Amine Lbath

Research

My doctoral research sits at the intersection of AI agents, large language models, and software engineering: how intelligent systems can understand, test, and secure real-world software. Currently, I build agentic frameworks that generate high-quality, repository-scale datasets for training and evaluating code-security agents.

News

Selected publications

1. CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training

   Amine Lbath*, Manan Suri*, Aurelien Delaitre, Vadim Okun, Massih-Reza Amini, Ram D. Sriram, Dinesh Manocha

   *equal contribution

   Submitted July 2026, under review

   abs bib html pdf site code data

   Despite recent advances, frontier large language model (LLM) agents remain limited in discovering and patching complex vulnerabilities in real-world software. Generally available agents can already aid attackers, who only need to find one exploitable weakness, while defenders must continuously identify and patch all vulnerabilities across fast-growing codebases. Stronger defensive agents would help close this gap, yet the scarcity of security training data with reproducible build and execution environments remains a bottleneck. We present CyberForge, a framework that synthesizes executable, repository-level security training data by injecting vulnerabilities into real C/C++ projects. It validates each instance dynamically: the injected build must pass the project's unit tests, and generated proof-of-vulnerability (PoV) must trigger on the injected build and not on the clean one. CyberForge is not limited by the availability of disclosed vulnerabilities, therefore it can scale in comparison to data augmentation techniques which rely on historic CVE data. The resulting corpus holds 1034 validated vulnerabilities across 80 projects and 63 weakness categories, with edit locality similar to real CVE patches under a real-versus-real noise floor. Fine-tuning on trajectories collected over this corpus improves SEC-bench patch repair by +3.3 to +14.7 points, in all six configurations of three model scales and two teachers, with the 31B student reaching its GPT-5.4-mini teacher, 72.7% against 74.0%. These gains generalize out of distribution to PatchEval, a corpus containing other programming languages, where every configuration also improves and the 31B student passes its teacher.

   @misc{lbath2026cyberforge,  title         = {CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training},  author        = {Lbath, Amine and Suri, Manan and Delaitre, Aurelien and Okun, Vadim and Amini, Massih-Reza and Sriram, Ram D. and Manocha, Dinesh},  year          = {2026},  eprint        = {2608.06471},  archivePrefix = {arXiv},  primaryClass  = {cs.CR},  url           = {https://arxiv.org/abs/2608.06471}}

2. Toward Scalable Automated Repository-Level Datasets for Software Vulnerability Detection

   Amine Lbath

   34th ACM International Conference on the Foundations of Software Engineering (FSE 2026), Doctoral Symposium

   abs bib html pdf

   Software vulnerabilities continue to grow in volume and remain difficult to detect in practice. Although learning-based vulnerability detection has progressed, existing benchmarks are largely function-centric and fail to capture realistic, executable, interprocedural settings. Recent repo-level security benchmarks demonstrate the importance of realistic environments, but their manual curation limits scale. This doctoral research proposes an automated benchmark generator that injects realistic vulnerabilities into real-world repositories and synthesizes reproducible proof-of-vulnerability (PoV) exploits, enabling precisely labeled datasets for training and evaluating repo-level vulnerability detection agents. We further investigate an adversarial co-evolution loop between injection and detection agents to improve robustness under realistic constraints.

   @inproceedings{lbath2026toward,  title         = {Toward Scalable Automated Repository-Level Datasets for Software Vulnerability Detection},  author        = {Lbath, Amine},  booktitle     = {Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering (FSE), Doctoral Symposium},  year          = {2026},  publisher     = {ACM},  doi           = {10.1145/3803437.3804870},  url           = {https://dl.acm.org/doi/10.1145/3803437.3804870}}

3. AVIATOR: Towards AI-Agentic Vulnerability Injection Workflow for High-Fidelity, Large-Scale Code Security Dataset

   Amine Lbath, Massih-Reza Amini, Aurelien Delaitre, Vadim Okun

   Journal of Systems and Software, minor revision

   abs bib html pdf code

   The increasing complexity of software systems and the sophistication of cyber-attacks have underscored the need for reliable automated software vulnerability detection. Data-driven approaches using deep learning models show promise but critically depend on the availability of large, accurately labeled datasets. Yet existing datasets either suffer from noisy labels, limited vulnerability coverage, or fail to reflect vulnerabilities as they occur in real-world software. This also limits large-scale benchmarking of such solutions. Automated vulnerability injection provides a way to address these limitations, but existing techniques remain limited in coverage, contextual fidelity, or injection success. In this paper, we present AVIATOR, the first AI-agentic vulnerability injection framework. AVIATOR decomposes vulnerability injection into a coordinated workflow of specialized AI agents, tool-based analysis, and iterative self-correction, explicitly mirroring expert reasoning. It integrates RAG and lightweight LoRA-based fine-tuning to produce realistic, category-specific vulnerabilities without relying on handcrafted patterns. Across three benchmarks, AVIATOR achieves high injection fidelity (91-95%) surpassing existing injection techniques in both accuracy and vulnerability coverage. When used for data augmentation to train deep learning-based vulnerability detection (DLVD) models, AVIATOR provides the strongest downstream gains in vulnerability detection. Across models and base datasets, AVIATOR improves average F1 scores by +22% over no augmentation, +25% over VGX, holding the prior best injection success rate, and +3% over VulScribeR, the prior state-of-the-art LLM-based injection model, with +7% higher recall and no precision loss. Its augmented data exhibits the lowest distributional distortion and scales efficiently with <2% syntax rejection at 4.3x lower cost than VulScribeR.

   @misc{lbath2025aviator,  title         = {AVIATOR: Towards AI-Agentic Vulnerability Injection Workflow for High-Fidelity, Large-Scale Code Security Dataset},  author        = {Lbath, Amine and Amini, Massih-Reza and Delaitre, Aurelien and Okun, Vadim},  year          = {2025},  eprint        = {2508.20866},  archivePrefix = {arXiv},  primaryClass  = {cs.CR},  note          = {Minor revision, Journal of Systems and Software},  url           = {https://arxiv.org/abs/2508.20866}}

See all publications

Service

Contact

The best way to reach me is by email at amine_dot_lbath_at_univ-grenoble-alpes_dot_fr. You can also find me on GitHub and LinkedIn.