Janus turns red-blue adversarial search on deserialization defenses, cutting held-out attack success to 6.2% across 16 deployments
Synopsis
Unsafe deserialization lets attacker-controlled data trigger chains of existing methods and reach code execution, while gateway, application and system controls each see only part of the attack. Janus runs a black-box attacker agent against an isolated replica to surface exploit variants, has a defender agent summarize each verified variant into security-relevant effects, and uses counterfactual replay to separate complementary coverage from redundant enforcement before jointly selecting and scoping controls. Across 16 deployments in six Java and PHP applications, held-out attack success falls to 6.2% versus 18.8%–55.0% for gateway, application, system and cross-layer baselines, while 98.4% of benign functionality tests pass.
Interpretation
Deserialization defense is no longer assembled layer by layer by hand; it is synthesized automatically for a specific deployment as a coordinated gateway, application and system policy. Existing defenses typically act at a single enforcement point with limited visibility into the full attack, and combining controls across layers offers complementary protection but demands substantial expert effort to preserve legitimate functionality and adapt to new variants. Across 16 deployments in six Java and PHP applications, Janus lowers held-out attack success to 6.2%, while ModSecurity with OWASP CRS, Datadog RASP, OpenRASP, Kintsugi and Tetragon fall in the 18.8%–55.0% range.
The loop starts from one known exploit and iterates on an isolated offline replica until the policy meets both security and functionality gates. The black-box attacker agent sees only responses, timing and attacker-controlled out-of-band signals, and adjusts gadget-chain selection and payload representation from them; the defender condenses each verified variant into a capability summary with decisive parameters and uses counterfactual replay to tell whether a rule is the sole blocker or redundant. Janus fully mitigates 13 of 16 deployments, is breached on 5 of 48 unseen-attacker/deployment pairs, passes 98.4% of functionality tests, and adds 6.9% targeted P95 latency.
The frozen policy changes configuration only, never application source code, and is accepted only when it blocks every archived attack and passes the benign-workflow regression. A rule that is acceptable alone can break legitimate workflows when combined, so a candidate configuration must pass the training workflows and latency thresholds as a whole. In the Jenkins CVE-2026-84645 run, the frozen v2 blocks all four held-out attacks and passes all four functionality tests, whereas CRS stops only one re-encoded variant and both RASPs block no attacks.
Perspective
The demonstrated scope is 16 (application, CVE) deployments across six Java and PHP applications, each with one training seed attack, four held-out attacks, 12 training workflows and 4 functionality tests, with defenses that change configuration only and not application source code. The authors propose that the loop needs only a consequence oracle, a control catalog and benign workflows, making template injection and request forgery natural next targets.
Protection is empirical rather than proven, and public exploits may appear in model training data, which independent held-out paths and unseen attackers only partly address. Impact-limitation rules leave the vulnerable path reachable, so frozen configurations are temporary measures until a root-cause fix; the benchmark covers six applications, only one in PHP, so results are reported per deployment rather than through statistical tests. Refinement stops at budget exhaustion, stagnation or catalog exhaustion, and none of these proves that no bypass exists.