Verifier stage changes offensive security reports without improving accuracy
The Model Proposes, the Code Disposes: A Pre-Registered Ablation of a Verifier-and-Acceptance Stage in an LLM-Orchestrated Offensive-Security Agent
Cryptography and Security
Summary
When a security system uses a checking step that reviews and filters its findings, it reports fewer issues but with somewhat higher accuracy. The authors tested removing this checking step and found that more issues were reported, but the overall quality did not improve significantly. Their experiments used vulnerable lab systems to compare results with and without the extra verification coding. They conclude that while the verifier stage changes the final reports, it is not clearly better than other methods.
What this means in practice
- •For security testing teams: Design security agents that include code-enforced verification stages to reduce false positive reports in automated vulnerability scans.
- •For software quality engineers: Incorporate deterministic acceptance rules to enforce consistency and auditability in automated security findings workflows.
Authors
Theodoros Moutesidis
Abstract
We evaluate whether a verifier-and-acceptance stage - a model verifier whose verdicts are enforced by deterministic code - changes what an LLM-driven offensive-security agent reports. We report a 15-run exploratory pilot, a pre-registered 20-run confirmatory ablation, and a pre-registered 2 x 2 factorial study with 40 runs across two deliberately vulnerable lab targets. In the confirmatory study, removing the stage eliminated pre-report suppression (median 2 versus 0 findings per run; exact one-sided p = 0.00003) and reduced model-blinded shipped precision (median 0.471 versus 0.353; p = 0.0087). Recall against a frozen but incomplete ground-truth list did not differ significantly (two-sided p = 0.158; equivalence was not established). The factorial study attributed suppression to the model verifier (Holm-adjusted p = 0.004); deterministic acceptance rules alone suppressed no false positives, and no interaction was detected (p = 0.72). The full design retained 93.8% of model-adjudicated true candidates but did not meet its pre-registered non-inferiority criterion because the lower one-sided 95% bound was 0.875, below the 0.90 floor. Across the confirmatory and factorial studies, an instrumented canary recorded zero contacts in 60 of 60 runs, with incidental external contacts disclosed separately. Independent human adjudication of the retained blind packets is pending, so precision and sensitivity endpoints are supporting rather than final evidence. Six audit-trail failures, including one in the evaluation tooling, are also disclosed. The results support a narrow conclusion: the verifier changes what the system ships, while deterministic code supplies enforcement and auditability; they do not establish superiority to other agents or generalization beyond lab targets.