← Lab /AI/ML

Cross-layer synthesis cuts web deserialization attack success to 6.2%

AI/ML2026-10-26T14:47:24Z Defense · Prototype · arXiv Threat model

The claim

JANUS reduces attack success to 6.2% and fully mitigates 13 of 16 deployments

Ruozhao Yang, Minglang Li, Jiongchi Yu, Xinfeng Li, Xiaofei Xie · arXiv Paper PDF

Published as: “JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks”

So what

Janus demonstrates that automated cross-layer defense synthesis can markedly improve protection against deserialization attacks while maintaining functional performance, offering a practical path for operators to harden existing services.

The five-minute version

Janus reduces held-out attack success to 6.2%, about a third of the best baseline (18.8-55.0%) and fully mitigates 13 of 16 deployments while preserving 98.4% of functionality tests with only a 6.9% targeted latency increase. The claim is backed by an evaluation on 16 real-world Java and PHP applications, 48 attacker/deployment pairs, and comparison against five existing defenses. However, Janus still breaches 5 of 48 unseen attacker pairs and suffers two synthesis failures, showing the approach is not universally foolproof.

What they found 1

Held-out attack success drops to 6.2% with Janus, far below baselines.
“Janus lowers held-out attack success to 6.2%, versus 18.8-55.0% for the baselines”

What undercuts it the paper’s own results

The residual attacks come from two synthesis failures and one held-out failure.
Janus is breached on 5/48 attacker/deployment pairs.

Stated limits 1

None of them proves that no bypass exists.

What’s new here 4

Synthesizes coordinated cross-layer (gateway, application, system) defenses rather than single-layer patches.
Uses a red-blue adversarial loop where a black-box attacker generates verified exploit variants.
Applies counterfactual replay to attribute coverage and prune redundant controls.
Integrates regression-guarded joint revision to meet functional and latency constraints.

Threat model stated by the source

AdversaryAttacker controlling HTTP requests to a vulnerable deserialization entry point

CapabilityCan adapt payload representations and gadget chains using responses, timing, and out-of-band observations within fixed query and time budgets; cannot modify deployment configurations, defensive policies, or validation infrastructure

AssumesHost kernel, enforcement backends, and validation oracles are trusted; Defender can only change configuration, not application source code or business logic

Artifacts & methods 5

Janus frameworksystem
Black-box attacker agentprimitive
Defender agent with attack-effect summarizationprimitive
Counterfactual replay for coverage attribution
Evaluation deployments (Apache OFBiz, Jenkins, Liferay, Metabase, ActiveMQ, Snipe-IT)dataset

Topics

unsafe deserializationcross-layer defense synthesisadversarial red-blue frameworkcounterfactual replaypolicy coordinationregression testingweb application firewallsruntime application self-protection (RASP)

← Previous Most web vulnerabilities stay exploitable via AI agents; interface design drives risk