arXiv:2605.03034v1 [cs.AI] 4 May 2026
Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense
Kerri Prinos Lilianne Brush Cameron Denton Zhanqi Wang Joshua Knox Snehal Antani Anton Foltz Amy Villaseñor Horizon3.ai San Francisco, CA {kerri.prinos, lili.brush, cameron.denton, zhanqi, joshua.knox, antani, anton.foltz, amy.villasenor}@horizon3.ai
Abstract Agentic systems involved in high-stake decision-making under adversarial pressure need formal guarantees not offered by existing approaches. Motivated by the operational needs of security operations centers (SOCs) that must configure endpoint detection and response (EDR) policies under adversarial pressure, we present a tool-mediated architecture: LLM agents use deterministic tools (Stackelberg best-response, Bayesian observer updates, attack-graph primitives) and select from finite action catalogs enforced at the tool-output interface. A composite Lyapunov function machine-checked in Lean 4 with zero sorry certifies controllability, observability from asymmetric sensor data, and Input-to-State Stability (ISS) robustness under intelligent adversarial disturbance, with two corollaries extending the certificate to any controller or adversary from the catalogs. On 282 real enterprise attack graphs, the claims hold with margin. On paired offensive/defensive telemetry, a tool-mediated Claude Sonnet 4 controller reduces the attacker’s expected payoff (game value) by 59% relative to a deterministic greedy baseline, with zero variance across 40 runs at four temperatures. A Claude Haiku 4.5 controller converges to suboptimal game values but stays catalog-bounded over an additional 40 runs, demonstrating that architectural stability is not dependent on the controller capability. The LLM agent’s non-determinism furthers creative exploration of strategies, while the tool-mediated architecture ensures system stability.
1
Introduction
Agentic AI is redefining the cyber threat landscape. CrowdStrike reported an 89% increase in attacks by AI-enabled adversaries in their 2026 Global Threat Report [1]. AI introduces new attacks, acts as a force multiplier, and accelerates breakout speed, giving defenders less time to detect and respond to threats [1]. In this new era, there is a critical need for reliable and rapid agentic defense systems that can keep pace with adaptive adversaries. Reinforcement learning and self-play, where autonomous agents learn the optimization of defense strategies through adversarial interaction, is a promising approach to build smarter defensive agents [2]. However, existing approaches converge on optimal strategies in O(103 ) training episodes [2] which is impractical when each episode is a real pentest with operational cost and risk. Autonomous attack and defense agents have independently demonstrated great success in real-world environments [3, 4]. We envision a system where an LLM-based defense agent meets its match: learning optimal defensive strategies on the fly against an adaptive LLM-based attacker agent. Within a feedback control loop, an LLM-based defense agent analyzes attack graphs, selects hardening actions, and invokes simulation tools, operating with what Eslami and Yu [5] characterize as endogenous modification of the control architecture. Simultaneously, an adaptive adversary observes Preprint.
the defender’s deployments and best-responds with novel attack strategies, acting as an intelligent disturbance on the system. But these agents are non-deterministic. Identical inputs produce different action selections across runs, with accuracy variance up to 15% even at T = 0 [6]. This non-determinism makes it difficult to predict agent behavior, and unconstrained agents can exhibit destructive actions in production [7]. Zhu [8] argues that controllability, observability, and stability are operational necessities for agentic cybersecurity and suggests Lyapunov stability as the required formal guarantee. The question is whether we can provide such guarantees despite the agents’ non-determinism. Several research directions converge on this need: guaranteed-safe-AI frameworks [9], runtime enforcement [10–12], per-action theorem proving [13], and safe RL with Lyapunov constraints [14– 16], but none provide machine-checked closed-loop stability guarantees where the disturbance is itself a best-responding agent. We take a different approach: combining game theory, control theory, and tool-mediated LLM control into a stable architecture where closed-loop stability is a property of the loop, not of the agent. From the blue team’s perspective, formal guarantees must answer three operational questions: Controllability — does each policy deployment make the defense strictly better? Robustness — when a novel technique emerges, how much damage can it cause? Observability — is the team’s understanding of its posture accurate? We formalize these as closed-loop stability properties: monotone decrease of the game value (Claim i), input-to-state stability under adversarial expansion (Claim ii), and observer convergence from asymmetric sensor data (Claim iii). We present a tool-mediated architectural pattern for LLM-in-the-loop adversarial control, validated on autonomous cyber defense. Our contributions are as follows: • Tool-mediated architecture. Our architecture combines a Bayesian observer over an asymmetrically-visible plant, Stackelberg best-response dynamics, double oracle expansion and catalog-membership enforcement at the tool-output interface which confines both controller and adversary to finite action sets. The LLM defense agent (controller) composes deterministic tool outputs, but does not compute them; no component is learned or fine-tuned, and convergence occurs within a single analysis cycle, requiring no training episodes. • Formal verification. Theorem 1 establishes three closed-loop properties — controllability, Input-to-State Stability (ISS) robustness under best-responding disturbance, and observability from asymmetric sensor data — via a composite Lyapunov function V (k) = S(k) + λθ(k), with proofs machine-checked in Lean 4 with zero sorry. Two corollaries extend the certificate to any controller and any adversary drawn from the catalogs. To our knowledge, this is the first mechanically-verified closed-loop stability certificate for a tool-mediated LLM controller. • Empirical validation on real-world security data. We empirically validate stability of the adversarial closed-loop system on 282 real enterprise attack graphs from production pentests (161 organizations, 25 industries) where the adversary aids belief-truth alignment (4.7× reduction in |S − Ŝ|), and on paired Horizon3.ai NodeZero offensive telemetry and Microsoft Defender XDR defensive telemetry where a tool-mediated Claude Sonnet 4 controller achieves S(kfinal ) = 0.34 versus 0.84 for a deterministic greedy baseline at σ = 0.000 across 40 runs at four temperatures, while a less capable Claude Haiku 4.5 controller stays catalog-bounded with non-zero σ, separating architectural stability from achieved game value.
2
Related Work
Our architecture combines four lines of prior work: composite Lyapunov stability, game-theoretic adversarial modeling, Endpoint Detection and Response (EDR) policy optimization, and tool-mediated LLM scaffolding. Composite Lyapunov stability and ISS. Hayakawa et al. [17] proved that a composite Lyapunov function decomposing into plant and estimator terms guarantees partial asymptotic stability. Jiang and Wang [18] established the ISS-Lyapunov equivalence. Zhu and Basar [19] pioneered the integration of game theory with control-theoretic methods for cyber-physical resilience, although their games-ingames principle addresses physical plant dynamics rather than EDR policy optimization. Eslami and 2
Yu [5] proposed a control-theoretic framework for LLM-based agentic system where runtime-adaptive LLM agents are modeled as endogenous modification of the control architecture, but they explicitly identified verification of stability assumptions for complex decision processes involving LLMs as an open problem. Game-theoretic adversarial modeling. In a Stackelberg security game [20, 21], the defender commits first and the adversary best-responds. Stackelberg security games with partial observability have been addressed by Durkota et al. [22] with Bayesian formulations and Miehling et al. [23] with POMDP-based dynamic defense. Double-oracle methods [24, 25] iteratively expand both strategy sets to converge to game equilibria without full enumeration. Zhang et al. [26] demonstrated scalability of the double oracle method to large AD graphs. Network interdiction [27] formalizes the game value as the best surviving path probability which we adopt for S(k). Romano and Pavel [28] use control theory to prove Nash convergence under exogenous disturbances. However, these methods guarantee convergence of the game equilibria, not stability of a closed-loop adversarial system where beliefs are derived from noisy, real-world sensor data. EDR policy optimization. EDR is a primary defense technology used by enterprise security teams to monitor, detect, and respond to threats on end-user devices [29]. Blue teams operating under partial or asymmetric observability must reason about an attacker’s behavior based on defensive telemetry and deploy defensive policies. Enabling every available policy in block mode is infeasible: each carries operational overhead (false positives, prerequisite dependencies, alert triage cost) that the SOC must absorb within a maintenance window. Analysis of 37 EDR vendors in MITRE ATT&CK evaluations reveals significant coverage variation requiring attack-graph-level correlation [30]. Outkin et al. [31] applied game-theoretic resource allocation to MITRE data; subsequent work explores centrality-based [32] and cost-benefit [33] approaches. These optimize over abstract allocation, not over a real vendor catalog with detect/block tradeoffs, budget constraints, and measured deployment outcomes. Tool-mediated LLM scaffolding. ReAct [34] interleaves reasoning with tool calls; SayCan [35] grounds actions through learned value functions; Inner Monologue [36] closes the loop via language feedback. G-CTR [37] pairs a game-theoretic solver to guide offensive and defensive LLM agents (5.2× variance reduction); MaMa [38] uses a Stackelberg meta-game to harden multi-agent designs. These reduce variance or secure outputs but do not certify system-level closed-loop stability.
3
Approach
We cast autonomous cyber defense as a closed-loop control problem blending LLM tool use, game theory, and control-theoretic stability. The system is a discrete-time non-linear feedback loop: G(k + 1) = f G(k), u(k), w(k) , y(k) = h G(k), w(k) .
(1)
where G(k) is the state of the adversarial graph, u(k) the control input (defender actions), w(k) the disturbance (adversary actions), and y(k) the observation (defender telemetry). A Stackelberg double-oracle game under asymmetric observability is integrated into the loop. Plant. The plant is a directed adversarial graph G(k) = (V, E): nodes are hosts at a stage of the attack chain (foothold, lateral, objective); edges are attacker actions (MITRE ATT&CK techniques applied to a host). Edge-local quantities depend on (e, k): • payoff(e, k) ∈ [0, 1]: attacker’s stage payoff if edge e is traversed at round k (technique impact and host criticality). • block(e, k) ∈ [0, 1]: probability the defender blocks traversal of edge e at time k. • detect(e, k) ∈ [0, 1]: probability the defender observes traversal of edge e at time k. • Pe (k) ∈ [0, 1]: defender’s posterior uncertainty on edge e at time k (belief error between ground truth G(k) and belief Ĝ(k) on that edge). Edges derive from temporal ordering within each host, cross-host credential flow, and causal parentchild links in the pentest attack-chain data. Nodes and edges update at each step via defender and attacker actions. 3
Asymmetric visibility. The attacker has full visibility of G(k); the defender maintains a belief graph Ĝ(k) built from defensive telemetry. Edges matched to alerts are initialized with uncertainty Pe = 0.15; unmatched edges are absent from Ĝ — these “dark edges” remain unknown to the defender until ground truth is revealed via the plant transition. The defender anticipates the attacker’s best-response over Ĝ(k) and may propose blocking, detection, or logging actions to shrink the dark-edge set. Controller. In our control feedback loop, the defender acts as the controller. Following the Stackelberg game model, the defender is the leader and the attacker observes the defender’s strategy and best-responds. Strategy-wise, the defender upgrades existing policies from logging to enforce, or uses the oracle to expand to new policies from a finite catalog C = {p1 , . . . , pn } spanning endpoint, identity, and cloud domains (compiled from public vendor and MITRE sources; Appendix B). Each deployment consumes one slot from a per-round budget B. The defender selects blocking actions to minimize the attacker’s payoff on its belief state graph Ĝ(k). The attacker’s expected payoff or game value is given by the maximum payoff reachable via any surviving path from ENTRY to OBJECTIVE [27, 26]:
S(k) = max p∈P
" Y
# ′ 1 − block(e, k) · max payoff(e , k) ′ e ∈p
e∈p
(2)
where P is the set of ENTRY-to-OBJECTIVE paths at round k; the product is the path’s survival probability and the inner max is the largest stage payoff on p. Tool-mediated action selection. The LLM controller never reads G(k) or Ĝ(k) directly, nor computes S(k), enumerates paths, or runs observer updates. All such quantities are produced by a bounded set of deterministic tools implementing Stackelberg best-response, Bayesian observer updates, and attack-graph primitives. The LLM issues tool calls, consumes structured outputs, and selects one catalog action per deployment slot. The defender is exposed to 9 tools (e.g. compute_v_after_deploy, simulate_round_ahead, get_critical_path, identify_dark_edges, list_deployable_policies) and the adversary to a mirror 11-tool suite (e.g. find_weakest_path, evaluate_new_edge, find_zero_day_opportunity); full inventories in Appendix D.2. This follows G-CTR’s [37] pattern (a ReAct [34] loop guided by a game-theoretic digest): non-determinism is confined to tool-composition and action-selection over deterministic outputs. Assumption A2 (catalog finiteness) is enforced at the tool-output interface, so off-catalog proposals are rejected as no-ops. §5.3 also evaluates a deterministic greedy controller (no tool calls, catalog policies ranked by marginal S(k) reduction) to isolate what the LLM’s tool-composition loop adds over the best deterministic alternative. Disturbance. The attacker observes the defender’s actions and ground truth graph state G(k) and uses an oracle to best-respond to G(k + 1) = f (G(k), u(k)) by proposing a new edge enew from a finite attack technique catalog T to maximize its payoff. New edges connect existing intermediate nodes (no ENTRY → OBJECTIVE bypass). Observer. A scalar Kalman filter per edge e ∈ Ĝ(k) contracts uncertainty Pe toward ground truth: Ke =
Pe (k − 1) , Pe (k − 1) + Rk
P̂e (k) ← P̂e (k − 1) + Ke ze − P̂e (k − 1) ,
(3)
Pe (k) ← (1 − Ke ) Pe (k − 1). Here, ze is the measurement from matched telemetry or ground-truth reveal, Rk > 0 the measurementnoise variance, and Ke ∈ (0, 1) the Kalman gain. Let Eobs (k) ⊆ E(Ĝ(k)) denote edges that receive a measurement at round k; contraction applies to each e ∈ Eobs (k) (Theorem 1). The per-edge innovation measures the gap between prediction and ground truth on an observed edge: |∆detect(e, k)| + |∆block(e, k)| + |∆traversal(e, k)| innov(e, k) = 1 − Pe (k) · . (4) 3 Each ∆-term is the absolute mismatch between belief and revealed ground truth on edge e (traversal coded 1/0). The factor (1 − Pe (k)) increases the weight of high-confidence mismatches. 4
Convergence criterion. We terminate the loop when either of the following conditions is met: • Strong Stackelberg Equilibrium (SSE) [20] criterion is met — neither the defender nor the attacker can improve their payoff by unilaterally deviating from their current strategy. P 1 • The mean innovation innov(k) = |E(Ĝ(k))| e∈E(Ĝ(k)) innov(e, k) < εinnov for two consecutive rounds, where εinnov > 0 is a fixed convergence threshold (value in §5.1), indicating belief has converged to ground truth. §4 formalizes the three closed-loop properties — Controllability, Robustness (ISS), and Observability— with two corollaries extending them to arbitrary controllers and adversaries. §5 empirically validates each claim.
4
Formal Verification of Closed-Loop Stability
Proof sketches appear in Appendix A; the full Lean 4 source (five files, ∼300 lines, zero sorry) is included in the supplementary material. Assumptions. (A1) The graph G is finite. (A2) The defender’s policy catalog C is finite. (A3) The attacker’s new edges are drawn from a finite attack technique set T and connect existing nodes. (A4) Persistent deployment: The defender and the attacker maintain the existing graph structure, update existing edges, or add new edges to the graph. They do not roll back or undo their actions. (A5) The Bayesian observer update is contractive: each observation strictly reduces Pe . Definition 1 (Composite Lyapunov function). We define a composite Lyapunov function V (k) as the sum of the game value S(k) and a weighted aggregate of edge uncertainties Pe (k), decomposing into plant and estimator terms as in [17]: V (k) = S(k) + λθ(k),
λ > 0,
(5)
P 1 where S(k) is the game value from (2) and θ(k) = P̄e (k) = |E(Ĝ(k))| e∈E(Ĝ(k)) Pe (k) ∈ [0, 1] is the mean per-edge posterior uncertainty on the belief graph. Both S(k) and θ(k) are positive definite decrescent functions bounded in [0, 1]. The Lyapunov function V (k) is non-negative and equals zero if and only if no attacker path from ENTRY to OBJECTIVE survives and the observer is perfectly calibrated (Pe = 0 for every edge in the belief graph). The three claims below are machine-checked in Lean 4 (Appendix A). Theorem 1 (Closed-loop stability). Under Assumptions (A1)–(A5), the closed-loop system satisfies the following: (i) Controllability (monotone decrease toward optimal defense). When no adversary disturbance occurs, V (k + 1) ≤ V (k) − αB S(k) − λδ Eobs (k) (6) where αB is a class-K function representing the minimum S(k) reduction from B greedy policy deployments and δ > 0 is the minimum reduction in θ per observed edge from the Bayesian observer update. (ii) Robustness (ISS under adversarial disturbance). Under adversary graph expansion, V (k + 1) ≤ V (k) − αB S(k) + γ |w(k)| − λδ Eobs (k) (7) where Enew (k) denotes the set of edges the attacker adds at round k (so |Enew (k)| = nnew ), with γ(|w(k)|) = 0 if Enew (k) = ∅ and otherwise γ |w(k)| = (1 − εantic ) max payoff(e, k), e∈Enew (k)
5
which bounds the single-round S increase from those edges; εantic ∈ [0, 1] is the anticipatory defense effectiveness. The system is ISS when αB +λδ Eobs (k) > γ(|w(k)|)+λ nnew Pmax , where Pmax is the maximum initial uncertainty assigned to a new edge. The non-expansivity bound follows from Hayakawa et al. [17]. (iii) Observability (observer convergence from asymmetric sensor data). θ(k) ≤ (1 − δ)k θ(0) + Cnew (k)
(8)
k
with θ(k) as in (5). The factor (1 − δ) θ(0) decays geometrically in the round index k. Cnew (k) is bounded by double oracle termination: the adversary’s technique set is finite (A4), the node set is finite (A1), anticipatory defense shrinks the effective pool each round, and diminishing returns ensure termination. After termination, Cnew stabilizes and the geometric decay dominates, yielding convergence to a bounded neighborhood. Corollary 1 (Controller-agnostic guarantee). Theorem 1 applies to any controller selecting from C; the bounds in (6)–(8) depend only on the action space, not on the controller’s decision process. An LLM controller operates within the action space defined by C and inherits all three stability guarantees. Corollary 2 (Adversary-agnostic bound). The disturbance bound γ scales with the maximum stage payoff among the edges in Enew (k) and with (1 − εantic ), not with how the adversary ranks the catalog internally. An LLM adversary may discover higher-payoff edges faster than a deterministic one but cannot exceed the maximum payoff over the finite attack technique set (A3)–(A4); the ISS bound holds regardless of the adversary’s decision process.
5
Experiments
We validate the architectural pattern along two axes corresponding to the formal results of §4. Experiment 1 tests Claims (i)–(iii) — Controllability, Robustness (ISS), and Observability — on 282 real enterprise attack graphs spanning 161 organizations and 25 industries, using a deterministic greedy controller so that the evidence isolates the contribution of the architecture’s deterministic components (finite-catalog action space, Bayesian observer, game-theoretic solver). Experiment 2 tests Corollaries 1 and 2 — controller- and adversary-agnosticism — on a paired offensive/defensive telemetry, comparing a deterministic greedy controller against two tool-mediated controllers (Claude Sonnet 4 and Claude Haiku 4.5), each swept over four temperatures (80 runs total). The crossLLM contrast tests within-family scaling of the corollaries. None of the controllers have trained or fine-tuned components. 5.1
Datasets and shared setup
Experiment 1. We construct 282 adversarial graphs from real enterprise penetration tests conducted by Horizon3.ai’s NodeZero, a commercial autonomous pentesting platform [39]. From 7,372 operations in the data warehouse, 300 are selected via stratified sampling across three complexity bins (Appendix B); 18 are excluded during validation (14 where S < 0.01 before any deployment and 4 where no block-mode policy covers any edge). The remaining 282 graphs span 161 customer organizations across 25 industries (healthcare, manufacturing, finance, government). Graphs range from 276 to 3,599 edges (median 806). All graphs are sanitized to remove customer-identifiable information (Appendix B). Synthetic sensor alerts at 60% coverage create realistic asymmetric observation — approximately 40% of edges are absent from the defender’s belief graph. Experiment 2. One adversarial graph (23 nodes, 44 edges, 30-action catalog spanning endpoint, identity, and cloud; 66-technique adversary catalog) derived from a pentest of the Game of Active Directory (GOAD)1 environment with paired defensive telemetry (Appendix C.1). Both defender and adversary observe full ground truth. Shared hyperparameters. B = 3, R = 0.05, εinnov = 0.05, εV = 10−4 (Lyapunov convergence threshold, |V (k)−V (k−1)| < εV ), max 10 rounds, λ = 1.0, seed 42. Benchmark runs on a single CPU (∼30 min total); temperature sweep costs $93.90 total across 80 runs (40 Sonnet-4 + 40 Haiku-4.5). Full justifications in Appendix D. 1 https://github.com/Orange-Cyberdefense/GOAD
6
5.2
Experiment 1: Validating Claims (i)–(iii) on 282 real enterprise graphs
Setup. Two conditions per graph: defender-only (no adversary disturbance; isolates Claims (i) Controllability and (iii) Observability) and defender + attacker (adaptive adversary injects one new edge per round; exercises all three claims, including (ii) Robustness/ISS). The controller is deterministic greedy, ranking actions by marginal S(k) reduction. 564 runs total (282 × 2). Of the 282 graphs, 143 have at least one catalog-covered high-payoff edge and drive non-trivial S reduction; the remaining 139 produce flat (still non-increasing) trajectories — we report effective-N alongside the full sample throughout. Results. Figure 1 visualizes empirical validation of Claims (i)–(iii) across all 282 graphs; aggregate metrics per claim are reported inline below. (a) Plant trajectory S(k) 1
1
0.5 0.25
0.4
0.75
|x̃(k)|
|∆S(k)|
S(k)
0.75
0
(c) Estimation error |S(k) − Ŝ(k)|
(b) ISS gain
0.5
0.2
0.25 0
1
2
3
4
5
6
Round k defender only
7
8
0
0
0.25
0.5
0.75
1
0
0
1
def. + attacker
per-round event
2
3
4
5
6
7
8
Round k
∥w(k)∥ (max payoff of new edge) γ=payoff
γ≤1 (ISS)
Figure 1: Experiment 1 results on 282 graphs. (a) Plant trajectory S(k): defender-only (blue) monotone 0.51 → 0.41; defender+attacker (red) stabilizes at ≈ 0.85. (b) ISS gain: all 602 disturbance events satisfy |∆S(k)| ≤ γ = 1.0; max excursion stays below 0.60 across all graphs. (c) Belief-truth game-value gap |S(k) − Ŝ(k)|: defender-only plateaus at 0.33; defender+attacker decreases to 0.12 as adversary-triggered reveals supply additional Bayesian updates. Final-gap median 0.07 adversarial vs 0.33 defender-only (4.7× improvement). Claim (i): Controllability. Under defender-only, ground-truth S(k) is non-increasing on every defender turn in 282/282 graphs (Wilson 95% CI [0.987, 1.000]), confirming (6). Mean S falls from 0.509 to 0.408 (19.7%; bootstrap 95% CI [17.2%, 22.3%]; paired Wilcoxon p < 10−24 ) in 3.0 ± 0.1 rounds, with 97.7% of the reduction in round 1 on the 143/282 dynamic graphs. Convergence is size-invariant across 276–3,599 edges. Claim (ii): Robustness. Under adversarial expansion (67.6% of turns), all single-round S spikes satisfy (7): max observed ∆S = 0.74, below γ = 1.0; mean max spike 0.42 (bootstrap 95% CI [0.40, 0.44]; SD 0.14; Fig. 1b). Per-graph max excursion stays below 0.60, a 40% margin to the ISS ceiling. Anticipatory defense under A4 blocks 67/890 adversary actions outright (7.5%; Wilson 95% CI [6.0%, 9.4%]). Claim (iii): Observability. The belief-truth game-value gap |S(k) − Ŝ(k)| decays geometrically, fitted by 0.064 · 0.10k + 0.007, a 90% per-round contraction reaching a 0.007 noise floor by round 2. All 282 graphs converge within 6 rounds with size-invariant decay rate. Counterintuitively, the final gap is 4.7× lower under adversarial pressure (median 0.07 vs 0.33; paired Wilcoxon p < 10−32 , ˆ = 0.24, bootstrap 95% CI [0.22, 0.28]): adversary-triggered reveals supply Hodges-Lehmann ∆ additional Bayesian updates, so purple teaming accelerates rather than degrades observability. Composite Lyapunov. Both components of V (k) = S(k)+λθ(k) are non-increasing under defender control and bounded under adversarial disturbance; V (k) decreases toward a neighborhood of V ∗ = 0 whenever (7)’s ISS condition holds on all 564 scenarios. 5.3
Experiment 2: Validating Corollaries 1 and 2 on paired telemetry
Setup. Three controllers on the same GOAD graph with paired Horizon3.ai NodeZero pentest telemetry + Microsoft Defender XDR telemetry (5 hosts, 55-min pentest): greedy (deterministic, marginal-S ranking), Sonnet 4 (tool-mediated with 9 defender tools), and Haiku 4.5 (identical toolmediated controller with weaker backbone — same SDK, prompt, and catalog). The adversary 7
is an LLM with a mirror 11-tool suite (Appendix D.2). Each tool-mediated controller runs 40 times at four temperatures {0.0, 0.3, 0.7, 1.0}. Greedy vs Sonnet isolates the LLM’s value over a deterministic baseline; the temperature sweep tests Cor. 1 and Cor. 2; the Sonnet vs Haiku contrast tests within-family scaling. Greedy vs tool-mediated. Deterministic greedy reaches S(kfinal ) = 0.8367 by deploying 5 catalog policies and plateauing after the adversary’s round-1 spike. Sonnet 4 reaches S(kfinal ) = 0.3427 (59% lower) by deploying the same 5 plus mfa_enforcement and cloud_app_security, breaking the adversary’s identity and cloud pivots — a globally-optimal choice surfaced by simulate_round_ahead and get_critical_path that greedy’s immediate-marginal-value ranking misses. The belief-truth game-value gap shrinks correspondingly: greedy ends with |S − Ŝ| = 0.494 (uncovered adversary expansions persist in the truth graph but are absent from the belief graph) versus 0.0 for Sonnet 4. Sonnet 4 sweep (Cor. 1, Cor. 2). Figure 2a shows all 40/40 Sonnet 4 runs converging to exactly 0.3427 (Wilson 95% CI [91.2%, 100%]) — a literal zero-variance point mass, qualitatively stronger than the variance-reduction typical of LLM-determinism studies (Atil et al. [6] report ∼15% accuracy variance at T =0). Temperature governs which action is selected but not the system-level outcome: per-run observer decay rates across the four temperatures show no detectable temperature effect (Kruskal-Wallis p = 0.17). Defender Jaccard ranges 0.86–0.93 across temperatures; zero off-catalog hallucinations across 210 deployments. Haiku 4.5 sweep (within-family scaling). The same architecture with a less capable backbone exhibits a different pattern (Fig. 2b): S(kfinal ) varies across runs (σ = 0.249, mean 0.603, bootstrap 95% CI [0.527, 0.681]), with 19/40 runs reaching S = 0.3427 (matching Sonnet 4) and 21/40 stalling at 0.85–0.90 (greedy-baseline level). Defender Jaccard 0.80–0.96 (comparable to Sonnet 4); zero off-catalog hallucinations across 210 deployments. Inspection of failure cases shows Haiku 4.5 correctly solves the round-0 graph but fails to integrate adversary-expanded edges into its belief graph in subsequent rounds: the inferred Ŝ(k) stays pinned at the round-0 optimum while the ground-truth S(k) climbs as the adversary introduces new techniques (21/40 runs exhibit a final belief-truth gap > 0.1, Wilson 95% CI [0.375, 0.671]). This is a controller-reasoning failure (Haiku does not re-query the belief graph after adversary expansion), not an architectural fault. Mann-Whitney on per-run S(kfinal ) confirms the two controllers differ at p = 1.6 × 10−7 .
(a) Sonnet 4: S(k) across 40 runs
(b) Haiku 4.5: S(k) across 40 runs
1
1 greedy 0.8367
greedy 0.8367 0.8
S(k)
S(k)
0.8 0.6 0.4 0.2
0.6 0.4
0
1
2
3
4
5
6
0.2
7
0
Round k
1
2
3
4
5
6
7
Round k T = 0.0
T = 0.3
T = 0.7
T = 1.0
Figure 2: Within-family scaling of LLM stability. (a) Sonnet 4: all 40 runs converge to S(kfinal ) = 0.3427 with σ = 0 across temperatures; variance is zero. (b) Haiku 4.5: same architecture, weaker backbone — 19/40 runs reach S = 0.3427, 21/40 stall at 0.85–0.90 (σ = 0.249, mean 0.603). Both controllers stay catalog-bounded (420/420 deployments on-catalog); the achieved S floor depends on capability, not on the architectural guarantee. Corollary 1: Controller-agnostic. Both controllers stay catalog-bounded (zero off-catalog hallucinations across 420 deployments) with V (k) ISS-bounded on all 80 runs (Claim ii; max single-round ∆S = 0.51 < γmax = 1.0). Sonnet 4’s anticipatory cross-domain deployment drives γ ≈ 0 in (7) and V (k) is non-increasing on all 40 runs; Haiku 4.5’s narrower coverage produces adversary-expansion spikes in 21/40 runs within the ISS bound. Stability is architectural; the S floor is capability-bound — 8
Sonnet hits 0.3427 (σ = 0), Haiku stays bounded but converges to suboptima (σ = 0.249) depending on belief-graph integration (§6). Corollary 2: Adversary-agnostic. The adversary’s action sets are far more diverse (Jaccard 0.17– 0.44; 6–11 distinct counter-techniques per temperature); S never exceeds the catalog-maximum payoff bound under either controller. Zero catalog exits across 240 proposals. Innovation decays 95% for Sonnet 4 (0.13 → 0.007), matching Claim (iii).
6
Discussion
Stability as architectural discipline. Constraining the environment rather than agent reasoning is more reliable than post-hoc behavioral constraints given destructive failures in [7], addressing the open stability verification problem in [5]. The architecture does not only constrain; it lets exploratory capacity pay off. The tool-mediated controller reaches S(kfinal ) = 0.34 vs. 0.84 for greedy by composing simulate_round_ahead and get_critical_path past greedy’s marginalvalue ranking, while staying inside the catalog throughout. Why not compute the optimal solution deterministically? Greedy is deterministic but stuck at a local optimum, and exhaustive search over the budget-B catalog composition space is combinatorially intractable. The LLM serves as a heuristic search, discovering the globally-optimal mfa_enforcement + cloud_app_security pair that greedy structurally cannot find. Action-level variance (Jaccard 0.74–0.93) coexists with zero outcome-level variance (σ = 0) — the architecture decouples exploration from stability. Stable does not mean optimal. Haiku 4.5 satisfies every formal guarantee — zero off-catalog hallucinations (210 deployments), ISS-bounded V (k) on all 40 runs — yet 21/40 runs stall at S(kfinal ) ≈ 0.85 (greedy level). The failure is specific: Haiku solves the round-0 graph but does not re-interrogate the belief graph after adversary expansion — a reasoning-depth limitation, not a tool-calling failure. Its θ(k) decreases on known edges (Claim (iii) holds) while unseen edges accumulate, separating safety envelope (architecture) from decision quality (controller). Runtime monitoring of the belief-truth game-value gap |S(k) − Ŝ(k)| should complement the structural certificate. Operational diagnostics. The V (k) trajectory and ISS margin double as diagnostics: shrinking V (k) with margin means the defender is ahead; plateau under adversary expansion signals an underprovisioned catalog; rapid decay with unused budget signals over-provisioning. The Lyapunov certificate supplies when to stop and what to invest in next as auditable signals. The adversary as informant. Adversarial pressure improves belief-truth alignment (4.7× lower final game-value gap, Exp. 1): each best-response reveals edges the observer could not otherwise see, inverting the usual ISS framing of disturbance as cost. Broader impact and limitations. Off-catalog hallucinations become no-ops (zero across 660 actions), and the certificate transfers across model upgrades without re-verification. However, the pattern is dual-use (Corollary 2 proves the adversary’s certificate identically), and the Haiku result shows a certified-stable system can still make poor decisions. The adversary-as-informant result assumes a bounded adversary (A3). Exp. 1 uses synthetic sensors at 60% coverage from one vendor; Exp. 2 tests one graph and one LLM family. A4 rules out policy rollback; relaxing A4 is future work.
7
Conclusion
We present a tool-mediated architecture for LLM-in-the-loop adversarial control with a Lean 4verified Lyapunov certificate for controllability, observability, and ISS robustness. The claims hold on 282 enterprise graphs and paired telemetry (59% game-value reduction, σ=0, 40 runs). The pattern is not domain-specific: wherever agentic systems act under adversarial pressure with a finite action catalog, stability becomes a formal property of the loop rather than of the agent.
Acknowledgments and Disclosure of Funding Our team would like to thank Justin Cady for his contribution of the sanitization method for attack graphs used in Experiment 1 and Naveen Sunkavally for his attack expertise and feedback on the 9
architecture and experiment design. We note the use of Claude Code (Opus 4.5-7, February - April 2026) to accelerate the implementation of Python code with hands-on checks by the research team.
References [1] CrowdStrike. 2026 global threat report: Year of the evasive adversary, 2026. URL https://www. crowdstrike.com/explore/2026-global-threat-report/2026-global-threat-report? utm_medium=org. [2] Kim Hammar and Rolf Stadler. Finding efficient security strategies through reinforcement learning and self-play. arXiv, 2020. URL https://arxiv.org/pdf/2009.08120. [3] Anthropic. Disrupting the first reported ai-orchestrated cyber espionage campaign. 2026. URL https://assets.anthropic.com/m/ec212e6566a0d47/original/ Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf.
[4] SentinelOne. How sentinelone’s ai edr autonomously discovered and stopped anthropic’s claude from executing a zero-day supply chain attack globally, 2026. URL https://www.sentinelone.com/blog/ how-sentinelones-ai-edr-autonomously-discovered-and-stopped-anthropics-claude-from-executing-a-zero-da [5] Ali Eslami and Jiangbo Yu. A control-theoretic foundation for agentic systems, 2026. URL https: //arxiv.org/html/2603.10779. [6] Non-Determinism of “Deterministic” LLM System Settings in Hosted Environments, 2025. URL https: //aclanthology.org/2025.eval4nlp-1.12/. [7] Natalie Shapira, Chris Wendler, Avery Yen, Gabriele Sarti, Koyena Pal, Olivia FLoody, Adam Belfki, Alex Loftus, Aditya Ratan Jannali, Nikhil Prakash, Jasmine Cui, Giordano Rogers, Jannik Brinkmann, Can Rager, Amir Zur, Michael Ripa, Aruna Sankaranarayanan, David Atkinson, Rohit Gandikota, Jaden Fiotto-Kaufman, EunJeong Hwang, Hadas Orgad, P Sam Sahil, Negev Taglicht, Tomer Shabtay, Atai Ambus, Nitay Alon, Shiri Oron, Ayelet Gordon-Tapiero, Yotam Kaplan, Vered Shwartz, Tamar Rott Shaham, Christoph Riedl, Reuth Mirsky, Maarten Sap, David Manheim, Tomer Ullman, and David Bau. Agents of chaos. arXiv, 2026. URL https://arxiv.org/abs/2602.20021. [8] Quanyan Zhu. Game theory meets llm and agentic ai: Reimagining cybersecurity for the age of intelligent threats. arXiv, 2025. URL https://arxiv.org/abs/2507.10621. [9] David “davidad” Dalrymple, Joar Skalse, Yoshua Bengio, Stuart Russell, Max Tegmark, Sanjit Seshia, Steve Omohundro, Christian Szegedy, Ben Goldhaber, Nora Ammann, Alessandro Abate, Joe Halpern, Clark Barrett, Ding Zhao, Tan Zhi-Xuan, Jeannette Wing, and Joshua Tenenbaum. Towards guaranteed safe ai: A framework for ensuring robust and reliable ai systems. arXiv, 2024. URL https://arxiv. org/abs/2405.06624. [10] Christopher M. Poskitt Haoyu Wang and Jun Sun. Agentspec: Customizable runtime enforcement for safe and reliable llm agents. arXiv, 2025. URL https://arxiv.org/abs/2503.18666. [11] Adharsh Kamath, Sishen Zhang, Calvin Xu, Shubham Ugare, Gagandeep Singh, and Sasa Misailovic. Enforcing temporal constraints for llm agents. arXiv, 2025. URL https://arxiv.org/pdf/2512. 23738. [12] Varun Pratap Bhardwaj. Agent behavioral contracts: Formal specification and runtime enforcement for reliable autonomous ai agents. arXiv, 2026. URL https://arxiv.org/pdf/2602.22302. [13] Devakh Rashie and Veda Rashi. Type-checked compliance: Deterministic guardrails for agentic financial systems using lean 4 theorem proving. arXiv, 2026. URL https://arxiv.org/abs/2604.01483. [14] A Lyapunov-based Approach to Safe Reinforcement Learning, 2018. URL https://proceedings. neurips.cc/paper_files/paper/2018/file/4fe5149039b52765bde64beb9f674940-Paper. pdf. [15] Safe Model-Based Reinforcement Learning with Stability Guarantees, 2017. URL https://proceedings.neurips.cc/paper_files/paper/2017/file/ 766ebcd59621e305170616ba3d3dac32-Paper.pdf. [16] Yarden As, Bhavya Sukhija, Lenart Treven, Carmelo Sferrazza, Stelian Coros, and Andreas Krause. Actsafe: Active exploration with safety constraints for reinforcement learning. arXiv, 2024. URL https://arxiv.org/abs/2410.09486.
10
[17] Wassim M.Haddad Tomohisa Hayakawa and Alexander Leonessa. A lyapunov-based adaptive control framework for discrete-time non-linear systems with exogenous disturbances. International Journal of Control, 77(3):250–263, 2004. URL https://scispace.com/papers/ a-lyapunov-based-adaptive-control-framework-for-discrete-1mzw8c3u14. [18] Zhang-Ping Jiang and Yuan Wang. Input-to-state stability for discrete-time nonlinear systems. Automatica, 37(6):857–869, 2001. URL https://www.sciencedirect.com/science/article/abs/pii/ S0005109801000280. [19] Quanyan Zhu and Tamer Basar. Games-in-games principle for cyber-physical resilience. IEEE Control Sytems Magazine, 35(1):46–65, 2015. URL https://ieeexplore.ieee.org/document/7011006. [20] G Leitmann. On generalized stackelberg strategies. Journal of Optimization Theory and Applications, 26: 637–643, 1978. URL https://link.springer.com/article/10.1007/BF00933155. [21] Survey of Stackelberg Security Games, 2018. URL https://dl.acm.org/doi/10.5555/3304652. 3304789. [22] Optimal network security hardening using attack graph games, 2015. URL https://dl.acm.org/doi/ 10.5555/2832249.2832322. [23] Demosthenis Teneketzis Erik Miehling, Mohammad Rasouli. Input-to-state stability for discrete-time nonlinear systems. IEEE Transactions on Information Forensics and Security, 13(10):2490–2505, 2018. URL https://ieeexplore.ieee.org/document/8325528. [24] Learning to Search Better than Your Teacher, 2003. URL https://dl.acm.org/doi/10.5555/ 3041838.3041906. [25] Manish Jain, Dmytro Korzhyk, Ondřej Vanek, Vincent Conitzer, Michal Pechoucek, and Milind Tambe. A double oracle algorithm for zero-sum security games on graphs, 2011. URL https://www.cs.cmu. edu/~conitzer/graph_securityAAMAS11.pdf. [26] A Scalable Double Oracle for Hardening Large Active Directory Systems, 2023. URL https://dl.acm. org/doi/10.1145/3579856.3590343. [27] R. Kevin Wood. Deterministic network interdiction. Mathematical and Computer Modelling, 17(2):1–18, 1993. URL https://apps.dtic.mil/sti/pdfs/ADA487308.pdf. [28] Andrew R. Romano and Lacra Pavel. Dynamic ne seeking for multi-integrator networked agents with disturbance rejection. arXiv, 2019. URL https://arxiv.org/pdf/1903.02587. [29] Anne Aarness. What is edr? endpoint detection & response defined | crowdstrike, 2025. URL https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/ endpoint-detection-and-response-edr/. [30] Decoding the MITRE ATT&CK Enterprise Evaluation: An Analysis of EDR Performance in Real-World Environments, 2024. URL https://dl.acm.org/doi/10.1145/3634737.3645012?__cf_chl_ tk=.86c2C1ZEfMkg0vaSnkaKbugkY4QLrNj6JcmGOjNIsI-1775786335-1.0.1.1-HvuTRKtAOs_ hMOOL9a39uxjxZ5mKEFwnF8OOohWildI. [31] Alexander V. Outkin, Patricia V. Schulz, Timothy Schulz, Thomas D. Tarman, and Ali Pinar. Defender policy evaluation and resource allocation with mitre att&ck evaluation data. IEEE Transactions on Dependable and Secure Computing, 20(3):1909–1926, 2023. URL https://ieeexplore.ieee.org/ document/9758675. [32] Mohammad Aleiadeh and Mustafa Abdallah. Cbdra-is: Centrality-based defense resource allocation for securing interdependent systems. ACM Transactions on Privacy and Security, 28(3):1–44, 2025. URL https://dl.acm.org/doi/10.1145/3736760. [33] Jinghan Zhang, Enrico Zio, Chiye Ma, Kang Liu, and Wei Wang. A probabilistic cost-benefit analysis for cyberattack path evaluation. Reliability Engineering & System Safety, 263, 2025. URL https: //www.sciencedirect.com/science/article/abs/pii/S0951832025004569. [34] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models. In International Conference on Learning Representations (ICLR), 2023. URL https://arxiv.org/abs/2210.03629.
11
[35] Michael Ahn, Anthony Brohan, Noah Brown, Yevgen Chebotar, Omar Cortes, Byron David, Chelsea Finn, Chuyuan Fu, Keerthana Gopalakrishnan, Karol Hausman, Alex Herzog, Daniel Ho, Jasmine Hsu, Julian Ibarz, Brian Ichter, Alex Irpan, Eric Jang, Rosario Jauregui Ruano, Kyle Jeffrey, Sally Jesmonth, Nikhil J Joshi, Ryan Julian, Dmitry Kalashnikov, Yuheng Kuang, Kuang-Huei Lee, Sergey Levine, Yao Lu, Linda Luu, Carolina Parada, Peter Pastor, Jornell Quiambao, Kanishka Rao, Jarek Rettinghouse, Diego Reyes, Pierre Sermanet, Nicolas Sievers, Clayton Tan, Alexander Toshev, Vincent Vanhoucke, Fei Xia, Ted Xiao, Peng Xu, Sichun Xu, Mengyuan Yan, and Andy Zeng. Do as i can, not as i say: Grounding language in robotic affordances. In Conference on Robot Learning (CoRL), 2022. URL https://arxiv.org/abs/2204.01691. [36] Wenlong Huang, Fei Xia, Ted Xiao, Harris Chan, Jacky Liang, Pete Florence, Andy Zeng, Jonathan Tompson, Igor Mordatch, Yevgen Chebotar, Pierre Sermanet, Noah Brown, Tomas Jackson, Linda Luu, Sergey Levine, Karol Hausman, and Brian Ichter. Inner monologue: Embodied reasoning through planning with language models. arXiv, 2022. URL https://arxiv.org/abs/2207.05608. [37] Victor Mayoral-Vilches, Maria Sanz-Gomez, Francesco Balassone, Stefan Rass, Lidia Salas-Espejo, Benjamin Jablonski, Luis Javier Navarrete-Lozano, Maite del Mundo de Torres, and Cristobal R. J. Veas Chavez. Cybersecurity ai: A game-theoretic ai for guiding attack and defense. arXiv, 2026. URL https://arxiv.org/abs/2601.05887. [38] Adish Singla Jonathan, Nöther and Goran Radanovic. MaMa: A game-theoretic approach for designing safe agentic systems. arXiv, 2026. URL https://arxiv.org/abs/2602.04431. [39] Horizon3.ai. Nodezero: The ultimate endpoint security platform, 2026. URL https://www.horizon3. ai/nodezero/. [40] MITRE Corporation. MITRE ATT&CK: Enterprise matrix, 2024. URL https://attack.mitre.org/ matrices/enterprise/. [41] Microsoft Corporation. Microsoft Defender XDR: Security Configuration and Attack Surface Reduction Guidance. https://learn.microsoft.com/en-us/defender-xdr/, 2026. Accessed 2026-04. [42] EDR Telemetry Project Contributors. EDR Telemetry Comparison Matrix. https://github.com/ tsale/EDR-Telemetry, 2026. Community-maintained telemetry-fidelity reference. [43] Microsoft. Configure security settings in Microsoft Defender for Endpoint on Linux. https://learn. microsoft.com/en-us/defender-endpoint/linux-preferences, 2026. Accessed: 2026-04-27.
A
Formal Verification of Closed-Loop Stability
We formally verify the stability guarantees of Theorem 1 using the Lean 4 proof assistant with the Mathlib mathematical library. The complete Lean source (five files, ∼300 lines) is included in the supplementary materials and compiles with zero sorry, no unproved assertions beyond Mathlib’s foundational axioms. A.1
Proof Sketches
Lyapunov nonnegativity and zero characterization. S ≥ 0 by construction (product of terms in [0, 1] times a payoff in [0, 1]; see Eq. 2). θ = P̄e ≥ 0 as a mean of nonnegative terms. Since λ > 0, V (k) = S(k) + λθ(k) ≥ 0. For the converse, V (k) = 0 requires both summands to vanish: S(k) = 0 (all ENTRY→OBJECTIVE paths severed) and θ(k) = 0 (perfect calibration, Pe = 0 for every belief-graph edge), since λ > 0 prevents cancellation. □ Claim (i): Controllability (monotone decrease). The proof decomposes V into two independent non-increasing components. Game value reduction. Policy deployment only increases block(e, k)—the actuator computes block′ (e, k) = min(0.95, block(e, k) + eff(p)). Since S(k) is monotone non-increasing in block probabilities [27], any policy deployment from the finite catalog either decreases S(k) or leaves it unchanged. The class-K lower bound αB (·) on the reduction from B greedy deployments follows from the monotonicity of S(k) in block probabilities and the positive effectiveness of policies in the finite catalog. 12
Table A1: What is proved in Lean vs. assumed from cited results. Proved in Lean
Assumed (cited)
V (k) ≥ 0; V = 0 characterization
αB is class-K (monotonicity of (2) under the actuator update) S(k) monotone in block prob. [27] Double oracle terminates (finite catalog) Anticipatory coverage (implementation property) Cnew ≥ 0 (follows from termination)
Kalman gain Ke ∈ (0, 1); Pe (k) < Pe (k − 1) Claim (i): monotone Lyapunov decrease Claim (ii): ISS bound + sufficient condition Claim (iii): geometric decay + convergence
Observer contraction. The Bayesian observer uses a scalar Kalman filter per edge with gain Ke = Pe (k − 1)/(Pe (k − 1) + R), R > 0. Since Pe (k − 1) > 0 and R > 0, the gain satisfies Ke ∈ (0, 1), and the updated variance is Pe (k) = (1 − Ke )Pe (k − 1) < Pe (k − 1). Each observation reduces Pe by at least δedge = mine Ke Pe (k − 1) > 0. With |Eobs (k)| edges observed at round k, the mean θ = P̄e drops by at least δ|Eobs (k)|, where δ := δedge /|E(Ĝ(k))| absorbs the mean normalization. Combining. V (k + 1) ≤ S(k) − αB (S(k)) + λ θ(k) − δ|Eobs (k)| = V (k) − αB (S(k)) − λδ|Eobs (k)|, matching (6). □ Claim (ii): ISS bound. When the attacker adds nnew edges, S(k) may increase by at most γ(|w(k)|) = (1 − εantic ) maxe∈Enew (k) payoff(e, k) over the set Enew (k) of added edges (and γ = 0 if none are added), where εantic is the fraction of new-edge payoff neutralized by anticipatory defense. Each new edge contributes at most Pmax uncertainty to θ, so λθ may grow by at most λ nnew Pmax . The ISS sufficient condition is that the net per-round change of V remains negative: αB +λδ|Eobs (k)| > γ(|w(k)|)+λ nnew Pmax . The non-expansivity bound follows from the discretetime adaptive control framework of Hayakawa et al. [17] (Theorem 2): the closed-loop input–output map satisfies P ⊤ X z z ≤ γ2 w⊤ w + V (x0 ), 1 + Vs where Vs and V (x0 ) in this display equation are Hayakawa’s Lyapunov-related quantities from their framework, not our V (k) from (5). We extend their result with anticipatory defense, which reduces the effective γ. With full anticipatory defense (εantic = 1), γ = 0 and the ISS condition reduces to αB + λδ|Eobs (k)| > λ nnew Pmax , which holds whenever the defender observes more edges per round than the attacker adds. □ Claim (iii): Observer convergence. The defender’s belief graph initially contains only edges matched to EDR alerts—edges without alerts are absent entirely, not merely uncertain. The ground truth reveal both corrects estimates on known edges (the geometric decay term) and discovers previously unknown edges (the Cnew term). Convergence is proved within each execution of the controlled adversarial loop. By induction on k. At k = 0: θ(0) = P̄e (0) and Cnew (0) = 0, so the bound θ(k) ≤ (1 − δ)k θ(0) + Cnew (k) holds trivially. For the inductive step, the per-round contraction gives θ(k + 1) ≤ (1 − δ)θ(k) + ∆Cnew . Substituting the inductive hypothesis yields the bound at k + 1. The double-oracle structure ensures Cnew stabilizes: the attacker’s best-response oracle searches over a finite technique catalog and finite node set, anticipatory defense shrinks the effective pool each round, and diminishing returns guarantee termination. After termination (nnew → 0), Cnew is constant and the geometric term (1 − δ)k θ(0) → 0 dominates. □ A.2
Scope of Formal Verification
Extension to LLM controllers. The proof applies to any controller selecting from the finite catalog C. The LLM cannot decrease block(e, k)—monotonicity is preserved by the actuator update, not the agent’s reasoning. The LLM may achieve a lower S floor than greedy but cannot violate the stability guarantees. 13
Table A2: Lean source files in the supplementary bundle. File
Contents
Defs.lean
Edge, game value, Kalman gain/update, Lyapunov function, StabilityParams V (k) ≥ 0; V (k) = 0 iff S(k) = 0 and θ(k) = 0 Claim (i): Kalman contraction + monotone decrease Claim (ii): ISS bound with anticipatory defense Claim (iii): geometric decay + convergence
Lyapunov.lean MonotoneDecrease.lean ISS.lean ObserverConvergence.lean
What is not proved. The formalization does not re-prove the monotonicity of the network interdiction objective [27] or the optimality of the Kalman filter. The contraction property Pe (k) < Pe (k − 1) is sufficient; Bayesian optimality provides faster convergence as a bonus. The composite Lyapunov structure follows Hayakawa et al. [17]; we instantiate their framework on attack graphs and extend it with anticipatory defense. The double-oracle termination argument is informal—formalizing it would require encoding the finite catalog and diminishing-returns structure. A.3
Reproducing the Verification
The Lean 4 project is included in the supplementary materials. To verify: Install elan: curl -sSf \ https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh Build: cd ClosedLoopStability lake update && lake build Expected: Build completed successfully with zero errors and zero sorry warnings.
Lean 4.30.0-rc1, Mathlib (fetched automatically). Build time ∼10 minutes.
B
Additional Benchmark Dataset Details
This appendix supplements Section 5.1 with additional detail on the 282 adversarial graphs used in Experiment 1. B.1
Provenance and ethics
The benchmark graphs are derived from 300 enterprise penetration tests conducted by Horizon3.ai’s NodeZero, a commercial autonomous pentesting platform [39]. The raw pentest data is proprietary and cannot be publicly released due to contractual and customer-privacy constraints. Each graph is sanitized before inclusion in the benchmark: • Host identifiers are replaced with anonymous integer labels (host_1, host_2, . . . ). • Customer identifiers, network prefixes, and any personally-identifiable metadata are stripped at export time. • Only structural graph information (MITRE ATT&CK technique labels, topology, and precomputed payoff/block/detection probabilities) is retained. B.2
Construction pipeline
Each pentest is converted to a directed graph G = (V, E) via the following steps: 1. Node set. Vertices correspond to attack events (one per logged action), plus two virtual nodes: ENTRY (representing the attacker’s initial access point) and OBJECTIVE (representing the compromise goal, typically domain admin or sensitive data exfiltration). 14
Table A3: Distribution statistics for the 282 valid benchmark graphs. Quantity
Min
Median
Mean
Max
Edges per graph Nodes per graph Distinct techniques per graph Distinct policies per graph
276 152 4 10
806 437 11 22
1,053 563 10.8 21.3
3,599 1,940 15 24
Table A4: Top 10 MITRE ATT&CK techniques by graph coverage in the 282-graph benchmark. Technique ID
Name
Graphs (of 282)
T1057 T1003.001 T1003.002 T1003.004 T1555.004 T1039 T1552.005 T1005 T1518 T1087.001
Process Discovery LSASS Memory Security Account Manager LSA Secrets Credentials from Windows Credential Manager Data from Network Shared Drive Cloud Instance Metadata API Data from Local System Software Discovery Local Account Enumeration
278 (99%) 277 (98%) 275 (98%) 272 (96%) 272 (96%) 270 (96%) 248 (88%) 247 (88%) 242 (86%) 235 (83%)
2. Edge derivation. Edges are derived from three sources: (i) temporal ordering within each host (foothold → post-exploitation → objective), (ii) cross-host credential flow inferred from credential dumps matched to subsequent logons, and (iii) causal parent-child links from the penetration test platform’s attack chain data. 3. Edge attributes. Each edge carries a MITRE ATT&CK technique label, an attacker payoff (derived from technique impact score and host criticality), a block probability (policy effectiveness from the enrichment pipeline, capped at 0.95), a detection probability (flat baseline 0.1), and a mapping from policy IDs to effectiveness values. 4. Sanitized output. The final artifact is a JSON file per graph consumable by the experiment runner without access to raw pentest data. B.3
Filtering criteria
Of the 300 exported graphs, 18 are excluded as degenerate inputs and 282 are retained for evaluation: • 14 graphs excluded for S < 0.01: the attacker has no viable path to the objective before any policy deployment (defense is already saturated). • 4 graphs excluded for no actionable policies: after aligning graph edges with the defender catalog, no block-mode policy covers any edge (the defender has no actionable moves in the game). B.4
Summary statistics
Table A3 reports distribution statistics across the 282 valid graphs. Across the 282 graphs, 16 unique MITRE ATT&CK [40] techniques appear. Table A4 lists the top 10 by graph coverage (fraction of graphs containing the technique). The benchmark is heavily weighted toward credential-access and discovery techniques, reflecting the typical activity pattern in automated penetration testing: attackers focus on stealing credentials and mapping the environment after initial access. Later-stage techniques (privilege escalation, lateral movement, persistence) appear with lower coverage because tests often converge before those stages are reached. 15
B.5
Catalog alignment and provenance
The defender action catalog C and the per-policy effectiveness map were compiled from three publiclyavailable sources: (i) Microsoft’s Defender XDR security-configuration documentation [41], which provides the canonical policy identifiers, modes (audit / block), and dependency graph used in our YAML; (ii) the MITRE ATT&CK Enterprise taxonomy [40], which provides the technique identifiers that each policy claims to mitigate; and (iii) the EDR Telemetry Project [42], which supplies the per-technique telemetry-fidelity ratings used to convert policy coverage claims into the numerical block and detection probabilities on each edge. Per-technique effectiveness ranges and category priors are further informed by the MITRE Engenuity ATT&CK Evaluations analyses of Shen et al. [30] and Outkin et al. [31]. Each graph edge labeled with MITRE technique t is aligned with the subset of policies whose coverage mapping (from (i) and (ii)) includes t; the resulting block and detect probabilities are the product of claimed policy effectiveness and the telemetry-fidelity modifier from (iii), capped at 0.95. The full compiled catalog, including per-policy mode-aware effectiveness and technique coverage, was assembled into an internal reference document with LLMassisted (Anthropic Claude Opus 4.6) extraction and formatting; the document is derivative rather than primary research, and the public sources above are the authoritative references for any individual policy or technique. B.6
Reproducibility
The raw benchmark graphs cannot be released publicly due to contractual and customer-privacy constraints, and no redacted excerpts or synthetic analogs are released with this submission. Researchers with access to comparable attack-graph data conforming to the schema described in this appendix (nodes with ENTRY/OBJECTIVE virtual vertices; edges carrying MITRE ATT&CK technique labels, attacker payoff, block probability, detection probability, and policy effectiveness mappings) can re-implement the experiment directly from the method in Section 4 and the hyperparameters in Appendix D.
C
Temperature Sweep Details (Experiment 2)
C.1
GOAD Environment
The Game of Active Directory (GOAD) provisions a multi-forest Active Directory environment spanning three domains (sevenkingdoms.local, north.sevenkingdoms.local, and essos.local) connected via parent-child and cross-forest trusts. The standard GOAD deployment consists of five virtual machines: three domain controllers and two member servers. We deployed this environment on Microsoft Azure and added two of the project’s official extensions: exchange and lx01. These contribute a Microsoft Exchange server (the-eyrie, SRV01) and a domain-joined Linux host (dragonstone, LX01), introducing endpoint diversity representative of enterprise networks. The lab is preconfigured with a broad range of Active Directory attack paths, including Kerberoasting, ASREP roasting, constrained delegation abuse, NTLM downgrade, ACL misconfigurations, credential exposure, and DCSync. The NodeZero penetration test was scoped to five Defender-instrumented hosts (Table A5), on which Microsoft Defender XDR was deployed in its default out-of-box configuration. The Windows hosts run Defender in active mode, providing both prevention and EDR telemetry, while the Linux host operates in passive mode, providing EDR telemetry only. Passive mode is the documented default enforcement level for Microsoft Defender for Endpoint on Linux since agent version 101.23062.0001 [43]. To establish an initial foothold representative of a post-compromise scenario, we injected the credential of a domain user (tywin.lannister / powerkingftw135) at the start of the engagement. This account is a non-privileged member of the sevenkingdoms.local domain and served as the entry point from which subsequent attack paths were exercised against the in-scope hosts. C.2
Per-run defender action sets
Four policies appear in 100% of runs across both controllers and every temperature (the core set): asr_rule, audit_policy, controlled_folder_access, and credential_guard. Vari16
Table A5: In-scope GOAD hosts for the penetration test. All five hosts were instrumented with Microsoft Defender XDR in its default configuration. Hosts marked † are added via official GOAD extensions. Host
Role
OS
Domain
Defender Mode
kingslanding winterfell the-eyrie† castelblack dragonstone†
DC01 DC02 SRV01 SRV02 LX01
Windows Server 2019 Windows Server 2019 Windows Server 2019 Windows Server 2019 Ubuntu 22.04
sevenkingdoms.local north.sevenkingdoms.local sevenkingdoms.local north.sevenkingdoms.local sevenkingdoms.local
Active Active Active Active Passive
Table A6: Sonnet 4 exploratory-set defender policy frequency across 40 runs (number of runs deploying the policy at least once). Policy
Runs (of 40) 40 36 33 31 1 1
identity_protection conditional_access mfa_enforcement cloud_app_security privileged_identity_management exploit_protection
Domain identity (Entra) identity (Entra) identity (Entra) cloud (Defender for Cloud Apps) identity (Entra) endpoint (Defender XDR)
ation across runs comes from exploratory identity and cloud policies. Sonnet 4 explores this exploratory set extensively (Table A6), reaching S = 0.3427 by selecting mfa_enforcement and cloud_app_security to break the adversary’s identity/cloud pivots. Haiku 4.5 deploys substantially fewer exploratory policies per run (Table A7), heavily relying on identity_protection alone — which explains the higher achieved S floor: matching Sonnet 4 requires the mfa_enforcement + cloud_app_security combination Haiku rarely produces. Table A8 gives the mean number of deployed policies per run by temperature for both controllers. C.3
Adversary technique diversity
The adversary draws from a 66-technique GOAD catalog T . Across the 80 runs spanning both controllers, the adversary’s exploration distribution reflects the controller it faces: against Sonnet 4 the adversary spreads probes across 64 distinct techniques (Table A9), responding to the broad cross-domain defenses Sonnet deploys; against Haiku 4.5 the adversary concentrates on 39 distinct techniques (Table A10), heavily exploiting the identity/cloud pivots Haiku rarely covers. Both cases stay catalog-bounded by Cor. 2: S(kfinal ) is bounded by the catalog-maximum payoff, not the adversary’s per-run ranking, regardless of the controller faced. C.4
Innovation trajectories
Per-run exponential fits use only four innovation points and are correspondingly noisy. Sonnet 4 yields a median per-run geometric base b = 0.093 (95% bootstrap CI [0.093, 0.093], n = 40 fits), fitting innov(k) = a · bk + c with c = 0.007 fixed at the Experiment 1 noise floor; Haiku 4.5 yields a comparable median b = 0.093. Both are consistent with the Experiment 1 per-graph fits (median b = 0.10, n = 282) given the limited trajectory length per run. Across the four temperatures, per-run b shows no detectable temperature effect for Sonnet 4 (Kruskal-Wallis p = 0.17); for Haiku 4.5 the test is significant (p = 0.0065), reflecting the within-family scaling caveat that Haiku’s belief graph fails to integrate adversary-expanded edges in 21/40 runs (§5.3, Table A12). The integration failure manifests as a flat inferred trajectory while the ground-truth S(k) climbs — not a change in the observer’s nominal decay rate, but a stalling of the belief update under adversary expansion. C.5
Cost and tool usage
Tool-call rates are near-constant across temperature for each controller (Table A11), consistent with the observation that temperature changes which action the LLM proposes but not the reasoning budget it spends to propose it. Sonnet 4 averages ∼ 110 tool calls per run at $1.61–$1.80/run ($69.68 total 17
Table A7: Haiku 4.5 exploratory-set defender policy frequency across 40 runs. Haiku selects far fewer exploratory policies than Sonnet 4: it relies almost entirely on identity_protection and rarely deploys the mfa_enforcement + cloud_app_security combination required to match Sonnet 4’s S = 0.3427 floor. Policy
Runs (of 40) 34 5 3 2 1
identity_protection mfa_enforcement conditional_access cloud_app_security lsa_protection
Domain identity (Entra) identity (Entra) identity (Entra) cloud (Defender for Cloud Apps) endpoint (Defender XDR)
Table A8: Defender deployment size by temperature for both controllers. The core set (4 policies) is deployed in every run; exploratory-set selection differs sharply between models. Controller
Temperature
Policies per run (mean ± std)
Core / Exploratory
Distinct observed
Sonnet 4 Sonnet 4 Sonnet 4 Sonnet 4
0.0 0.3 0.7 1.0
7.5 ± 0.5 7.7 ± 0.6 7.2 ± 0.7 7.8 ± 0.9
4 / 3.5 4 / 3.7 4 / 3.2 4 / 3.8
8 8 8 10
Haiku 4.5 Haiku 4.5 Haiku 4.5 Haiku 4.5
0.0 0.3 0.7 1.0
5.2 ± 0.4 4.9 ± 0.3 5.0 ± 1.1 5.4 ± 0.8
4 / 1.2 4 / 0.9 4 / 1.0 4 / 1.4
7 5 8 8
across 40 runs); Haiku 4.5 averages ∼ 150 tool calls per run at $0.58–$0.63/run ($24.22 total across 40 runs). Haiku makes more tool calls per run but consumes fewer tokens per call, yielding a ∼ 3× cost advantage at the price of converging to suboptimal S in 21/40 runs. Tool definitions are in Appendix D.2. C.6
Statistical significance tests
Table A12 reports every hypothesis test and confidence interval used to back the claims in §5. Tests use n = 282 paired graphs (Experiment 1) or n = 40 runs (Experiment 2). Confidence intervals are Wilson for proportions and percentile bootstrap (10,000 resamples, seed 42) for means, medians, variance, and maxima. Wilcoxon and Kruskal-Wallis are used throughout; V (S) is bounded [0, 1] and skewed, so nonparametric tests are preferred. Hodges-Lehmann is reported as the effect size for paired Wilcoxon tests. Benjamini-Hochberg FDR is applied across the seven-test p-value family; q-values shown alongside p.
D
Hyperparameters and Reproduction
D.1
Hyperparameters
D.2
LLM configuration (Experiment 2)
Model. Claude Sonnet 4, API identifier claude-sonnet-4-20250514, accessed via the Anthropic Messages API. Temperatures {0.0, 0.3, 0.7, 1.0} applied symmetrically to both the defender and adversary agents. Each agent invocation uses a tool-use loop with max_tokens = 4096. Tool inventory. The defender agent has access to 9 tools and the adversary to 11 tools (the two sets share get_graph_state, so 19 distinct tools in total). The split reflects that the adversary has additional edge-proposal and novel-technique primitives, and the defender has policy-catalog query primitives. Tables A14 and A15 list each tool and its role. Counts are total invocations across all the 40 Sonnet 4 runs; the defender makes 3,039 tool calls and the adversary 1,225 tool calls. The 40 Haiku 4.5 runs use the same tool inventory and produce a comparable per-tool distribution. Catalog enforcement. All tool outputs and all agent action proposals are validated against the policy catalog C (defender) or technique catalog T (adversary) before they reach the plant; proposals outside 18
Table A9: Sonnet 4: adversary technique frequency across 40 runs (number of runs with ≥ 1 proposal of the technique; top 15 of 64 distinct techniques shown). Technique (catalog id)
Runs (of 40)
PassTheHashViaWinRM DumpEntraCredentialsFromEntraConnect AccessAzureMetadataUrlWithNodeZeroRat DumpNtdsViaVssAdmin ImplantNodeZeroRatViaWinrm PilferFilesWithNodeZeroRat ExploitAzureServicePrincipal DumpLsassViaWinRM ImplantNodeZeroRatViaSsh ExploitCloudMetadataSSRF ExploitCloudCredentialsForLateralMovement ExploitCloudServiceAccount DumpNtdsWithVssAdmin DumpLsaWithNodeZeroRat ExploitSmbSigningDisabled
11 10 8 7 5 4 4 3 3 2 2 2 2 2 2
Table A10: Haiku 4.5: adversary technique frequency across 40 runs (number of runs with ≥ 1 proposal; top 15 of 39 distinct techniques shown). The adversary’s distribution is more concentrated than against Sonnet 4 — it focuses on identity and cloud pivots Haiku rarely defends against. Technique (catalog id)
Runs (of 40)
DumpEntraCredentialsFromEntraConnect CompromiseOktaUserWithNodeZeroRat ImplantNodeZeroRatViaWinrm ImplantNodeZeroRatViaSsh DumpMicrosoft365TokensWithNodeZeroRat PilferFilesFromSlackWithNodeZeroRat DumpDomainUserCredentialsWithDcSync ImplantNodeZeroRatViaWmi PassTheHashLateralMovement AccessAzureMetadataUrlWithNodeZeroRat DirectImplantToFileExfiltration CredentialDumpToCloudMetadataEscalation AwsMetadataToObjectiveEscalation DirectAwsMetadataAccess ChainLsassDumpToDcSync
29 15 15 10 7 3 2 2 1 1 1 1 1 1 1
the catalog are rejected as no-ops at the actuator interface. Across 40 runs we observed zero catalog exits on either side, consistent with the stability guarantee depending on the actuator interface rather than on the LLM’s cooperation (see Section 6 and Corollaries 1–2). D.3
Compute resources
Experiment 1 (benchmark). 564 closed-loop runs (282 graphs × 2 conditions) with the deterministic greedy controller execute in approximately 30 minutes on a single Apple M-series CPU core; peak memory footprint < 1 GB; no GPU required. Experiment 2 (temperature sweep). 80 runs total against the Anthropic Messages API: 40 Claude Sonnet 4 (mean wall time ∼ 388 seconds/run, ∼4.31 hours total) and 40 Claude Haiku 4.5 (mean wall time ∼ 269 seconds/run, /sim2.99 hours total), dominated by API round-trips rather than local compute. Total API cost $93.90 ($69.68 Sonnet + $24.22 Haiku); (Table A11). Lean 4 verification. lake build completes in ∼10 minutes on a standard laptop after the Mathlib cache is populated (approximately 3,496 compilation units, of which ours account for 5 files and ∼300 lines; the remainder is Mathlib). 19
Table A11: Mean tool calls and API cost per run, by temperature, for both controllers. Cost includes both defender and adversary turns. Pricing: Sonnet 4 at $3/$15 per MTok input/output; Haiku 4.5 at $1/$5 per MTok. Controller
Temperature
Mean tool calls/run
Total tokens/run
Cost/run
Sonnet 4 Sonnet 4 Sonnet 4 Sonnet 4 Sonnet 4
0.0 0.3 0.7 1.0 all 40 runs
104.3 111.2 112.3 112.6 —
487,065 535,778 542,554 546,093 —
$1.613 $1.766 $1.789 $1.800 $69.68 total
Haiku 4.5 Haiku 4.5 Haiku 4.5 Haiku 4.5 Haiku 4.5
0.0 0.3 0.7 1.0 all 40 runs
157.7 146.7 141.1 142.8 —
535,034 526,829 502,482 496,576 —
$0.631 $0.619 $0.588 $0.584 $24.22 total
Preliminary / unreported compute. Iterative prompt-engineering and per-edge enrichment-pipeline development during research consumed additional API calls and pentest pipeline runs that are not counted here; the $93.90 figure above is strictly for the 80-run temperature sweep reported in Experiment 2. All three reported components (Experiment 1, Experiment 2, Lean verification) are runnable on a standard laptop once dependencies are installed.
20
Table A12: Statistical significance summary. CI = 95% confidence interval. HL = Hodges-Lehmann paired-difference estimator. Tests ordered by paper claim. Test
p
q (BH)
Exp. 1 — Claim (i) Controllability Monotonicity pass rate 282 1.000 [0.987, 1.000] Mean S reduction 282 0.197 [0.172, 0.223] S before vs after round 1 282 HL = 0.000 [0.000, 0.080]
Wilson bootstrap paired Wilcoxon
— — 5.0×10−25
— — 1.2×10−24
Exp. 1 — Claim (ii) Robustness ∆S ≤ γ = 1.0 Mean max spike Anticipatory block rate
Wilson bootstrap Wilson
— — —
— — —
bootstrap Wilson 1-sided Wilcoxon paired Wilcoxon paired Wilcoxon
— — 2.7×10−48 3.3×10−33 1.6×10−8
— — 1.9×10−47 1.1×10−32 2.8×10−8
Exp. 2 — Sonnet 4: temperature invariance Runs at S = 0.3427 40 1.000 [0.912, 1.000] Var. of S(kfinal ) 40 0.000 [0.000, 0.000] Median decay b 40 0.093 [0.093, 0.093] Sfinal ∼ T 40 — Decay b ∼ T 40 — Lfinal ∼ T 40 —
Wilson bootstrap bootstrap K-W (degenerate)† Kruskal-Wallis K-W (degenerate)†
— — — 1.000 0.170 1.000
— — — 1.000 0.297 1.000
Exp. 2 — Haiku 4.5: within-family scaling Runs at S = 0.3427 40 0.475 [0.329, 0.625] Mean S(kfinal ) 40 0.603 [0.527, 0.681] SD of S(kfinal ) 40 0.249 [0.231, 0.255] Belief gap > 0.1 40 0.525 [0.375, 0.671] Off-catalog halluc. 210 0.000 [0.000, 0.018] Decay b ∼ T 40 — Sfinal ∼ T 40 —
Wilson bootstrap bootstrap Wilson Wilson Kruskal-Wallis Kruskal-Wallis
— — — — — 0.0065 0.366
— — — — — 0.020 0.512
Mann-Whitney U
1.6×10−7
5.6×10−7
Metric
n Estimate (95% CI)
890 1.000 [0.996, 1.000] 282 0.420 [0.404, 0.437] 890 0.075 [0.060, 0.094]
Exp. 1 — Claim (iii) Observability Median decay r 282 Fraction R2 > 0.9 282 Per-graph r < 1 282 Paired final gap 282 Paired rounds completed 282
0.109 [0.109, 0.109] 1.000 [0.987, 1.000] HL = −0.891 [−0.891, −0.891] HL = 0.243 [0.221, 0.277] HL = 0.0; means 3.00 vs 3.16
Cross-controller (Sonnet 4 vs Haiku 4.5) S(kfinal ) 80 —
† Degenerate: every run produced an identical value, so there is no within-group variance for Kruskal-Wallis to test. The non-degenerate invariance evidence is the decay-rate Kruskal-Wallis on the row above.
21
Table A13: Primary loop hyperparameters used for Experiment 1 (and Experiment 2 unless noted). Values are fixed across all 282 graphs. Parameter
Value
Justification
Defender controller B (budget per round)
3
Max rounds
10
Block cap
0.95
Random seed
42
Bayesian observer R (measurement noise) Pe prior (dark edges) Pe prior (observed edges) Alert coverage
0.05 0.85 0.15 60%
Scalar Kalman noise; used in gain Ke = Pe /(Pe + R). Diffuse prior on edges with no matched EDR alert. Informative prior on edges with a matched alert. Synthetic EDR alert rate at benchmark construction time.
Convergence check εinnov εV Stability window
0.05 10−4 2 rounds
Mean innovation threshold. S change threshold; treat sub-10−4 changes as converged. Both ε conditions must hold for 2 consecutive rounds.
Lyapunov function λ (weight)
1.0
Equal weighting of S(k) and θ(k) = P̄e (k) in V (k) (Eq. 5).
Attacker New edges per round
≤1
Technique catalog size |T |
66
Adversary proposes at most one new edge per round from a finite technique catalog. Finite adversary technique catalog (shared across Exp. 1 and Exp. 2); bounded by Assumption A3. Distinct from the 16 MITRE techniques observed in the benchmark graphs (Table A4), which reports what actually appears, not what is proposable.
Matches typical SOC maintenance-window capacity; resets per round. Hard cap; 282/282 graphs converge within 6 rounds, 99% within 4. Post-deployment block probability clipped to 0.95 to prevent single-policy dominance. Fixed for reproducibility; greedy controller is deterministic.
Table A14: Defender (controller) tools exposed to the LLM agent in Experiment 2. Each tool is a deterministic Python function; the LLM composes them to assemble a round’s action. Tool name
Calls
Role
compute_v_after_deploy simulate_round_ahead identify_dark_edges get_critical_path list_deployable_policies list_all_vendor_policies get_graph_state identify_bottleneck_edges propose_new_edge
1,309 535 322 320 320 214 9 9 1
simulate S(k) reduction from a candidate policy deployment one-round look-ahead including adversary best-response list belief-graph edges with high Pe return path p∗ achieving max S(k) list catalog entries enable-able under current budget enumerate the full policy catalog C dump belief graph Ĝ(k) rank edges by centrality on surviving paths anticipatory-defense: simulate adversary reply
22
Table A15: Adversary (disturbance) tools exposed to the LLM agent in Experiment 2. Tool name
Calls
Role
evaluate_new_edge chain_credential_attack list_blocked_techniques get_graph_state find_weakest_path find_dark_path find_zero_day_opportunity find_optimal_path find_protocol_bypass compute_path_value propose_novel_technique
323 121 120 120 120 120 120 66 64 26 25
simulate ∆S from a candidate technique edge propose a composite multi-step credential chain enumerate techniques currently blocked by defender policies dump ground-truth Q graph G(k) return lowest- (1 − block) path return path minimizing defender observability surface catalog techniques with no policy coverage max-payoff path search surface protocol-layer alternatives to blocked edges compute S along a named path propose a catalog technique not yet present in G(k)
23