Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →2 papers in English
2 papers
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. The paper describes incident-response sessions spanning signal curation, structured target extraction, reviewed playbook selection, declared action contracts, deterministic admissibility, bounded network-edge execution, capability-disjoint verification, hash-linked evidence sealing, scheduled review, reconciliation and undo. The learned model is trained on the system’s own outcome-verified transcripts and narrates the result; admissibility and execution authority remain structurally outside the model. The paper addresses per-principal containment within shared enforcement domains, rule-budget aggregation, element-identified reconciliation, independent receipt recomputation and exact localization of controlled tampering. Reported measurements refer to the version and period described in the manuscript and are not a claim of universal performance.
Read paper →ResearchAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint verification for systems acting on production infrastructure. Admissibility is adjudicated outside the learned model, while hash-linked, seal-terminated receipts provide a self-describing recomputation contract. The paper develops exact tamper localization, per-principal containment at shared enforcement points, element-wise reconciliation under aggregation, atomization conditions, blinded correlation and conditions for composite reversibility. It separates policy quality, envelope integrity and evidence integrity in its evaluation methodology. Formal results depend on their stated assumptions. This preprint does not assert that every theoretical construction is implemented or independently validated.
Read paper →