Closing the Sim-to-Emulation Gap

Close the sim-to-emulation gap for autonomous cyber agents by addressing exploit-version mismatches, indirect or delayed observation of action outcomes, and non-deterministic service behavior in real environments.

Background

The paper evaluates transfer into NASim emulation as a proxy for real-world deployment, but recognizes that direct emulation introduces difficulties absent from abstract simulators. These include mismatches between the exploits modeled during training and the versions available in deployment, delayed or indirect feedback about whether actions succeeded, and non-deterministic behavior of live services.

The authors explicitly identify direct emulation as unresolved. Addressing this gap would extend the proposed representation-alignment framework beyond transfer among known simulators and toward reliable operation in realistic, partially observable cyber environments. The same conclusion also identifies evaluation on branching attack topologies as a related next step, but does not state that as a separate explicit open problem.