Research map / Multi-agent systems and games / LLM agents

Towards Effective Offensive Security LLM Agents: Hyperparameter Tuning, LLM as a Judge, and a Lightweight CTF Benchmark

AAAI 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Studies how LLM decoding hyperparameters and model choice affect a D-CIPHER multi-agent CTF solver, introducing the CTFJudge LLM-as-judge framework with a CCI partial-credit metric and a 50-challenge CTFTiny benchmark.

Problem

Offensive security LLM agents are sensitive to hyperparameters and evaluated only with coarse pass/fail metrics, and existing CTF benchmarks are too heavy for rapid, resource-constrained experimentation.

Approach

Combines a reference-guided LLM judge (CTFJudge) that scores agent trajectories against expert write-ups on six cyber competencies into a weighted CTF Competency Index, with a difficulty-stratified 50-challenge subset (CTFTiny) of NYU CTF Bench and a temperature/top-p/max-token sweep of the D-CIPHER agent.

Key results

• Claude 4 Sonnet solved 38 of 50 CTFTiny challenges (76%), the highest among seven models; Gemini 2.5 Flash solved 32 (64%).
• Claude 4 Sonnet peaked at temperature 1.0 with 38 solves and at max tokens 4096, while GPT-4.1 peaked at temperature 0.6 with 21 solves.
• CTFJudge CCI ranged 77.5–84.5 for Claude 4 Sonnet and separated successful from failed trajectories, with most models weak on efficiency of approach.

Surprising findings

• Longer max-token limits (8192) reduced performance compared with 4096 for both Claude 4 Sonnet and GPT-4.1.
• Llama 4 Maverick solved only 4 of 50 challenges, and Gemini 2.5 Flash outperformed Claude 4 Sonnet on binary exploitation.

Limitations

• CCI uses fixed equal weights chosen by experts and may not generalize to other CTF tasks.
• Only one agent architecture (D-CIPHER) is studied.
• Hyperparameter sweep covers one-factor-at-a-time variations and only small challenge set (50).

Experimental setup

Datasets: NYU CTF Bench

Benchmarks: CTFTiny

Metrics: pass@1 CTF Competency Index (CCI) average cost

Baselines: D-CIPHER default configuration Claude 4 Sonnet Gemini 2.5 Pro Gemini 2.5 Flash GPT-4.1 Qwen 3 DeepSeek V3 Llama 4 Maverick

Builds on: D-CIPHER NYU CTF Bench CRAKEN

Closest papers by meaning

• EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities (ICML 2025 · similarity 0.89)
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.89)
• NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security (NeurIPS 2024 · similarity 0.88)
• SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.88)
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases (NeurIPS 2024 · similarity 0.88)
• ORBIT: A Framework for Multi-Agent Security Evaluations (NeurIPS 2026 · similarity 0.88)