Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning

• URL: http://arxiv.org/abs/2604.04442v1
• Date: Mon, 06 Apr 2026 05:40:43 GMT
• Title: Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning
• Abstract summary: We present the Causal Multi-Agent Decision Framework (C-MADF) for autonomous cyber defense.<n>C-MADF integrates causal modeling with adversarial dual-policy control.<n>On the real-world CICIoT2023 dataset, C-MADF reduces the false-positive rate from 11.2%, 9.7%, and 8.4% in three cutting-edge literature baselines to 1.8%.
• Score: 2.0391237204597368
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Autonomous agents are increasingly deployed in both offensive and defensive cyber operations, creating high-speed, closed-loop interactions in critical infrastructure environments. Advanced Persistent Threat (APT) actors exploit "Living off the Land" techniques and targeted telemetry perturbations to induce ambiguity in monitoring systems, causing automated defenses to overreact or misclassify benign behavior as malicious activity. Existing monolithic and multi-agent defense pipelines largely operate on correlation-based signals, lack structural constraints on response actions, and are vulnerable to reasoning drift under ambiguous or adversarial inputs. We present the Causal Multi-Agent Decision Framework (C-MADF), a structurally constrained architecture for autonomous cyber defense that integrates causal modeling with adversarial dual-policy control. C-MADF first learns a Structural Causal Model (SCM) from historical telemetry and compiles it into an investigation-level Directed Acyclic Graph (DAG) that defines admissible response transitions. This roadmap is formalized as a Markov Decision Process (MDP) whose action space is explicitly restricted to causally consistent transitions. Decision-making within this constrained space is performed by a dual-agent reinforcement learning system in which a threat-optimizing Blue-Team policy is counterbalanced by a conservatively shaped Red-Team policy. Inter-policy disagreement is quantified through a Policy Divergence Score and exposed via a human-in-the-loop interface equipped with an Explainability-Transparency Score that serves as an escalation signal under uncertainty. On the real-world CICIoT2023 dataset, C-MADF reduces the false-positive rate from 11.2%, 9.7%, and 8.4% in three cutting-edge literature baselines to 1.8%, while achieving 0.997 precision, 0.961 recall, and 0.979 F1-score.

Related papers

• Modality-Decoupled Federated Learning for Privacy-Preserving Embodied Intelligence in 6G [90.42669277637026]
  Sixth-generation (6G) wireless networks are expected to provide a key infrastructure for large-scale embodied intelligence.<n>This article proposes FedMVLA, a modality-decoupled FL framework for privacy-preserving embodied intelligence in 6G networks.
  arXiv  Detail & Related papers  (2026-09-09T01:36:44Z)
• Defense Against LLM Backdoors using Critical Neuron Isolation Pruning [29.131051732315157]
  Large language models (LLMs) are vulnerable to backdoor attacks, where hidden triggers induce malicious outputs.<n>Existing defenses fall into inference-time detection or training-time mitigation, but face two key limitations.<n>DeCNIP (Defense with Critical Neuron Isolation Pruning) identifies trigger-like behaviors by optimizing a cross-entropy loss.<n>It then isolates Backdoor Critical Neurons (BCNs) and prunes them selectively to remove malicious influence.
  arXiv  Detail & Related papers  (2026-07-22T08:29:06Z)
• Provably Secure Agent Guardrail [89.79561918065122]
  Existing defense architectures rely on empirical semantic guardrails and probabilistic large model adjudicators.<n>This paper proposes a new security paradigm for agents based on the fundamental limitations of logical reasoning.
  arXiv  Detail & Related papers  (2026-05-28T02:12:41Z)
• Real-Time Evaluation of Autonomous Systems under Adversarial Attacks [0.29360071145551064]
  This work presents an offline trajectory-learning and adversarial robustness evaluation framework grounded in real-world intersection driving data.<n>We train and compare three trajectory-learning paradigms: Multi-Layer Perceptron (MLP)-based Behavior Cloning (BC), Transformer-based object-tokenized BC, and inverse reinforcement learning (IRL)<n>Inference-time robustness is assessed by subjecting trained policies to gradient-based adversarial perturbations across multiple intersection scenarios.
  arXiv  Detail & Related papers  (2026-05-05T08:30:18Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• From Agent Failure Paths to Quantified Residual Risk: A Compositional Framework for Resilient Agentic AI [8.947753534117298]
  Agentic AI is crossing trust boundaries faster than current risk models can represent.<n>We propose a mechanism-to-magnitude pipeline for resilient agentic and embodied AI.<n>We show the framework on two contrasting scenarios a real-time warehouse robot and a governance-instrumented financial-services agent.
  arXiv  Detail & Related papers  (2026-04-28T23:40:24Z)
• Beyond Single-Agent Alignment: Preventing Context-Fragmented Violations in Multi-Agent Systems [10.660248467840821]
  We identify and formalize a novel security risk: Context-Fragmented Violations (CFVs)<n>CFVs are a class of policy breaches where individual agent actions appear locally safe and reasonable, yet collectively violate organizational policies.<n>We propose Distributed Sentinel, a distributed zero-trust enforcement architecture.
  arXiv  Detail & Related papers  (2026-04-24T03:08:52Z)
• The Cognitive Penalty: Ablating System 1 and System 2 Reasoning in Edge-Native SLMs for Decentralized Consensus [0.0]
  We introduce Sentinel-Bench, an 840-inference empirical framework executing a strict intra-model ablation on Qwen-3.5-9B.<n>System 1 achieved 100% adversarial robustness, 100% juridical consistency, and state finality in under 13 seconds.<n>System 2 reasoning introduced catastrophic instability, fundamentally driven by a 26.7% Reasoning Non-Convergence (cognitive collapse) rate.
  arXiv  Detail & Related papers  (2026-04-18T08:46:37Z)
• Explainability-Guided Defense: Attribution-Aware Model Refinement Against Adversarial Data Attacks [6.573058520271728]
  We identify a connection between interpretability and robustness that can be directly leveraged during training.<n>We introduce an attribution-guided refinement framework that transforms Local Interpretable Model-Agnostic Explanations into an active training signal.
  arXiv  Detail & Related papers  (2026-01-02T19:36:03Z)
• Cracking IoT Security: Can LLMs Outsmart Static Analysis Tools? [1.8549313085249322]
  This work presents the first comprehensive evaluation of Large Language Models (LLMs) across a multi-category interaction threat taxonomy.<n>We benchmark Llama 3.1 8B, Llama 70B, GPT-4o, Gemini-2.5-Pro, and DeepSeek-R1 across zero-, one-, and two-shot settings.<n>Our findings show that while LLMs exhibit promising semantic understanding, their accuracy degrades significantly for threats requiring cross-rule structural reasoning.
  arXiv  Detail & Related papers  (2026-01-02T04:17:36Z)
• Cognitive Control Architecture (CCA): A Lifecycle Supervision Framework for Robustly Aligned AI Agents [1.014002853673217]
  LLM agents are vulnerable to Indirect Prompt Injection (IPI) attacks.<n>IPI attacks hijack agent behavior by polluting external information sources.<n>We propose the Cognitive Control Architecture (CCA), a holistic framework achieving full-lifecycle cognitive supervision.
  arXiv  Detail & Related papers  (2025-12-07T08:11:19Z)
• Hiding in the AI Traffic: Abusing MCP for LLM-Powered Agentic Red Teaming [0.0]
  We introduce a novel command & control (C2) architecture leveraging the Model Context Protocol (MCP) to coordinate adaptive reconnaissance agents covertly across networks.<n>We find that our architecture not only improves goal-directed behavior of the system as whole, but also eliminates key host and network artifacts that can be used to detect and prevent command & control behavior altogether.
  arXiv  Detail & Related papers  (2025-11-20T02:51:04Z)
• Alignment Tipping Process: How Self-Evolution Pushes LLM Agents Off the Rails [103.05296856071931]
  We identify the Alignment Tipping Process (ATP), a critical post-deployment risk unique to self-evolving Large Language Model (LLM) agents.<n>ATP arises when continual interaction drives agents to abandon alignment constraints established during training in favor of reinforced, self-interested strategies.<n>Our experiments show that alignment benefits erode rapidly under self-evolution, with initially aligned models converging toward unaligned states.
  arXiv  Detail & Related papers  (2025-10-06T14:48:39Z)
• A Comparative Analysis of Ensemble-Based Machine Learning Approaches with Explainable AI for Multi-Class Intrusion Detection in Drone Networks [0.2708211191235587]
  This research aims to develop a robust and interpretable intrusion detection framework tailored for drone networks.<n>We present a comparative analysis of ensemble-based machine learning models, namely Random Forest, Extra Trees, AdaBoost, CatBoost, and XGBoost, trained on a labeled dataset.<n>The proposed approach not only delivers near-perfect accuracy but also ensures interpretability, making it highly suitable for real-time and safety-critical drone operations.
  arXiv  Detail & Related papers  (2025-09-23T00:59:21Z)
• Efficient Adversarial Training in LLMs with Continuous Attacks [99.5882845458567]
  Large language models (LLMs) are vulnerable to adversarial attacks that can bypass their safety guardrails. We propose a fast adversarial training algorithm (C-AdvUL) composed of two losses. C-AdvIPO is an adversarial variant of IPO that does not require utility data for adversarially robust alignment.
  arXiv  Detail & Related papers  (2024-05-24T14:20:09Z)
• SAFE-SIM: Safety-Critical Closed-Loop Traffic Simulation with Diffusion-Controllable Adversaries [94.84458417662407]
  We introduce SAFE-SIM, a controllable closed-loop safety-critical simulation framework. Our approach yields two distinct advantages: 1) generating realistic long-tail safety-critical scenarios that closely reflect real-world conditions, and 2) providing controllable adversarial behavior for more comprehensive and interactive evaluations. We validate our framework empirically using the nuScenes and nuPlan datasets across multiple planners, demonstrating improvements in both realism and controllability.
  arXiv  Detail & Related papers  (2023-12-31T04:14:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.