Ask the Expert: LLM-Guided Reinforcement Learning for Autonomous Cyber Defense

arXiv:2610.09337 · cs.CR, cs.LG · Submitted 2026-10-07 · Read on arXiv

cs.CR, cs.LG

Submitted: 2026-10-07

Updated: 2026-10-07

Comments: Accepted for publication at IEEE GLOBECOM 2026. Proceedings forthcoming. 6 pages, 4 figures

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Reinforcement Learning — 15× in this paper · explained in 4 episodes
• Reward Shaping — 13× in this paper · explained in 2 episodes
• Action Space — 7× in this paper · explained in 1 episode
• Benchmark — 2× in this paper · explained in 2 episodes
• Deep Reinforcement Learning — 2× in this paper · explained in 2 episodes
• Large Language Models (LLMs) — 2× in this paper · explained in 6 episodes
• Reinforcement Learning (RL) — 2× in this paper · explained in 25 episodes
• Sample Efficiency — 2× in this paper · explained in 4 episodes
• Action Masking — 1× in this paper · explained in 1 episode
• Fidelity — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• Partially observable Markov decision process (POMDP) — 1× in this paper · explained in 2 episodes
• Representation Learning — 1× in this paper · explained in 2 episodes
• Reward Function — 1× in this paper · explained in 2 episodes
• World Model — 1× in this paper · explained in 7 episodes

Sources

• Proximal Policy Optimization Algorithms
• Deep Reinforcement Learning for Autonomous Cyber Defence: A Survey
• In-Context Reinforcement Learning via Communicative World Models
• On Autonomous Agents in a Cyber Defence Environment

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs