← Back to all news
arXiv Machine Learning By Fernando Martinez, Abhishek Satyam, Tao Li, Junaid Farooq, Ying Wang, Juntao Chen

Ask the Expert: LLM-Guided Reinforcement Learning for Autonomous Cyber Defense

Read the original on arXiv Machine Learning →

The paper introduces Ask the Expert, a training-time framework that leverages large language models (LLMs) to guide reinforcement learning for autonomous cyber defense. It summarizes complex cyber‑defense states, intermittently queries an LLM for host‑level defensive recommendations via a constrained action interface, and then uses those recommendations to shape rewards for PPO training. After training, the LLM is discarded, leaving a pure RL policy that improves sample efficiency and outperforms potential‑based reward shaping baselines on TTCP CAGE CC1 and CC2 scenarios.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Machine Learning.

Related stories

arXiv Machine Learning
Aug 3

Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations

arXiv:2607. 28826v1 Announce Type: new Abstract: Autonomous Cyber Operations (ACO) are increasingly important for defending enterprise networks as cyber threats continue to evolve in sophistication.

By Konur Tholl, Fran\c{c}ois Rivest, Mariam El Mezouar, Adrian Taylor, Ranwa Al Mallah
llmsagentsreinforcement-learningfine-tuningefficiencysafety
More like this →
Hugging Face Trending Papers
Aug 5

Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)

Autonomous cyber defense systems based on Deep Reinforcement Learning (DRL) have attracted significant research attention, yet remain evaluated almost exclusively against static, heuristic red agents, leaving their robustness against adaptive threats critically understudied. Meanwhile, recent advances in Reinforcement Learning with Verifiable Rewards (RLVR) have improved LLM reasoning, but their integration into cybersecurity remains elusive due to the absence of suitable benchmark environments and interaction datasets.

llmsagentsreinforcement-learningbenchmarks
More like this →
arXiv AI
Oct 2

Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution

The paper explores using frozen large language models (LLMs) to control hierarchical cyber defense systems without retraining across different network scales. By separating planning (selecting subnets to defend) from execution (choosing defensive actions), the authors compare RL+RL, LLM+RL, and LLM+LLM setups in the Cyberwheel environment. Results show that while an LLM planner alone offers limited gains, extending LLM control to execution—especially with a 70B general‑purpose model—yields strong defensive performance across small, medium, and large networks, matching or surpassing retrained RL baselines.

By Harshith Doppalapudi, Nathaniel D. Bastian, Ankit Shah
llmsagentsreinforcement-learningsafety
More like this →
arXiv AI
Aug 6

Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)

arXiv:2608. 04317v1 Announce Type: cross Abstract: Autonomous cyber defense systems based on Deep Reinforcement Learning (DRL) have attracted significant research attention, yet remain evaluated almost exclusively against static, heuristic red agents, leaving their robustness against adaptive threats critically understudied.

By Ryozo Masukawa, Ian Bryant, Armita Kazeminajafabadi, Sanggeon Yun, Hyunwoo Oh, SungHeon Jeong, Nathaniel D. Bastian, Mahdi Imani, Mohsen Imani
llmsagentsreinforcement-learningbenchmarks
More like this →