Formal Models and Convergence Analysis for Context-Aware Security Verification

TL;DR

This work tackles the persistent problem that static security scanners miss novel attacks due to context blindness. It introduces context-aware verification, a formal framework where the context extracted from a system informs a targeted payload generator and verifier, with guarantees on completeness and soundness. Key theoretical contributions include sample complexity bounds via VC-dimension, an information-theoretic limit based on $I(W;X)$ and Fano's inequality, convergence guarantees for the adaptive process, and a compositional soundness bound; a formal separation shows context-aware verifiers outperform static ones under a finite payload budget. The authors instantiate the framework with a domain-specific LLM payload generator and validate predictions on 97{,}224 samples, observing accuracy improvements with context, convergence rates of $O(1/\sqrt{T})$, and soundness within theoretical bounds. The results demonstrate that context-enriched adaptive verification can effectively detect unseen attacks and provide rigorous guarantees for practical security tooling.

Abstract

Traditional security scanners fail when facing new attack patterns they haven't seen before. They rely on fixed rules and predetermined signatures, making them blind to novel threats. We present a fundamentally different approach: instead of memorizing specific attack patterns, we learn what makes systems genuinely secure. Our key insight is simple yet powerful: context determines vulnerability. A SQL query that's safe in one environment becomes dangerous in another. By modeling this context-vulnerability relationship, we achieve something remarkable: our system detects attacks it has never seen before. We introduce context-aware verification that learns from genuine system behavior. Through reconstruction learning on secure systems, we capture their essential characteristics. When an unknown attack deviates from these patterns, our system recognizes it, even without prior knowledge of that specific attack type. We prove this capability theoretically, showing detection rates improve exponentially with context information I(W;C). Our framework combines three components: (1) reconstruction learning that models secure behavior, (2) multi-scale graph reasoning that aggregates contextual clues, and (3) attention mechanisms guided by reconstruction differences. Extensive experiments validate our approach: detection accuracy jumps from 58 percent to 82 percent with full context, unknown attack detection improves by 31 percent, and our system maintains above 90 percent accuracy even against completely novel attack vectors.

Figures (3)

• Figure 1: Context-aware verification system architecture. The system composes three components (C, G, V) with individual error rates. Theorem \ref{['thm:soundness']} bounds the compositional false positive rate at $\epsilon_V + \delta_C + \delta_G = 12\%$. Adaptive learning refines the generator over time.
• Figure 2: Validation results (I): information-theoretic scaling and convergence.
• Figure 3: Validation results (II): sample complexity and soundness.