders than deploying real LLM agent swarms. We model a counterintuitive industry approach integrating Whaley’s lesser-known Theory of Outs and “turnabout” deception techniques to encourage a human or LLM attacker’s discovery of deception on an industry network. While we recognize that the knowledge of real or imagined deception can deter an attacker, we also recognize that attackers may demonstrate greater confidence on a network after discovering what appears to be deception artifacts. We visualize how ‘noisy’ LLM sock puppets inside of a network that prompt optimized query returns on their content and placement on the network could draw attackers to later stage deception functions and effects and enhanced defender alerting and analysis on human or LLM attacker interaction with those deception functions. We find in anecdotal operational research that highlighting ‘noisy’ sock puppet content enhances high-fidelity detection. We frame these findings using this integrated industry model in the context of LLM swarm narratives for deception. There has been an increasing concentration on swarming as a military technique and military strategy, as modern military conflicts continue to adapt to irregular warfare environments. The renewed concentration on developing and integrating swarm intelligence with LLM agents continues to face limitations, in terms of simulating natural swarm behaviors and operating autonomously as part of a decentralized model. This short position paper proposes a more immediate deception and influence effect, namely projecting fictional LLM swarm narratives suggesting there is an ‘Agentic AI Army’ assisting human defenders. We use organizational perception management as a design framework to visualize a deception and influence narrative communicating this fictional narrative using ‘noisy’ LLM sock puppets and our integrated model of Whaley’s Theory of Outs and “turnabout” deception techniques.
Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agents
Large language models are becoming deep agents that plan, persist state, and invoke tools, shifting safety failures from unsafe text to unsafe trajectories. We introduce AgentFence, an architecture-centric security evaluation that defines 14 trust-boundary attack classes across planning, memory, retrieval, tool use, and delegation, and detects failure via trace-auditable conversation breaks: unauthorized or unsafe tool use, wrong-principal actions, state or objective integrity violations, and attack-linked deviations. Holding the base model fixed, we evaluate eight agent archetypes under persistent multi-turn interaction and find substantial architectural variation in mean security break rate (MSBR), from 0.29 ± 0.04 for LangGraph to 0.51 ± 0.07 for AutoGPT. The highest-risk classes are operational: Denial-of-Wallet at 0.62 ± 0.08, Authorization Confusion at 0.54 ± 0.10, Retrieval Poisoning at 0.47 ± 0.09, and Planning Manipulation at 0.44 ± 0.11, while prompt-centric classes remain below 0.20 under standard settings. Breaks are dominated by boundary violations: SIV 31%, WPA 27%, UTI plus UTA 24%, and ATD 18%. Authorization confusion correlates with objective and tool hijacking, with rho approximately 0.63 and rho approximately 0.58, respectively. AgentFence reframes agent security around what matters operationally: whether an agent stays within its goal and authority envelope over time.
Contrastive Adversarial Agents for Intentional Drift Induction in Network Intrusion Detection Systems
Retraining and drift-adaptation methods for Network Intrusion Detection Systems (NIDS) are effective when adversarial behavior evolves gradually or remains predictable. However, these defenses often degrade when faced with coordinated or intentionally diverse attackers that induce abrupt and adversarial concept drift; a particularly critical vulnerability in client-server NIDS deployments for high-stakes domains such as healthcare. In this work, we investigate a stronger threat model in which an ensemble of reinforcement learning attackers collaborates to strategically disrupt adaptive defenses. We introduce a contrastive learning framework that trains multiple adversarial agents to learn distinct and non-redundant packet perturbation strategies. By encouraging behavioral diversity while maintaining attack effectiveness, the ensemble generates heterogeneous evasion patterns that are deployed sequentially or adaptively to destabilize retraining mechanisms. This approach enables systematic study of intentional, multi-modal adversarial drift and exposes vulnerabilities in standard NIDS adaptation pipelines. Our results demonstrate that contrastively trained attacker ensembles significantly reduce detection accuracy, highlighting the need for more robust and diversity-aware defensive strategies.
Human-Aware Multi-Agent Cyber Defense for Distributed Nuclear Operational Technology Systems
Operational Technology (OT) systems used in small modular reactor deployments (SMR) are becoming increasingly interconnected, increasing exposure to cyber threats that can affect tightly coupled physical processes. These systems operate under strict real-time and reliability requirements, which limit how security mechanisms can be deployed and evaluated. We present a multi-agent system for cybersecurity analysis across distributed nuclear OT environments in SMR fleets. The system is built on a simulation-based framework and uses a supervisory agent to coordinate specialized agents for vulnerability analysis and remediation. Agent interactions are restricted through controlled interfaces, and safeguards are applied to prevent unsafe actions during analysis. The system is designed to support continuous inspection of simulated environments while maintaining separation from operational systems. Human operators remain involved in decision-making when actions affect system behavior, enabling security analysis to be performed without introducing risk to live infrastructure.
The Illusion of Optimal Defense: Static Interdiction Under Adaptive and Persistent Attackers
As cyber threats evolve into sophisticated multi-stage campaigns, organizations increasingly rely on optimized yet static defense strategies to protect their networks. However, these static interdiction models often underestimate the capabilities of intelligent adversaries who learn and adapt to defensive barriers. This paper proposes an adaptive attacker model based on reinforcement learning to evaluate the robustness of static defense strategies derived from the Critical Node Problem (CNP). Unlike conventional simulations that assume predictable attack patterns, our agent leverages Q-learning to dynamically discover bypass trajectories while adhering to realistic operational constraints such as local persistence and entry commitment. We evaluate this adaptive agent against defense sets optimized via integer linear programming across various budget constraints. Experimental results demonstrate that the adaptive attacker agent consistently outperforms stochastic baselines by identifying efficient detour paths, revealing a significant security gap in static defense evaluations. Our findings underscore the need for dynamic defense mechanisms that account for the evolving intelligence of modern cyber threats.
Toward Human-Aware Active Directory Defense with Fine-Tuned LLMs
Autonomous cyber defense agents increasingly need to query complex enterprise attack graphs under time pressure, yet today’s Active Directory (AD) tools still assume expert-authored Cypher queries. This paper studies natural-language-to-Cypher generation as a core tool-use action for human-aware AD defense agents operating over BloodHound-style graphs. We curate 346 executable English–Cypher pairs from practitioner queries, augment them to 2,768 samples via constrained paraphrasing, and fine-tune an open-weight Mixtral‑8×7B model using QLoRA. Across ten representative BloodHound-equivalency tasks on five synthetic AD graphs, fine-tuning raises parse success from 0.80 to 0.94 and correct-answer rate from 0.34 to 0.42. These gains should be interpreted as evidence that domain tuning can improve syntactic robustness in a controlled setting, rather than as evidence of production-ready semantic reliability or real-enterprise scalability. Error analysis reveals safety-critical semantic gaps in domain admin identification, unsupported-OS detection, and temporal constraints. We argue that, for cyber defense agents, schema prompting and fine-tuning alone are insufficient: safe autonomy over AD graphs requires execution-grounded correction, explicit domain guardrails, and interaction designs that calibrate human trust in LLM-generated queries.
Cyber-Agent-Flow: Execution Trace Instrumentation and Analysis for Cybersecurity Agent Workflows (Extended Abstract)
Large language models (LLMs) are increasingly explored as agents capable of assisting with complex cybersecurity tasks such as reconnaissance, vulnerability discovery, and penetration testing. Recent systems demonstrate that LLMs can coordinate multi-step workflows by combining reasoning with tool execution. However, most current evaluations focus primarily on task completion and provide limited insight into how agents behave during real-world engagements. We present an instrumentation framework, AgentFlow, designed to improve the observability and analysis of agent-driven workflows; and we use it to target the cybersecurity domain. It records detailed execution traces capturing prompts, model responses, tool invocations, command outputs, and analyst annotations from penetration testing engagements. The framework integrates local cybersecurity tools through Model Context Protocol (MCP) interfaces while supporting privately hosted language models. Applying this framework to multi-step pivoting scenarios, we collect execution traces and analyze agent reasoning and tool orchestration. Observations reveal inefficiencies including redundant reasoning loops, repeated tool invocations, and suboptimal sequencing strategies — highlighting opportunities for improving the reliability and efficiency of agent-assisted cybersecurity operations.
From Playbooks to Decisions: An Auditable Coordination Protocol for Hunter–Policy–Responder Cyber Agents (Extended Abstract)
While Security Orchestration, Automation, and Response (SOAR) systems operationalize incident workflows through playbooks, they often lack a decision-provenance mechanism suited to multi-agent settings—where one agent proposes actions, another authorizes them, and a third executes them. We introduce the Cyber Agent Coordination Protocol (CACP), an auditable coordination layer that transitions agent collaboration from free-form dialogue to role-typed commitments. CACP enforces explicit authority boundaries across Hunter–Policy–Responder roles and emits signed, hash-chained Decision Cards that bind (i) evidence pointers and hashes, (ii) policy checks (e.g., rules-of-engagement clauses), and (iii) execution receipts into a queryable provenance record. To avoid a centralized bottleneck, CACP supports federated logging with periodic Merkle-root checkpointing to an immutable ledger. In a small simulated testbed (50 scenarios; 2 analysts), CACP reduced mean time-to-audit by 42% (8.6s → < 5s) relative to unstructured agent logs, and prevented execution of out-of-policy actions in a bounded suite of 100 indirect prompt-injection attempts, while adding 22ms mean coordination latency per decision cycle (vs. 1.2s average LLM inference).
Beyond Common Knowledge: A Belief-Reasoning Framework for Non-Equilibrium Games and Its Graphical Representation (Extended Abstract)
Classical Game Theory heavily relies on the “Common Knowledge” assumption, which mandates that all players know the game structure and others’ rationality ad infinitum. However, in asymmetric information scenarios, this assumption often collapses. This paper proposes a Belief-Reasoning Knowledge Model that decouples “States” from “Observable Features.” We introduce the Belief Forest, a graphical data structure to visualize and compress nested belief chains. We demonstrate the model’s efficacy through the “Hat Game” and a specialized Full-Belief Static Game analysis of the “Huarong Path” (Huarongdao) problem. We show that agents can achieve belief-driven strategies by assigning probability weights to belief trees, even in the absence of common knowledge.