{"id":"https://openalex.org/W7151445225","doi":"https://doi.org/10.48550/arxiv.2604.04442","title":"Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning","display_name":"Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning","publication_year":2026,"publication_date":"2026-04-06","ids":{"openalex":"https://openalex.org/W7151445225","doi":"https://doi.org/10.48550/arxiv.2604.04442"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.04442","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.04442","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.04442","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133124743","display_name":"Yiyao Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Zhang, Yiyao","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084412291","display_name":"Diksha Goel","orcid":"https://orcid.org/0000-0001-8212-8793"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Goel, Diksha","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133128022","display_name":"Hussain Ahmad","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ahmad, Hussain","raw_affiliation_strings":[],"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5133124743"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8773000240325928,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8773000240325928,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.04179999977350235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.010599999688565731,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6930999755859375},{"id":"https://openalex.org/keywords/ambiguity","display_name":"Ambiguity","score":0.6656000018119812},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.6039000153541565},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.5939000248908997},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5672000050544739},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.515999972820282},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5063999891281128},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.4251999855041504},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.4009000062942505},{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.38670000433921814}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6930999755859375},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.6656000018119812},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.638700008392334},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.6039000153541565},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.5939000248908997},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5672000050544739},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.515999972820282},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5063999891281128},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4456000030040741},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4447999894618988},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.4251999855041504},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.4009000062942505},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.38670000433921814},{"id":"https://openalex.org/C74197172","wikidata":"https://www.wikidata.org/wiki/Q1195339","display_name":"Directed acyclic graph","level":2,"score":0.36649999022483826},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.3610999882221222},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.35830000042915344},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3495999872684479},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.32749998569488525},{"id":"https://openalex.org/C115086926","wikidata":"https://www.wikidata.org/wiki/Q17004651","display_name":"Causal reasoning","level":3,"score":0.32690000534057617},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32659998536109924},{"id":"https://openalex.org/C17098449","wikidata":"https://www.wikidata.org/wiki/Q176814","display_name":"Partially observable Markov decision process","level":4,"score":0.3248000144958496},{"id":"https://openalex.org/C90509273","wikidata":"https://www.wikidata.org/wiki/Q11012","display_name":"Robot","level":2,"score":0.32350000739097595},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.32100000977516174},{"id":"https://openalex.org/C2776544517","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Unexpected events","level":2,"score":0.3142000138759613},{"id":"https://openalex.org/C146380142","wikidata":"https://www.wikidata.org/wiki/Q1137726","display_name":"Directed graph","level":2,"score":0.311599999666214},{"id":"https://openalex.org/C13687954","wikidata":"https://www.wikidata.org/wiki/Q4826847","display_name":"Autonomous agent","level":2,"score":0.2969000041484833},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.2939000129699707},{"id":"https://openalex.org/C2776904630","wikidata":"https://www.wikidata.org/wiki/Q356336","display_name":"Adept","level":3,"score":0.2937999963760376},{"id":"https://openalex.org/C72434380","wikidata":"https://www.wikidata.org/wiki/Q230930","display_name":"State space","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.2809000015258789},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2793999910354614},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2689000070095062},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.2651999890804291},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.2572999894618988},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.2572000026702881},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.25450000166893005}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.04442","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.04442","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.04442","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.04442","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Autonomous":[0],"agents":[1],"are":[2,71],"increasingly":[3],"deployed":[4],"in":[5,16,38,164,221],"both":[6],"offensive":[7],"and":[8,31,55,70,116,187,219,234],"defensive":[9],"cyber":[10,95],"operations,":[11],"creating":[12],"high-speed,":[13],"closed-loop":[14],"interactions":[15],"critical":[17],"infrastructure":[18],"environments.":[19],"Advanced":[20],"Persistent":[21],"Threat":[22],"(APT)":[23],"actors":[24],"exploit":[25],"\"Living":[26],"off":[27],"the":[28,83,207,213],"Land\"":[29],"techniques":[30],"targeted":[32],"telemetry":[33,115],"perturbations":[34],"to":[35,44,73,147,226],"induce":[36],"ambiguity":[37],"monitoring":[39],"systems,":[40],"causing":[41],"automated":[42],"defenses":[43],"overreact":[45],"or":[46,78],"misclassify":[47],"benign":[48],"behavior":[49],"as":[50,135,200],"malicious":[51],"activity.":[52],"Existing":[53],"monolithic":[54],"multi-agent":[56],"defense":[57,96],"pipelines":[58],"largely":[59],"operate":[60],"on":[61,67],"correlation-based":[62],"signals,":[63],"lack":[64],"structural":[65],"constraints":[66],"response":[68,129],"actions,":[69],"vulnerable":[72],"reasoning":[74],"drift":[75],"under":[76,204],"ambiguous":[77],"adversarial":[79,102],"inputs.":[80],"We":[81],"present":[82],"Causal":[84,110],"Multi-Agent":[85],"Decision":[86,138],"Framework":[87],"(C-MADF),":[88],"a":[89,108,136,159,166,173,183,190],"structurally":[90],"constrained":[91,154],"architecture":[92],"for":[93],"autonomous":[94],"that":[97,126,198],"integrates":[98],"causal":[99],"modeling":[100],"with":[101,194],"dual-policy":[103],"control.":[104],"C-MADF":[105,211],"first":[106],"learns":[107],"Structural":[109],"Model":[111],"(SCM)":[112],"from":[113,216],"historical":[114],"compiles":[117],"it":[118],"into":[119],"an":[120,195,201],"investigation-level":[121],"Directed":[122],"Acyclic":[123],"Graph":[124],"(DAG)":[125],"defines":[127],"admissible":[128],"transitions.":[130,150],"This":[131],"roadmap":[132],"is":[133,144,156,170,180],"formalized":[134],"Markov":[137],"Process":[139],"(MDP)":[140],"whose":[141],"action":[142],"space":[143,155],"explicitly":[145],"restricted":[146],"causally":[148],"consistent":[149],"Decision-making":[151],"within":[152],"this":[153],"performed":[157],"by":[158,172],"dual-agent":[160],"reinforcement":[161],"learning":[162],"system":[163],"which":[165],"threat-optimizing":[167],"Blue-Team":[168],"policy":[169],"counterbalanced":[171],"conservatively":[174],"shaped":[175],"Red-Team":[176],"policy.":[177],"Inter-policy":[178],"disagreement":[179],"quantified":[181],"through":[182],"Policy":[184],"Divergence":[185],"Score":[186,197],"exposed":[188],"via":[189],"human-in-the-loop":[191],"interface":[192],"equipped":[193],"Explainability-Transparency":[196],"serves":[199],"escalation":[202],"signal":[203],"uncertainty.":[205],"On":[206],"real-world":[208],"CICIoT2023":[209],"dataset,":[210],"reduces":[212],"false-positive":[214],"rate":[215],"11.2%,":[217],"9.7%,":[218],"8.4%":[220],"three":[222],"cutting-edge":[223],"literature":[224],"baselines":[225],"1.8%,":[227],"while":[228],"achieving":[229],"0.997":[230],"precision,":[231],"0.961":[232],"recall,":[233],"0.979":[235],"F1-score.":[236]},"counts_by_year":[],"updated_date":"2026-04-08T06:07:18.267832","created_date":"2026-04-08T00:00:00"}