{"id":"https://openalex.org/W7161011020","doi":"https://doi.org/10.48550/arxiv.2605.11188","title":"Adversarial SQL Injection Generation with LLM-Based Architectures","display_name":"Adversarial SQL Injection Generation with LLM-Based Architectures","publication_year":2026,"publication_date":"2026-05-11","ids":{"openalex":"https://openalex.org/W7161011020","doi":"https://doi.org/10.48550/arxiv.2605.11188"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.11188","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11188","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.11188","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136035076","display_name":"Ali Karakoc","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Karakoc, Ali","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136022463","display_name":"H. Birkan Yilmaz","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yilmaz, H. Birkan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.957099974155426,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.957099974155426,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0142000000923872,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.003800000064074993,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sql-injection","display_name":"SQL injection","score":0.7775999903678894},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.7598000168800354},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.6047999858856201},{"id":"https://openalex.org/keywords/sql","display_name":"SQL","score":0.5975000262260437},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.4918999969959259},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.47110000252723694}],"concepts":[{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.7775999903678894},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7644000053405762},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7598000168800354},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.6047999858856201},{"id":"https://openalex.org/C510870499","wikidata":"https://www.wikidata.org/wiki/Q47607","display_name":"SQL","level":2,"score":0.5975000262260437},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.4918999969959259},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.47110000252723694},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.3840000033378601},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.34709998965263367},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2831999957561493},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.2750999927520752},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.27480000257492065},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.2680000066757202},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.2621999979019165},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2612999975681305},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.2590999901294708},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2565999925136566},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.25049999356269836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.11188","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11188","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.11188","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11188","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"SQL":[0,69],"injection":[1,70],"(SQLi)":[2],"attacks":[3,10],"are":[4,186],"still":[5],"one":[6,103],"of":[7,61,153],"the":[8,13,48,138,235],"serious":[9],"ranked":[11],"in":[12,26,31,255],"Open":[14],"Worldwide":[15],"Application":[16,99],"Security":[17],"Project":[18],"(OWASP)":[19],"Top":[20],"10":[21,97],"threats.":[22],"Today,":[23],"with":[24,93,177],"advances":[25],"Artificial":[27],"Intelligence":[28],"(AI),":[29],"especially":[30],"Large":[32],"Language":[33],"Models":[34],"(LLMs),":[35],"an":[36],"opportunity":[37],"has":[38],"been":[39],"created":[40],"for":[41,67,81],"automating":[42],"adversarial":[43,68],"attack":[44],"tests":[45,151,164],"to":[46,56,204,215],"measure":[47],"defense":[49],"mechanisms.":[50],"In":[51,213],"this":[52],"paper,":[53],"we":[54,112,141],"aim":[55],"create":[57],"a":[58,109,178,248],"comprehensive":[59,110,168,249],"evaluation":[60,169],"use":[62],"cases":[63],"that":[64,156,171,221,244],"utilize":[65],"LLMs":[66],"generation.":[71],"We":[72,242],"introduce":[73],"two":[74],"novel":[75],"LLM-based":[76,253],"systems,":[77],"Retrieval":[78],"Augmented":[79],"Generation":[80],"Adversarial":[82],"SQLi":[83,88],"(RADAGAS)":[84],"and":[85,90,102,128,134,147,160,211],"Reflective":[86],"Chain-of-Thought":[87],"(RefleXQLi),":[89],"compare":[91],"them":[92],"existing":[94],"baselines":[95],"against":[96,165],"Web":[98],"Firewalls":[100],"(WAFs)":[101],"execution-based":[104],"MySQL":[105],"validator.":[106],"To":[107],"perform":[108,161],"test,":[111],"used":[113,142],"six":[114],"rule-based":[115,206],"open-source":[116],"WAFs":[117,124,131,191,207],"(ModSecurity":[118],"PL1--3,":[119],"Coraza":[120],"PL1--3),":[121],"2":[122,129],"AI/ML-based":[123,190],"(WAF":[125],"Brain,":[126],"CNN-WAF),":[127],"commercial":[130],"(AWS":[132],"WAF":[133],"Cloudflare":[135],"WAF).":[136],"For":[137],"LLM":[139],"models,":[140],"GPT-4o,":[143],"Claude":[144],"3.7":[145],"Sonnet,":[146],"DeepSeek":[148],"R1.":[149],"Our":[150,167],"consist":[152],"240":[154],"experiments":[155],"generate":[157],"240,000":[158],"payloads":[159,225],"2.2":[162],"million":[163],"WAFs.":[166],"reveals":[170],"RADAGAS-GPT4o":[172],"outperforms":[173],"other":[174],"baseline":[175],"models":[176],"22.73\\%":[179],"bypass":[180,205],"rate.":[181],"The":[182],"proposed":[183],"RADAGAS":[184],"variants":[185],"highly":[187],"successful":[188],"on":[189,193,198,209,251],"(92.49\\%":[192],"WAF-Brain":[194],"by":[195,200],"RADAGAS-DeepSeek,":[196],"80.48\\%":[197],"CNN-WAF":[199],"RADAGAS-Claude),":[201],"but":[202],"struggle":[203],"(0--5.70\\%":[208],"ModSecurity":[210],"Coraza).":[212],"addition":[214],"these":[216],"findings,":[217],"another":[218],"observation":[219],"is":[220,239],"creating":[222],"less":[223],"diverse":[224],"achieves":[226],"more":[227],"bypasses,":[228],"however":[229],"they":[230],"show":[231],"poor":[232],"results":[233],"if":[234],"initially":[236],"chosen":[237],"payload":[238],"not":[240],"successful.":[241],"observe":[243],"our":[245],"findings":[246],"provide":[247],"view":[250],"using":[252],"approaches":[254],"security":[256],"testing.":[257]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-14T00:00:00"}