Presented my work on scalable repository-level vulnerability datasets at the FSE 2026 Doctoral Symposium in Montréal (talk and poster).
Hi, I’m
Amine Lbath
AI researcher at NIST · PhD candidate in AI for software security
I am an AI researcher at the National Institute of Standards and Technology in Gaithersburg, Maryland, and a PhD candidate in computer science at Université Grenoble Alpes (LIG, CNRS), advised by Massih-Reza Amini.
Before my PhD, I graduated with highest distinction from INSA Lyon with an M.S. in computer science and data science, studied machine learning at DTU in Copenhagen, and worked on energy-efficient deep learning at Nokia Bell Labs.
Research
My doctoral research sits at the intersection of AI agents, large language models, and software engineering: how intelligent systems can understand, test, and secure real-world software. Currently, I build agentic frameworks that generate high-quality, repository-scale datasets for training and evaluating code-security agents.
News
Poster, Teaching AI to Break Code for Stronger Software Security, at Sigma Xi, NIST.
Talk and poster on AVIATOR at AI@NIST Day.
Poster, Agents for Software Security, at the France Science Summit, French Embassy, Washington, D.C.
Poster, AI Agents for Bug Injection, at Sigma Xi, NIST.
Started my PhD at Université Grenoble Alpes and joined NIST as an AI researcher.
Publications
-
CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training
Despite recent advances, frontier large language model (LLM) agents remain limited in discovering and patching complex vulnerabilities in real-world software. Generally available agents can already aid attackers, who only need to find one exploitable weakness, while defenders must continuously identify and patch all vulnerabilities across fast-growing codebases. Stronger defensive agents would help close this gap, yet the scarcity of security training data with reproducible build and execution environments remains a bottleneck. We present CyberForge, a framework that synthesizes executable, repository-level security training data by injecting vulnerabilities into real C/C++ projects. It validates each instance dynamically: the injected build must pass the project's unit tests, and generated proof-of-vulnerability (PoV) must trigger on the injected build and not on the clean one. CyberForge is not limited by the availability of disclosed vulnerabilities, therefore it can scale in comparison to data augmentation techniques which rely on historic CVE data. The resulting corpus holds 1034 validated vulnerabilities across 80 projects and 63 weakness categories, with edit locality similar to real CVE patches under a real-versus-real noise floor. Fine-tuning on trajectories collected over this corpus improves SEC-bench patch repair by +3.3 to +14.7 points, in all six configurations of three model scales and two teachers, with the 31B student reaching its GPT-5.4-mini teacher, 72.7% against 74.0%. These gains generalize out of distribution to PatchEval, a corpus containing other programming languages, where every configuration also improves and the 31B student passes its teacher.
@misc{lbath2026cyberforge, title = {CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training}, author = {Lbath, Amine and Suri, Manan and Delaitre, Aurelien and Okun, Vadim and Amini, Massih-Reza and Sriram, Ram D. and Manocha, Dinesh}, year = {2026}, eprint = {2608.06471}, archivePrefix = {arXiv}, primaryClass = {cs.CR}, url = {https://arxiv.org/abs/2608.06471} } -
Toward Scalable Automated Repository-Level Datasets for Software Vulnerability Detection
Software vulnerabilities continue to grow in volume and remain difficult to detect in practice. Although learning-based vulnerability detection has progressed, existing benchmarks are largely function-centric and fail to capture realistic, executable, interprocedural settings. Recent repo-level security benchmarks demonstrate the importance of realistic environments, but their manual curation limits scale. This doctoral research proposes an automated benchmark generator that injects realistic vulnerabilities into real-world repositories and synthesizes reproducible proof-of-vulnerability (PoV) exploits, enabling precisely labeled datasets for training and evaluating repo-level vulnerability detection agents. We further investigate an adversarial co-evolution loop between injection and detection agents to improve robustness under realistic constraints.
@inproceedings{lbath2026toward, title = {Toward Scalable Automated Repository-Level Datasets for Software Vulnerability Detection}, author = {Lbath, Amine}, booktitle = {ACM International Conference on the Foundations of Software Engineering (FSE), Doctoral Symposium}, year = {2026}, eprint = {2603.17974}, archivePrefix = {arXiv}, primaryClass = {cs.SE}, url = {https://arxiv.org/abs/2603.17974} } -
The increasing complexity of software systems and the sophistication of cyber-attacks have underscored the need for reliable automated software vulnerability detection. Data-driven approaches using deep learning models show promise but critically depend on the availability of large, accurately labeled datasets. Yet existing datasets either suffer from noisy labels, limited vulnerability coverage, or fail to reflect vulnerabilities as they occur in real-world software. This also limits large-scale benchmarking of such solutions. Automated vulnerability injection provides a way to address these limitations, but existing techniques remain limited in coverage, contextual fidelity, or injection success. In this paper, we present AVIATOR, the first AI-agentic vulnerability injection framework. AVIATOR decomposes vulnerability injection into a coordinated workflow of specialized AI agents, tool-based analysis, and iterative self-correction, explicitly mirroring expert reasoning. It integrates RAG and lightweight LoRA-based fine-tuning to produce realistic, category-specific vulnerabilities without relying on handcrafted patterns. Across three benchmarks, AVIATOR achieves high injection fidelity (91-95%) surpassing existing injection techniques in both accuracy and vulnerability coverage. When used for data augmentation to train deep learning-based vulnerability detection (DLVD) models, AVIATOR provides the strongest downstream gains in vulnerability detection. Across models and base datasets, AVIATOR improves average F1 scores by +22% over no augmentation, +25% over VGX, holding the prior best injection success rate, and +3% over VulScribeR, the prior state-of-the-art LLM-based injection model, with +7% higher recall and no precision loss. Its augmented data exhibits the lowest distributional distortion and scales efficiently with <2% syntax rejection at 4.3x lower cost than VulScribeR.
@misc{lbath2025aviator, title = {AVIATOR: Towards AI-Agentic Vulnerability Injection Workflow for High-Fidelity, Large-Scale Code Security Dataset}, author = {Lbath, Amine and Amini, Massih-Reza and Delaitre, Aurelien and Okun, Vadim}, year = {2025}, eprint = {2508.20866}, archivePrefix = {arXiv}, primaryClass = {cs.CR}, note = {Under review, Journal of Systems and Software}, url = {https://arxiv.org/abs/2508.20866} } -
Energy Efficiency in AI for 5G and Beyond: A DeepRx Case Study
This study addresses the challenge of balancing energy efficiency with performance in AI/ML models, focusing on DeepRX, a deep learning receiver based on a fully convolutional ResNet architecture. We evaluate the energy consumption of DeepRX, considering factors including FLOPs/Watt and FLOPs/clock, and find consistency between estimated and actual energy usage, influenced by memory access patterns. The research extends to comparing energy dynamics during training and inference phases. A key contribution is the application of knowledge distillation (KD) to train a compact DeepRX student model that emulates the performance of the teacher model but with reduced energy consumption. We experiment with different student model sizes, optimal teacher sizes, and KD hyperparameters. Performance is measured by comparing the Bit Error Rate (BER) performance versus Signal-to-Interference & Noise Ratio (SINR) values of the distilled model and a model trained from scratch. The distilled models demonstrate a lower error floor across SINR levels, highlighting the effectiveness of KD in achieving energy-efficient AI solutions.
@inproceedings{lbath2024energy, title = {Energy Efficiency in AI for 5G and Beyond: A DeepRx Case Study}, author = {Lbath, Amine and Labriji, Ibtissam}, booktitle = {2024 Joint European Conference on Networks and Communications \& 6G Summit (EuCNC/6G Summit)}, publisher = {IEEE}, year = {2024}, doi = {10.1109/EuCNC/6GSummit60053.2024.10597065} }
Contact
The best way to reach me is by email at amine.lbath@univ-grenoble-alpes.fr. You can also find me on GitHub and LinkedIn, or read my CV.