Recent News
- Serving on the SaTML'27 PCI am serving on the program committee for 5th IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). Looking forward to reviewing submissions!
- Distinguished Artifact Reviewer for PETS'26I have been recognized as a Distinguished Artifact Reviewer at the 26th Privacy Enhancing Technologies Symposium (PETS 2026).
- Blog post on my homelab setupA tour of my homelab, including the hardware, services, AI stack, and lessons learned along the way.
- Serving on the AISec'26 PCI am serving on the program committee for the 19th ACM Workshop on Artificial Intelligence and Security (AISec). Looking forward to reviewing submissions!
- Started my internship at SocketI will be working on preprocessing JavaScript packages to improve LLM-based detection.
- Presenting a poster at IEEE S&P'26The poster (https://jcnf.me/static/posters/codeql_sp_2026.pdf) on my research on CodeQL at IEEE S&P 2026 (https://sp2026.ieee-security.org/).
Selected Publications
-
Longitudinal Analyses of SAST Tools: A CodeQL Case Study
, , ,
In Submission, 2026Abstract: Open-source software (OSS) pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate static application security testing (SAST) tools through longitudinal measurements and perform the largest academic study of CodeQL---the most prevalent static analysis tool from GitHub---on OSS codebases. We apply our apparatus on 114 versions of CodeQL over time on 3993 CVEs from 1622 repositories to measure key properties of the tool, culminating in more than 20 billion lines of code analyzed. First, we measure its effectiveness, i.e., its ability to detect vulnerabilities before they are fixed. Then, we determine whether these detections were actionable through two measures of the distance between findings and vulnerability location either over the entire codebase or within the vulnerable file. Finally, we study the stability of CodeQL by examining how vulnerability detections hold across versions and the evolution of CodeQL on the accuracy-precision trade-off. We find that CodeQL identifies a total of 171 CVEs, and that for 83 of them, a CodeQL version prior to the fix could detect it. Such detections are in general actionable if findings are triaged across files, as for 50% of the 171 detections, more than 50% of findings in the vulnerable file are located in the vulnerable location. Finally, we show that CVE detections are not monotonic across versions as 21 CVEs were no longer detected following a version change and 17 that were never redetected. Our study shows that using SAST tools is a matter of best practice as they prevent numerous vulnerabilities from being introduced, but that developers should be aware of changes that may leave blind spots in detections upon updates of the tool.
@misc{ferrand2026longitudinalanalysessasttools, archiveprefix = {arXiv}, author = {Jean-Charles {Noirot Ferrand} and Kyle Domico and Yohan Beugin and Patrick McDaniel}, doi = {10.48550/arXiv.2605.07900}, eprint = {2605.07900}, primaryclass = {cs.CR}, title = {Longitudinal Analyses of SAST Tools: A CodeQL Case Study}, year = {2026} } -
Adversarial Agents: Black-Box Evasion Attacks with Reinforcement Learning
, , , , ,
Findings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2026Abstract: Attacks on machine learning models have been extensively studied through stateless optimization. In this paper, we demonstrate how a reinforcement learning (RL) agent can learn a new class of attack algorithms that generate adversarial samples. Unlike traditional adversarial machine learning (AML) methods that craft adversarial samples independently, our RL-based approach retains and exploits past attack experience to improve the effectiveness and efficiency of future attacks. We formulate adversarial sample generation as a Markov Decision Process and evaluate RL's ability to (a) learn effective and efficient attack strategies and (b) compete with state-of-the-art AML. On two image classification benchmarks, our agent increases attack success rate by up to 13.2% and decreases the average number of victim model queries per attack by up to 16.9% from the start to the end of training. In a head-to-head comparison with state-of-the-art image attacks, our approach enables an adversary to generate adversarial samples with 17% more success on unseen inputs post-training. From a security perspective, this work demonstrates a powerful new attack vector that uses RL to train agents that attack ML models efficiently and at scale
@inproceedings{domico2026adversarialagents, author = {Kyle Domico and Jean-Charles {Noirot Ferrand} and Ryan Sheatsley and Eric Pauley and Josiah Hanna and Patrick McDaniel}, booktitle = {Findings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)}, doi = {10.48550/arXiv.2503.01734}, title = {Adversarial Agents: Black-Box Evasion Attacks with Reinforcement Learning}, year = {2026} } -
The Role of Learning in Attacking Intrusion Detection Systems
, ,
In Submission, 2026Abstract: Recent work on network attacks have demonstrated that ML-based network intrusion detection systems (NIDS) can be evaded with adversarial perturbations. However, these attacks rely on complex optimizations that have large computational overheads, making them impractical in many real-world settings. In this paper, we introduce a lightweight adversarial agent that implements strategies (policies) trained via reinforcement learning (RL) that learn to evade ML-based NIDS without requiring online optimization. This attack proceeds by (1) offline training, where the agent learns to evade a surrogate ML model by perturbing malicious flows using network traffic data assumed to be collected via reconnaissance, then (2) deployment, where the trained agent is used in a compromised device controlled by an attacker to evade ML-based NIDS using learned attack strategies. We evaluate our approach across diverse NIDS and several white-, gray-, and black-box threat models. We demonstrate that attacks using these lightweight agents can be highly effective (reaching up to 48.9% attack success rate), extremely fast (requiring as little as 5.72ms to craft an attack), and require negligible resources (e.g., 0.52MB of memory). Through this work, we demonstrate that future botnets driven by lightweight learning-based agents can be highly effective and widely deployable in diverse environments of compromised devices.
@misc{domico2026rolelearningattackingintrusion, archiveprefix = {arXiv}, author = {Kyle Domico and Jean-Charles {Noirot Ferrand} and Patrick McDaniel}, doi = {https://doi.org/10.48550/arXiv.2602.10299}, eprint = {2602.10299}, primaryclass = {cs.CR}, title = {{The} {Role} of {Learning} in {Attacking} {Intrusion} {Detection} {Systems}}, year = {2026} } -
Targeting Alignment: Extracting Safety Classifiers of Aligned LLMs
, , , ,
IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 2026Abstract: Alignment in large language models (LLMs) is used to enforce guidelines such as safety. Yet, alignment fails in the face of jailbreak attacks that modify inputs to induce unsafe outputs. In this paper, we introduce and evaluate a new technique for jailbreak attacks. We observe that alignment embeds a safety classifier in the LLM responsible for deciding between refusal and compliance, and seek to extract an approximation of this classifier: a surrogate classifier. To this end, we build candidate classifiers from subsets of the LLM. We first evaluate the degree to which candidate classifiers approximate the LLM's safety classifier in benign and adversarial settings. Then, we attack the candidates and measure how well the resulting adversarial inputs transfer to the LLM. Our evaluation shows that the best candidates achieve accurate agreement (an F1 score above 80%) using as little as 20% of the model architecture. Further, we find that attacks mounted on the surrogate classifiers can be transferred to the LLM with high success. For example, a surrogate using only 50% of the Llama 2 model achieved an attack success rate (ASR) of 70% with half the memory footprint and runtime -- a substantial improvement over attacking the LLM directly, where we only observed a 22% ASR. These results show that extracting surrogate classifiers is an effective and efficient means for modeling (and therein addressing) the vulnerability of aligned models to jailbreaking attacks.
@inproceedings{noirot_ferrand_targeting_2026, author = {Jean-Charles {Noirot Ferrand} and Yohan Beugin and Eric Pauley and Ryan Sheatsley and Patrick McDaniel}, booktitle = {IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)}, doi = {10.48550/arXiv.2501.16534}, month = {March}, title = {{Targeting} {Alignment}: {Extracting} {Safety} {Classifiers} of {Aligned} {LLMs}}, year = {2026} }
arXiv
DOI
Slides
Poster