← Back to summary
JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks
Converted from PDF with markitdown. Layout may be rough.
JANUS: Synthesizing Cross-Layer Defenses Against Web
Deserialization Attacks
RuozhaoYang MinglangLi JiongchiYu
rz.yang.2024@phdcs.smu.edu.sg 2024060909004@std.uestc.edu.cn jiongchiyu@acm.org
SingaporeManagementUniversity UESTC NanyangTechnologicalUniversity
Singapore China Singapore
XinfengLi XiaofeiXie
xinfeng.li@polyu.edu.hk xfxie@smu.edu.sg
TheHongKongPolytechnic SingaporeManagementUniversity
University Singapore
China
Abstract Keywords
Unsafedeserializationturnsuntrusteddataintoattacker-controlled DeserializationVulnerabilities,WebApplicationDefense,Adver-
execution,andasinglevulnerabilitycanadmitdiverseexploitvari- sarialSelf-Evolution,RuntimeEnforcement
antsthatevadedefensestailoredtoaknownexploit.Existingde-
fensestypicallyoperateatasingleenforcementpointwithlimited ACMReferenceFormat:
visibilityintothefullattack.Combiningcontrolsacrosslayersof- RuozhaoYang,MinglangLi,JiongchiYu,XinfengLi,andXiaofeiXie.2027.
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserialization
ferscomplementaryprotection,butcoordinatingthemtopreserve
Attacks.InProceedingsofProceedingsoftheACMWebConference2027
legitimatefunctionalityandadaptingthemtonewvariantsrequires
(WWW’27).ACM,NewYork,NY,USA,13pages.https://doi.org/XXXXXXX.
substantialexperteffort.
XXXXXXX
WeproposeJanus,ared-blueadversarialframeworkforauto-
matedcross-layerdefensesynthesis.Startingfromaknownexploit,
Janusiterativelyrefinesdeployment-specificpoliciesinanisolated 1 Introduction
offlineenvironment.Ablack-boxattackerprobesthecurrentpolicy
UnsafedeserializationposesapersistentandcriticalthreattoWeb
forexploitvariantsusingonlyexternallyobservablefeedback.The
security[33,40].Whenapplicationsreconstructobjectsfromun-
defendersummarizeseachverifiedvariantintoitssecurity-relevant
trusteddata,attacker-controlledtypesandfieldvaluescantrigger
effects,usescounterfactualreplaytoseparatecomplementarycov-
chains of existing methods that lead to remote code execution
eragefromredundantenforcement,andjointlyselectsandscopes
(RCE)[37,40].Existingdefensesconstrainspecificstepsofthis
controlsacrosslayers.Eachcandidatepolicyisvalidatedagainst
process,forexamplebyrestrictingtheclassespermittedduring
accumulatedexploitsandbenignworkflows.
deserialization[14,46].However,asinglevulnerabilitymayad-
WeevaluateJanusonsixteenvulnerabilitydeploymentsacross
mitmultiplegadgetchainsdrawnfromapplicationdependencies,
sixJavaandPHPapplicationsagainstgateway,application,system,
sofilterstargetingknowngadgetscanbebypassedbyalternative
andcross-layerdefenses.Janusreducesheld-outattacksuccessto
chains[5,9,36,40].Mitigationisalsodeployment-specific:thede-
6.2%,comparedwith18.8-55.0%forthebaselines,fullymitigates
ployedlibrariesandruntimedeterminewhichchainsareviable[24],
13of16deployments,andpreserves98.4%ofbenignfunctionality
whereaslegitimatefeaturesdeterminewhichdeserializationbehav-
testsata6.9%targetedP95latencyincrease.
iorsmustremainavailable[21].
Motivation.AsshowninFigure1,defenderscaninterveneat
CCSConcepts
threelayerswithdistinctvisibilityandestablishedenforcement
•Securityandprivacy→Webapplicationsecurity;Software mechanisms.Atthegateway,aWebapplicationfirewall(WAF)
securityengineering. inspects and filters incoming request representations [35].
Application-level deserialization filters constrain the types and
object structures accepted during reconstruction [14, 32, 46].
System-level policies restrict the resulting operations through
system-callfilteringorcontainerisolation[4,25,37].Eachlayer
Permissiontomakedigitalorhardcopiesofallorpartofthisworkforpersonalor
neverthelessobservesonlypartoftheattack:narrowrestrictions
classroomuseisgrantedwithoutfeeprovidedthatcopiesarenotmadeordistributed
forprofitorcommercialadvantageandthatcopiesbearthisnoticeandthefullcitation maymissexploitvariants,whilebroaderrestrictionsriskdisrupting
onthefirstpage.Copyrightsforcomponentsofthisworkownedbyothersthanthe legitimatefeatures[15,40].
author(s)mustbehonored.Abstractingwithcreditispermitted.Tocopyotherwise,or
Combiningtheselayersofferscomplementaryprotection[39],
republish,topostonserversortoredistributetolists,requirespriorspecificpermission
and/orafee.Requestpermissionsfrompermissions@acm.org. butrequirescoordinatingtheirpolicies.Wedefineamulti-layer
WWW’27,Dublin,Ireland compositionasajointselectionofcontrolswithdeployment-specific
©2027Copyrightheldbytheowner/author(s).PublicationrightslicensedtoACM.
parametersandenforcementscopes.Constructinganeffectivecom-
ACMISBN978-1-4503-XXXX-X/2027/XX
https://doi.org/XXXXXXX.XXXXXXX position is challenging because upstream blocking can obscure
6202
tcO
62
]RC.sc[
1v23553.0162:viXra
WWW’27,May10-14,2027,Dublin,Ireland Yangetal.
Attacker User
coveragefromredundantenforcement.❸CoordinatingControls
UnderFunctionalConstraints.Controlsthatareindividually
Gateway Bytes acceptablemaybreaklegitimateworkflowswhencombined,and
WAF Rule
parses request Objects some improvements require coordinated changes across layers.
Janusjointlyselectsandscopescontrolsfromaboundedcatalogof
Application Objects deployablemechanismsandacceptsacandidateonlyifitblocksall
Type Guard
rebuilds objects Library Code verifiedexploitsandmeetsthefunctionalityandlatencythresholds
onthebenign-workflowregressionsuite.
System Syscalls Evaluation.WecompareJanuson16deploymentsacrosssix
Syscall Filter
runs syscalls Intent applicationsagainstModSecuritywithOWASPCRS[35],Datadog
RASP and OpenRASP [3, 13], Kintsugi [37], and Tetragon [10].
RCE on the Host Served Januslowersheld-outattacksuccessto6.2%,versus18.8-55.0%for
thebaselines,fullymitigates13of16deployments,andisbreached
Figure 1: Motivating example. Each layer’s defense stops on5of48unseen-attacker/deploymentpairs,whilepassing98.4%
someexploitvariants,butonevariantpassesallthreelayers offunctionalitytests.ArecordedrunonCVE-2026-84645,arecent
andreachesRCE,whilethelegitimaterequestisserved. JenkinsRCE,illustratestherefinementloop.
Contributions.Thispapermakesthreecontributions:
• Weformulateunsafe-deserializationmitigationasdeployment-
downstreamcoverage,overlappingcontrolsmayintroduceredun- specificcross-layerdefensesynthesisthatcoordinatescomple-
dantoverhead,andpolicyinteractionscandisruptlegitimatework- mentarycontrolsunderfunctionalconstraints.
flowsinwaysthatisolatedchecksdonotreveal.Moreover,acom- • WeproposeJanus,ared-blueadversarialframeworkinwhich
positionthatblocksknownexploitsmaystilladmitvariantsusing ablack-boxattackersuppliesverifiedexploitvariantsandade-
differentgadgetchainsorpayloadrepresentations.Existingauto- fendercombinesattack-effectsummarieswithcounterfactual
matedmitigationssupportthegenerationofsecurityworkarounds, coverageattributiontojointlyselectandscopecross-layercon-
deserialization restrictions, or runtime policies [21, 37, 46], but trolsunderfunctionalconstraints.
thesecapabilitiesalonedonotestablishhowcontrolsshouldbe
• Wedefineanevaluationprotocolwithheld-outpaths,unseenat-
jointlyconfiguredandrevisedtocoveradaptiveexploitvariants
tackers,multi-consequenceoracles,andbenign-workflowchecks.
whilepreservinglegitimatefunctionality.
WeevaluateJanusunderthisprotocolandwillreleaseitsimple-
OurApproach.WepresentJanus,ared-blueadversarialframe- mentationandevaluationmaterialsuponpublication1.
workforsynthesizingdeployment-specificmulti-layerdefenses
againstunsafedeserialization.Theframeworkpairsanattacker
2 BackgroundandProblemStatement
agentwithadefenderagentonanisolatedreplicaofthedeployment.
Startingfromaknownexploit,theattackeradaptsitsgadget-chain 2.1 DeserializationAttacksandDefenses
selectionandpayloadrepresentationtoachieveaspecifiedconse- Unsafedeserializationallowsattacker-controlleddatatotrigger
quence,suchascommandexecutionwithintheapplicationcon- unintendedmethodinvocationsduringobjectreconstruction.A
tainer.Thedefenderusesexecutionevidenceandbenign-workflow sequenceofexistingmethodsleadingtoasensitiveoperationcon-
feedbacktojointlyrevisecontrolsacrosslayers.Throughthisof- stitutesagadgetchain[12,40].Avulnerableentrypointmayadmit
flineinteraction,theagentsexposeandaddressweaknessesbeyond multiplechains[5,9,36],whoseviabilitydependsonthedeployed
thoserevealedbytheinitialexploit.Theattackerobservesonly librariesandruntime[6,24].Exploitvariantscandifferinwhere
whatanexternalattackercouldobserveandservesasasourceof serialized data enters, how it is encoded and framed, or which
counterexamples.ThetechnicalcontributionsofJanuslieonthe executionpathleadstotheconsequence.
defenseside,inhowthedefenderinterpretsthesecounterexamples Eachofthethreedefensivelayershasacharacteristicblindspot.
andcoordinatescontrolstocoverthem. Gatewaycontrols(G)suchasreverseproxiesandWAFs[35]in-
Realizingthisprocessraisesthreetechnicalchallenges.❶Expos-
spectrequestrepresentationsratherthanreconstructedobjects,
ingVariantsUnderBlack-BoxObservation.Adefenseisonlyas sorepresentationchangescanbypassthem[15,45].Application
robustasthevariantsitischeckedagainst,yetanexternalattacker controls(A)restrictacceptedclassesorobject-graphproperties
cannotdistinguishagatewayrejectionfromanincompatiblegad- wheretheparserexposesthem[31,32],yetmaystillpermitmali-
getchain.Janus’sattackerparameterizesreviewedfixtureswhose cioususesofallowedclasses.Systemcontrols(S)restrictprocess
prerequisitesmatchthedeployment,treatsambiguousfeedbackas creation,fileaccess,ornetworkcommunication[4,17],limiting
hypotheses,andsubmitscandidatestoanindependentoraclethat consequenceswithoutpreventingdeserialization,oftenforawhole
itcannotobserve.❷InterpretingExploitEffectsandDefensive
processorcontainer.Thesecontrolsalsodifferinavailabilityacross
Coverage.Rawsystem-calltracesaretoolow-levelforpolicyrea- deployments,soaneffectivecompositionmustaccountforboth
soning,andupstreamblockinghidestheprotectionofdownstream thecontrolsadeploymentsupportsandthelegitimatebehavior
controls. Janus condenses execution evidence into attack-effect withintheirscopes.
summariesexpressedassecurity-relevantcapabilities,eachtied
tothecontrolthatcaninterceptit,ifany,andusescounterfactual
replaywithupstreamrulesdisabledtoseparatecomplementary 1Anonymousrepository:https://anonymous.4open.science/r/VELA-70DF/
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserializationAttacks WWW’27,May10-14,2027,Dublin,Ireland
2.2 ThreatModel archiveA ={𝑥 },thedefenderturnsattackevidenceandbenign-
0 0
WeconsideraWebdeployment𝐷withaknown,unpatcheddeseri- workflowfeedbackintoaconfiguration𝜋 ∈Π 𝐷,whichisaccepted
alizationvulnerabilityandavalidatedseedexploitthatachievesa onlyifitblockseveryarchivedattackandmeetsboththresholds.
specifiedsecurityconsequence.Thedefenderoperatesonisolated, Theattackerthenprobestheacceptedconfigurationwithexternally
resettablereplicaswithrepresentativebenignworkflows. observablefeedback,andeachverifiedbypassenlargesthearchive
Attacker.TheattackercontrolsHTTPrequestsandholdsthe andtriggersanotherrevision.Thelastacceptedconfigurationis
privilegesrequiredtoreachthevulnerableentrypoint.Itmayadapt frozenanddeployedwithoutlanguage-modeldecisions.
payloadrepresentationsandgadgetchainsusingresponses,tim-
3.1 Black-BoxAttackExploration
ing,andattacker-controlledout-of-bandobservationswithinfixed
queryandtimebudgets,butcannotalterdeploymentconfigura- Theattackersuppliescounterexamplesandobservesonlywhatan
tions,defensivepolicies,orvalidationinfrastructure.Theoffline externalattackercould.Thisishardbecauseexploitsdependon
attackeragentoperatesunderthesamerestrictionsandreceives deployment-specificclassesandruntimebehavior[6,24],anda
nointernalexecution-stagefeedback. rejectedrequest,anincompatiblegadget,andadenieddownstream
Defender.Thedefenderanalyzesapplicationlogs,networktraf- operationcanlookidenticalfromoutside.
fic,andsystemlogstoconfiguresupportedcontrolsacrossthethree FixtureCatalog.Theattackerdrawsfromaboundedcatalog
layers.Itmaychangeonlyconfiguration,notapplicationsource ofreviewedfixtures,eachspecifyingitsprerequisites,entrypoint,
codeorbusinesslogic. payloadconstruction,andpermittedvariationsofentrypoint,rep-
TrustAssumptions.Thehostkernel,enforcementbackends, resentation,orexecutionpath.Afixtureiseligibleunlessknown
andvalidationoraclesaretrusted.Anindependentoracleverifies targetinformationcontradictsitsprerequisites.Held-outfixtures
exploitsuccessthroughcontrolledstateoreffectsratherthanre- aredisjointfromthecatalogbypathkey(AppendixD)andstay
sponsesorlogsalone. hiddenduringrefinement,andapermittedvariationthatreachesa
SecurityObjective.Adefensemustpreventthespecifiedcon- held-outpathcountsasrediscovery.
sequence,andinterventionafteritoccursdoesnotcount.Wedis- Observation-GuidedExploration.Ineachroundtheconfigu-
tinguish blocking before or during deserialization from impact ration𝜋 isfixed,andtheattackerreturnscandidates𝑋 generated
limitationthatdeniesasubsequentoperation.Weassessprotection fromeligiblefixtures.Itseesonlytheresponse,timing,andattacker-
onlyforthespecifiedconsequences,attackers,andbudgets. controlledout-of-bandsignalsofitsownrequests,neverlogsorpol-
icytext,andtreatsthemashypothesesratherthanexecution-stage
labels[38].Apparentfilteringsuggestsarepresentationchange,
2.3 Cross-LayerDefenseSynthesis
anexposedcompatibilityerrorsuggestsanotherfixture,andan
Givenadeployment𝐷 andavalidatedseedexploit,ourgoalisa ambiguousfailureleavesbothopen.
multi-layerdefenseagainsttheoriginalattackanditsvariantsthat Counterexample Verification. An independent oracle
exploitthesamevulnerabilitythroughalternativerepresentations 𝜔(𝑥,𝜋) ∈ {1,0,⊥}reportswhetherattack𝑥 reachesitsspecified
orexecutionpaths.LetΠ 𝐷 denotetheconfigurationssupportedby consequence under𝜋, fails to reach it, or cannot be decided. A
thedeployment’scontrolsandscopes,andBthebenignworkflows candidate becomes a counterexample only if it succeeds both
thatpasswithoutthedefense.Refinementalternatesbetweende- withoutandwiththedefense:
fenseconfigurationandbypassexploration,andverifiedattacks
𝑉(𝑋,𝜋)={𝑥 ∈𝑋 : 𝜔(𝑥,∅)=1 ∧ 𝜔(𝑥,𝜋)=1}. (2)
accumulateinanarchiveA𝑡 initializedwiththeseed.Atiteration
𝑡,thedefenderseeksaconfiguration
Failure on the undefended replica is thus never credited to the
𝜋 ∈Π 𝐷 s.t. ASR(𝜋,A𝑡)=0, BPR(𝜋,B)≥𝜏 𝑏 , Δ𝐿 95 (𝜋)≤𝜖 𝑙 , (1) defense,⊥nevercountsasprevention,and𝜔isneverreturnedto
whereASRisthefractionofattacksachievingtheirspecifiedcon- theattacker.
sequences,BPRthefractionofworkflowspassingallfunctional
assertions,andΔ𝐿 theP95latencyincreaseofthetargetedend- 3.2 Evidence-GuidedDefenseRefinement
95
pointunderbenigntraffic,withthresholds𝜏 𝑏 and𝜖 𝑙 fixedbefore Thedefendermapsexecutionevidenceontodeployablecontrols
refinementbegins. andreconcilesprotectionwithlegitimateuse.
Becauseeveryarchivedattackisaverifiedexploit,thearchive Attack-Effect Summary. For each archived attack, Janus
mustbecoveredcompletelyratherthantradedoffagainstfunc- links the request to application and system events through
tionality,soEq.(1)isafeasibilityproblem.Newbypassesexpand requestidentifiersandprocesslineage.Thesummaryrecordsthe
thearchiveandtriggerfurtherrevision,andfailuretomeetthe oracle-confirmedconsequence,theexercisedcapabilitieswiththeir
conditionswithinbudgetisrecordedasunsuccessful.Thefinalcon- decisiveparameters(Table5),andtheenforcementeventsunder
figurationisfrozenbeforeindependentevaluationagainstattacks thecurrentconfiguration,whileunlinkedormissingobservations
excludedfromrefinement. remainunknown.Ittiesbehaviortointerventionpointswithout
requiringthedefendertoreconstructthegadgetchain.
Rules.Arule𝑟 =(𝑐,𝜎,𝜃)instantiatesacatalogcontrol𝑐(Table1)
3 DesignofJanus withscope𝜎andparameters𝜃,andcarriesitssupportingevidence
JanussearchesforaconfigurationsatisfyingEq.(1)byalternating andexpectedeffect.Aconfiguration𝜋 isasetofrules,andΠ 𝐷
tworolesonisolatedreplicasof𝐷 (Figure2).Startingfromthe admitsonlycontrolsandscopesthat𝐷supports.
| WWW’27,May10-14,2027,Dublin,Ireland | | | | | | | | | Yangetal. |
| ----------------------------------- | -------- | --- | ------------------------ | --------------- | --- | -------- | --- | ---------- | --------- |
| Inputs | | | JANUS Offline Refinement | | | | | Deployment | |
| | Attacker | | | Execution Tools | | Defender | | | |
Unseen Variants
| De p lo y m e nt | Selection | | Candidates | | Bypass | Analysis | | | User |
| ---------------- | ------------------ | --- | ---------- | ------------------ | ------ | -------------- | --- | ----------- | ---- |
| | | | | Consequence Oracle | | | | Entry Bytes | Path |
| M a n if es t | Prerequisite Check | | | | | Effect Summary | | | |
| | | | Escalation | Frozen Policy | | | | G Gateway | |
Virtual Patch
A S Paired Edit
| | A d | a p ta t io n | | | | A tt r i b u t | io n | | |
| ----------- | --- | ------------- | ----------------------- | --- | ----------- | -------------- | ---- | -------- | ----------- |
| S e e d | | | E n t r y V a r i a n | t s | | | | A p p li | c a t i o n |
| E x p lo it | | | | | A Allowlist | | | A | |
Re-Encod e o r N e w F ixture P a t h V a r i a n t s Counte rfa c t u a l R e play Cl as s A ll o w l is t
G Signature
| | | | Seed Exploit | | | | | S System | |
| --- | ----------- | --- | ------------ | --- | --- | -------- | --- | -------- | --- |
| | Observation | | | | | Revision | | | |
Exec / Write Limits
| Benign | | | | Regression Check | | | | | |
| ------ | --- | --- | --- | ---------------- | --- | --- | --- | --- | --- |
Workflows Responses & Timing Accepted Candidate G A S Joint Edit
Web App
Figure2:OverviewofJanus,whichalternatesblack-boxattackexplorationandevidence-guideddefenserefinementunder
regressionchecks.
Counterfactual Coverage Attribution. Once an upstream Algorithm1WorkflowofJanus
rulerejects𝑥,downstreamprotectionisunobservedbutmayexist. Deployment𝐷,seed𝑥 0,workflowsB tr,budget𝑄,threshold𝑘
Require:
Janusreplays𝑥fromthesamesnapshot,maskstherulethatblocked Ensure: Frozenconfiguration𝜋★orRefinementFailure
it,andrepeatsuntil𝑥 reachesitsconsequenceornofurtherrule 𝜋 ←∅,A←{𝑥 },𝐸←Evidence(𝑥 )
| | | | | | 1: | 0 | 0 | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
𝑢←true,𝑛←0
| blocksit(AppendixD).Theresultisacoveragematrix | | | | | 2: | | | | |
| ---------------------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
whileBudgetRemains(𝑄)and𝑛<𝑘do
| Cov[𝑟][𝑥] | ∈{obs,lat,none,unk}, | | 𝑟 ∈𝜋, 𝑥 | ∈A, | 3: | | | | |
| --------- | -------------------- | --- | ------- | --- | ------- | --- | --- | --- | --- |
| | | | | (3) | if𝑢then | | | | |
4:
| | | | | | (𝑆,𝐶)←Analyze(𝜋,A,B | | ) ⊲summariesandcoverage | | |
| --- | --- | --- | --- | --- | ------------------- | --- | ----------------------- | --- | --- |
whereobsmarksthefirstrulethatblocks𝑥,latarulethatblocks 5: tr
| | | | | | 𝜋′←JointRevise(𝜋,𝑆,𝐶,𝐸,B | | ) | | |
| ------------------------------------------------------ | --- | --- | --- | --- | ------------------------ | -------------- | --- | --- | --- |
| itonlyonceupstreamrulesaremasked,nonearulestillenabled | | | | | 6: | | tr | | |
| | | | | | (𝑎 ,𝐹) | ← Check(𝜋′,A,B | ) | | |
whentheconsequenceoccurs,andunkaninconclusivereplay.Let 7 : tr
| | | | | | 𝐸 ← | 𝐸 ∪𝐹 | | | |
| ------------------------------------------------------- | --- | --- | --- | --- | ------------------ | ---- | --- | --- | --- |
| 𝐶(𝑥)betheruleswithobsorlatfor𝑥.Onrowswithoutunk,𝑥 | | | | | 8 : | | | | |
| | | | | has | ifnot𝑎thencontinue | | | | |
| asinglepointoffailurewhen|𝐶(𝑥)|=1,andaruleisaredundancy | | | | | 9: | | | | |
| | | | | | 𝜋 ←𝜋′,𝑢←false | | | | |
10:
candidatewheneveryattackitcovershas|𝐶(𝑥)|≥2.Becausethis ifnotBudgetRemains(𝑄)thenbreak
11:
testispairwise,aremovalisconfirmedonlybytheacceptancecheck (𝑋,𝑒)←AttackRound(𝐷[𝜋]) ⊲𝑒:catalogexhausted
12:
onthecompleteconfiguration.Replayingthetrainingworkflows 𝑌 ←𝑉(𝑋,𝜋),𝑛←𝑛+1
13:
if𝑌 ≠∅then
| inthesamewayrecordswhichworkflowseachrulebreaks. | | | | | 14: | | | | |
| ------------------------------------------------ | --- | --- | --- | --- | --- | --- | --- | --- | --- |
A←A∪𝑌,𝐸←𝐸∪Evidence(𝑌)
| JointRevision.Fromthesummaries,thecoveragematrix,and | | | | | 15: | | | | |
| ---------------------------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
𝑢←true,𝑛←0
| failedworkflowassertions,thedefenderproposesarevisionthat | | | | | 16: | | | | |
| --------------------------------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
elseif𝑒then
| mayadd,remove,narrow,orretunerulesatseverallayersatonce. | | | | | 17: | | | | |
| --------------------------------------------------------- | ------------ | ---------- | ------------- | ----------- | -------------------- | --- | --- | --- | --- |
| Singlepointsoffailurearepreserved,redundancycandidatesmay | | | | | 18: break | | | | |
| | | | | | returnFinalize(𝜋,A,B | ) | | | |
| | | | | | 19: | tr | | | |
| be removed | or narrowed, | and a rule | that breaks a | workflow is | | | | | |
narrowedorreplacedbyacontrolatanotherlayercoveringthe
sameconsequence.Individualeditsneednotbeacceptablealone,
sinceonlythecompleterevisedconfigurationischecked.
3.3 Regression-GuardedEvolution
| Acceptance.WithtrainingworkflowsB | | | ⊆Bandthethresholds | | | | | | |
| --------------------------------- | --------------------- | --- | ------------------ | --- | ------------------------------------------------------ | ------------------------------------ | --- | --- | --- |
| | | | tr | | StoppingandFreezing.Refinementstopsatbudgetexhaustion, | | | | |
| ofEq.(1),acandidate𝜋 | | | | | atstagnationafter𝑘 | | | | |
| | isacceptedifandonlyif | | | | | consecutiveroundswithoutanewverified | | | |
Acc(𝜋,A) ≡ (cid:211) 𝜔(𝑥,𝜋)=0 bypass,oratcatalogexhaustion,wheneveryeligiblefixtureand
𝑥∈A
| | | | | (4) | permittedvariationhasbeentriedagainsttheincumbent.None | | | | |
| --- | --------- | --- | ---------- | --- | ------------------------------------------------------ | --- | --- | --- | --- |
| | ∧ BPR(𝜋,B | )≥𝜏 | ∧ Δ𝐿 (𝜋)≤𝜖 | | | | | | |
tr 𝑏 95 𝑙 ofthemprovesthatnobypassexists.Finalizere-checksthelast
onareplicawherethenativeconfigurationhasloaded,andany⊥ incumbentonafreshreplicaandreturnsitas𝜋★ifitisstillaccepted,
falsifiesthepredicate.Rejectedcandidatesreturntothedefender orRefinementFailureotherwise.Held-outattacksandtestworkflows
areusedonlytoevaluate𝜋★.
withtheirfailureevidencebutneverreplacetheincumbent.
Rounds.Aroundisoneattackphaseagainstthefixedincumbent Run-to-Run Variation. Both agents sample from an LLM,
𝜋 𝑡.Itendswhentheattackerreturns𝑋 orexhaustsitsper-round sorunsfromthesameseedmayreturndifferentconfigurations,
𝑡
| queryallowance.ThearchivethengrowstoA𝑡+1 | | | =A𝑡∪𝑉(𝑋 | ,𝜋 𝑡), | | | | | |
| ---------------------------------------- | --- | --- | ------- | ------ | ------------------------------------------------------------ | --- | --- | --- | --- |
| | | | | 𝑡 | whereasverification,replay,andregressionchecksaredeterminis- | | | | |
andonlyanewbypasstriggersarevision,sotheattackernever ticgiventhesnapshot.Everyreturnedconfigurationblocksitsown
interactswithapartiallyupdatedcandidate(Algorithm1).Explo- archiveandpassesthetrainingworkflows,butitscoveragebeyond
ration,revision,andcheckingallconsumethebudget𝑄. thatarchivevaries,sowereportthespreadoverrepeatedruns.
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserializationAttacks WWW’27,May10-14,2027,Dublin,Ireland
Table1:DefensivecontrolssupportedbyJanusateachlayer. catalogexhaustion.Eachattackthussharpensthenextdefense,
B:attackblocking.L:limitationofaspecifiedeffect. andeachdefensenarrowswhatthenextattackcanuse.
WhyBaselinesFallShort.Thefrozenv2blocksallfourheld-out
ID Control ConfigurablePolicy Effect attacks of J06 and passes all four functionality tests. CRS stops
G1 IngressLimits Allowedroutesandmethods,body-sizecap B
onlyonere-encodedvariantthroughliteralmatchingandflags
G2 VirtualPatch Request-matchrulesandaction B
alegitimateconfigurationpost.BothRASPspreservefunctional-
A1 ClassFiltering Classallowlist,othersrejected B
ity but block no attacks, as their generic hooks do not capture
A2 GraphLimits Depth,references,bytes,arraylength B
XStream’sobjectreconstruction.KintsugiandTetragonblockthree
A3 ParserFilter Classblocklistintheparser’sownfilter B
attacksatthesinkbutmissthewriteinsideJenkinshome,while
S1 ExecutionLimits Denyprocess-executionsystemcalls L
S2 WriteConfinement Read-onlyroot,explicitwritablemounts L theirprocess-executionrestrictionsbreakabuildworkflow.These
S3 EgressIsolation Internalnetwork,noexternalegress L baselineseithermissvariantsorrestrictrequiredbehavior.Janus
scopesv2tothebuild-triggerpayloadwhilepreservinglegitimate
job-managementworkflows.
4 Implementation LayerAttribution.Maskedreplayofthetwoarchivedattacks
showsthateachiscoveredbyatleasttworules,thegatewayand
WeimplementJanusinabout9,800linesofPython.Acontrolplane
applicationrulesforbothandthesystemrulefortheseed,sov2
runsAlgorithm1,bothagentsshareoneLLMbackendwithschema-
hasnosinglepointoffailure.Replayingtheheld-outattacksafter
validatedoutputs(AppendixE),andverification,counterfactual
freezingconfirmsthatthelowerlayersarenotredundant.With
replay,andregressionchecksaredeterministictools(AppendixD).
thegatewaymasked,theapplicationrulealonestopsallfourand
EachdeploymentrunsasaDockerComposeprojectbehindan
thesystemruletwo,whereasthegatewayalonestopsone.The
NGINXreverseproxyandisrestoredfromasnapshotbeforeevery
systemrulemissestheattackthatwritesinsidetheJenkinshome,
replay.Oraclesandworkflowassertionsrunoutsidetheapplication
whichbuildsneed,andonevariantoutsideitsnarrowworkflow-
container, and failed replays are retried rather than counted as
preservingscope.
blocks.Noapplicationcodeismodified.
Per-layeradapterscompileeachruleofTable1intonativeconfig- 5 Evaluation
uration,rejectunsupportedcontrolsorscopes,andconfirmthatthe
Weorganizetheevaluationaroundfourquestions:
configurationhasloaded.Aloadedrulecountsasactingonlywhen
itsenforcementeventappearsduringreplay.G1andG2become • RQ1:Howdofrozendefensescompareonheld-outattacksand
NGINXlimitsandModSecurityrules[35],thelatterenabledonlyif unseenattackers?
theymatchnotrainingrequest.A1andA2becomejdk.serialFilter • RQ2: What functionality and online/offline costs accompany
settings[31,32]andapplyonlywherethevulnerablepathuses theirprotection?
ObjectInputStream.A3extendstheclassblocklistoftheJenkins • RQ3:Howdoesrefinementprogress,andwhatprotectionre-
remotingClassFilter,whichJenkinsappliestoXStreamalongside mainsonpathsneverrediscovered?
itsJEP-200allowlist.S1-S3becomeaseccompprofiledenyingex- • RQ4:Howdothecomponents,enforcementlayers,andbudgets
ecve[17],aread-onlyrootfilesystemwithexplicitwritablevolumes, affecttheoutcome?
andaninternalComposenetwork.Allowlists,limits,andwritable
volumesarederivedfromtrainingworkflowsonly. 5.1 ExperimentalSetup
Deployments.Westudysixteen(application,CVE)deployments
4.1 RunningExample
acrosssixapplications,fiveontheJVMandoneinPHP:Apache
Figure3tracestheJ06runonCVE-2026-84645,arecentXStream OFBiz(4CVEs),Jenkins(5),LiferayPortal(2),Metabase(1),Apache
deserializationRCEinJenkins2.567[23].Theexploitpostsjob- ActiveMQ(2),andSnipe-IT(2).Eachreproducesfromafreshsnap-
configuration XML from which Jenkins rebuilds a build-trigger shot,hasanon-destructiveconsequenceoracleandassertablebe-
objectgraph,andtheoraclechecksamarkerfileatthesink. nignworkflows,andhasatleastonesupportedcontrolonitsexploit
Red-Blue Escalation. The seed succeeds on the undefended path(AppendixA).OneActiveMQdeploymentisreachedthrough
replica, so the defender installs v1, a gateway rule matching nativeOpenWireratherthanHTTP,sogatewaycontrolsdonot
the literal build-trigger class name. The attacker sees its new applytoit.
carrierrejectedandre-encodestheclassnameasXMLcharacter Attacks and Workflows. For each deployment an expert con-
references.XStreamdecodesthisrequesttothesameobject,and structsfiveattackobjectivesfromthesamevulnerability,spanning
theoraclefires.Thedefenderthenrevisesfromtheexposedeffect remotecodeexecution,fileread,write,ordeletion,requestforgery,
rather than from the bytes of the request. Its v2 adds the class access-controlbypass,privilegeescalation,andapplication-state
totheJenkinsclassfilter(A3),whichactsafterdecodingandso abuse[29,34].Oneisthetrainingseed,andtheotherfourareheld-
coverseveryrepresentationoftheclass,keepsadecoded-name outtestattacksthatdifferfromitinimpactand,wherepossible,
gatewayruleasacheappre-filter,andconfineswritesoutsidethe ingadgetfamily,giving64held-outattacks.Eachdeploymentalso
Jenkinshomeasabackstop.v2isacceptedonlyafteritblocksboth has12trainingworkflowsfortheacceptancegate,4validation
archivedattacksandpassesthebenignworkflows.Theattacker’s workflowsforbaselinetuning,and4disjointfunctionalitytests
fourfurthervariantsallendinHTTP403,andtherunstopsby thatassertresponseandpersistentstate.Theoraclemonitorsevery
WWW’27,May10-14,2027,Dublin,Ireland Yangetal.
Seed Check Round 1 Round 2 Layer Status
Attempt 1 Attempts 2-3 Attempts 4-7 Policy v2, Attempts 4-7
Seed Exploit New Carrier Re-Encoding Re-Encoding ×3 Carrier Retry Variants Workflows
403 403 403
G Gateway Acted (403)
No Policy G Policy v1 G A S Policy v2
A Application Not Reached
Undefended Replica Literal Class Match Regression Check Passed
S System Not Reached
Seed Verified Oracle Silent Bypass Oracle Silent, No New Bypass Jenkins
Figure3:RecordedrunonJenkinsCVE-2026-84645.Are-encodedpayloadbypassestheliteralgatewayruleofv1.Thedefender
revisesfromtheexploitedeffectintothethree-layerv2,whichstopseverylatervariantatthegatewaywhilebenignworkflows
stillpass.
consequencereachableonthepath,andonlypreventiveblocks farfewerworkflows(81.2%versus95.3%BPR),sothebaselinesdo
count(AppendixB). notshareasingleweakness.
Changedattacksettingswidenthesegaps.Switchingtoanun-
Baselines.B1isModSecuritywithOWASPCRS[35],B2andB3
usedmonitoredconsequenceraisesJanus’sASRonlyfrom6.2%
areDatadogRASP[13]andOpenRASP[3],B4isKintsugi[37],the
to9.7%,whereasKintsugirisesfrom14.6%to31.9%andTetragon
closestmulti-layersystem(A+S),andB5isTetragon[10]witha
from12.5%to36.8%,becausealternativeeffectsinsidetheirallowed
service-widepolicythatdeniesprocessexecution,writesoutside
resourcesremainreachable.Withthefrozenpolicyrevealed,theat-
datadirectories,andexternalconnections.Tunablebaselinesre-
tackersbreach10/48pairsforJanusand23-38forthebaselines.The
ceivethesamearchive,validationworkflows,andtuningallowance
humanexpert,reportedseparatelyfromtheautomatedattackers,
(AppendixF).B1doesnotapplytotheOpenWiredeployment.
breaches4/16deploymentsforJanusand9-13forthebaselines.
Attackers and Budgets. Three unseen automated attackers, Theresidualattackscomefromtwosynthesisfailuresandone
PentestGPT and CAI on GPT6 Luna and the CVE-Bench refer- held-outfailure.J11endswithanarchivedbypassthatnocandi-
ence agent on Grok 4.7, attempt every deployment, giving 48 datecoverswithinbudget,andP02withabypasswhosefilewrite
attacker/deploymentpairs,andapolicy-awaresettingrevealsthe overlapsawritethatrequiredfunctionalityperforms.Bothhadac-
frozenpolicytothem.Ateam-memberhumanexpertisreported ceptedaconfigurationthatblockstheseed,andtheselastaccepted
separately.Synthesisiscappedat700,000tokens,800replays,600 policiesremainineveryaggregate.J07passessynthesisbutretains
attackerqueries,90minutes,20rules,and8rounds,with𝑘 =2, oneheld-outsuccess.Ofthe60preventedJanus attacks,44are
𝜏 𝑏 =100%onthetrainingworkflows,and𝜖 𝑙 =10%.Thedefault stoppedbeforeorduringdeserializationand16byconsequence
backendisDeepSeekV4Flash. limitation,11ofthembydeniedexecve,3bytheread-onlyroot,and
2bydeniedegress.BecauseGandAactbeforeSandeveryrule
Metrics.ASRisthefractionofheld-outattacksthatstillsucceed, onlydenies,thefirst44areexactlytheattacksthattheGandA
averagedoverdeployments.Mitigationcountsdeploymentswith rulesaloneblock.Nofile-readconsequenceiscreditedtolimitation.
noheld-outsuccessandnosynthesisfailure,andbreachcounts Thebaselinesdifferinwheretheystopanattack.B1stopsallits
attacker/deploymentpairswithatleastonesuccess.Afailedsyn- blockedattacksbeforedeserialization,whiletheRASPs,Kintsugi,
thesisisscoredwithitslastacceptedconfiguration,andblocking andTetragonstopmostoftheirsatthesensitiveoperation.Neither
andimpactlimitationarereportedseparately.BPRisthefraction stoppingpointestablishesthatanunmonitoredeffectissafe.
offunctionalitytestspassed,FPRthefractionofbenignrequests
rejected,andΔP95theP95latencyincreaseofthetargetedendpoint. Finding1.Coordinatedcross-layercontrolscutheld-outASRto6.2%,
about a third of the best baseline (18.8%), and leave only 5/48 at-
Noregressioncountsdeploymentswhereallfourtestspasswithin
tacker/deploymentpairsbreached.Theadvantagepersistsundercon-
thelatencygate.Experimentsthatre-runsynthesisarerepeated
sequenceswitching(9.7%versusatleast31.9%)andpolicyvisibility(10/48
threetimesandreportmeanswiththelargestsingle-rundeviation, versusatleast23/48breachedpairs),andallresidualattackstracetotwo
andsingle-runresultsusethemedianrun. synthesisfailuresandoneheld-outfailure.
5.2 RQ1:Effectiveness 5.3 RQ2:FunctionalityandOverhead
AsTable2shows,Janushas6.2%held-outASR,versus18.8-55.0%for Janus passes 98.4% of functionality tests at a 6.9% targeted P95
thebaselines,mitigates13/16deployments,andisbreachedon5/48 increase and has no regression on 15/16 deployments (Table 2).
attacker/deploymentpairs.Onthe15deploymentsthatB1covers, KintsugiandDatadogRASPalsomeettheaggregatereferencebut
Janus’sASRis6.7%,butbaselinesfailindifferentways.Specifically, regresson4and8deployments,andOpenRASPexceedsthelatency
requestsignaturesmisssemanticvariants,genericRASPhooksmiss gateonaverage.Highfunctionalitydoesnotimplysecurity,since
deserializationpathsoutsidetheirsinks,andruntimecontainment bothRASPskeep96.9%BPRatabout50%ASR.Tetragonreaches
missesconsequencesinsidepermittedresources.Tetragonreachesa only81.2%BPRbecausesomefeaturesneedsubprocesses,writes,or
slightlylowerASRthanKintsugi(18.8%versus20.3%)butpreserves networkaccess.Itrejectsonly1.2%ofbenignrequests,soalowFPR
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserializationAttacks WWW’27,May10-14,2027,Dublin,Ireland
Table2:Frozendefensesonthe16deployments.RatesareinpercentandOfflineinminutes.MainandSwitchareASRsonthe
12deploymentswithanunusedmonitoredconsequence,Awarecountsbreachedattackerpairswiththefrozenpolicyrevealed,
andHumancountsdeploymentsbreachedbytheexpert.OtherP95isthenon-targetedlatencyincrease.
Held-outsecurity Changedattacksettings Functionalityandlatency Overhead
Method ASR Mitigated Breached Main Switch Aware Human FPR BPR ΔP95 Noregr. OtherP95 RPS Offline
ModSecurity+CRS 55.0 0/15 32/45 45.5 59.1±2.3 38/45 13/15 4.5 88.3 3.2 8/15 2.0 -1.5 15
DatadogRASP 48.4 0/16 29/48 39.6 55.6±1.4 34/48 12/16 0.6 96.9 9.9 8/16 5.5 -4.8 18
OpenRASP 50.0 0/16 32/48 41.7 59.7±1.4 37/48 13/16 0.8 96.9 10.9 7/16 6.0 -5.5 18
Kintsugi 20.3 6/16 17/48 14.6 31.9±2.8 23/48 9/16 0.5 95.3 9.3 12/16 1.8 -2.5 12
Tetragon 18.8 8/16 18/48 12.5 36.8±1.4 24/48 10/16 1.2 81.2 4.6 4/16 3.5 -2.0 5
Janus 6.2 13/16 5/48 6.2 9.7±1.4 10/48 4/16 0.3 98.4 6.9 15/16 1.2 -3.0 60
doesnotestablishfunctionalitypreservation,becausearequestmay redundancyisjudgedonlyonconclusiverows.One-shotjointsyn-
beadmittedwhilealateroperationorpersistent-stateassertionfails. thesisreaches24.0%andgreedysingleedits13.0%.Thegapsamong
Janusadds1.2%non-targetedlatencyandlowersthroughputby theattribution,greedy,andno-archivevariantsarecomparable
3.0%.Its60-minutemedianofflinecostispaidonceperdeployment torun-to-runvariationandindicateaconsistentdirectionrather
andworkflowversion,notonline.Atypicalsynthesisuses420,000 thanastrictranking.Seed-onlysynthesishasnosynthesisfailures,
tokensand680environmentreplays,110ofthemcounterfactual. since every seed can be blocked within the gates, so its higher
ASRcomesfromvariantsitneversaw.TheBPRandlatencyofall
Finding2.JanuscombinesthelowestASRwiththehighestBPR(98.4%)
variantsappearinAppendixFigure6.
ata6.9%targetedlatencyincreaseandregressesononly1/16deployments.
HighBPRalonedoesnotimplyprotection,asbothRASPskeep96.9% Layers.Figure4(e)showsthateverylayermatters.DisablingA,
BPRyetleaveabouthalfoftheheld-outattackssuccessful. S,orGinthefrozenpolicyraisesASRfrom6.2%to14.1%,31.2%,
and20.3%.DroppingAmattersonlyonJenkins,wheretheclass
filter(A3)carriesthetypeconstraintthatthegatewayandsystem
5.4 RQ3:RefinementDynamics
ruleseachcoveronlyinpart.Singlelayersaremuchweaker,partly
Figure4(a)showsdiminishingreturns.Held-outASRfallsfrom becausesixdeploymentshavenoAcontrol,soA-onlyASRisat
21.9%afterseed-onlyconstructionto6.2%atthedefaultcap,while least37.5%.S-onlyre-optimization(40.1%)trailsTetragonbecause
newverifiedbypassesdeclinefrom9to1.Intotal14/16runsstop Janusscopessystemrulesnarrowlytopreserveworkflows,and
withoutanewbypass,9bystagnationand5bycatalogexhaustion. onJ07-J09theseeds’statechangeslieinsidethewritableJenkins
Theother2/16exhausttheirbudgetwithunresolvedarchiveattacks, home,whereScannotlimitthem.Janus’sgatewayrulesalone(47.9-
whicharethetwosynthesisfailures.Snapshotsarescoredafter 53.1%)areclosetotunedCRS,leaving50.0%openonthe15HTTP
freezing,soheld-outoutcomesneverguidestopping. deploymentsversus55.0%forCRS.
Totestgeneralizationbeyondrediscovery,wesplitthe64held- BudgetsandBackends.Figure4(b-c)showsthatASRstayswithin
outattacksbywhethertheattackereventuallyreachedtheirpaths, 5.7-6.8%acrossthethreebackends,withinrun-to-runvariation.
definedonthepathkeysoftheregisteredfixtures(AppendixD). GPT6Lunaalsodrivestwooftheevaluationattackers,soitsrowis
The19rediscoveredattackshave1success(5.3%)andthe45never- notanindependent-attackertest.Thequerycapissplitevenlyover
rediscoveredones3(6.7%),allonthesynthesisfailuresJ11and therounds,soitchangeshowmanyvariationseachattackphase
P02.Onthe14acceptedsyntheses,nonever-rediscoveredattack maytryratherthanthenumberofrounds.Loweringthequery
succeeds.J07’ssuccessisaheld-outpayloadonarediscoveredpath capto150raisesASRto10.9%,whileraisingitto900lowersASR
whosearchivedattackisblocked,consistentwithacceptance. onlyto5.7%at13%moreofflinetime.Mostrunsstopbystagna-
tionorcatalogexhaustionbeforetheoverallcapbinds,soalarger
Finding3.Refinementshowsdiminishingreturns,aseightroundscut
allowancemainlyhelpsroundsthatpreviouslyranoutofqueries.
ASRfrom21.9%to6.2%whilenewbypassesfallfrom9to1.Protection
carriesovertopathstheattackerneverrediscovered(6.7%ASR),andnone Rotatingthetrainingseedonsixdeploymentsleaves4.2-8.3%ASR
oftheseattackssucceedsonthe14acceptedsyntheses. ontheirheld-outattacks,versusnoneunderthedefaultseed.
Finding4.Everycomponentandeverylayercontributes.Theseed-only,
non-adaptive,andone-shotvariantscostthemost(15.1-24.0%ASR),and
5.5 RQ4:AblationandSensitivity
droppinganysinglelayerraisesASRto14.1-31.2%.Resultsstaywithin
5.7-6.8%acrossbackends,andraisingthedefault600-querycapto900
Components.Figure4(d)isolatesexposure,attribution,andcoor-
lowersASRbyonly0.5points.
dination,whichaddresschallenges❶-❸.Seed-onlyconstruction
(21.9%)andanon-adaptivevariantpool(15.1%)showthatadap-
tiveexposuremattersbeyondsupplyingmorevariants.Without 6 Discussion
counterfactualreplay,ASRrisesto10.9%andBPRdropsto94.8%,
6.1 Implications
reflectingredundantorpoorlyscopedcontrols.Ofthemaskedre-
plays,71%endblocked,18%attheconsequence,8%notreached, Theevaluationalsoshowswhysingle-pointandgenericdefenses
and3%inerror,and6%ofcoverageentriesremainunknown,so fallshort,whichyieldsthreelessonsbeyondJanus.
| WWW’27,May10-14,2027,Dublin,Ireland | | | | | | | | | | | | | Yangetal. |
| ----------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --------- |
(a) Round cap (b) Query cap (c) Backend (d) Ablations (e) Layer subsets
60
| | +9 | +n: new bypasses | | | | | | | Full | 6.2 | | | Disable |
| ---------------- | --- | ---------------- | ----- | --- | --- | --- | --- | --------------- | --------- | ---- | ---- | --- | ----------- |
| )%( RSA tuo-dleH | | | | | | | | | | | | | Re-optimize |
| | | | | | | | | .pxE | Seed only | | 21.9 | | |
| | 20 | | | | | | | Non-adaptive | | 15.1 | | | |
| | | +7 | | | | | | | | | | 40 | |
| | | | | | | | | | Raw logs | 12.0 | | | |
| | | +4 | | | | | | .rttA | | | | | |
| | | | | | | | | Timing-only | | 9.9 | | | |
| | 10 | | +2 +1 | | | | | No counterfact. | | 10.9 | | | |
20
| | | | | | | | | .drooC Greedy edit | | 13.0 | | | |
| --- | ----- | ----- | ----- | ------- | ------- | ------------ | ----- | ------------------ | ---------- | ------- | ---- | ----- | ----------- |
| | | | | | | | | One-shot joint | | | 24.0 | | |
| | | | | | | | | | No archive | 8.9 | | | |
| | 0 | | | | | | | | | | | 0 | |
| | | | | | | | | | | | | G A S | GA AS GSGAS |
| | 0 | 2 4 | 6 8 | 150 300 | 600 900 | DeepSeekGPT6 | Grok | | | 0 10 20 | 30 | | |
| | min 9 | 24 38 | 50 60 | 38 49 | 60 68 | 60 | 70 55 | | | | | | |
Figure4:Refinement,sensitivity,andablations(held-outASR,%).(a)Roundcap,withnewverifiedbypassesfoundaftereach
snapshot.(b)Attacker-querycapand(c)backend,defaultcircledordark,withmedianofflineminutesbelow.(d)Component
ablations.(e)Layersubsets,disabledinthefrozenpolicyorre-optimized.Errorbarsshowthelargestsingle-rundeviationover
threeruns.
PlacetheDecisiveConstraintWheretheAttackBecomes that their applicability hinges on classpath and version prereq-
Visible.Aliteralgatewayrulemissesanequivalentrepresentation, uisites[6,24,40].Onthedefenseside,look-aheadagentsrestrict
whileatype-levelconstraintafterdecodingcoverseveryencod- theclassesastreammayinstantiate[7],runtimesprovideclass
ingofthesameclass,anddisablingtheapplicationlayerraises andgraphfilters[31],andrecentsystemssynthesizethemauto-
ASRfrom6.2%to14.1%.Agatewaysignatureisbettertreatedasa matically: DeseriGuard derives Java allowlists from application
cheappre-filterthatletsdownstreamcontrolsbescopednarrowly, semantics[46],QUACKinfersallowedPHPclassesbystaticduck
aprincipledefenderscanadoptwithoutJanus. typing[14],andGauthierandBaeblockchainsatruntime[19].
JudgeMitigationsonCoverageandFunctionalityTogether. Thesefiltersactonlyatthecallsitesandparserstheyhook,whereas
Frozensystemhardeningdeniesoperationsthatlegitimatefeatures Janususesthemasoneofthreelayers.
need(81.2%BPRforTetragon),whereasRASPkeeps96.9%ofwork-
| | | | | | | | | 7.2 | RuntimeMitigation | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | ----------------- | --- | --- | --- | --- |
flowsbutmissesabouthalfoftheheld-outattacks.Mitigations
shouldthusbemeasuredonheld-outpaths,unseenattackers,and Earlierworkblocksknownexploitinputswithnetworkandhostfil-
functionalitytogether,sinceevaluatingthemontheirownseed ters[11,44],disablesavulnerablepathuntilapatchships[21,22],or
overstatesprotection. rewritescodewithlanguagemodels[30].System-callspecialization
shrinkstheattacksurfaceofapplicationsandcontainers[4,20,25],
CounterfactualAttributionIsUsefulonItsOwn.Rulecountis
apoorproxyforprotection,becauseanupstreamrulehideswhether whileRASP[3,13]andeBPFenforcement[10]applygenericpoli-
ciesthatignorethespecificvulnerabilityanddeployment.Kintsugi,
downstreamruleshold.Counterfactualreplayneedsonlyreplicas
theclosestsystem,placeskernel-enforcedpoliciesatapplication
andoracles,94%ofitsentrieswereconclusiveinourruns,and
codelocations[37].Thesesystemsfixenforcementpointsinad-
operatorscanapplyittohand-writtenpoliciestoexposeredundant
vance,whereasJanusselectsandscopescontrolsacrosslayersand
rulesandsinglepointsoffailure.Theselessonsrestonabounded
benchmarkandempiricalattackers,whoselimitswediscussnext. revisesthemagainstanadaptiveattacker.
| | | | | | | | | 7.3 | Cross-LayerSynthesis | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | -------------------- | --- | --- | --- | --- |
6.2 LimitationsandFutureWork
Policygenerationfordefenseindepth[39],firewallanomalyanal-
Januspreservesonlythebehavioritsbenignworkflowsexpress,
ysis[1],andcoordinatedfront-endfiltering[28]shareourpremise
soweuseexpert-writtenworkflowswithstateassertionsandun-
thatlayersmustbeconfiguredtogether,buttheyreasonoverstatic
seentests.Itsprotectionisempiricalratherthanproven,andpublic
rulemodelsandcannottellwhetheraseeminglyredundantruleis
exploitsmayappearinmodeltrainingdata,whichindependent
theonlyonethatstopsavariant,whichJanuslearnsfromcoun-
held-outpathsandunseenattackerspartlyaddress.Impactlimita-
| | | | | | | | | terfactual | replay. | Adversarial | testing | evades WAFs | [2, 15], and |
| --- | --- | --- | --- | --- | --- | --- | --- | ---------- | ------- | ----------- | ------- | ----------- | ------------ |
tionleavesthevulnerablepathreachable,sofrozenconfigurations
language-modelagentsexploitrealvulnerabilities[16,18,26,47],
aretemporarymeasuresuntilaroot-causefix.Thebenchmarkcov-
buttheseworksmeasureorbreakdefensesratherthanfeedvariants
erssixapplications,onlyoneinPHP,sowereportper-deployment
backintosynthesis.Ourloopfollowscounterexample-guidedsyn-
resultsratherthanstatisticaltests.Theloopneedsonlyaconse-
thesis[42],adversarialtraining[27],andself-refiningagents[41],
| quence | oracle, | a control | catalog, | and | benign | workflows, | which | | | | | | |
| ------ | ------- | --------- | -------- | --- | ------ | ---------- | ----- | --- | --- | --- | --- | --- | --- |
butitproducesadeployableconfiguration,verifieseverycoun-
makestemplateinjectionandrequestforgerynaturalnexttargets.
terexamplewithanindependentoracle,andgateseveryrevision
onbenignworkflows.
7 RelatedWork
| 7.1 | DeserializationDefenses | | | | | | | EthicalConsiderations | | | | | |
| --- | ----------------------- | --- | --- | --- | --- | --- | --- | --------------------- | --- | --- | --- | --- | --- |
Gadget-chaindiscoverytoolstargetPHP[12,36]andJava[5,8, Ourstudybuildsanoffensivecomponenttoevaluatedefenses,so
9, 43], and empirical studies show that chains are diverse and weconstrainedbothwhatitcanreachandwhatwerelease.All
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserializationAttacks WWW’27,May10-14,2027,Dublin,Ireland
experimentstargetpubliclydisclosedvulnerabilitiesinapplications [14] YanivDavid,NeophytosChristou,AndreasDKellas,VasileiosPKemerlis,and
wedeployedinisolated,resettableenvironmentswithoutInter- JunfengYang.2024.QUACK:HinderingDeserializationAttacksviaStaticDuck
Typing..InNDSS.
netaccess,oraclesusecanarieswecontrol,andnorealuserdata
[15] LucaDemetrio,AndreaValenza,GabrieleCosta,andGiovanniLagorio.2020.Waf-
is involved. The attacker draws only from reviewed fixtures of a-mole:evadingwebapplicationfirewallsthroughadversarialmachinelearning.
knowngadgetfamiliesandrunsonlyagainstthesereplicas,and InProceedingsofthe35thAnnualACMSymposiumonAppliedComputing.1745–
1752.
anysignofanundisclosedissuewillbereportedtothemaintainers [16] GeleiDeng,YiLiu,VíctorMayoral-Vilches,PengLiu,YuekangLi,YuanXu,
before publication. For the same reason, the defense side is re- TianweiZhang,YangLiu,MartinPinzger,andStefanRass.2024.{PentestGPT}:
Evaluatingandharnessinglargelanguagemodelsforautomatedpenetration
leasedopenly,whereasattacksequencesarereleasedonlyintheir
testing.In33rdUSENIXSecuritySymposium(USENIXSecurity24).847–864.
already-publicformandnewvariantsonlytovettedresearchers. [17] Docker.2024.SeccompsecurityprofilesforDocker.Dockerdocumentation.
Thehuman-expertattackerisateammemberwhoseresultsare [18] RichardFang,RohanBindu,AkulGupta,andDanielKang.2024.Llmagentscan
autonomouslyexploitone-dayvulnerabilities.arXivpreprintarXiv:2404.08144
reportedseparately,soIRBreviewdoesnotapply.
(2024).
[19] FrançoisGauthierandSoraBae.2022. Runtimepreventionofdeserialization
8 Conclusion attacks.InProceedingsoftheACM/IEEE44thInternationalConferenceonSoftware
Engineering:NewIdeasandEmergingResults.71–75.
WepresentedJanus,ared-blueadversarialframeworkthatsyn- [20] SeyedhamedGhavamnia,TaptiPalit,AzzedineBenameur,andMichalisPoly-
chronakis.2020.Confine:Automatedsystemcallpolicygenerationforcontainer
thesizesdeployment-specificcross-layerdefensesagainstunsafe
attacksurfacereduction.In23rdInternationalSymposiumonResearchinAttacks,
deserialization.Ablack-boxattackersuppliesverifiedexploitvari- IntrusionsandDefenses(RAID2020).443–458.
ants,andadefenderturnsthemintojointgateway,application, [21] ZhenHuang,MarianaDAngelo,DhavalMiyani,andDavidLie.2016. Talos:
Neutralizingvulnerabilitieswithsecurityworkaroundsforrapidresponse.In
andsystemcontrolsthroughattack-effectsummaries,counterfac-
2016IEEESymposiumonSecurityandPrivacy(SP).IEEE,618–635.
tualcoverageattribution,andregression-gatedrevision.Onsixteen [22] ZhenHuang,DavidLie,GangTan,andTrentJaeger.2019.UsingSafetyProperties
deploymentsacrosssixJavaandPHPapplications,Januslowers toGenerateVulnerabilityPatches..InIEEESymposiumonSecurityandPrivacy.
539–554.
held-out attack success to 6.2%, about a third of the best base- [23] JenkinsProject.2026.JenkinsSecurityAdvisory2026-09-02.https://www.jenkins.
line,mitigates13of16deployments,andisbreachedononly5 io/security/advisory/2026-09-02/.
[24] BrunoKreyssigandAlexandreBartel.2024.Analyzingprerequistesofknown
of48unseen-attackerpairs,whilepassing98.4%offunctionality
deserializtionvulnerabilitiesonjavaapplications.InProceedingsofthe28th
testsata6.9%targetedlatencyincrease.Itsadvantageholdsunder InternationalConferenceonEvaluationandAssessmentinSoftwareEngineering.
consequenceswitchingandpolicyvisibilityandcarriesoverto 28–37.
[25] YunsenLeiandCraigAShue.2025.Making(Only)theRightCalls:Preventing
exploitationpathstheattackerneverrediscovered.
RemoteCodeExecutionAttacksinPHPApplicationswithContextual,State-
SensitiveSystemCallFiltering.InInternationalConferenceonDetectionofIntru-
References sionsandMalware,andVulnerabilityAssessment.Springer,46–65.
[26] ZichengLiu,LigeHuang,JieZhang,DongruiLiu,YuanTian,andJingShao.
[1] EhabSAl-ShaerandHazemHHamed.2004.Discoveryofpolicyanomaliesin 2026. Pacebench:Aframeworkforevaluatingpracticalaicyber-exploitation
distributedfirewalls.InIeeeInfocom2004,Vol.4.IEEE,2605–2616. capabilities.InInternationalConferenceonLearningRepresentations,Vol.2026.
[2] DennisAppelt,CuDNguyen,AnnibalePanichella,andLionelCBriand.2018. 17137–17163.
Amachine-learning-drivenevolutionaryapproachfortestingwebapplication [27] AleksanderMadry,AleksandarMakelov,LudwigSchmidt,DimitrisTsipras,and
firewalls.IEEETransactionsonReliability67,3(2018),733–757. AdrianVladu.2017.Towardsdeeplearningmodelsresistanttoadversarialattacks.
[3] BaiduSecurity.2024.OpenRASP:RuntimeApplicationSelf-Protection.https: arXivpreprintarXiv:1706.06083(2017).
//github.com/baidu/openrasp. [28] WeiMeng,ChenxiongQian,ShuangHao,KevinBorgolte,GiovanniVigna,
[4] AlexanderBulekov,RasoulJahanshahi,andManuelEgele.2021.Saphire:Sand- ChristopherKruegel,andWenkeLee.2018. Rampart:Protectingwebappli-
boxing{PHP}applicationswithtailoredsystemcallallowlists.In30thUSENIX cationsfrom{CPU-Exhaustion}{Denial-of-Service}attacks.In27thUSENIX
SecuritySymposium(USENIXSecurity21).2881–2898. SecuritySymposium(USENIXSecurity18).393–410.
[5] SicongCao,BiaoHe,XiaobingSun,YuOuyang,ChaoZhang,XiaoxueWu, [29] MITRE.2024.CWE-502:DeserializationofUntrustedData.https://cwe.mitre.
TingSu,LiliBo,BinLi,ChuanleiMa,etal.2023. Oddfuzz:Discoveringjava org/data/definitions/502.html.
deserializationvulnerabilitiesviastructure-awaredirectedgreyboxfuzzing.In [30] YuNong,HaoranYang,LongCheng,HongxinHu,andHaipengCai.2025.
2023IEEESymposiumonSecurityandPrivacy(SP).IEEE,2726–2743. {APPATCH}:Automatedadaptivepromptinglargelanguagemodelsfor{Real-
[6] SicongCao,XiaobingSun,XiaoxueWu,LiliBo,BinLi,RongxinWu,WeiLiu, World}softwarevulnerabilitypatching.In34thUSENIXSecuritySymposium
BiaoHe,YuOuyang,andJiajiaLi.2023.Improvingjavadeserializationgadget (USENIXSecurity25).4481–4500.
chainminingviaoverriding-guidedobjectgeneration.In2023IEEE/ACM45th [31] OpenJDK.2016.JEP290:FilterIncomingSerializationData.https://openjdk.org/
InternationalConferenceonSoftwareEngineering(ICSE).IEEE,397–409. jeps/290.
[7] LucaCarettoni.2016. SerialKiller:Look-AheadJavaDeserializationLibrary. [32] Oracle.2024.SerializationFiltering.OracleJavaPlatformdocumentation.Ob-
https://github.com/ikkisoft/SerialKiller. jectInputFilter;jdk.serialFilter.
[8] BofeiChen,LeiZhang,XinyouHuang,YinzhiCao,KekeLian,YuanZhang,and [33] OWASPFoundation.2021. OWASPTop10:A08SoftwareandDataIntegrity
MinYang.2024. Efficientdetectionofjavadeserializationgadgetchainsvia Failures.https://owasp.org/Top10/.
bottom-upgadgetsearchanddataflow-aidedpayloadconstruction.In2024IEEE [34] OWASPFoundation.2024.TestingforInsecureDeserialization.OWASPWeb
SymposiumonSecurityandPrivacy(SP).IEEE,3961–3978. SecurityTestingGuide(WSTG).
[9] XingchenChen,BaizhuWang,ZeJin,YunFeng,XianglongLi,XinchengFeng, [35] OWASP Foundation. 2026. OWASP ModSecurity Core Rule Set. https://
andQixuLiu.2023.Tabby:Automatedgadgetchaindetectionforjavadeserial- coreruleset.org/.Accessed2026.
izationvulnerabilities.In202353rdAnnualIEEE/IFIPInternationalConferenceon [36] SunnyeoPark,DaejunKim,SumanJana,andSooelSon.2022. {FUGIO}:Au-
DependableSystemsandNetworks(DSN).IEEE,179–192. tomaticexploitgenerationfor{PHP}objectinjectionvulnerabilities.In31st
[10] CiliumAuthors.2025.Tetragon:eBPF-BasedSecurityObservabilityandRuntime USENIXSecuritySymposium(USENIXSecurity22).197–214.
Enforcement.https://github.com/cilium/tetragon. [37] YihaoPeng,ZizhenZhu,JiatianHu,JiaxuWang,HaiWan,andXibinZhao.2026.
[11] ManuelCosta,MiguelCastro,LidongZhou,LintaoZhang,andMarcusPeinado. Kintsugi:Empowering{LLMs}toMitigateWebVulnerabilitiesviaRuntime
2007.Bouncer:Securingsoftwarebyblockingbadinput.InProceedingsoftwenty- PolicyInjection.In35thUSENIXSecuritySymposium(USENIXSecurity26).731–
firstACMSIGOPSsymposiumonOperatingsystemsprinciples.117–130. 750.
[12] JohannesDahse,NikolaiKrein,andThorstenHolz.2014.Codereuseattacksin [38] Van-ThuanPham,MarcelBöhme,andAbhikRoychoudhury.2020. Aflnet:A
php:Automatedpopchaingeneration.InProceedingsofthe2014ACMSIGSAC greyboxfuzzerfornetworkprotocols.In2020IEEE13thinternationalconference
ConferenceonComputerandCommunicationsSecurity.42–53. onsoftwaretesting,validationandverification(ICST).IEEE,460–465.
[13] Datadog.2025. ApplicationSecurityManagement:RuntimeApplicationSelf- [39] PaulRubel,MichaelIhde,StevenHarp,andCharlesPayne.2005. Generating
Protection(RASP).https://www.datadoghq.com/product/application-security- policiesfordefenseindepth.In21stAnnualComputerSecurityApplications
management/. Conference(ACSAC’05).IEEE,10–pp.
WWW’27,May10-14,2027,Dublin,Ireland Yangetal.
Table3:Enforcementreachperapplication.AcoversJava- varytheimpactandtheexecutionvariantinstead.Everyheld-out
nativepaths(A1/A2)andtheJenkinsXStreampath(A3);G attackfirstreachesitsconsequenceontheundefendedreplica,and
needsanHTTPentry.ActiveMQ’sJolokiaCVEadmitsGS, noneisaddedtothearchive.
itsnativeOpenWireCVEonlyS.
Oracles. The oracle monitors process execution, protected-file
access,controlledegress,andanapplication-statecanarywhere
Application Format A Layers Gadgetfamilies applicable,andanattacksucceedsifanymonitoredconsequence
OFBiz Java-native ✓ GAS CommonsBeanutils,ROME, occurs.Access-controlbypass,privilegeescalation,andstateabuse
MozillaRhino
areconfirmedthroughthecanary.Nosystem-layercontrolcan
Jenkins XStream ✓ GAS nestedPersistenceRoot,
OfflineCause,ListView,Agent limitafileread(Table5),soonlyGorArulescanpreventsucha
identity,lazyrender consequence.Alerts,HTTPerrorcodes,replayfailures,andprocess
Liferay JSON ✗ GS C3P0/ReferenceSerialized, terminationaftertheconsequencedonotcountasprevention.
JdbcRowSetImpl
Metabase Java-native ✓ GAS JavaURLDNS,Clojurecomparator AttackersandBudgets.Theautomatedattackersarepinnedto
ActiveMQ JMX/OpenWire ✗ GS/S JolokiaMBean, theSeptember2026modelsnapshots,andeachreceives200queries,
ClassPathXmlApplicationContext 60minutes,and500,000tokensperdeployment,separatefromthe
Snipe-IT PHPobject ✗ GS Laravel,Monolog,Guzzlechains synthesiscaps.Thehumanexpertusesthesameexternalobserva-
tionchannel,hasnoaccesstothearchiveorheld-outsuite,and
spendseighthoursperdeployment.Thesynthesisquerycapissplit
[40] ImenSayar,AlexandreBartel,EricBodden,andYvesLeTraon.2023.Anin-depth
studyofjavadeserializationremote-codeexecutionexploitsandvulnerabilities. evenlyovertherounds(75perroundbydefault),andeveryquery,
ACMTransactionsonSoftwareEngineeringandMethodology32,1(2023),1–45. verification,regressioncheck,andcounterfactualreplayconsumes
[41] NoahShinn,FedericoCassano,AshwinGopinath,KarthikNarasimhan,and
environmentreplays.Theconsequence-switchsuitecoversthe12
ShunyuYao.2023.Reflexion:Languageagentswithverbalreinforcementlearning.
Advancesinneuralinformationprocessingsystems36(2023),8634–8652. deploymentsthatleaveamonitoredconsequenceunused,sincethe
[42] ArmandoSolar-Lezama,LiviuTancau,RastislavBodik,SanjitSeshia,andVijay objectivesofJ07-J09andP01alreadyuseeverymonitoredconse-
Saraswat.2006.Combinatorialsketchingforfiniteprograms.InProceedingsofthe
12thinternationalconferenceonArchitecturalsupportforprogramminglanguages quenceonthepath.Allrunsuseone32-coreAMDEPYCserver
andoperatingsystems.404–415. with128GBofmemory,andlatencyismeasuredwhilereplaying
[43] PrashastSrivastava,FlavioToffalini,KostyantynVorobyov,FrançoisGauthier,
thetrainingworkflowsat50requestspersecond.
AntonioBianchi,andMathiasPayer.2023.Crystallizer:Ahybridpathanalysis
frameworktoaidinuncoveringdeserializationvulnerabilities.InProceedingsof MetricsandAggregation.FPRisperbenignrequestandBPRper
the31stACMJointEuropeanSoftwareEngineeringConferenceandSymposiumon
functionalitytest,sotheyarenotcomplements,becausearequest
theFoundationsofSoftwareEngineering.1586–1597.
[44] HelenJWang,ChuanxiongGuo,DanielRSimon,andAlfZugenmaier.2004. may be admitted while a later operation fails. Every applicable
Shield:Vulnerability-drivennetworkfiltersforpreventingknownvulnerabil- deploymentcontributesfourattacks,sopooledandmacroASRco-
ityexploits.InProceedingsofthe2004conferenceonApplications,technologies,
incide.Wetreatapplicationsasclustersandreportper-deployment
architectures,andprotocolsforcomputercommunications.193–204.
[45] CongWu,JingChen,SimengZhu,WenqiFeng,KunHe,RuiyingDu,andYang countsinsteadof𝑝-values.Repeatedexperimentspoolthe192held-
Xiang.2024.Wafbooster:Automaticboostingofwafsecurityagainstmutated outattacksofthreeruns.Theirsingle-rundeviationstayswithin
maliciouspayloads.IEEETransactionsonDependableandSecureComputing22,2
(2024),1118–1131. 2.8percentagepoints,andthefullpolicyleaves3,4,and5of64
[46] QuanZhang,YiwenXu,ZijingYin,ChijinZhou,andYuJiang.2024.Automatic attackssuccessfulacrossruns(4.7-7.8%ASR).
PolicySynthesisandEnforcementforProtectingUntrustedDeserialization..In
NDSS.
C Attack-EffectSummary
[47] YuxuanZhu,AntonyKellermann,DylanBowman,PhilipLi,AkulGupta,Adarsh
Danda,RichardFang,ConnerJensen,EricIhli,JasonBenn,etal.2025. CVE-
Thedefenderreasonsoverareducedviewofeachattack’strace
bench:AbenchmarkforAIagents’abilitytoexploitreal-worldwebapplication
vulnerabilities.arXivpreprintarXiv:2503.17332(2025). ratherthantherawsystem-callstream.Januskeepsonlyoperations
linkedtotheattackrequestandprojectsthemontothecapability
A BenchmarkDetails vocabularyofTable5.Thevocabularydescribeswhatwasobserved
andisbroaderthanwhatthesystemlayercanenforce:thetable
CandidatescomefromtheKintsugiartifact[37],PACEbench[26],
separatelylistswhichcatalogcontrol,ifany,canintercepteach
CVE-Bench[47],andpublicadvisories.Acandidateiskeptonly
capability,soanobservedcapabilitydoesnotimplyanavailable
ifitsseedreproducesthreetimesinarowfromafreshsnapshot
limitation.Thedecisiveoperation,theonetheoracleobserves,is
anditmeetsthecriteriaoftheevaluationsetup.Table4liststhe
recordedwithitsparametersandlineage;allotheroperationsare
manifest,andTable3theenforcementreachandgadgetfamilies
collapsedtoacount.Theoracle,notthesummary,decideswhether
perapplication.
anattacksucceeded.
B EvaluationDetails
D ValidationProcedures
AttackObjectives.Objectivesfollowthedeserialization-impact
CounterfactualReplay.Janusreplayseacharchivedattackfrom
taxonomyconsolidatedfromMITRECWE-502[29]andtheOWASP
thesamesnapshot,maskingeachrulethatblockedit,untilthe
Web Security Testing Guide [34]. Denial of service is excluded
attackreachesitsconsequenceornoruleblocksit.Areplaycounts
becauseitsconsequencecannotbeconfirmedbyanon-destructive
asblockedby𝑟 onlyifanenforcementeventofrule𝑟 precedesthe
oracle.Whereanapplicationexposesmorethanonegadgetfamily
pointwheretheconsequencewouldoccurandnoconsequenceis
(Table3),held-outobjectivesalsodifferfromtheseedinfamily.Each
observed;replicaororaclefailuresareretriedaboundednumberof
ActiveMQCVEexposesasinglefamily,soitsheld-outobjectives
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserializationAttacks WWW’27,May10-14,2027,Dublin,Ireland
Table4:Benchmarkmanifest.Authindicateswhethertheattackrequiresauthentication,andPointsliststhecatalogenforce-
mentpointsontheseed’sexploitpath.Sislistedonlywheretheconsequenceinvolvesprocessexecution,awriteoutside
writablevolumes,oregress,soitcannotlimitthefilereadofP01orthestatechangesofJ07-J09insidethewritableJenkins
home.P01assumesthedefaultAPP_KEY,andJ12auserpermittedtorunnativeH2queries.
| | ID CVE | | Application(version) | | | Format | Consequence | | | Auth Points | | |
| --- | ------ | --- | -------------------- | --- | --- | ------ | ----------- | --- | --- | ----------- | --- | --- |
Java
J01 CVE-2020-9496 ApacheOFBiz17.12.01 Java-native RCE No G,A,S
J02 CVE-2021-26295 ApacheOFBiz17.12.01 Java-native RCE No G,A,S
J03 CVE-2021-29200 ApacheOFBiz17.12.01 Java-native RCE No G,A,S
J04 CVE-2021-30128 ApacheOFBiz17.12.01 Java-native RCE No G,A,S
| | J05 CVE-2026-53435 | | Jenkins2.567 | | | XStream | RCE | | | Yes G,A,S | | |
| --- | ------------------ | --- | ----------------------- | --- | --- | ------- | ------------ | --- | --- | --------- | --- | --- |
| | J06 CVE-2026-84645 | | Jenkins2.567 | | | XStream | RCE | | | Yes G,A,S | | |
| | J07 CVE-2026-84646 | | Jenkins2.567 | | | XStream | Statechange | | | Yes G,A | | |
| | J08 CVE-2026-84650 | | Jenkins2.567 | | | XStream | Configchange | | | Yes G,A | | |
| | J09 CVE-2026-84651 | | Jenkins2.567 | | | XStream | Configchange | | | Yes G,A | | |
| | J10 CVE-2020-7961 | | LiferayPortalCE7.2.0GA1 | | | JSON | RCE | | | No G,S | | |
| | J11 CVE-2020-15842 | | LiferayPortalCE7.2.0GA1 | | | JSON | RCE | | | Yes G,S | | |
J12 CVE-2026-59827 MetabaseOSS0.61.1.3 Java-native RCE Yes G,A,S
| | J13 CVE-2022-41678 | | ActiveMQClassic5.17.3 | | | JolokiaJMX | RCE | | | Yes G,S | | |
| --- | ------------------ | --- | --------------------- | --- | --- | ---------- | --- | --- | --- | ------- | --- | --- |
| | J14 CVE-2023-46604 | | ActiveMQClassic5.17.3 | | | OpenWire | RCE | | | No | S | |
PHP
| | P01 CVE-2024-48987 | | Snipe-IT7.0.9 | | | PHPobject | Fileread/write | | | No G,S | | |
| --- | ------------------ | --- | ------------- | --- | --- | --------- | -------------- | --- | --- | ------- | --- | --- |
| | P02 CVE-2025-59713 | | Snipe-IT7.0.9 | | | PHPobject | RCE | | | Yes G,S | | |
(a) Held-out successes (b) Failed function tests (c) Targeted ΔP95 (%) (d) Breached attackers
B1 B2 B3 B4 B5Janus B1 B2 B3 B4 B5Janus B1 B2 B3 B4 B5Janus B1 B2 B3 B4 B5Janus
| J01 | 1 1 1 | 0 0 | 0 | 0 0 | 0 0 | 1 0 | 3 8 | 9 8 | 4 6 | 1 | 1 1 | 0 0 0 |
| --- | ----- | --- | --- | --- | --- | --- | --- | ---- | --- | --- | --- | ----- |
| | 1 1 1 | 0 0 | 0 | 0 0 | 0 0 | 1 0 | 3 9 | 10 8 | 4 6 | 1 | 1 1 | 0 0 0 |
OFBiz J02
| J03 | 2 1 1 | 1 0 | 0 | 1 0 | 0 0 | 0 0 | 4 9 | 10 9 | 5 7 | 2 | 1 2 | 1 1 0 |
| --- | ----- | --- | --- | --- | --- | --- | ---- | ----- | --- | --- | --- | ----- |
| J04 | 1 1 1 | 0 0 | 0 | 0 0 | 0 0 | 1 0 | 3 8 | 9 8 | 4 6 | 1 | 1 1 | 1 0 0 |
| J05 | 3 3 3 | 1 1 | 0 | 1 0 | 0 1 | 1 0 | 3 11 | 12 10 | 5 7 | 3 | 3 3 | 1 1 0 |
| J06 | 3 4 4 | 1 1 | 0 | 1 0 | 0 1 | 1 0 | 4 12 | 13 11 | 5 8 | 3 | 3 3 | 2 2 0 |
Jenkins J07 4 4 4 3 3 1 0 0 0 0 0 0 3 11 12 10 5 8 3 3 3 3 3 2
| J08 | 3 3 3 | 1 1 | 0 | 1 0 | 0 0 | 1 0 | 3 12 | 13 10 | 5 7 | 2 | 2 3 | 1 1 0 |
| --- | ----- | --- | --- | --- | --- | --- | ---- | ----- | --- | --- | --- | ----- |
| J09 | 3 3 3 | 1 1 | 0 | 0 0 | 0 0 | 1 0 | 3 11 | 12 11 | 5 7 | 3 | 3 3 | 2 2 0 |
| J10 | 2 1 2 | 1 0 | 0 | 1 0 | 1 0 | 1 0 | 4 10 | 11 9 | 4 7 | 2 | 2 2 | 1 1 0 |
Liferay
| J11 | 2 2 2 | 1 2 | 1 | 0 0 | 0 0 | 1 0 | 4 11 | 12 10 | 5 8 | 2 | 2 2 | 2 2 1 |
| --- | ----- | --- | --- | --- | --- | --- | ---- | ----- | --- | --- | --- | ----- |
Metabase J12 1 1 1 0 0 0 1 0 0 0 0 0 3 10 11 8 4 6 2 1 1 0 0 0
| J13 | 1 1 1 | 0 0 | 0 | 0 0 | 0 0 | 0 0 | 2 8 | 9 8 | 4 6 | 1 | 1 1 | 0 0 0 |
| --- | ----- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ----- |
ActiveMQ
| J14 | N/A 1 1 | 0 0 | 0 | N/A 0 | 0 0 | 1 0 | N/A 9 | 10 8 | 4 6 | N/A | 1 1 | 0 0 0 |
| --- | ------- | --- | --- | ----- | --- | --- | ----- | ----- | --- | --- | --- | ----- |
| P01 | 3 2 2 | 1 1 | 0 | 1 1 | 0 0 | 1 0 | 3 9 | 10 10 | 5 7 | 3 | 2 2 | 1 2 0 |
Snipe-IT
| P02 | 3 2 2 | 2 2 | 2 | 0 1 | 1 1 | 1 1 | 3 10 | 11 11 | 5 8 | 3 | 2 3 | 2 3 2 |
| --- | ----- | --- | --- | --- | --- | --- | ---- | --------------- | --- | --- | --- | ----- |
| | 0 1 | 2 3 | 4 | 0 | 1 | 2 | ≤5 | 6–10 >10 (gate) | | | 0 1 | 2 3 |
Figure5:Per-deploymentresults.(a)Held-outsuccessesoutof4testattacks,allofwhichsucceedundefended;(b)failed
functionalitytestsoutof4;(c)targetedP95increase(%),with>10%exceedingthelatencygate;(d)breachedattackersoutof3.
N/AmarksB1onthenativeOpenWiredeploymentJ14.
timesandnevercountedasblocks.Areplayhasfouroutcomes,and tostop𝑥andreceivesnone.Ifitendswithneithertheconsequence
noranenforcementevent(notreached),orstillfailsafterretries
onlytwoofthemdeterminetheremainingentries.Ifitisblockedby
𝑟,theentryof𝑟isobs(firstreplay)orlat(laterreplays).Ifitreaches
(error),nothingislearnedabouttheenabledrules,andtheirentries
stayunknown.Anoneentrythusmeansthat𝑟doesnotstop𝑥once
theconsequence,everystill-enabledrulehasdemonstrablyfailed
WWW’27,May10-14,2027,Dublin,Ireland Yangetal.
Full 98.4
Seed only 97.9
Non-adaptive 97.9
Raw logs 96.9 Timing-only 96.9
No counterfact. 94.8
Greedy edit 96.9
One-shot joint 93.8
No archive 92.7
95 100
.pxE
.rttA
.drooC
(a) BPR (%) (b) ΔP95 (%) (c) Breached pairs / 144 (d) Layer subsets: ΔP95 (%)
6.9 15 8 6.9
6.4 63
6.7 48 6 5.3
7.2 39 4.0 4.5 7.3 33 4
8.4 36 2.4 2.9
7.6 42 2 1.6
7.7 69
7.0 33
0
6 8 10 0 50 G A S GA AS GS GAS
BPR 100 100 98.4 100 98.4 98.4 98.4
Figure6:Utilityandbreachcountsoftheablations(a-c)andthedisabled-layersubsets(d),complementingtheheld-outASRin
Figure4(d-e).Dashedlinesmarkthe95%BPRand10%latencyreferences.Meansoverthreeruns;breachesaresummedover48
attacker/deploymentpairsperrun.
Table5:Capabilityvocabularyoftheattack-effectsummary. Table6:Informationavailabletothetwoagents.
Thelastcolumnliststhecatalogcontrolthatcanintercept
eachcapability. Attacker Defender
Sees Vulnerabilitydescription, Attack-effectsummaries,coverage
reviewedfixturesand matrix,failedworkflowassertions,
Capability Rawoperations Interceptableby
prerequisites,ownrequestsand incumbentrules,catalog
proc_exec execve, execveat (also via S1 externalfeedback
posix_spawn)
Neversees Oracles,defenselogs,coverage Held-outattacks,testworkflows
file_write openat(write/create),rename, S2, outside writable results,policytext
unlink,chmod volumesonly
Returns Fixturechoiceandparametersina Typededitswithevidenceand
file_read openat(read-only) none requestschema expectedeffect
net_egress connect, sendto (non- S3
loopback)
Table7:Baselineapplicabilityandconfiguration.
other (collapsedtoacount) none
ID Method Layer Coverage Configuration
therulesthatstopped𝑥 earlieraredisabled.Thisreadingassumes
B1 ModSecurity+CRS[35] G 15/16 Tunedparanoia,exclusions
thatdisablingadeny-onlyruledoesnotreroute𝑥 ontoapaththat
B2 DatadogRASP[13] A 16/16 Tuneddetectionrules,thresholds
𝑟 wouldblock. B3 OpenRASP[3] A 16/16 Tuneddetectionrules,thresholds
AttributionQuality.Eachrunreportsthefractionofmaskedre- B4 Kintsugi[37] A+S 16/16 Reproducedpertarget
playsperoutcome,theretries,andthefractionofunknownentries. B5 Tetragon[10] S 16/16 Onefixedservice-widepolicy
On12referenceconfigurationswithknowncoverage,suchasdu-
plicatedrulesorrulesondisjointpaths,141of144entriesagree
Kintsugiinsertstriggermarkersintoapplicationcode,adeployment
withthereferenceandtheother3areunknown.Unknownentries
assumptionthatconfiguration-onlycontrolsavoid.Thegreedyand
donotaffectthemeasuredASR,butaruleisdeclaredredundant
one-shotablationsshareJanus’scandidates,model,evidence,and
onlyfromrowswithoutunknownentries.
budget,andgreedysearchacceptsaneditonlyifitkeepsarchive
PathKey.Averifiedattackislabeledwithitsentrypoint(route ASRandallthresholds.
andparameter),theoutermostframingofitsstream,andahashof
theapplicationframesbetweenthedeserializationcallsiteandthe G AdditionalResults
sink.Twoattackswiththesamekeyfollowthesameexploitation
Allfiguresandtablesaregeneratedfromoneresultfilebyscripts
path.Disjointnessischeckedonthekeysofthecatalogfixtures
thatalsocheckdenominators,failureinclusion,andtheA-only
asregistered;apermittedvariationmayproduceadifferentkey.
lowerbound.
An archived attack whose key equals that of a held-out attack
Per-DeploymentResults.Figure5givestheintegercountsbe-
rediscoversthatpath.Thetwoattacksmaydifferinpayload,and
hindeveryaggregate.Janus’sresidualfailuresareconfinedtoJ07,
theheld-outattackisneveraddedtothearchive.
J11,andP02,whichaccountforallfourheld-outsuccessesand
E AgentInputs allfivebreachedpairs.B1-B3arebreachedoneverydeployment
theycoverandfailmostonJenkins,with3-4of4held-outattacks
Table6listswhateachagentsees,neversees,andreturns.Prompt
succeedingoneachofJ05-J09.B5failsafunctionalityteston12of
templateswillbereleasedwiththeartifact.
16deployments,B2andB3exceedthelatencygateon6and9,and
JanusfailsatestonlyonP02andstayswithin8%latency.
F Baselines
UtilityofAblationsandLayerSubsets.Figure6reportswhat
ThetunablebaselinesB1-B3receivethesame12-trialallowance
Figure4omits.EveryablationkeepsBPRbetween92.7%and97.9%,
ontheevolvedarchiveandareselectedonvalidationworkflows.
JANUS:SynthesizingCross-LayerDefensesAgainstWebDeserializationAttacks WWW’27,May10-14,2027,Dublin,Ireland
belowthefullpolicy’s98.4%,andbreachedpairsfollowtheheld- additively,andBPRis100%wheneverSisdisabledbecausethefull
outASRranking,from15of144forthefullpolicyto69forone- policy’sonlyfailingtestcomesfromanSrule.
shotsynthesis.Forthelayersubsets,targetedlatencygrowsnearly