Safety-Contract Graph Multi-Agent Reinforcement Learning for Autonomous Network Security Response

• URL: http://arxiv.org/abs/2606.13832v1
• Date: Thu, 11 Jun 2026 19:02:48 GMT
• Title: Safety-Contract Graph Multi-Agent Reinforcement Learning for Autonomous Network Security Response
• Abstract summary: We present a safety-contract graph MARL framework and instantiate it as ACD$3$-GAT (Adaptive Constrained Counterfactual Decisioning with a Graph Attention Network encoder)<n>We evaluate the method in CAGE Challenge 4, where agents operate under budgets for Mean Time to Recover (MTTR), false-positive response, and firewall change-management disruption.<n>This complements prior CAGE Challenge 4 findings by showing that reward-only learning lacks operational discipline.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Autonomous network-security response systems promise to reduce Security Operations Centre (SOC) reaction latency, but reward-only multi-agent reinforcement learning (MARL) can improve security reward while remaining non-deployable. We present a safety-contract graph MARL framework and instantiate it as ACD$^3$-GAT (Adaptive Constrained Counterfactual Decisioning with a Graph Attention Network encoder), an architecture that separates simulator observations from reusable operational budgets, constrained optimization, graph state encoding, and counterfactual action screening. We evaluate the method in CAGE Challenge 4, where agents operate under budgets for Mean Time to Recover (MTTR), false-positive response, and firewall change-management disruption. Across the benchmark, every unconstrained method violates the SOC downtime budget in 100% of evaluated episodes, with mean downtime proxy costs of 311-430 against a budget of 50. This complements prior CAGE Challenge 4 findings by showing that reward-only learning lacks operational discipline. Constrained MAPPO-GAT (C-MAPPO-GAT) isolates Lagrangian operational-cost control and budget-aware screening, while ACD$^3$-GAT adds budget context, CVaR tail-risk estimation, opponent-belief state, and Graph Counterfactual Risk Propagation (G-CRP). The replicated comparison includes three 200-episode seeds for IPPO, MAPPO-GAT, C-MAPPO-GAT, and ACD$^3$-GAT. C-MAPPO-GAT reduces downtime violation from 100% to 0.3% and mean downtime cost from 355.4 to 15.5 relative to MAPPO-GAT. ACD$^3$-GAT reduces mean downtime cost to 48.2 with a 13.8% violation rate, placing it on the safety-contract frontier rather than at the most conservative compliance point. Topology-seed and coupled adaptive Red-process stress tests preserve this contrast and show lower worst adaptive degradation for safety-constrained policies than reward-only MAPPO-GAT.

Related papers

• Safe Remediation as Risk-Constrained Intervention Decision in Microservice Systems [2.1686718805804976]
  In modern IT operations (IT-Ops), the cost of an incorrect repair often exceeds the cost of no action at all.<n>This paper makes three contributions to close this gap: (i) we reformulate safe remediation as a risk-constrained intervention decision problem; (ii) we introduce a three-dimensional risk decomposition; and (iii) we design a context-adaptive human-in-the-loop (HITL) gate that turns from a binary failsafe into a bandwidth-aware control layer.
  arXiv  Detail & Related papers  (2026-07-22T10:43:14Z)
• WMAttack: Automated Attack Search for Adversarial Evaluation of World-Model Agents [53.84430233754606]
  We introduce WMAttack, an automated attack-search framework for adversarial evaluation of world-model agents.<n> WMAttack formulates robustness evaluation as a finite-budget search over attack configurations.<n>We show that WMAttack consistently discovers stronger attacks than the evaluated baselines.
  arXiv  Detail & Related papers  (2026-05-22T04:31:09Z)
• Learning When to Act: Communication-Efficient Reinforcement Learning via Run-Time Assurance [0.27998963147546146]
  We show that a single policy can learn control inputs and communication-efficient timing decisions under a pointwise Lyapunov safety shield.<n>A run-time assurance layer overrides the policy via a one-step-ahead Lyapunov prediction and a precomputed LQR backup.<n>A 12-state 3D quadrotor case study extends the framework to higher-dimensional systems where classical STC is intractable.
  arXiv  Detail & Related papers  (2026-05-11T23:55:15Z)
• Cognitive Friction: A Decision-Theoretic Framework for Bounded Deliberation in Tool-Using Agents [0.0]
  Unconstrained tool-using agents must decide which information source to query and act on.<n>We propose the Triadic Cognitive Architecture (TCA), a decision-theoretic framework that formalizes these failure modes via cognitive friction.<n>We validate TCA in two controlled environments designed to isolate stopping quality, action selection under congestion, and temporal urgency.
  arXiv  Detail & Related papers  (2026-03-31T17:30:25Z)
• LLM Readiness Harness: Evaluation, Observability, and CI Gates for LLM/RAG Applications [51.56484100374058]
  We present a readiness harness for LLM and RAG applications that turns evaluation into a deployment decision workflow.<n>The system combines automated benchmarks, OpenTelemetry observability, and CI quality gates under a minimal API contract.<n>We evaluate the harness on ticket-routing and BEIR tasks with full Azure matrix coverage.
  arXiv  Detail & Related papers  (2026-03-28T18:03:32Z)
• Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG [5.4716896485317195]
  Current stateless defences for multimodal agentic RAG fail to detect adversarial strategies that distribute malicious semantics.<n>We introduce MMA-RAGT, an inference-time control framework governed by a Modular Trust Agent (MTA) that maintains an approximate belief state.
  arXiv  Detail & Related papers  (2026-02-24T23:52:27Z)
• Reward Under Attack: Analyzing the Robustness and Hackability of Process Reward Models [68.45272703833209]
  We show that state-of-the-art PRMs are systematically exploitable under adversarial optimization pressure.<n>We introduce a three-tiered diagnostic framework that applies increasing adversarial pressure to quantify these vulnerabilities.<n>We release PRM-BiasBench and a diagnostic toolkit to enable robustness evaluation before deployment.
  arXiv  Detail & Related papers  (2026-02-20T23:38:03Z)
• Safe Langevin Soft Actor Critic [10.683491090059867]
  We introduce Safe Langevin Soft Actor-Critic (SL-SAC) to balance reward and safety in constrained reinforcement learning.<n>We show that SL-SAC achieves the lowest cost in 7 out of 10 tasks while maintaining competitive returns.<n>On Safety-Gymnasium, SL-SAC achieves cost reductions of 19-63% in velocity tasks compared to state-of-the-art baselines.
  arXiv  Detail & Related papers  (2026-01-31T08:06:35Z)
• Quantifying Return on Security Controls in LLM Systems [0.0]
  This paper introduces a decision-oriented framework to quantify residual risk.<n>It converts adversarial probe outcomes into financial risk estimates and return-on-control metrics.
  arXiv  Detail & Related papers  (2025-12-17T04:58:09Z)
• R-Stitch: Dynamic Trajectory Stitching for Efficient Reasoning [80.104336426172]
  Chain-of-thought (CoT) enhances problem-solving ability of large language models.<n>CoT incurs substantial inference cost due to long autoregressive trajectories.<n>We introduce R-Stitch, a training-free hybrid decoding framework.
  arXiv  Detail & Related papers  (2025-07-23T08:14:36Z)
• G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering [116.4277292854053]
  Federated Learning (FL) offers collaborative model training without data sharing. FL is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. We present G$2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem.
  arXiv  Detail & Related papers  (2023-06-08T07:15:04Z)
• IBP Regularization for Verified Adversarial Robustness via Branch-and-Bound [85.6899802468343]
  We present IBP-R, a novel verified training algorithm that is both simple effective. We also present UPB, a novel robustness based on $beta$-CROWN, that reduces the cost state-of-the-art branching algorithms.
  arXiv  Detail & Related papers  (2022-06-29T17:13:25Z)
• Penalized Proximal Policy Optimization for Safe Reinforcement Learning [68.86485583981866]
  We propose Penalized Proximal Policy Optimization (P3O), which solves the cumbersome constrained policy iteration via a single minimization of an equivalent unconstrained problem. P3O utilizes a simple-yet-effective penalty function to eliminate cost constraints and removes the trust-region constraint by the clipped surrogate objective. We show that P3O outperforms state-of-the-art algorithms with respect to both reward improvement and constraint satisfaction on a set of constrained locomotive tasks.
  arXiv  Detail & Related papers  (2022-05-24T06:15:51Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.