Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts

arXiv:2607.08292 · cs.CR, cs.AI · Submitted 2026-07-09 · Read on arXiv

Lea Roxanne Muth, Marian Margraf

cs.CR, cs.AI

Submitted: 2026-07-09

Comments: Accepted for publication at the 2026 IEEE International Conference on Computer, Information and Telecommunication Systems (IEEE CITS), Piraeus-Athens, Greece, July 22-24, 2026. 8 pages, 1 figure

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Ontology — 25× in this paper · explained in 2 episodes
• Verification — 19× in this paper · explained in 2 episodes
• Knowledge Graph — 12× in this paper · explained in 7 episodes
• F1 Score — 7× in this paper · explained in 3 episodes
• RAG — 7× in this paper · explained in 3 episodes
• Accuracy — 5× in this paper · explained in 1 episode
• Alignment — 5× in this paper · explained in 1 episode
• Hallucination — 5× in this paper · explained in 3 episodes
• Open Security Controls Assessment Language — 5× in this paper
• Consistency — 4× in this paper · explained in 3 episodes
• Robustness — 4× in this paper · explained in 5 episodes
• Benchmark — 3× in this paper · explained in 2 episodes
• Fidelity — 3× in this paper · explained in 2 episodes
• Knowledge graphs — 3× in this paper · explained in 2 episodes
• Benchmarking — 2× in this paper · explained in 3 episodes
• Cognitive Load — 2× in this paper · explained in 2 episodes
• Data Sovereignty — 2× in this paper · explained in 2 episodes
• Human-in-the-Loop — 2× in this paper · explained in 3 episodes
• Multi-Agent System — 2× in this paper · explained in 6 episodes
• National Institute of Standards and Technology — 2× in this paper
• Provenance — 2× in this paper · explained in 4 episodes
• Accountability — 1× in this paper · explained in 2 episodes
• Adaptation — 1× in this paper · explained in 1 episode
• Assessment Results — 1× in this paper
• Clustering — 1× in this paper · explained in 2 episodes
• Core — 1× in this paper · explained in 2 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Downstream Tasks — 1× in this paper · explained in 2 episodes
• Error Taxonomy — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• Graph Construction — 1× in this paper · explained in 3 episodes
• Hybrid Architectures — 1× in this paper · explained in 3 episodes
• LLMs with Satisfiability Modulo Theories — 1× in this paper
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Natural Language Processing — 1× in this paper
• SMT solver — 1× in this paper · explained in 2 episodes
• Structural Integrity — 1× in this paper · explained in 3 episodes

Sources

• ComplianceNLP: Knowledge-Graph-Augmented RAG for Multi-Framework Regulatory Gap Detection
• COMPL-AI Framework: A Technical Interpretation and LLM Benchmarking Suite for the EU Artificial Intelligence Act
• Bench-2-CoP: Can We Trust Benchmarking for EU AI Compliance?
• GraphCompliance: Aligning Policy and Context Graphs for LLM-Based Regulatory Compliance
• RAGulating Compliance: A Multi-Agent Knowledge Graph for Regulatory QA
• A Case Study for Compliance as Code with Graphs and Language Models: Public release of the Regulatory Knowledge Graph
• HybridRAG: Integrating Knowledge Graphs and Vector Retrieval Augmented Generation for Efficient Information Extraction

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs