Ruozhao Yang

Unsafe deserialization lets attacker-controlled data trigger chains of existing methods and reach code execution, while gateway, application and system controls each see only part of the attack. Janus runs a black-box attacker agent against an isolated replica to surface exploit variants, has a defender agent summarize each verified variant into security-relevant effects, and uses counterfactual replay to separate complementary coverage from redundant enforcement before jointly selecting and scoping controls. Across 16 deployments in six Java and PHP applications, held-out attack success falls to 6.2% versus 18.8%–55.0% for gateway, application, system and cross-layer baselines, while 98.4% of benign functionality tests pass.

Unsafe deserialization lets attacker-controlled data trigger chains of existing methods and reach code execution, while gateway, application and system controls each see only part of the attack. Janus runs a black-box attacker agent against an isolated replica to surface exploit variants, has a defender agent summarize each verified variant into security-relevant effects, and uses counterfactual replay to separate complementary coverage from redundant enforcement before jointly selecting and scoping controls. Across 16 deployments in six Java and PHP applications, held-out attack success falls to 6.2% versus 18.8%–55.0% for gateway, application, system and cross-layer baselines, while 98.4% of benign functionality tests pass.