Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper frames OS vulnerability discovery as a repeated Bayesian Stackelberg game, where an LRM orchestrator strategically allocates analysis budget across kernel components based on verifier feedback. They introduce VCAO, a six-layer architecture that uses a DOBSS-derived MILP to optimize resource allocation across heterogeneous analysis tools, guided by online Stackelberg learning with regret bounds. Experiments on Linux kernel subsystems demonstrate that VCAO discovers significantly more validated vulnerabilities with lower false-positive rates compared to baselines like coverage-only fuzzing and static analysis.
Outsmart attackers and find 2.7x more vulnerabilities by strategically orchestrating fuzzers and static analyzers with a game-theoretic AI agent.
We formulate operating-system vulnerability discovery as a \emph{repeated Bayesian Stackelberg search game} in which a Large Reasoning Model (LRM) orchestrator allocates analysis budget across kernel files, functions, and attack paths while external verifiers -- static analyzers, fuzzers, and sanitizers -- provide evidence. At each round, the orchestrator selects a target component, an analysis method, and a time budget; observes tool outputs; updates Bayesian beliefs over latent vulnerability states; and re-solves the game to minimize the strategic attacker's expected payoff. We introduce \textsc{VCAO} (\textbf{V}erifier-\textbf{C}entered \textbf{A}gentic \textbf{O}rchestration), a six-layer architecture comprising surface mapping, intra-kernel attack-graph construction, game-theoretic file/function ranking, parallel executor agents, cascaded verification, and a safety governor. Our DOBSS-derived MILP allocates budget optimally across heterogeneous analysis tools under resource constraints, with formal $\tilde{O}(\sqrt{T})$ regret bounds from online Stackelberg learning. Experiments on five Linux kernel subsystems -- replaying 847 historical CVEs and running live discovery on upstream snapshots -- show that \textsc{VCAO} discovers $2.7\times$ more validated vulnerabilities per unit budget than coverage-only fuzzing, $1.9\times$ more than static-analysis-only baselines, and $1.4\times$ more than non-game-theoretic multi-agent pipelines, while reducing false-positive rates reaching human reviewers by 68\%. We release our simulation framework, synthetic attack-graph generator, and evaluation harness as open-source artifacts.