Proceedings of the 2025 Conference on Applied Machine Learning for Information Security Held in Sands Capital, Arlington VA, USA on 22-24 October 2025 Published as Volume 299 by the Proceedings of Machine Learning Research on 02 December 2025. Volume Edited by: Edward Raff Ethan M. Rudd Series Editors: Neil D. Lawrence https://proceedings.mlr.press/v299/ Wed, 07 Oct 2026 11:43:28 +0000 Wed, 07 Oct 2026 11:43:28 +0000 Jekyll v3.10.0 The widespread adoption of {Large Language Models} ({LLMs}) has revolutionized {AI} deployment, enabling autonomous and semi-autonomous applications across industries through intuitive language interfaces and continuous improvements in model development. However, the attendant increase in autonomy and expansion of access permissions among {AI} applications also make these systems compelling targets for malicious attacks. Their inherent susceptibility to security flaws necessitates robust defenses, yet no known approaches can prevent zero-day or novel attacks against {LLMs}. This places {AI} protection systems in a category similar to established malware protection systems: rather than providing guaranteed immunity, they minimize risk through enhanced observability, multi-layered defense, and rapid threat response, supported by a threat intelligence function designed specifically for {AI}-related threats. Prior work on {LLM} protection has largely evaluated individual detection models rather than end-to-end systems designed for continuous, rapid adaptation to a changing threat landscape. To address this gap, we present a production-grade defense system rooted in established malware detection and threat intelligence practices. Our platform integrates three components: a threat intelligence system that turns emerging threats into protections; a data platform that aggregates and enriches information while providing observability, monitoring, and {ML} operations; and a release platform enabling safe, rapid detection updates without disrupting customer workflows. Together, these components deliver layered protection against evolving {LLM} threats while generating training data for continuous model improvement and deploying updates without interrupting production. We share these design patterns and practices to surface the often under-documented, practical aspects of {LLM} security and accelerate progress on operations-focused tooling. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/swanda25a.html https://proceedings.mlr.press/v299/swanda25a.html Large language models (LLMs) are widely deployed across various applications, often with safeguards to prevent the generation of harmful or restricted content. However, these safeguards can be covertly bypassed through adversarial modifications to the computational graph of a model. This work highlights a critical security vulnerability in computational graph-based LLM formats, demonstrating that widely used deployment pipelines may be susceptible to obscured backdoors. We introduce ShadowLogic, a method for creating a backdoor in a white-box LLM by injecting an uncensoring vector into its computational graph representation. We set a trigger phrase that, when added to the beginning of a prompt into the LLM, applies the uncensoring vector and removes the content generation safeguards in the model. We embed trigger logic directly into the computational graph which detects the trigger phrase in a prompt. To evade detection of our backdoor, we obfuscate this logic within the graph structure, making it similar to standard model functions. Our method requires minimal alterations to model parameters, making backdoored models appear benign while retaining the ability to generate uncensored responses when activated. We successfully implement ShadowLogic in Phi-3 and Llama 3.2, using ONNX for manipulating computational graphs. Implanting the uncensoring vector achieved a >60% attack success rate for further malicious queries. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/schulz25a.html https://proceedings.mlr.press/v299/schulz25a.html Millions of new pieces of malicious software (i.e., malware) are introduced each year. This poses significant challenges for antivirus vendors, who use machine learning to detect and analyze malware, and must keep up with changes in the distribution while retaining knowledge of older variants. Continual learning (CL) holds the potential to address this challenge by relaxing the requirements of the incremental storage and computational costs of regularly retraining over all the collected data. Prior work, however, shows that CL techniques, which are designed primarily for computer vision tasks, fare poorly when applied to malware classification. To address these issues, we begin with an exploratory analysis of a typical malware dataset, which reveals that malware families are diverse and difficult to characterize, requiring a wide variety of samples to learn a robust representation. Based on these findings, we propose $\underline{M}$alware $\underline{A}$nalysis with $\underline{D}$istribution-$\underline{A}$ware $\underline{R}$eplay (MADAR), a CL framework that accounts for the unique properties and challenges of the malware data distribution. Through extensive evaluation on large-scale Windows and Android malware datasets, we show that MADAR significantly outperforms prior work. This highlights the importance of understanding domain characteristics when designing CL techniques and demonstrates a path forward for the malware analysis domain. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/rahman25a.html https://proceedings.mlr.press/v299/rahman25a.html Bad actors, primarily distressed firms, have the incentive and desire to manipulate their financial reports to hide their distress and derive personal gains. As attackers, these firms are motivated by potentially millions of dollars and the availability of many publicly disclosed and used financial modeling frameworks. Existing attack methods do not work on this data due to anti-correlated objectives that must both be satisfied for the attacker to succeed. We introduce Maximum Violated Multi-Objective (MVMO) attacks that adapt the attacker’s search direction to find 20$\times$more satisfying attacks compared to standard attacks. The result is that in $\approx$ 50% of cases, a company could inflate their earnings by 100-200%, while simultaneously reducing their fraud scores by 15%. By working with lawyers and professional accountants, we ensure our threat model is realistic to how such frauds are performed in practice. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/raff25a.html https://proceedings.mlr.press/v299/raff25a.html Despite advancements in machine learning for security, rule-based detection remains prevalent in Security Operations Centers due to the resource intensiveness and skill gap associated with ML solutions. While traditional rule-based methods offer efficiency, their rigidity leads to high false positives or negatives and requires continuous manual maintenance. This paper proposes a novel, two-stage hybrid framework to democratize ML-based threat detection. The first stage employs intentionally loose YARA rules for coarse-grained filtering, optimized for high recall. The second stage utilizes an ML classifier to filter out false positives from the first stage’s output. To overcome data scarcity, the system leverages Simula, a seedless synthetic data generation framework, enabling security analysts to create high-quality training datasets without extensive data science expertise or pre-labeled examples. A continuous feedback loop incorporates real-time investigation results to adaptively tune the ML model, preventing rule degradation. This proposed model with active learning has been rigorously tested for a prolonged time in a production environment spanning tens of thousands of systems. The system handles initial raw log volumes often reaching 250 billion events per day, significantly reducing them through filtering and ML inference to a handful of daily tickets for human investigation. Live experiments over an extended timeline demonstrate a general improvement in the model’s precision over time due to the active learning feature. This approach offers a self-sustained, low-overhead, and low-maintenance solution, allowing security professionals to guide model learning as expert “teachers”. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/momeni25a.html https://proceedings.mlr.press/v299/momeni25a.html Red teaming has evolved from its origins in military applications to become a widely adopted methodology in cybersecurity and AI. In this paper, we take a critical look at the practice of AI red teaming. We argue that despite its current popularity in AI governance, there exists a significant gap between red teaming’s original intent as a critical thinking exercise and its narrow focus on discovering model-level flaws in the context of generative AI. Current AI red teaming efforts focus predominantly on individual model vulnerabilities while overlooking the broader sociotechnical systems and emergent behaviors that arise from complex interactions between models, users, and environments. To address this deficiency, we propose a comprehensive framework operationalizing red teaming in AI systems at two levels: macro-level system red teaming spanning the entire AI development lifecycle, and micro-level model red teaming. Drawing on cybersecurity experience and systems theory, we further propose a set of six recommendations. In these, we emphasize that effective AI red teaming requires multifunctional teams that examine emergent risks, systemic vulnerabilities, and the interplay between technical and social factors. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/majumdar25a.html https://proceedings.mlr.press/v299/majumdar25a.html Modern cloud environments contain thousands of interdependent resources that frequently change, making them complex to monitor with traditional tools. This paper introduces Relational Inference GraphRAG (RIG-RAG), a pair of LLM-assisted inference pipelines that transform raw cloud configuration data into a security-enriched typed knowledge graph to support natural-language reasoning about deployed infrastructure. RIG-RAG enables organizations to execute natural language security queries against their cloud environments and to support the continuous validation of critical questions such as "What resources are publicly accessible?" or "Which identities can read from databases?". Our implementation, SkyShark IQ, processes queries in two modes: interactive mode for ad hoc user interaction, and oversight mode for periodically executed curated inquiries that monitor infrastructure drift. By extracting cloud resource configurations into a typed graph structure with inferred security relationships, SkyShark IQ allows security teams to reason over complex infrastructure through an intuitive conversational interface. Based on the current state of the deployed infrastructure, the system provides role-appropriate security insights, providing technical details to analysts, explaining implementation impacts to product owners, and presenting contextual risk summaries to business leaders. We deployed and evaluated our system in a production AWS environment that supports 300,000 users, demonstrating its ability to simplify complex infrastructure analysis, surface hidden security relationships, and provide verifiable, role-appropriate explanations that improve situational awareness and cross-team communication in operational security workflows. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/lilley25a.html https://proceedings.mlr.press/v299/lilley25a.html Recent advances in deep reinforcement learning for autonomous cyber defence have resulted in agents that can successfully defend simulated computer networks against cyber-attacks. However, many of these agents would need retraining to defend networks with differing topology or size, making them poorly suited to real-world networks where topology and size can vary over time. In this research we introduce a novel set of Topological Extensions for Reinforcement Learning Agents (TERLA) that provide generalisability for the defence of networks with differing topology and size, without the need for retraining. These extensions can be applied to existing autonomous cyber defence agents and may also help address policy learning challenges inherent with large network action spaces. Our approach involves the use of heterogeneous graph neural network layers to produce a fixed-size latent embedding representing the observed network state. This representation learning stage is coupled with a reduced, fixed-size, semantically meaningful and interpretable action space. We apply TERLA to a standard deep reinforcement learning Proximal Policy Optimisation (PPO) agent model, and to reduce the sim-to-real gap, conduct our research using Cyber Autonomy Gym for Experimentation (CAGE) Challenge 4. This Cyber Operations Research Gym environment has many of the features of a real-world network, such as realistic Intrusion Detection System (IDS) events and multiple agents defending network segments of differing topology and size. TERLA agents have been designed for host-based defence, and defensive actions are resolved to specific hosts using only observable IDS information that would be available in real-world networks. TERLA agents have been evaluated against vanilla PPO agents as well as other approaches including no defence against cyber-attacks and performing random defensive actions. TERLA agents retain the defensive performance of vanilla PPO agents whilst showing improved action efficiency. Generalisability has been demonstrated by showing that all TERLA agents have the same network-agnostic neural network architecture, and by deploying a single TERLA agent multiple times to defend network segments with differing topology and size, showing improved defensive performance and efficiency. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/dudman25a.html https://proceedings.mlr.press/v299/dudman25a.html The increasing integration of Visual Language Models (VLMs) into AI systems necessitates robust model alignment, especially when handling multimodal content that combines text and images. Existing evaluation datasets heavily lean towards text-only prompts, leaving visual vulnerabilities under evaluated. To address this gap, we propose Text2VLM, a novel multi-stage pipeline that adapts text-only datasets into multimodal formats, specifically designed to evaluate the resilience of VLMs against typographic prompt injection attacks. The Text2VLM pipeline identifies harmful content in the original text and converts it into a typographic image, creating a multimodal prompt for VLMs. Also, our evaluation of open-source VLMs highlights their increased susceptibility to prompt injection when visual inputs are introduced, revealing critical weaknesses in the current models’ alignment. This is in addition to a significant performance gap compared to closed-source frontier models. We validate Text2VLM through human evaluations, ensuring the alignment of extracted salient concepts; text summarization and output classification align with human expectations. Text2VLM provides a scalable tool for comprehensive safety assessment, contributing to the development of more robust safety mechanisms for VLMs. By enhancing the evaluation of multimodal vulnerabilities, Text2VLM plays a role in advancing the safe deployment of VLMs in diverse, real-world applications. We have made Text2VLM available for others to use, along with the code to replicate the results in this paper. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/downer25a.html https://proceedings.mlr.press/v299/downer25a.html Machine learning (ML)-based systems are increasingly being deployed in real-world applications with high societal impacts. A pivotal factor that contributes to the success of ML techniques is the availability of high-quality training datasets. However, there are many attack vectors (exploitable by attackers) to launch various data poisoning (DP) attacks against ML systems since training datasets are often collected from untrusted data sources. One direct negative consequence of DP attacks is that the data quality of the poisoned dataset can be significantly deteriorated compared with the original clean dataset. To mitigate the low-data-quality issue, we design a neural network (NN)-based Poisoned Data Automatic Restoration (PD-AutoR) engine to automatically detect and restore PD prior to ML model training. Our high-level methodology is to develop a transductive learning-supported pipeline, which allows the target PD (that needs to be restored) to be used in PD-AutoR training, so PD-AutoR can achieve very high restoration accuracy. In addition, we design transformer-based networks (with a self-attention mechanism) to enable PD-AutoR to precisely and automatically pay attention to the areas that need to be restored, enabling PD-AutoR to restore the PD even if the attacker’s poisoning strategy is agnostic. Our theoretical analysis and preliminary experimental results show that PD-AutoR can simultaneously fulfill the three design goals including high PD detection accuracy, high PD restoration accuracy, and strong fault tolerance. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/chen25a.html https://proceedings.mlr.press/v299/chen25a.html LLMs are increasingly pervasive in the security environment, with limited measures of their effectiveness, which limits trust and usefulness to security practitioners. Here, we present an open-source evaluation framework and benchmark metrics for evaluating LLM-generated cybersecurity rules. The benchmark employs a holdout set-based methodology to measure the effectiveness of LLM-generated security rules in comparison to a human-generated corpus of rules. It provides three key metrics inspired by the way experts evaluate security rules, offering a realistic, multifaceted evaluation of the effectiveness of an LLM-based security rule generator. This methodology is illustrated using rules from Sublime Security’s detection team and those written by Sublime Security’s Automated Detection Engineer (ADÉ), with a thorough analysis of ADÉ’s skills presented in the results section. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/bertiger25a.html https://proceedings.mlr.press/v299/bertiger25a.html Large Language Models (LLMs) have demonstrated impressive fluency and reasoning capabilities, but their potential for misuse has raised growing concern. In this paper, we present ScamAgent, an autonomous multi-turn agent built on top of LLMs, capable of generating highly realistic scam call scripts that simulate real-world fraud scenarios. Unlike prior work focused on single-shot prompt misuse, ScamAgent maintains dialogue memory, adapts dynamically to simulated user responses, and employs deceptive persuasion strategies across conversational turns. We show that current LLM safety guardrails, including refusal mechanisms and content filters, are ineffective against such agent-based threats. Even models with strong prompt-level safeguards can be bypassed when prompts are decomposed, disguised, or delivered incrementally within an agent framework. We further demonstrate the transformation of scam scripts into lifelike voice calls using modern text-to-speech systems, completing a fully automated scam pipeline. Our findings highlight an urgent need for multi-turn safety auditing, agent-level control frameworks, and new methods to detect and disrupt conversational deception powered by generative AI. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/badhe25a.html https://proceedings.mlr.press/v299/badhe25a.html The application of machine learning (ML) for cyber anomaly detection has attracted significant research attention. However, existing detection systems often face major challenges, including rigid feature discretisation, black-box classification, biased learning from confounded data, and lack of robustness, which collectively compromise interpretability, fairness, and predictive accuracy. Causal inference offers a robust approach to estimating intervention effects by isolating spurious correlations from true cause-effect relationships, crucial for reliable decision making under uncertainty. In contrast, reinforcement learning (RL) enables agents to learn optimal adaptive policies through interaction with dynamic environments. To address the aforementioned challenges, this work proposes a paradigm that leverages a RL framework to drive causal inference into the anomaly detection pipeline. Specifically, an RL agent is trained to optimize binning thresholds for confounded numerical features, guided by a reward function that incorporates both causal effect estimation and predictive accuracy. This approach enables the agent to learn feature discretisation strategies that avoid spurious associations induced by confounders, resulting in thresholds that are both causally aware and statistically effective. The optimized binning policy is then applied to transform the dataset, and a decision tree classifier is trained on the resulting unbiased features. This produces a model that is interpretable, robust to confounding, and sensitive to causal structures. Experimental results show that the proposed approach improves robustness and interpretability in unseen environments. This work highlights the potential of combining causal reasoning with adaptive learning to produce high-performance, transparent, optimal feature discretisation, and bias-aware cyber defence models. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/babirye25a.html https://proceedings.mlr.press/v299/babirye25a.html AWS AssumeRole enables essential automation but also provides attackers with a primary mechanism for privilege escalation and lateral movement. Security teams face two critical challenges: identifying suspicious individual AssumeRole events within overwhelming legitimate activity and detecting when sequences of seemingly benign events form malicious role-chaining attacks. RoleSentry addresses both challenges through a novel three-stage framework combining behavioral filtering, ensemble anomaly detection, and graph neural networks. The system first applies a lightweight behavioral trait filter that automatically suppresses routine service-to-service automation, resulting in a 12.3% volume reduction with zero conflicting classifications. Filtered events undergo parallel analysis: an ensemble model scores individual events using contextual features, while a graph neural network analyzes temporal graphs to detect multi-step chaining patterns. The system provides SHAP-based explanations for analyst interpretation. We evaluated RoleSentry on a large corpus of AssumeRole events collected from over 30 days. Compared to Amazon GuardDuty, RoleSentry reduced false positive alerts by 98% and identified 25 sophisticated attacks that the commercial service missed entirely, includ-ing complex role-chaining scenarios. The results demonstrate that combining behavioral filtering with graph-based analysis provides operationally viable detection of both isolated and chained AssumeRole abuse. Tue, 02 Dec 2025 00:00:00 +0000 https://proceedings.mlr.press/v299/attigah25a.html https://proceedings.mlr.press/v299/attigah25a.html