category: training · status: draft · updated: 2026-11-02

The Purple Loop — When the Attacker Trains the Defender

Every AI-for-security effort in 2026 is one-sided. Red-side projects teach models to find and exploit bugs; blue-side benchmarks measure how badly LLMs do at triage. Nobody has closed the loop: an attacker whose reward depends on a defender's blindness, and a defender whose reward depends on the attacker's visibility — trained against each other in the same lab, graded by the same ground truth. That loop is the purple loop, and it's the white space we claim (see [[landscape-2026]]).

The mechanism

One cycle, six steps:

  1. Execute. An attacker agent (or a scripted Atomic Red Team test) runs a real MITRE ATT&CK technique inside a lab container — Windows with Sysmon installed, or Linux with auditd.
  2. Capture. The endpoint sensor (Sysmon operational log, auditd rules) records what the technique actually looked like: process creations, file writes, network calls, process-access events. This is attack telemetry with exact ground truth — we know which log lines are ours because we made them.
  3. Dilute. Inject those lines into a benign corpus at 20–50x noise ratio. The base is BOTSv3, Splunk's Boss of the SOC v3 dataset, distributed under CC0-based licenses — real enterprise Windows telemetry, legally clean. Timestamps and hostnames are randomized per run so nothing can be memorized.
  4. Triage. A defender agent gets the blended log (as DuckDB-queryable tables, like Simbian's setup) and a bounded query budget — say 50 queries. It must find the campaign and write a Sigma rule that detects it.
  5. Grade. pySigma first checks the rule compiles and converts to a backend (SPL, Lucene…). Then we replay it against (a) the attack-spiked corpus and (b) pure-benign slices. Because we know every injected event, precision and recall against ground truth are computed, not judged.
  6. Improve both. High-F1 defender trajectories are kept as verified training data. The attacker gets the mirror signal: survival reward = 1 − F1 of the best rule it couldn't evade. Run thousands of cycles; both sides climb.

The key property is step 5. Sigma-rule quality is programmatically gradeable — compile check, precision, recall, false-positive rate on clean noise. That's an RLVR-grade verifier with no LLM judge in the loop, the same "grade execution, not claims" stance Novee uses on the red side, ported to blue.

Worked example: ATT&CK T1003

T1003 is OS Credential Dumping; the canonical sub-technique, T1003.001, is LSASS memory dumping (ATT&CK page).


title: LSASS dump via comsvcs MiniDump
logsource: {product: windows, service: sysmon}
detection:
    selection:
        EventID: 10
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess: ['0x1010', '0x1410']
    condition: selection

Why nobody has shipped it

Factory tie-in

The purple loop is a fleet component (Stream D) and a trajectory source for both model variants we ship from Qwen3.8-27B/35B-A3B bases. Weekly refresh re-seeds dilution ratios, placements, and benign slices, so the pair can't overfit a fixed mixture — the same contamination defense CTFusion demands. Every kept cycle emits two artifacts we publish: an attack trajectory with known telemetry footprint, and a compiled, precision/recall-graded Sigma rule. Nobody else sells either; [[bugcrowd-rl-environments]] names trajectories as an internal hard problem and doesn't ship them.

One honest caveat: co-evolution can collapse into an arms race over one or two techniques. We cap it the boring way — breadth-first scheduling across the ATT&CK technique matrix, so the loop spins on T1003 this week and on persistence or exfil chains the next, and eval coverage stays wide.

See also

[[capability-ladders]] · [[cpt-lora-and-forgetting]] · [[landscape-2026]] · [[cyberfactory-openaegis]] · [[index]]