G-CTR: Game-Theoretic Guidance for LLM Pen Testing

• The paper introduces G-CTR, a lightweight game-theoretic guidance layer that extracts attack graphs and computes Nash equilibria within milliseconds.
• G-CTR leverages a three-phase pipeline—graph extraction, equilibrium computation, and digest integration—to anchor LLM decisions with tactical insights.
• Empirical benchmarks show up to 2.67× faster success times and 23× lower costs, highlighting significant improvements in strategic effectiveness.

Generative Cut-the-Rope (G-CTR) is a lightweight game-theoretic guidance layer designed to augment LLM-driven penetration-testing agents with machine-level strategic reasoning and reproducible performance. The system automatically extracts attack graphs from the agent's log context, computes Nash equilibria reflecting both attacker and defender strategies with effort-aware edge scoring, and feeds a concise digest of tactical guidance into the agent's prompt loop. By continuously closing this loop—agent generates graph, G-CTR analyzes, agent re-plans under guidance—the system reduces ambiguity, suppresses hallucinations, and anchors the model’s actions to statistically promising paths. Empirical results demonstrate substantial gains in success rate, consistency, and cost-efficiency, matching expert structure 70–90% of the time but at vastly increased speed and lower cost (Mayoral-Vilches et al., 9 Jan 2026).

1. System Architecture and Workflow

The G-CTR pipeline consists of three primary phases, executed at regular intervals (typically every ~80 tool calls or ~20 seconds):

Phase 1 (Game-Theoretic Analysis):

The agent’s log (ℓ), consisting of a sequence of J messages, is processed by an LLM to extract a structured attack graph $G = (V, E)$. NetworkX is employed to enforce acyclic paths and prune leaf nodes. The attack graph is represented with a merged root entry node $v_{entry}$ and vulnerable leaf nodes. G-CTR computes a Nash equilibrium over the graph—typically within $\ll 5$ ms overhead—informing optimal inspection strategies for defenders and attack paths for adversaries.

Phase 2 (Digest Generation):

Equilibrium outputs—defender mixed strategy $\sigma_d^*$, attacker’s probability-weighted paths, and overall success probability $u^*$—are summarized in a digest using either algorithmic or LLM-based methods.

• Algorithmic mode uses rule-based templates to mark bottlenecks ($p < 0.95$) and high-risk transitions ($p > 0.90$), with digest generation under 10 ms.
• LLM mode sends a 350-word structured prompt to an LLM ("alias1"), generating lingustically rich summaries in $\approx 28$ s. Fallback to algorithmic occurs on API failure.

Phase 3 (Agent Execution):

The digest is prepended to the agent's system prompt. Subsequent action selection (ReAct framework) is performed with both tool outputs and G-CTR-derived strategic hints, iteratively updating $G$ until a termination condition is met (flag discovery or step limit) (Mayoral-Vilches et al., 9 Jan 2026).

2. Formal Game-Theoretic Model

G-CTR models attack graphs as directed acyclic graphs $G = (V, E)$, where each edge $v_{entry}$0 is assigned an effort score:

$v_{entry}$1

with

• $v_{entry}$2 (message distance)
• $v_{entry}$3 (token count)
• $v_{entry}$4 (estimated cost)

$v_{entry}$5 quantifies attacker effort; higher values indicate greater difficulty traversing the edge.

Defender’s expected detection probability (inspecting distribution $v_{entry}$6 over nodes $v_{entry}$7) is:

$v_{entry}$8

where $v_{entry}$9 and $\ll 5$0 (edges per defender inspection window). The attacker’s success is $\ll 5$1.

The Nash equilibrium is computed by solving the zero-sum minimax:

$\ll 5$2

or equivalently, by numerically minimizing $\ll 5$3:

$\ll 5$4

3. Attack Graph Extraction and Heuristics

Extraction proceeds via the following steps:

1. Merge entry points: All nodes with minimal message_id are consolidated into the single root $\ll 5$5.
2. Prune cycles: Acyclicity enforced via NetworkX all_simple_paths; cycles are removed.
3. Remove non-vulnerable leaves: Non-vulnerable leaves are recursively pruned.
4. Enforce leaf vulnerabilities: Artificial leaf nodes (“leaf_X”) are attached to all vulnerable nodes, each with $\ll 5$6.
5. Reconnect components: Components are reconnected to root, and incoming edges to root are removed.
6. Node-count bounds: Node count is set as a piecewise percentage of $\ll 5$7 (message sequence length):
   • Short ($\ll 5$8 msgs): $\ll 5$9–$\sigma_d^*$0 of $\sigma_d^*$1
   • Medium ($\sigma_d^*$2–$\sigma_d^*$3): $\sigma_d^*$4–$\sigma_d^*$5
   • Long ($\sigma_d^*$6): $\sigma_d^*$7–$\sigma_d^*$8 with hard bounds at $\sigma_d^*$9 total nodes.

This approach enables efficient graph extraction, balancing computational tractability with faithful representation of agent reasoning (Mayoral-Vilches et al., 9 Jan 2026).

4. Equilibrium Computation and Digest Integration

G-CTR employs the following pseudocode for Nash equilibrium computation, using precomputed Poisson probabilities and a linear program:

$\approx 28$3

Digest generation employs algorithmic or LLM-based summarization, with thresholds for bottlenecks ($u^*$0) and high-risk transitions ($u^*$1):

$\approx 28$4

Digest is injected directly into the agent’s system prompt: $\approx 28$5 This prompt replacement anchors subsequent LLM outputs to the strategic guidance (Mayoral-Vilches et al., 9 Jan 2026).

5. Empirical Performance and Quantitative Benchmarks

G-CTR demonstrates significant improvements in speed, cost, and agent effectiveness across multiple testbeds:

Attack-Graph Generation vs. Human Experts:

• Node correspondence: $u^*$2–$u^*$3 match to expert graphs (five domains).
• Time: LLMs $u^*$4–$u^*$5 s versus human $u^*$6–$u^*$7 min ($u^*$8–$u^*$9 faster).
• Cost: $p < 0.95$00.05$p < 0.95$1\$p < 0.95$2 (API) versus $p < 0.95$322.5$p < 0.95$4\$p < 0.95$5 (human) ($p < 0.95$6–$p < 0.95$7 cheaper).
• Equilibrium overhead: $p < 0.95$8 ms per run.</li> </ul> <p><strong>Shellshock CVE-2014-6271 Cyber-Range (44 runs):</strong></p> <div class='overflow-x-auto max-w-full my-4'><table class='table border-collapse w-full' style='table-layout: fixed'><thead><tr> <th>Mode</th> <th>Success Rate</th> <th>Avg Duration</th> <th>Tool-use Variance</th> <th>Cost/Succ</th> </tr> </thead><tbody><tr> <td>No G-CTR</td> <td>13.3% (2/15)</td> <td>16.7 min</td> <td>1.6×</td> <td>\$2.71 G-CTR Algorithmic 20.0% (3/15) 22.5 min 6.2× \$0.32 G-CTR LLM 42.9% (6/14) 20.2 min 1.2× \$0.12

• Expected time to success $p < 0.95$9: $p > 0.90$0 min $p > 0.90$1 min ($p > 0.90$2 faster).
• Cost per success: $p > 0.90$32.71 \rightarrow \$p > 0.90$4 ($p > 0.90$5 cheaper).
• Variance reduction: $p > 0.90$6 ($p > 0.90$7 lower).

Attack-and-Defense CTFs (25 matches each):

Team Configuration	Cowsay Win%	Loss%	Pingpong Win%	Loss%
No G-CTR (baseline)	28.6	52.4	28.6	52.4
Red G-CTR (attacker only)	33.3	42.9	19.0	61.9
Blue G-CTR (defense only)	57.1	28.6	25.0	75.0*
Purple G-CTR (dual, sep)	52.9	23.5	13.6	86.4
Purple G-CTRₘₑᵣgₑd (shared)	55.0	15.0	52.4	28.6

Sharing a single G-CTR graph (Purple merged) achieves best outcomes: $p > 0.90$8 win over baseline, $p > 0.90$9 over separate dual-guided teams (Mayoral-Vilches et al., 9 Jan 2026).

6. Strategic Impact: Search Collapse and Hallucination Suppression

Closed-loop integration of game-theoretic equilibrium insights fundamentally constrains the LLM’s reasoning space. By providing a continuous external equilibrium signal, G-CTR anchors action selection to statistically valid paths and choke points. This re-anchoring yields:

• $\approx 28$0 reduction in tool-use variance
• $\approx 28$1 increase in success rates beyond raw LLM action selection
• Dramatic reduction in “hallucinated” actions—irrelevant or dead-end behaviors

This suggests closed-loop guidance is essential for superintelligent cybersecurity agents, providing machine-scale reproducibility that approaches human strategic intuition (Mayoral-Vilches et al., 9 Jan 2026).

7. Limitations and Future Directions

Several inherent limitations define current G-CTR deployments:

• Graph-size and complexity bounds employ heuristics; adaptive or domain-specific tuning could further improve fidelity.
• Prompting strategies remain ad hoc; targeted prompt engineering might enhance both extraction and summarization quality.
• Existing graphs (6–15 nodes for CTFs) may be too coarse for large-scale enterprise networks, motivating hierarchical or multi-scale representations.
• Equilibrium solvers scale efficiently to $\approx 28$2 nodes, but larger graphs could require approximations or Monte Carlo algorithms.
• Future work targets dynamic LLM temperature schedules (balancing creativity and control), adversarial robustness against poisoned logs, and integration with probabilistic vulnerability databases (e.g., CVSS alongside effort scores).

A plausible implication is that ongoing advances in adaptive graph construction, scalable equilibrium computation, and robust prompting will further expand G-CTR’s domain applicability and strategic capabilities.