ACTION selected a group of seven undergraduate students for this year's 8-week research experience at UCSB. 2026 is the third year of ACTION's summer program.
Student researchers joined with participants from other undergraduate summer programs, including McNair Scholars and groups managed by the Center for Engineering and Science Partnerships (CSEP). All students had opportunities to attend skills development seminars and to network with other programs.
After an 8-week experience, ACTION was able to show four posters at the 2026 Undergraduate Research Symposium. Four of the six projects were mentored by a postdoctoral scholar. The remaining two were mentored by ACTION faculty members.
REDUCING VULNERABILITY INFORMATION LEAKAGE FROM PUBLIC IDS RULES
Nathan Qiu, UC Santa Barbara
Yigitcan Kaya (Mentor), UC Santa Barbara
Intrusion detection systems use rules that act as security tripwires to detect suspicious network traffic associated with known vulnerabilities. These rules are distributed publicly so users can protect their systems. Even when a rule does not explicitly identify its associated vulnerability, an attacker may still infer it from rule components that describe the specific network traffic. Our research explores how IDS rules can be modified to reveal less about their target vulnerabilities while retaining their ability to detect the corresponding attacks. We curated 20 representative IDS rules that an LLM-based attacker could consistently reverse-engineer to identify their target vulnerabilities. We then systematically modified individual rule components using varying levels of generality to remove vulnerability-specific clues. For example, if an exact service port enabled the attacker to infer the vulnerability, we replaced it with increasingly broader port ranges. We evaluated each modification by testing whether the same LLM-based attacker could still infer the correct vulnerability. To evaluate detection, we generated synthetic exploit traffic to verify that modified rules detected their intended attacks, and used benign traffic to assess false positives and any loss of precision. Among 565 modified rule variants, 79 (14.0%) caused the attacker to miss the target vulnerability. All 79 variants detected every exploit sample, while 24 (30.4%) triggered on at least one benign sample. These results suggest that some rule transformations can reduce attacker vulnerability inference without sacrificing attack detection, but may increase false positives, highlighting the tradeoff between limiting information leakage and preserving detection specificity.
BAYESIAN OPTIMIZATION-BASED EXPLAINER FOR TEMPORAL GRAPH NEURAL NETWORKS
Varsha Narasiman, UC Santa Barbara
Chenrui Zhang, UC Santa Barbara
Ambuj K. Singh (Mentor), UC Santa Barbara
Temporal Graph Neural Networks (TGNNs) learn on temporal graphs, or data that change in structure or features over time, such as evolving user recommendations, traffic systems, and financial fraud detection. They can be utilized to predict future interactions or classify dynamic data. Still, the inner workings of TGNNs remain obscure, and in high-risk applications like financial security, a prediction of a breach is difficult to trust if the model cannot ground its reasoning by identifying a sequence of events that caused its decision. Existing explainers for TGNNs typically focus on either factual explanations that identify subgraphs that are sufficient to preserve the original prediction or counterfactual explanations that identify the minimal perturbation necessary to flip it. However, prior work has largely left unanswered how to produce global explanations for TGNNs that are semantically meaningful, sufficient, and necessary. Improving on the Gloss-T pipeline by Polat et al., we propose a new method called Temporal Necessity-Sufficient Bayesian Optimization (TNS-BO) that identifies factual and counterfactual subgraphs through a Bayesian Optimization search. Once a valid counterfactual subgraph is found, unnecessary nodes are greedily removed to ensure compactness, and robustness checks are performed to ensure sufficiency. Experimental results using the standard Wikipedia dataset indicate that TNS-BO finds explanations for 16/30 targets using about 66.1/100 model queries, matching or exceeding the state-of-the-art approaches. Though these findings require further investigation, our method is one of the first to attempt a necessity-and-sufficiency approach toward a global explainer for temporal graphs.
SPEAKER-SPECIFIC PRONUNCIATION CUES FOR TEXT-TO-SPEECH VOICE CLONE DETECTION
Juan Nunez, UC Santa Barbara
Yigitcan Kaya (Mentor), UC Santa Barbara
Modern voice cloning tools can create realistic deepfakes with just 3 seconds of audio. Public data (such as videos on social media) allows attackers to collect audio and weaponize a person’s voice for phishing attacks. General deepfake detectors often lose accuracy when evaluated on speakers, cloning systems, recording devices, or acoustic conditions absent from their training data. Our initial experiments tested whether some phrases are consistently hard for cloning systems to reproduce. We found that no universal phrase-level pattern reliably predicted synthesis difficulty, consistent with how cloning systems separate what is said from who is saying it. This motivated us to take a different approach: testing whether speaker-specific pronunciation habits resist reproduction when cloned, even when the deepfake models are fed recordings of those pronunciations.
In a pilot study using recordings from the research team, we examined speaker-specific mispronunciation patterns across different phonetic categories. We compared genuine and cloned recordings of sentences containing these pronunciations (such as a Spanish pronunciation of an English word) by using acoustic measurements of vowel quality and syllable timing. One clone differed about twice the speaker's normal variation, while one devoicing habit appeared in 50% of genuine recordings but only 8% of synthesized recordings. Across the pilot’s words and metrics, the cloning systems often defaulted towards standard English pronunciation rather than reproducing the speaker's own.
These findings suggest that speaker-specific pronunciation habits could serve as personalized authenticity cues. Larger studies are needed to determine generalizability across different speakers, language backgrounds, and cloning systems.
THE BANDIT PROBLEM IN NON-STATIONARY ENVIRONMENTS FOR MALWARE DETECTION
Kyle Lemmons, UC Santa Barbara
Rohan Mittal, UC Santa Barbara
João P. Hespanha (Mentor), UC Santa Barbara
Malware classifiers must adapt as attackers change their behavior to evade previously effective models, yet most are trained once and never updated. We formulate this adaptation problem as a contextual bandit: for each sample, a decision-maker observes context, selects an action, and learns only the cost of that specific choice, never what the alternatives would have cost. Building on Anderson and Hespanha's Boltzmann learning framework, we extend its treatment of classifier-based context to a setting prior work has not evaluated: realistic malware identification can involve hundreds of families, where confusing a destructive threat with a harmless one is far more costly than confusing a harmless one with a destructive threat. We validate two adaptive algorithms, D-LinUCB and Discounted Thompson Sampling, on a benchmark where an opponent's strategy changes abruptly, confirming both recover under restricted feedback. We then build an adaptive arbiter for a real, large-scale malware dataset, MABEL, that observes agreement among several trained classifiers and learns which one to trust for each sample. The arbiter outperforms every individual classifier regardless of which bandit algorithm drives it, recovering roughly 40% (Thompson Sampling) to 69% (Boltzmann learning) of the improvement a perfect selector could achieve, showing the arbitration design itself is the key contribution. We also find that a classifier can look accurate overall while completely failing on a specific, high-severity malware category; when every classifier shares this failure, adaptive selection cannot fix it, showing detection systems need diverse classifiers and severity-aware evaluation, not adaptive selection alone.
HOW MUCH CAN AN ATTACK-DETECTION RULE REVEAL ABOUT A SOFTWARE VULNERABILITY?
Paolo Ciappetta, Antelope Valley College
Yigitcan Kaya (Mentor), UC Santa Barbara
Intrusion detection systems (IDSs) use rules to identify network traffic associated with cyberattacks. If an attacker obtains a target’s rules through distribution, leakage, or system access, their logic may reveal clues about vulnerabilities the organization is prepared to detect. Linking these clues to a known vulnerability record, or CVE (Common Vulnerabilities and Exposures), could help narrow the search for vulnerable systems. We study this risk by measuring how accurately an IDS rule can be attributed to its corresponding CVE. This attribution is challenging because IDS rules and CVE records describe different aspects of an attack. A rule captures observable network behavior during exploitation, such as a request path, command, or byte pattern, while a CVE describes the underlying vulnerability, affected products, and versions. We developed an auditable, multi-stage pipeline separating rule interpretation, candidate search, and comparison. First, an LLM analyzes an unattributed rule and extracts clues about affected product, protocol, attack behavior, vulnerability type, and software version without seeing the associated CVE. The system then searches 208,247 CVE records using these clues, treating missing information as uncertainty rather than evidence against a candidate. Finally, the LLM compares the remaining candidates. In a pilot evaluation of 22 rules, the correct CVE appeared among the final 20 candidates in 6 cases and was correctly identified in 5. Evaluating each stage reveals whether attribution fails during retrieval or comparison, and which clues enable successful attribution. Our framework measures how much vulnerability information IDS rules may expose and where that information remains ambiguous.
SUBLIMINAL SECRET LEAKAGE THROUGH UNRELATED LLM CONVERSATIONS
Kayshav Bhardwaj, Purdue University
Yigitcan Kaya (Mentor), UC Santa Barbara
LLMs may process confidential information in user prompts or system context. This creates an obvious privacy risk if a model directly reveals that information. However, private information may also influence unrelated outputs in subtle statistical ways. We study whether an observer can exploit these patterns to recover a secret even when the output never states it. We place a secret in the model’s context and ask it to generate unrelated content. An observer then compares how likely the observed output would be under different candidate secrets, assuming access to the same model, its token probabilities, and candidate secrets, but not the true secret. The candidate that makes the output most likely is selected. For four-digit PINs, a single randomly generated number list recovers the correct PIN among five candidates 65–77% of the time, compared with 20% by chance. Combining 20 independently generated lists recovers the exact PIN from 10,000 possibilities in approximately 50–58% of trials. We observe similar leakage across multiple open-weight models. We also evaluate semantic secrets, such as a private medical fact, using unrelated emails and essays as observable outputs. With long constrained essays, we achieve 80% accuracy among four candidate secrets. Among 200 candidates, a single essay identifies the secret 22% of the time, while combining evidence from 10 essays increases accuracy to approximately 67% (chance: 0.5%). Our results show that preventing models from explicitly stating confidential information may not prevent leakage: secrets can still influence unrelated outputs in ways that make them recoverable.
The 8-week research experience concluded with a debrief over a group lunch and a promise to run again in 2027.
If you are interested in interning with the ACTION AI Institute, be sure to check our Education & Outreach page for an application starting in November 2026.