{"id":"https://openalex.org/W7104278099","doi":"https://doi.org/10.1145/3733799.3762978","title":"LLM-CVX: A Benchmarking Framework for Assessing the Offensive Potential of LLMs in Exploiting CVEs","display_name":"LLM-CVX: A Benchmarking Framework for Assessing the Offensive Potential of LLMs in Exploiting CVEs","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W7104278099","doi":"https://doi.org/10.1145/3733799.3762978"},"language":"en","primary_location":{"id":"doi:10.1145/3733799.3762978","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762978","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3733799.3762978","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Mohamed Amine El yagouby","orcid":"https://orcid.org/0009-0002-7575-3392"},"institutions":[{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I4210106663","display_name":"International University of Rabat","ror":"https://ror.org/01t9czq80","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210106663"]},{"id":"https://openalex.org/I4210121838","display_name":"Laboratoire Lorrain de Recherche en Informatique et ses Applications","ror":"https://ror.org/02vnf0c38","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I277688954","https://openalex.org/I4210107720","https://openalex.org/I4210121838","https://openalex.org/I4210159245","https://openalex.org/I90183372"]},{"id":"https://openalex.org/I90183372","display_name":"Universit\u00e9 de Lorraine","ror":"https://ror.org/04vfs2w97","country_code":"FR","type":"education","lineage":["https://openalex.org/I90183372"]}],"countries":["FR","MA"],"is_corresponding":false,"raw_author_name":"Mohamed Amine El yagouby","raw_affiliation_strings":["CNRS, Inria, LORIA, Universit\u00e9 de Lorraine, Nancy, France and TICLab, International University of Rabat, Rabat, Morocco"],"raw_orcid":"https://orcid.org/0009-0002-7575-3392","affiliations":[{"raw_affiliation_string":"CNRS, Inria, LORIA, Universit\u00e9 de Lorraine, Nancy, France and TICLab, International University of Rabat, Rabat, Morocco","institution_ids":["https://openalex.org/I1294671590","https://openalex.org/I4210106663","https://openalex.org/I4210121838","https://openalex.org/I90183372"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Abdelkader Lahmadi","orcid":"https://orcid.org/0000-0003-3882-1560"},"institutions":[{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I4210121838","display_name":"Laboratoire Lorrain de Recherche en Informatique et ses Applications","ror":"https://ror.org/02vnf0c38","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I277688954","https://openalex.org/I4210107720","https://openalex.org/I4210121838","https://openalex.org/I4210159245","https://openalex.org/I90183372"]},{"id":"https://openalex.org/I90183372","display_name":"Universit\u00e9 de Lorraine","ror":"https://ror.org/04vfs2w97","country_code":"FR","type":"education","lineage":["https://openalex.org/I90183372"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Abdelkader Lahmadi","raw_affiliation_strings":["CNRS, Inria, LORIA, Universit\u00e9 de Lorraine, Nancy, France"],"raw_orcid":"https://orcid.org/0000-0003-3882-1560","affiliations":[{"raw_affiliation_string":"CNRS, Inria, LORIA, Universit\u00e9 de Lorraine, Nancy, France","institution_ids":["https://openalex.org/I1294671590","https://openalex.org/I4210121838","https://openalex.org/I90183372"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Mehdi Zakroum","orcid":"https://orcid.org/0000-0003-2891-8588"},"institutions":[{"id":"https://openalex.org/I4210106663","display_name":"International University of Rabat","ror":"https://ror.org/01t9czq80","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210106663"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Mehdi Zakroum","raw_affiliation_strings":["TICLab, International University of Rabat, Rabat, Morocco"],"raw_orcid":"https://orcid.org/0000-0003-2891-8588","affiliations":[{"raw_affiliation_string":"TICLab, International University of Rabat, Rabat, Morocco","institution_ids":["https://openalex.org/I4210106663"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Olivier Festor","orcid":"https://orcid.org/0000-0002-3181-7967"},"institutions":[{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I4210121838","display_name":"Laboratoire Lorrain de Recherche en Informatique et ses Applications","ror":"https://ror.org/02vnf0c38","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I277688954","https://openalex.org/I4210107720","https://openalex.org/I4210121838","https://openalex.org/I4210159245","https://openalex.org/I90183372"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Olivier Festor","raw_affiliation_strings":["CNRS, Inria, LORIA,, Universit\u00e9 de Lorraine, Nancy, France"],"raw_orcid":"https://orcid.org/0000-0002-3181-7967","affiliations":[{"raw_affiliation_string":"CNRS, Inria, LORIA,, Universit\u00e9 de Lorraine, Nancy, France","institution_ids":["https://openalex.org/I1294671590","https://openalex.org/I4210121838"]}]},{"author_position":"last","author":{"id":null,"display_name":"Mounir Ghogho","orcid":"https://orcid.org/0000-0002-0055-7867"},"institutions":[{"id":"https://openalex.org/I4210131560","display_name":"Universit\u00e9 Mohammed VI Polytechnique","ror":"https://ror.org/03xc55g68","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210131560"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Mounir Ghogho","raw_affiliation_strings":["University Mohammed VI Polytechnic, Rabat, Morocco"],"raw_orcid":"https://orcid.org/0000-0002-0055-7867","affiliations":[{"raw_affiliation_string":"University Mohammed VI Polytechnic, Rabat, Morocco","institution_ids":["https://openalex.org/I4210131560"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"194","last_page":"205"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.039900001138448715,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.039900001138448715,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13972","display_name":"Business Law and Ethics","score":0.029400000348687172,"subfield":{"id":"https://openalex.org/subfields/1402","display_name":"Accounting"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.019700000062584877,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.9355999827384949},{"id":"https://openalex.org/keywords/benchmarking","display_name":"Benchmarking","score":0.8402000069618225},{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.8104000091552734},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5927000045776367},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5245000123977661},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.32359999418258667}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.9355999827384949},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.8402000069618225},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.8104000091552734},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5927000045776367},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5882999897003174},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5245000123977661},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4350999891757965},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.38510000705718994},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.32359999418258667},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.31709998846054077},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.29840001463890076},{"id":"https://openalex.org/C127576917","wikidata":"https://www.wikidata.org/wiki/Q624630","display_name":"Competitor analysis","level":2,"score":0.2685000002384186},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.25999999046325684},{"id":"https://openalex.org/C32833848","wikidata":"https://www.wikidata.org/wiki/Q4115054","display_name":"Extensibility","level":2,"score":0.2533000111579895}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3733799.3762978","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762978","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},{"id":"pmh:oai:HAL:hal-05349650v1","is_oa":true,"landing_page_url":"https://inria.hal.science/hal-05349650","pdf_url":"https://inria.hal.science/hal-05349650v1/document","source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"AISec 2025 - 18 th ACM Workshop on Artificial Intelligence and Security, Association for Computing Machinery, Oct 2025, Taipei, Taiwan. ⟨10.1145/3733799.3762978⟩","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3733799.3762978","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762978","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1473282988","display_name":null,"funder_award_id":"ANR-15-IDEX-04-LUE","funder_id":"https://openalex.org/F4320310925","funder_display_name":"Universit\u00e9 de Lorraine"},{"id":"https://openalex.org/G3172997804","display_name":"Isite LUE","funder_award_id":"ANR-15-IDEX-0004","funder_id":"https://openalex.org/F4320320883","funder_display_name":"Agence Nationale de la Recherche"},{"id":"https://openalex.org/G6612625481","display_name":null,"funder_award_id":"France 2030","funder_id":"https://openalex.org/F4320320883","funder_display_name":"Agence Nationale de la Recherche"},{"id":"https://openalex.org/G8254623148","display_name":null,"funder_award_id":"ANR-15-IDEX-04-LUE","funder_id":"https://openalex.org/F4320320883","funder_display_name":"Agence Nationale de la Recherche"},{"id":"https://openalex.org/G8918884702","display_name":null,"funder_award_id":"15-IDEX-04-LUE","funder_id":"https://openalex.org/F4320320883","funder_display_name":"Agence Nationale de la Recherche"}],"funders":[{"id":"https://openalex.org/F4320310925","display_name":"Universit\u00e9 de Lorraine","ror":"https://ror.org/04vfs2w97"},{"id":"https://openalex.org/F4320320883","display_name":"Agence Nationale de la Recherche","ror":"https://ror.org/00rbzpz17"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"increasing":[1],"capabilities":[2],"of":[3,38,42,151],"Large":[4],"Language":[5],"Models":[6],"(LLMs)":[7],"in":[8,46,60,148],"code":[9],"generation":[10],"and":[11,57,63,93,96,107,128,131],"reasoning":[12],"have":[13],"raised":[14],"concerns":[15],"about":[16],"their":[17,61,140],"potential":[18,41],"misuse,":[19],"particularly":[20],"for":[21,34],"automating":[22],"or":[23],"assisting":[24],"with":[25,88,158],"vulnerability":[26],"exploitation":[27,86,142,156],"tasks.":[28],"This":[29],"concern":[30],"highlights":[31],"the":[32,39,149],"need":[33],"a":[35,74,132],"systematic":[36],"evaluation":[37],"offensive":[40],"LLMs.":[43],"Existing":[44],"methodologies":[45],"this":[47,69,111],"context":[48],"use":[49],"synthetic":[50],"vulnerabilities,":[51],"rely":[52],"on":[53,83,118],"fixed":[54],"prompting":[55,91],"strategies":[56,92],"exploit":[58,94,125],"tools":[59,126],"evaluation,":[62],"do":[64],"not":[65],"consider":[66],"efficiency.":[67,108],"In":[68],"paper,":[70],"we":[71],"introduce":[72],"LLM-CVX,":[73],"novel":[75],"benchmarking":[76],"framework":[77,112],"designed":[78],"to":[79,99,103,113,138],"systematically":[80],"evaluate":[81,114],"LLMs":[82,98,117,137],"real-world":[84],"CVE":[85],"tasks,":[87],"extensibility":[89],"towards":[90],"tools,":[95,157],"allowing":[97],"make":[100],"multiple":[101],"attempts":[102],"capture":[104],"both":[105,155],"effectiveness":[106],"We":[109],"implemented":[110],"14":[115],"state-of-the-art":[116],"exploiting":[119],"36":[120],"real":[121],"CVEs":[122],"using":[123,154],"2":[124],"(Metasploit":[127],"GitHub":[129],"PoC)":[130],"correction":[133],"loop":[134],"that":[135],"enables":[136],"correct":[139],"previous":[141],"attempts.":[143],"Experimental":[144],"results":[145],"reveal":[146],"variation":[147],"behavior":[150],"different":[152],"LLMs,":[153],"closed-source":[159],"models":[160],"generally":[161],"outperforming":[162],"open-source":[163],"ones.":[164]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-25T15:57:00.446498","created_date":"2025-11-07T00:00:00"}