{"id":"36788881-c01c-4244-9b3f-21c0b1866155","arxiv_id":"2501.10900","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"A complete curriculum teaches students to build LLM-powered security applications, attack them, and apply them to security tasks with ground-truth answers.","lead":"This paper presents a university course that teaches students to build, attack, and apply generative AI tools in cybersecurity. It is a concrete, reusable teaching blueprint for an emerging skill set.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reusability claim is unverified: public artifacts lack documented dependencies, credentials, and costs for external adoption.","rationale":"The paper is internally coherent and honestly framed as an 'initial' curriculum, so there is no basic soundness problem. The reader's conditional verdict is appropriate, but the more immediate load-bearing gap is not learning outcomes; it is the reproducibility of the advertised public materials. The paper lists repositories and labs, yet says almost nothing about how an external instructor would provision the many third-party services and API keys needed to run the exercises. This makes the paper's own 'help similar efforts' sentence a claim that is not currently testable from the text. A clean-environment run of the public labs would settle whether the materials are merely available or actually reusable. If they are not reproducible, the paper remains a useful design description but should either add environment/dependency/cost documentation or explicitly narrow its claim. The reader's pedagogical-effectiveness concern is valid and should remain part of the conditional, but the reusability check is a prerequisite for any independent evaluation to happen at all.","tokens_in":9519,"tokens_out":6433,"duration_ms":80242,"concrete_test":"In a fresh Ubuntu VM, clone the public cs410g-src repo and follow only the README/setup files in the repository to run one complete lab from each of §3.2 (RAG), §3.3 (ReAct injection), and §3.4.5 (threat intelligence) with no instructor-issued credentials or paid accounts. Record which steps fail due to missing API keys, undocumented service accounts, unmocked external dependencies, or cost barriers. If any module cannot be completed from the public materials by a non-PSU instructor, the paper should be revised to add setup/cost documentation or the claim should be narrowed from 'reusable' to 'described with source code.'","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's value stands partly on the claim that the materials are publicly usable: Section 4 says 'all of the curricular material described are available for public use and modification' to 'help similar efforts.' But the paper supplies no dependency manifest, API-key provisioning, cost estimate, or hardware requirements. The course depends on Ollama/cloud VMs (§3.1), LangChain tools such as SerpAPI and arbitrary OpenAPI endpoints (§3.2.2), Portswigger and CTF services (§3.3, §3.4.2), and VirusTotal, crt.sh, Safebrowsing, PhishTank, and other APIs (§3.4.5). Most of these require accounts, quotas, or payment, and closed-source model access requires billing. A clean install from the GitHub repo would still be un-runnable for an outside instructor who lacks the instructor-specific keys and credits used at PSU. The absence of this documentation does not invalidate the paper as a description, but it undercuts the stated goal of helping similar efforts and makes the 'modular, reusable curriculum' claim untestable. The missing learning assessment noted by the reader is also real, but it is secondary: even a course that is effective at PSU cannot be adopted or independently evaluated if the public materials are not reproducible.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper describes a graduate-level or upper-division security course at Portland State University that teaches students how to apply generative AI and large language models to cybersecurity tasks. The curriculum is organized into four modules: LLM models and their characteristics; application frameworks, primarily LangChain, RAG, and agent architectures; security of LLM applications, including OWASP Top 10 vulnerabilities, prompt injection, and excessive agency; and a set of security tasks with verifiable outcomes, including code summarization, vulnerability discovery and exploitation, command and configuration generation, code generation, threat intelligence, and social engineering. Section 4 reports that versions of the course ran in Spring 2024 and Fall 2024 and that the course materials are publicly available, with links to slides, labs, source code, screencasts, and tutorial videos.","tokens_in":9709,"tokens_out":3395,"duration_ms":39161,"significance":"If the materials work as described, the paper is a useful, unusually concrete blueprint for an emerging area of security education. Its modular organization, detailed exercise descriptions, and inclusion of tasks with known correct answers are strengths; the RAG-based prompt injection exercise in §3.3 and the agent-securing exercises in §3.2.2 are specific enough for other instructors to understand and adapt. The authors appropriately call the work an initial curriculum rather than a validated one. However, the contribution as presented is a course description rather than an educational intervention: the paper reports no learning outcomes, no assessment data, and no external adoption evidence, and the public materials are not accompanied by reuse documentation. These omissions directly affect the paper's stated goal of helping similar efforts.","major_comments":[{"comment":"The central pedagogical claim is unsupported by assessment data. Section 4 states that the course was offered in Spring 2024 and Fall 2024, but the paper reports no learning outcomes, student work samples, pre/post measures, or comparison group, and no section evaluates whether the exercises achieve their stated learning goals. Without such evidence, the reader cannot distinguish an effective curriculum from a collection of demonstrations. Please add an evaluation, however preliminary, or explicitly reframe the paper as a descriptive curriculum proposal with evaluation left to future work.","section":"4. Conclusion"},{"comment":"The public reuse claim is undermined by missing dependency and credential documentation. The conclusion says the materials are available 'for public use and modification' to 'help similar efforts,' but the exercises depend on Ollama/cloud VMs (§3.1), LangChain tools such as SerpAPI and arbitrary OpenAPI endpoints (§3.2.2), Portswigger and CTF services (§3.3 and §3.4.2), and multiple account-gated or paid APIs such as VirusTotal, crt.sh, Safe Browsing, PhishTank, and OOPSpam (§3.4.5). The linked repositories are not accompanied in the paper by a dependency manifest, API-key provisioning guide, cost estimate, or hardware requirement, so an external instructor cannot determine how to run the course. Please provide a run-book or installation guide, or soften the reuse claim to match what is actually provided.","section":"4. Conclusion and §3.1–§3.4"},{"comment":"The social engineering module lacks an explicit safety and ethics framework. Students are asked to generate fake social media profiles, phishing lures, and misinformation, but the paper does not describe safeguards, platform terms-of-service considerations, human-subjects review, or how the generated artifacts are contained and disposed of. For a curriculum intended for adoption elsewhere, this omission is consequential; the authors should state the controls used in their offering, such as sandboxed environments, fictional targets, and institutional review procedures.","section":"3.4.6 Social engineering"}],"minor_comments":[{"comment":"The text and reference list use 'OW ASP' with a space; this should be 'OWASP'.","section":"3.3 and References [38]"},{"comment":"The word 'evaulate' in the phishing lures exercise should be 'evaluate'.","section":"3.4.6"},{"comment":"The acronym 'MVP' is defined as 'model-view-controller'; this is normally abbreviated 'MVC', and the text should use the correct abbreviation.","section":"3.4.4 Chatbot coding"},{"comment":"'A WS' in 'A WS's aws' should be 'AWS'.","section":"3.4.3 Cloud commands"},{"comment":"The rendering 'Pok´ emon' in the RAG prompt injection walkthrough has broken encoding; it should read 'Pokémon'.","section":"3.4.1 Summarization"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is squarely within the scope of a computing-education venue and may become a useful resource. The main question for the editor is whether the journal requires evidence of educational effectiveness for a curriculum paper; if so, the absence of any outcome data is a central gap, not a presentation issue. The reuse/documentation gap is also worth treating seriously, since the paper makes an explicit adoption-oriented claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick read of Feng and Baker-Robinson's curriculum paper. The honest headline: this is a solid, well-organized teaching blueprint, and it earns a place in the conversation about how to teach LLM security. It is not a research paper and should not be judged as one.\n\nWhat's new: the specific course design. The sequence—model familiarity, RAG and agent labs, LLM security attacks, then ground-truth security tasks—is a useful assembly of known pieces (LangChain, DSPy, OWASP Top 10 for LLMs, Portswigger levels, CTFs) into a coherent semester. I especially like the use of tasks with known correct answers (Section 3.4), which forces students to wrestle with LLM hallucination instead of just chaining demo outputs. The Bulbasaur ReAct injection write-up is a nice teaching example. The authors also acknowledge model limitations and costs, which is more honest than most LLM course descriptions.\n\nThe soft spots, in order. First, no learning assessment. The course ran twice (Spring/Fall 2024) but no student outcomes, pre/post tests, or even enrollment attrition. The paper itself calls it an \"initial curriculum,\" which is honest, but the load-bearing claim—that these exercises teach students to apply generative AI in security—is plausible and untested. Second, the reusability claim is oversold. Section 4 says the materials are \"available for public use and modification,\" which is literally true (links to slides, labs, code), but the stress-test note about missing dependencies is fair: external adopters need API keys, billing info, and tool-specific setup that the paper does not document. That gap makes independent evaluation of the materials harder, not impossible. I'd downgrade the \"help similar efforts\" goal to \"helpful but needs setup documentation.\" Neither flaw is fatal to the paper's descriptive purpose.\n\nThe citation pattern looks fine: references are mostly online docs, CTF portals, and prior LLM security work, appropriate for a curriculum piece. No citation inflation or self-citation abuse.\n\nBottom line: this is a useful design document for educators building or revising an LLM security course. It deserves serious peer review, but the expected outcome should be a revision that adds an evaluation plan and a short \"getting started\" appendix covering setup and costs. I'd bring it to a reading group as a discussion piece on what counts as evidence in CS education. Not my area to cite directly, but I'd point colleagues to it.","headline":"Solid, clearly written curriculum blueprint for LLM security, but the teaching is unvalidated and the public materials are not yet reproducible by outsiders.","tokens_in":10205,"tokens_out":2475,"would_cite":false,"duration_ms":28278,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes a curriculum that teaches cybersecurity by building, attacking, and applying LLM applications.","keywords":["generative AI","security education","LLM applications","curriculum design","prompt injection","retrieval-augmented generation","LLM agents","capture-the-flag"],"falsifier":"A controlled teaching experiment: give one cohort this four-module curriculum and another a traditional security course, then give both new security tasks with known correct answers and measure accuracy, speed, and judgment about when to trust model output; if the LLM-curriculum group does not outperform, the central premise fails. A simpler check is to collect student solutions from the labs and see whether graduates of the course can independently detect prompt injection and restrict agent tool privileges when asked to build a fresh agent.","tokens_in":9320,"feed_emoji":"🛡️","tokens_out":8232,"duration_ms":79249,"temperature":0.7,"pith_summary":"The paper proposes a curriculum and a course that teaches cybersecurity by having students build, attack, and apply large language model (LLM) applications. Its central argument is that security education should stop treating generative AI as a topic and start treating it as the working medium: students learn the models, assemble them into applications, compromise those applications, and then use them on security tasks with known correct answers. The course is organized into four modules—models, frameworks, security, and tasks—and all materials are released publicly so other programs can reuse them. The intended payoff is a generation of security practitioners who can steer automation instead of performing every step by hand.","feed_headline":"Course teaches students to build, break, and apply LLM security tools","feed_subtitle":"The four-part design moves from models to frameworks to LLM attacks to verifiable security tasks.","key_machinery":"The load-bearing mechanism is the four-part course architecture: models, frameworks, security, and tasks. Each segment supplies the next: students probe models to understand what they can and cannot do; assemble models into applications using a framework's abstractions for retrieval, agents, and tools; break those applications to learn LLM-specific failure modes; and finally use the resulting skills on security tasks whose outcomes are known and checkable. The repeated design motif is a 'naive versus hardened' pair—for example, a database agent with excessive tool privilege is contrasted with one that restricts permitted SQL and validates inputs—so that a security principle is learned by building and breaking. The ground-truth requirement is what keeps the course honest about LLM reliability: because models can be confidently wrong, every task in the final module has a correct answer students can verify.","core_discovery":"On its own terms, the paper's claim is that a security course can be built around the generative-AI application life cycle and that doing so teaches students both how to use LLMs and how to secure them. The curriculum starts with hands-on model experimentation, then moves to building LLM applications with retrieval-augmented generation and agent architectures, then to attacking those applications using a standard catalog of LLM-specific vulnerabilities such as prompt injection and excessive agency, and finally to applying the tools to security tasks—code summarization, vulnerability discovery and exploitation, command and configuration generation, code generation, threat intelligence, and social engineering. A key design choice is the use of 'ground-truth' tasks, drawn from capture-the-flag levels and known commands and configurations, so students can verify whether a model's output is actually correct. The paper's contribution is the curriculum structure and the public materials, not an empirical demonstration of improved learning.","pith_inferences":["The paper's implicit pedagogical bet is that learning to build and break an LLM application transfers to real security work; the obvious next test is a controlled comparison of this course against a conventional security curriculum on new, unseen tasks.","The ground-truth benchmarking idea could be lifted out of the classroom and used as an evaluation methodology for LLM security tools generally, giving teams a cheap way to decide which models they can trust.","A testable extension is to measure not just whether students answer tasks correctly but whether they learn when to distrust model output, since the curriculum's emphasis on verifiable tasks should sharpen calibration.","The course implicitly argues that future security practitioners will spend more time designing and validating automated workflows than performing individual commands; if true, curriculum hours should shift away from memorizing tools and toward evaluation and tool-building."],"forward_implications":["Adopting this structure lets a security program teach LLM application development and security together rather than as separate electives.","Students completing the course should be able to build LLM-powered tools for code analysis, vulnerability discovery, command generation, threat intelligence, and social engineering detection.","The ground-truth task design gives students a way to benchmark whether a model is dependable, countering the danger of plausible-but-wrong outputs.","By making the materials public, the paper enables other institutions to offer a similar course without designing exercises from scratch.","The 'secure by construction' pattern—using custom restricted tools instead of broad agent toolkits—gives students a concrete template for secure LLM application design."],"supporting_citations":[{"why":"The LLM application framework that supplies abstractions for the course's retrieval and agent-building exercises.","marker":"[24]"},{"why":"The catalog of common LLM application vulnerabilities that structures the security module's attack exercises.","marker":"[38]"},{"why":"The reasoning-acting agent pattern used in the agent exercises and the prompt-injection demonstration.","marker":"[54]"},{"why":"Provides the retrieval-augmented generation technique the course uses to reduce hallucinations in LLM applications.","marker":"[21]"},{"why":"The survey of prompt engineering techniques that backs the model-use module.","marker":"[45]"},{"why":"The web security training levels that supply client-side code and challenges for exploits and deobfuscation.","marker":"[41]"},{"why":"The collection of vulnerable server-side web application code used in the vulnerability-finding exercises.","marker":"[37]"},{"why":"The reverse-engineering framework used in the binary analysis exercise to decompile executables for LLM analysis.","marker":"[33]"}],"fun_headline_variants":["Security course rebuilt around generative AI and LLM attacks","Four-part curriculum trains students to build and break LLM tools","New security course focuses on generative AI application skills","LLM security course uses CTF ground-truth tasks to train students"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The curriculum's value rests on the assumption that the hands-on exercises translate into real ability to use generative AI in security work, yet the paper reports no assessments, pre/post tests, or comparisons to establish that.","fun_headline_variants_meta":{"raw":{"variants":["Security course rebuilt around generative AI and LLM attacks","Four-part curriculum trains students to build and break LLM tools","New security course focuses on generative AI application skills","LLM security course uses CTF ground-truth tasks to train students"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000599,"raw_usage":{"total_tokens":2732,"prompt_tokens":812,"completion_tokens":1920,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":428,"completion_tokens_details":{"reasoning_tokens":1852}},"tokens_in":428,"tokens_out":1920,"duration_ms":15485,"temperature":1.0,"reasoning_tokens":1852,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T18:50:20.242585+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A controlled teaching experiment: give one cohort this four-module curriculum and another a traditional security course, then give both new security tasks with known correct answers and measure accuracy, speed, and judgment about when to trust model output; if the LLM-curriculum group does not outperform, the central premise fails. A simpler check is to collect student solutions from the labs and see whether graduates of the course can independently detect prompt injection and restrict agent tool privileges when asked to build a fresh agent.","supporting_citations":[{"cited_title":"LangChain, 2024","cited_arxiv_id":null,"evidence_quote":"The LLM application framework that supplies abstractions for the course's retrieval and agent-building exercises."},{"cited_title":"OW ASP Top 10: LLM Applications and Generative AI, 2024","cited_arxiv_id":null,"evidence_quote":"The catalog of common LLM application vulnerabilities that structures the security module's attack exercises."},{"cited_title":"Teaching Generative Security Applications using LangChain","cited_arxiv_id":null,"evidence_quote":"The reasoning-acting agent pattern used in the agent exercises and the prompt-injection demonstration."},{"cited_title":"A Survey on Retrieval-Augmented Text Generation for Large Language Models, 2024","cited_arxiv_id":null,"evidence_quote":"Provides the retrieval-augmented generation technique the course uses to reduce hallucinations in LLM applications."},{"cited_title":"A Systematic Survey of Prompt Engi- neering in Large Language Models: Techniques and Applications, 2024","cited_arxiv_id":null,"evidence_quote":"The survey of prompt engineering techniques that backs the model-use module."},{"cited_title":"Web Security Academy, 2024","cited_arxiv_id":null,"evidence_quote":"The web security training levels that supply client-side code and challenges for exploits and deobfuscation."},{"cited_title":"OverTheWire Wargames, 2024","cited_arxiv_id":null,"evidence_quote":"The collection of vulnerable server-side web application code used in the vulnerability-finding exercises."},{"cited_title":"Ghidra Software Reverse Engineering Suite, 2024","cited_arxiv_id":null,"evidence_quote":"The reverse-engineering framework used in the binary analysis exercise to decompile executables for LLM analysis."}],"review_version":1}