Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LACE claims that LLMs, guided by prompts and checked by formal logic, can turn natural-language IoT access rules into enforceable, conflict-free policies.

desk verdict Solid integrated system, but the SMT conflict-detection step has a load-bearing gap: as written, it cannot run on the system's own natural-language conditions. read the letter →

arxiv 2505.23835 v1 pith:Z3Z6QH37 submitted 2025-05-28 cs.CL

Ye Cheng , Minghui Xu , Yue Zhang , Kun Li , Hao Wu , Yechao Zhang , Shaoyong Guo , Wangjie Qiu
show 2 more authors
Dongxiao Yu Xiuzhen Cheng
This is my paper · ORCID
classification cs.CL
keywords naturallanguagepolicyauthoringIoTaccesscontrollargemodelsretrieval-augmentedgenerationformalverificationconflictdetectionsmarthomesecurityOpenAgent
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the real obstacle in IoT access control is the gap between natural-language policy intent and machine-enforceable logic, which today is bridged by manual, error-prone developer translation. The authors propose LACE, a pipeline in which an LLM converts plain-language access requirements into structured JSON policies, a validation stage checks those policies against the original wording and detects conflicts with a satisfiability solver, and a retrieval-augmented LLM makes runtime decisions that are then verified by a formal policy engine. The paper reports 100 percent correctness in verified policy generation across several LLMs and up to 88 percent decision accuracy with a 0.79 F1-score using DeepSeek-V3, with policy matching staying fast at 500 or more policies. If this holds, device owners could author enforceable, auditable access rules directly in natural language, without a developer translating them into code.

What carries the argument

The central object is the LACE pipeline, a two-stage architecture that pairs an LLM with formal guardrails. The load-bearing pieces are the structured JSON policy schema, the reconstruction of generated policies into checkable sentences for natural-language-inference consistency, the tuple-based conflict definitions handled by an SMT solver, embedding-based top-k policy retrieval, a chain-of-thought decision prompt, and Open Policy Agent as the final decision verifier. Together these components are what convert probabilistic LLM outputs into claims of verified, conflict-free policy enforcement.

What would settle it

A decisive test would be to give LACE two plainly conflicting policy descriptions, such as 'Alice may use multimedia devices on Monday' and 'Alice may not control the TV on weekdays', with no extra ontology or human-provided axioms, and check whether the conflict-detection stage flags them on its own, since the Monday/weekday and TV/multimedia links are knowledge an SMT solver does not inherently possess.

Watch

Extended reading notes

Core claim

The central claim of the paper is that a large language model, constrained by a designed prompt and verified by a multi-stage pipeline, can act as a semantic interface between natural-language access-control descriptions and machine-enforceable IoT policies. LACE converts a text description into structured JSON policies with subject, resource, action, effect, and condition fields; reconstructs each generated policy into a sentence of the form 'subject can effect action resource if conditions' and checks semantic consistency against the original text; then models each policy as a tuple $P=(S,R,A,E,C)$ and uses an SMT solver to detect effect conflicts ($\mathrm{SAT}(C_1 \wedge C_2)$ with opposite effects), redundancy conflicts ($C_1 \Rightarrow C_2$ with the same effect), and inconsistency conflicts ($\mathrm{UNSAT}(C_1 \wedge C_2)$ with the same effect). At runtime it retrieves candidate policies by embedding similarity, asks the LLM to reason over them with chain-of-thought prompting, and uses Open Policy Agent to verify the decision before it is enforced. The paper reports 100 percent correctness in verified policy generation across four LLMs, up to 88 percent decision accuracy and a 0.79 F1-score with DeepSeek-V3, and near-flat policy-matching latency as the library grows from 50 to 500 policies.

Load-bearing premise

The load-bearing premise is that ordinary English conditions in a policy can be converted automatically into formal logic that the conflict checker can reason over; if that translation requires a hidden human step, the claimed conflict detection and 'no conflicts' guarantee are not actually delivered.

Editorial extensions

If this is right

  • If the reported 100 percent verified-generation result holds, device owners and security staff can author policies directly in natural language and review the structured output before it is stored.
  • Because policy-matching latency stays nearly flat from 50 to 500 policies, the retrieval stage should not become the bottleneck as smart-home policy libraries grow.
  • The OPA decision check gives the system a way to catch and re-prompt an incorrect LLM decision before it is enforced, which is the mechanism the authors rely on to bound probabilistic errors.
  • Routing simple requests to rule-based evaluation and reserving the LLM for context-rich cases means most requests stay fast while ambiguous ones receive explainable decisions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit is applying the same pipeline to hospital or industrial IoT policy sets, where the required domain knowledge is less likely to be supplied by an LLM's general training.
  • The paper's conflict guarantees depend on conditions being expressible in the solver's logic, so a useful stress test would be to measure what fraction of LLM-extracted conditions actually survive translation into that logic without manual help.
  • An implicit consequence of the design is that access-control audit trails become pairs of human-readable explanations and formally checkable decisions, which could make IoT access reviews feasible for non-experts.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes LACE, a hybrid framework for IoT access control that translates natural-language policy descriptions into JSON-formatted access control policies, verifies them through an NLI-based correctness check and an SMT-based conflict check, then answers access requests using embedding-based retrieval, LLM-based reasoning, and OPA-based decision checking. The evaluation reports 100% verified policy-generation accuracy across four LLMs and up to 88% decision accuracy with 0.79 F1-score using DeepSeek-V3, together with scalability experiments on policy volume and concurrency.

Significance. If the two verification layers (NLI correctness and SMT conflict detection) were fully specified and independently evaluated, LACE would be a useful step toward practical natural-language-driven access control with formal guardrails. The paper's strengths include a clear modular architecture, an evaluation spanning several LLMs and embedding models, a manually annotated 1000-request decision dataset, and latency measurements under varying load. However, the central 'verified' and 'conflict-free' claims currently rest on an unspecified natural-language-to-logic conversion, and the correctness metric is partly circular because the verifier is itself an LLM-family model. The absence of released code and data further limits reproducibility.

major comments (5)
  1. [Section IV-A Step-II] The conflict definitions rely on set intersections and logical operations (e.g., SAT(C1 ∧ C2), C1 ⇒ C2) over policy tuple elements, but in the pipeline the elements S, R, A, and C are produced as natural-language strings (see Fig. 5, where conditions such as 'authenticate before changes outside of business hours' appear). The paper does not describe any translation from these strings to SMT-LIB formulas, any domain ontology or predicate mapping, or any independent validation of the translation. Consequently, the claimed Z3-based detection of effect, redundancy, and inconsistency conflicts, and the resulting 'no conflicts' guarantee, are unsupported as presented. The Monday/weekday and TV/multimedia-device example also requires commonsense knowledge that Z3 does not inherently contain.
  2. [Section IV-B Step-III] The OPA decision-checking step asserts that 'these policies encode the same logical constraints as those used in policy authoring but are compiled into a declarative, verifiable format,' yet the mechanism for compiling the natural-language-conditioned JSON policies into Rego policies is never described. Without this compilation, the claim that OPA formally verifies LLM decisions is another unsupported formalization step, and it is unclear how the OPA check avoids the same NL-to-logic gap as the conflict detector.
  3. [Section IV-A Step-II and Section V-B-1] The reported '100% final accuracy' (Table III) is based on an NLI model judging equivalence between reconstructed policy sentences and the original descriptions. Since the generator and the NLI verifier are both LLM-family models, the correctness measure is partly circular, and no independent human-annotation evaluation of the 500 generated policies is reported. Moreover, the mechanism by which 'incorrect or incomplete policies were detected and corrected' is not described, so it is unclear whether the final 1.00 reflects automatic correction, regeneration, or manual intervention.
  4. [Section IV-B and Section V-B-2] The end-to-end decision evaluation depends on free parameters that are not reported: the top-k retrieval size in Step-I of Section IV-B, the threshold that routes requests to the LLM rather than the rule engine, and the batch size in Figure 2(c). The paper also does not report how many of the 1000 requests were handled by the rule-based path versus the LLM path, making the latency and accuracy results difficult to interpret or replicate.
  5. [Section V-B-1 and Section V-A] The construction of the evaluation set is underspecified: the 500 policy descriptions mix 300 entries from an existing dataset and 200 LLM-generated policies, but the paper does not state how the LLM-generated entries were validated before use, how raw accuracy (Acc(Raw)) was measured, or what the distribution of conflict types was. Without this information, the policy-generation results are hard to reproduce, especially because the dataset is not released.
minor comments (6)
  1. [Section IV-A Step-II] In the tuple definition, the sentence 'R is the set of resources. R is the set of actions' appears to contain a typo; the second set should be A for actions.
  2. [Section V-A] The sentence 'Dataset We initially constructed an access control policy dataset...' has a formatting issue; please add a period or otherwise separate the subsection heading text from the body.
  3. [Table III] The terms Acc(Raw) and Acc(Final) are not defined in the text; please define them in the caption or in the surrounding paragraph.
  4. [Section III-A] The example JSON conditions use boolean expressions such as 'time >= 18:00', while later examples in Figure 5 use natural-language phrases. Please state explicitly which condition forms are expected as LLM output, since this directly affects the downstream SMT and OPA steps.
  5. [Figure 3] The sentence 'divided into two main processes that in that involve a homeowner and a guest' contains a grammatical error; please remove 'that in that'.
  6. [Table VII] The symbols used in the comparison table (checkmarks and percentages) are not explained in the caption or in the text; please add a legend.

Circularity Check

1 steps flagged · score 6.0 of 10

The headline 100% verified policy-generation correctness is self-definitional: the NLI verifier both defines and adjudicates correctness, so the final accuracy figure reduces to the verifier accepting its own corrected outputs.

  1. self definitional [Section IV-A (Step-II) and Section V-B1 (RQ1, Table III)]
    "Correctness means that the meaning represented by the access control policy must be semantically consistent with the original access control description... we employ an advanced AI model specialized in natural language inference (NLI) to perform semantic similarity judgments between the reconstructed sentences and the original access control descriptions. ... After applying the policy verification module, all incorrect or incomplete policies were detected and corrected, resulting in 100% final accuracy across all models."

    The paper defines policy correctness as semantic consistency with the original description and then uses the NLI module as the arbiter of that consistency. Acc(Final) is reported after this same module has filtered and corrected the policies, so any policy counted as correct is, by construction, one the NLI module accepted. No independent human-labeled ground truth for policy-generation correctness is described in RQ1; the 100% figure therefore reflects the verifier agreeing with the corrected output rather than an externally measured correctness rate. The raw-accuracy column is also not tied to a stated external oracle, so the only operational correctness signal in the pipeline is the verifier's own judgment.

full rationale

The central circularity is confined to the policy-generation correctness claim. Because correctness is defined as semantic consistency, and the NLI verifier is the device that judges that consistency, the '100% final accuracy' result is forced by the evaluation setup rather than established against an independent standard. This is a genuine self-definitional reduction of the headline claim. The decision-accuracy evaluation is materially different: the 1000-request decision dataset is 'manually annotated to indicate whether the request would be allowed or denied,' so the 88% accuracy and 0.79 F1-score are measured against human ground truth and are not circular. No load-bearing self-citation or imported uniqueness theorem appears in the paper; citations to prior work by the co-authors are in related-work comparisons and are not used to justify the framework's core claims. A separate correctness risk, not a demonstrated circularity, is that Section IV-A's SAT-based conflict detection requires formalized conditions, but the generated policies shown in Fig. 5 carry natural-language condition strings such as 'authenticate before changes outside of business hours' and 'parental consent between 7 AM and 9 PM'; the paper never specifies a condition-to-SMT translation, so the Z3-based 'no conflicts' guarantee is underspecified. That gap weakens the formal-validation claim but does not by itself reduce a prediction to an input, so it is noted here rather than scored as an additional circular step. Overall, the paper has substantial independent content in the human-annotated decision evaluation, but its flagship 100% verified-policy-correctness result reduces by construction to the verifier's own acceptance.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entity is introduced. The framework is an orchestration of existing components (LLMs, embeddings, SMT, OPA), so the ledger contains only modeling assumptions about representation and verification.

free parameters (2)
  • top-k retrieval size = not reported
    The number of policies retrieved per access request is a hand-chosen hyperparameter that directly affects decision accuracy and latency; no sensitivity analysis is provided.
  • LLM invocation threshold = not reported
    LACE decides between rule-based and LLM-based paths using an unspecified complexity threshold; this threshold changes the accuracy/latency trade-off reported in RQ3.
assumptions (5)
  • domain assumption Natural-language access control descriptions can be faithfully mapped to the fixed JSON schema {subject, resource, action, effect, conditions}.
    The whole pipeline (Prompt A, Section IV-A) assumes all relevant policy semantics, including context and conditions, are expressible in this structured format.
  • domain assumption Semantic equivalence between a generated policy and the original description can be determined by reconstructing a sentence and using an NLI model.
    Section IV-A Step-II: correctness verification relies on an AI NLI model judging reconstructed sentences. The 100% final accuracy depends on this verifier being right.
  • ad hoc to paper Natural-language conditions can be automatically encoded as logical formulas for SMT-based conflict detection.
    Section IV-A Step-II claims Z3 detects conflicts by encoding policy tuples, but no encoding of free-text conditions such as 'authenticate before changes outside of business hours' is described, so the formalism is not yet operational.
  • domain assumption OPA Rego policies encode the same logical constraints as the JSON policies, making OPA a meaningful formal verifier of LLM decisions.
    Section IV-B Step-III states OPA 'reevaluates the request using its formal evaluation pipeline', but the paper never specifies how Rego policies are derived from the JSON policies.
  • domain assumption The 200 LLM-generated policies and 1000 manually annotated requests are representative of realistic smart-home access-control scenarios.
    Section V-A: the dataset is constructed using LLMs and reuse of an existing dataset, but no distribution, sampling strategy, or inter-annotator agreement is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things." pith.science (2026). https://pith.science/paper/Z3Z6QH37

@misc{pith2026250523835,
  author       = {Pith},
  title        = {Pith review of: Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z3Z6QH37}},
  note         = {Machine review of arXiv:2505.23835}
}
read the original abstract

Access control in the Internet of Things (IoT) is becoming increasingly complex, as policies must account for dynamic and contextual factors such as time, location, user behavior, and environmental conditions. However, existing platforms either offer only coarse-grained controls or rely on rigid rule matching, making them ill-suited for semantically rich or ambiguous access scenarios. Moreover, the policy authoring process remains fragmented: domain experts describe requirements in natural language, but developers must manually translate them into code, introducing semantic gaps and potential misconfiguration. In this work, we present LACE, the Language-based Access Control Engine, a hybrid framework that leverages large language models (LLMs) to bridge the gap between human intent and machine-enforceable logic. LACE combines prompt-guided policy generation, retrieval-augmented reasoning, and formal validation to support expressive, interpretable, and verifiable access control. It enables users to specify policies in natural language, automatically translates them into structured rules, validates semantic correctness, and makes access decisions using a hybrid LLM-rule-based engine. We evaluate LACE in smart home environments through extensive experiments. LACE achieves 100% correctness in verified policy generation and up to 88% decision accuracy with 0.79 F1-score using DeepSeek-V3, outperforming baselines such as GPT-3.5 and Gemini. The system also demonstrates strong scalability under increasing policy volume and request concurrency. Our results highlight LACE's potential to enable secure, flexible, and user-friendly access control across real-world IoT platforms.

Figures

Figures reproduced from arXiv: 2505.23835 by the authors.

Figure 1
Figure 1. The architecture of LACE. TABLE I PROMPT A: ACCESS CONTROL POLICY GENERATION Elements Contents Instruction You are a security expert, please convert the natural language described access control description provided by the Input data into formalized access control poli￾cies based on the Context. Context Basic backgrounds: 1. An Access control policy typically encompasses Subject, Resource, Action, Effect, and Condit… view at source ↗
Figure 2
Figure 2. Time cost analysis for different components in [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. LACE Assisted Smart Home [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Some access control policies generated by [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. LIFT: Automating Symbolic Execution Optimization with Large Language Models for AI Networks

    cs.CR 2025-07 conditional novelty 5.0 of 10

    LIFT uses GPT-4o to rewrite VEX IR statements in angr, reducing symbolic execution time and IR complexity on ten test binaries with claimed semantic preservation.

Reference graph

Works this paper leans on

46 extracted references · 34 canonical work pages · cited by 1 Pith paper

  1. [1]

    Apple. Homekit. [Online]. Available: https://www.apple.com/tv-home/

    work page

  2. [2]

    Xiaomi. Mi home. [Online]. Available: https://home.mi.com

    work page

  3. [3]

    Smartthings

    Samsung. Smartthings. [Online]. Available: https://www.samsung.com/ us/smartthings/

    work page

  4. [4]

    A. Cloud. Alibaba cloud iot. [Online]. Available: https://iot.aliyun.com

    work page

  5. [5]

    Amazon. Aws iot. [Online]. Available: https://aws.amazon.com/iot/ ?nc1=h ls

    work page

  6. [6]

    Azure iot

    Microsoft. Azure iot. [Online]. Available: https://azure.microsoft.com/ en-us/solutions/iot

    work page

  7. [7]

    Access control in the internet of things: Big challenges and new opportunities,

    A. Ouaddah, H. Mousannif, A. Abou Elkalam, and A. Ait Ouahman, “Access control in the internet of things: Big challenges and new opportunities,” Computer networks, vol. 112, pp. 237–262, 2017

    work page 2017

  8. [8]

    Mandatory access control and role-based access control revisited,

    S. Osborn, “Mandatory access control and role-based access control revisited,” in Proceedings of the second ACM workshop on Role-based access control, 1997, pp. 31–40

    work page 1997

Show all 46 references
  1. [9]

    Role-based access control,

    R. S. Sandhu, “Role-based access control,” in Advances in computers . Elsevier, 1998, vol. 46, pp. 237–286

    1998

  2. [10]

    Attribute-based access control,

    V . C. Hu, D. R. Kuhn, D. F. Ferraiolo, and J. V oas, “Attribute-based access control,” Computer, vol. 48, no. 2, pp. 85–88, 2015

    2015

  3. [11]

    A survey of context-aware access control mechanisms for cloud and fog networks: Taxonomy and open research issues,

    A. Kayes, R. Kalaria, I. H. Sarker, M. S. Islam, P. A. Watters, A. Ng, M. Hammoudeh, S. Badsha, and I. Kumara, “A survey of context-aware access control mechanisms for cloud and fog networks: Taxonomy and open research issues,” Sensors, vol. 20, no. 9, p. 2464, 2020

    2020

  4. [12]

    A survey of large language models,

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y . Hou, Y . Min, B. Zhang, J. Zhang, Z. Dong, Y . Du, C. Yang, Y . Chen, Z. Chen, J. Jiang, R. Ren, Y . Li, X. Tang, Z. Liu, P. Liu, J.-Y . Nie, and J.-R. Wen, “A survey of large language models,” 2024. [Online]. Available: https:...

    2024 arXiv

  5. [13]

    Chain-of-thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V . Le, D. Zhou et al. , “Chain-of-thought prompting elicits reasoning in large language models,” Advances in neural information processing systems , vol. 35, pp. 24 824–24 837, 2022

    2022

  6. [14]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschel et al. , “Retrieval- augmented generation for knowledge-intensive nlp tasks,” Advances in neural information processing systems , vol. 33, pp. 9459–9474, 2020

    2020

  7. [15]

    Retrieval-augmented generation for large language models: A survey,

    Y . Gao, Y . Xiong, X. Gao, K. Jia, J. Pan, Y . Bi, Y . Dai, J. Sun, H. Wang, and H. Wang, “Retrieval-augmented generation for large language models: A survey,” arXiv preprint arXiv:2312.10997 , vol. 2, p. 1, 2023

    2023 arXiv

  8. [16]

    O. P. Agent. Opa. [Online]. Available: https://www.openpolicyagent.org

  9. [17]

    Ai-powered policy management: Implementing open policy agent (opa) with intelligent agents in kuber- netes,

    R. Vadisetty, A. Polamarasetti et al., “Ai-powered policy management: Implementing open policy agent (opa) with intelligent agents in kuber- netes,” Cuestiones de Fisioterapia , vol. 54, no. 5, pp. 19–27, 2025

    2025

  10. [18]

    Amazon web services cloud compliance automation with open policy agent,

    A. Paul, R. Manoj, and U. S, “Amazon web services cloud compliance automation with open policy agent,” in 2024 International Conference on Expert Clouds and Applications (ICOECA) , 2024, pp. 313–317

    2024

  11. [19]

    Identity control plane: The unifying layer for zero trust infrastructure,

    S. T. Avirneni, “Identity control plane: The unifying layer for zero trust infrastructure,” 2025. [Online]. Available: https://arxiv.org/abs/ 2504.17759

    2025 arXiv

  12. [20]

    Intent-aware authorization for zero trust ci/cd,

    ——, “Intent-aware authorization for zero trust ci/cd,” 2025. [Online]. Available: https://arxiv.org/abs/2504.14777

    2025 arXiv

  13. [21]

    The Stanford CoreNLP natural language processing toolkit,

    C. Manning, M. Surdeanu, J. Bauer, J. Finkel, S. Bethard, and D. McClosky, “The Stanford CoreNLP natural language processing toolkit,” in Proceedings of 52nd Annual Meeting of the Association for Computational Linguistics: System Demonstrations , K. Bontcheva and J. Zhu, Eds. ...

    2014

  14. [22]

    Sentence-bert: Sentence embeddings using siamese bert-networks,

    N. Reimers and I. Gurevych, “Sentence-bert: Sentence embeddings using siamese bert-networks,” 2019. [Online]. Available: https: //arxiv.org/abs/1908.10084

    2019 arXiv

  15. [23]

    The faiss library,

    M. Douze, A. Guzhva, C. Deng, J. Johnson, G. Szilvasy, P.-E. Mazar ´e, M. Lomeli, L. Hosseini, and H. J ´egou, “The faiss library,” 2025. [Online]. Available: https://arxiv.org/abs/2401.08281

    2025 arXiv

  16. [24]

    Ra- gent: Retrieval-based access control policy generation,

    S. H. Jayasundara, N. A. G. Arachchilage, and G. Russello, “Ra- gent: Retrieval-based access control policy generation,” arXiv preprint arXiv:2409.07489, 2024

    2024 arXiv

  17. [25]

    Transformers

    S. Transformers. all-minilm-l6-v2. [Online]. Available: https: //huggingface.co/sentence-transformers/all-MiniLM-L6-v2

  18. [26]

    C-pack: Packaged resources to advance general chinese embedding,

    S. Xiao, Z. Liu, P. Zhang, and N. Muennighoff, “C-pack: Packaged resources to advance general chinese embedding,” 2023

    2023

  19. [27]

    Transformers

    S. Transformers. all-distilroberta-v1. [Online]. Available: https:// huggingface.co/sentence-transformers/all-distilroberta-v1

  20. [28]

    Text embeddings by weakly-supervised contrastive pre- training,

    L. Wang, N. Yang, X. Huang, B. Jiao, L. Yang, D. Jiang, R. Majumder, and F. Wei, “Text embeddings by weakly-supervised contrastive pre- training,” arXiv preprint arXiv:2212.03533 , 2022

    2022 arXiv

  21. [29]

    A. C. C. C. Ltd. qwen-plus. [Online]. Available: https://bailian.console. aliyun.com/?tab=model#/model-market/detail/qwen-plus

  22. [30]

    qwen-turbo

    ——. qwen-turbo. [Online]. Available: https://bailian.console.aliyun. com/?tab=model#/model-market/detail/qwen-turbo

  23. [31]

    deepseek-v3

    DeepSeek. deepseek-v3. [Online]. Available: https://platform.deepseek. com/usage

  24. [32]

    Llama3.3

    Meta. Llama3.3. [Online]. Available: https://bailian.console.aliyun.com/ ?tab=model#/model-market/detail/llama3.3-70b-instruct

  25. [33]

    Gpt-3.5 turbo

    OpenAI. Gpt-3.5 turbo. [Online]. Available: https://openai.com/index/ gpt-3-5-turbo-fine-tuning-and-api-updates/

  26. [34]

    gemini-2.0-flash

    Google. gemini-2.0-flash. [Online]. Available: https://ai.google.dev/ gemini-api/docs/models#gemini-2.0-flash

  27. [35]

    Attribute- based access control scheme in federated iot platforms,

    S. Sciancalepore, M. Pilc, S. Schr ¨oder, G. Bianchi, G. Boggia, M. Pawłowski, G. Piro, M. Pł ´ociennik, and H. Weisgrab, “Attribute- based access control scheme in federated iot platforms,” in International Workshop on Interoperability and Open-Source Solutions . Springer, 20...

    2016

  28. [36]

    Smart contract- based access control for the internet of things,

    Y . Zhang, S. Kasahara, Y . Shen, X. Jiang, and J. Wan, “Smart contract- based access control for the internet of things,” IEEE Internet of Things Journal, vol. 6, no. 2, pp. 1594–1605, 2019

    2019

  29. [37]

    Privacy- preserving bilateral fine-grained access control for cloud-enabled in- dustrial iot healthcare,

    J. Sun, Y . Yuan, M. Tang, X. Cheng, X. Nie, and M. U. Aftab, “Privacy- preserving bilateral fine-grained access control for cloud-enabled in- dustrial iot healthcare,” IEEE Transactions on Industrial Informatics , vol. 18, no. 9, pp. 6483–6493, 2022

    2022

  30. [38]

    Context- aware adaptive remote access for iot applications,

    A. Arfaoui, S. Cherkaoui, A. Kribeche, and S. M. Senouci, “Context- aware adaptive remote access for iot applications,” IEEE Internet of Things Journal, vol. 7, no. 1, pp. 786–799, 2020

    2020

  31. [39]

    Sc-caac: A smart-contract-based context- aware access control scheme for blockchain-enabled iot systems,

    M. M. Merlec and H. P. In, “Sc-caac: A smart-contract-based context- aware access control scheme for blockchain-enabled iot systems,” IEEE Internet of Things Journal , vol. 11, no. 11, pp. 19 866–19 881, 2024

    2024

  32. [40]

    Context- aware policy enforcement for paas-enabled access control,

    Y . Verginadis, I. Patiniotakis, P. Gouvas, S. Mantzouratos, S. Veloudis, S. T. Schork, L. Seitzluwig, I. Paraskakis, and G. Mentzas, “Context- aware policy enforcement for paas-enabled access control,” IEEE Trans- actions on Cloud Computing , vol. 10, no. 1, pp. 276–291, 2022

    2022

  33. [41]

    Context sensitive access control in smart home environments,

    S. Dutta, S. S. L. Chukkapalli, M. Sulgekar, S. Krithivasan, P. K. Das, and A. Joshi, “Context sensitive access control in smart home environments,” in 2020 IEEE 6th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and S...

    2020

  34. [42]

    Intent-based access control: Using llms to intelligently manage access control,

    P. Subramaniam and S. Krishnan, “Intent-based access control: Using llms to intelligently manage access control,” 2024. [Online]. Available: https://arxiv.org/abs/2402.07332

    2024 arXiv

  35. [43]

    Lmn: A tool for generating machine enforceable policies from natural language access control rules using llms,

    P. Sonune, R. Rai, S. Sural, V . Atluri, and A. Kundu, “Lmn: A tool for generating machine enforceable policies from natural language access control rules using llms,” 2025. [Online]. Available: https://arxiv.org/abs/2502.12460

    2025

  36. [44]

    Synthesizing access control policies using large language models,

    A. Vatsa, P. Patel, and W. Eiers, “Synthesizing access control policies using large language models,” 2025. [Online]. Available: https://arxiv.org/abs/2503.11573 14

    2025 arXiv

  37. [45]

    iconpal: Llm-guided policy authoring assistant for configuring iot defenses,

    M. Alam, S. Zhang, E. Rodriguez, A. Nafis, and E. Hoque, “iconpal: Llm-guided policy authoring assistant for configuring iot defenses,” in 2024 IEEE Secure Development Conference (SecDev) , 2024, pp. 76–92. Ye Cheng received his bachelor’s degree in mechan- ical engineering fr...

    2024

  38. [2020]

    Her research focuses on blockchain computing, security and privacy, and Internet of Things

    Currently she is a professor of computer sci- ence at Shandong University, Qingdao, China. Her research focuses on blockchain computing, security and privacy, and Internet of Things. She is a Fellow of IEEE, a Fellow of CSEE, and a Fellow of AAIA

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.