Security Calibration in Modern Systems

• Security calibration is a framework that aligns system confidence with true security outcomes through verifiable metrics and traceability.
• It spans multiple domains—including adversarial ML, autonomous agents, robotics, IoT, and quantum cryptography—to mitigate risks and enhance decision reliability.
• Integrating calibration into system design improves detection precision and robustness against adversarial manipulation while ensuring trustworthiness.

Searching arXiv for recent and relevant papers on security calibration and closely related uses of the term across ML, agents, robotics, IoT, and quantum security. arxiv_search(query="security calibration", max_results=10) {"query":"security calibration","max_results":10} Security calibration denotes a family of problems at the boundary between security, uncertainty, and system assurance. Across recent work, the term is used for at least four closely related purposes: aligning confidence with true security outcomes in machine learning; aligning an agent’s internal threat judgment with the actual maliciousness of instructions, tools, or contexts; securing the calibration infrastructure and traceability chains on which cyber-physical safety depends; and ensuring that calibration procedures themselves remain inside the assumptions of cryptographic security proofs (Obadinma et al., 2024, Li et al., 27 Apr 2026, Jain et al., 2011, Shah et al., 2019, Siddiq et al., 30 Jun 2026).

1. Scope and recurring meanings

The literature does not use “security calibration” as a single standardized term. Instead, it recurs in several technical settings with a shared concern: a system should not merely perform well, but should also know, prove, or verify when its outputs, confidence values, trust assignments, or measurement assumptions are security-valid. This suggests a common structure across otherwise distant areas such as adversarial ML, agent security, robotics, Industrial IoT, and quantum cryptography.

Domain	Calibration target	Representative papers
Cybersecurity scoring	Threat score $\rightarrow$ posterior probability	(Yousef et al., 2021)
Adversarial ML	Confidence without changing predicted labels	(Obadinma et al., 2024)
Autonomous agents	Recall–precision balance in threat judgment	(Li et al., 27 Apr 2026)
MCP tool use	Adaptive trust over tool metadata, outputs, and side effects	(Zhou et al., 15 Feb 2026)
Robotics and IIoT	Traceable, authenticated, non-repudiable calibration chains	(Shah, 2019, Shah et al., 2019)
Quantum cryptography	Calibration integrated into security proofs	(Ma et al., 2019, Zhang et al., 2019, Deng, 16 Jan 2026)
LLM-generated code and distillation	Confidence in code security; distillability as a safety/IP knob	(Siddiq et al., 30 Jun 2026, Zhan et al., 21 Apr 2026)

A useful distinction emerges between decision-layer calibration and infrastructure-layer calibration. In the first, the calibrated object is a probability, score, or trust state that guides action. In the second, the calibrated object is the physical or procedural substrate itself: detector timing, shot-noise normalization, phase-reference alignment, calibration certificates, or traceability to a root of trust.

2. Confidence calibration as a security property

In standard probabilistic terms, a model is calibrated when

$P(Y' = Y \mid P(Y' \mid X) = p) = p,$

so that predictions issued with confidence $p$ are correct with empirical frequency $p$ (Siddiq et al., 30 Jun 2026). In cybersecurity, this matters because many deployed systems emit arbitrary or vendor-specific scores rather than posterior probabilities. One explicit formulation treats calibration as learning a map

$$g:\mathbb{R}\to[0,1], \qquad g(s)\approx P(Y=1\mid S=s),$$

where $S=h(X)$ is a raw score and $Y=1$ denotes the malicious class; the same work extends this to multi-score calibration, where several detectors jointly produce a single posterior estimate on a common scale (Yousef et al., 2021).

The security significance of calibration becomes sharp in adversarial settings. “Calibration attacks” are adversarial attacks that aim to trap victim models to be heavily miscalibrated without altering their predicted labels, thereby endangering trustworthiness and downstream decision-making based on confidence. The dedicated study on this topic proposes four typical forms—underconfidence, overconfidence, maximum miscalibration, and random confidence attacks—in both black-box and white-box setups, and reports that they are highly effective on both convolutional and attention-based models: with a small number of queries, they seriously skew confidence without changing predictive performance. The same study also finds significant limitations in a wide range of adversarial defence and recalibration methods when evaluated by ECE and KS scores (Obadinma et al., 2024).

A related but broader line of work argues that calibration must extend beyond classification to safety-critical perception. In object detection, the relevant target is not only multiclass confidence but also localization quality, because an incorrect yet high-confidence bounding box can distort safety margins in applications such as autonomous driving and surveillance. The proposed MCCL method is a train-time technique that jointly calibrates multiclass confidence and box localization, and it is evaluated on both in-domain and out-of-domain detection benchmarks precisely because security-sensitive deployment requires calibration under distribution shift, not only on nominal data (Pathiraja et al., 2023).

The same concern appears in code generation. A large-scale study of LLM-generated code defines a security label by requiring both functional correctness and the absence of exploitable vulnerability tests, and then studies whether the model’s self-reported security confidence matches that joint outcome. Its central result is that overconfidence is prevalent across the evaluated LLMs, while functional calibration is consistently worse than security calibration, potentially because functional correctness depends on complex execution behavior. It also isolates False Trust, the rate at which models assign high confidence to wrong or insecure code, as the operational failure mode most directly tied to unsafe developer reliance (Siddiq et al., 30 Jun 2026).

Calibration has also been linked to robustness through stochastic generative preprocessing. In energy-based models trained with long-run persistent Langevin chains, increasing the computational budget of Gibbs sampling improves both calibration and adversarial robustness of a downstream classifier, motivating “stochastic security” as a joint performance metric for reliability and attack resistance (Crum et al., 2023).

3. Threat-judgment calibration in agents and cyber defense

In autonomous agents, security calibration shifts from confidence over labels to confidence over threat judgments. ClawdGo formalizes this as the Security Awareness Calibration Problem (SACP): an agent must reliably decide when to treat something as a threat while balancing recall against precision. Its formal control parameter is training intensity $\tau$, with deployment-specific optimum

$$\tau^* = \arg\max_\tau F_1(\tau), \qquad F_1(\tau)=\frac{2\cdot P(\tau)\cdot R(\tau)}{P(\tau)+R(\tau)},$$

where $P(\tau)$ is precision and $P(Y' = Y \mid P(Y' \mid X) = p) = p,$0 is recall. The framework couples a 12-dimensional Three-Layer Domain Taxonomy (TLDT), weakest-first self-play training, and a four-layer persistent memory architecture. Under weakest-first ASAT, average TLDT score rises from $P(Y' = Y \mid P(Y' \mid X) = p) = p,$1 to $P(Y' = Y \mid P(Y' \mid X) = p) = p,$2 over 16 sessions, outperforming uniform-random scheduling by $P(Y' = Y \mid P(Y' \mid X) = p) = p,$3 points and improving 11 of 12 dimensions; yet the same paper also shows hyper-vigilance under overtraining, including a case where a legitimate capability assessment is classified as prompt injection and the agent scores only $P(Y' = Y \mid P(Y' \mid X) = p) = p,$4 (Li et al., 27 Apr 2026).

This work corrects a common misconception: more security training is not always better. In the SACP regime, $P(Y' = Y \mid P(Y' \mid X) = p) = p,$5 is non-decreasing but $P(Y' = Y \mid P(Y' \mid X) = p) = p,$6 eventually degrades, producing a defensive refusal bias. The practical implication is that agent security must be calibrated against both missed attacks and benign-task rejection, not summarized by a single “security score.”

For tool-using LLM agents, MCPShield frames the same issue as adaptive trust calibration. It models each invocation artifact as

$P(Y' = Y \mid P(Y' \mid X) = p) = p,$7

where $P(Y' = Y \mid P(Y' \mid X) = p) = p,$8 is tool metadata, $P(Y' = Y \mid P(Y' \mid X) = p) = p,$9 arguments, $p$0 visible output, and $p$1 the execution trajectory, and updates agent state by

$p$2

The security cognition layer performs metadata-guided probing before invocation, constrains execution within controlled boundaries while cognizing runtime events, and then reasons over historical traces after invocation. Empirically it defends against six novel MCP-based attack scenarios across six widely used agentic LLMs, while avoiding false positives on benign servers and incurring low deployment overhead (Zhou et al., 15 Feb 2026).

A mathematically distinct but conceptually related use of calibration appears in cyber-risk games. In a continuous-time reputation game, a defender does not observe attack intensity directly but maintains a suspicion level

$p$3

and chooses when to block based on that belief rather than certainty. The paper derives equilibrium blocking thresholds and proposes both empirical and theoretical methods for calibrating the prior attack probability $p$4, thereby treating attack prevalence itself as a security-calibrated quantity rather than a fixed external parameter (Han et al., 2020).

4. Traceability and calibration infrastructure in cyber-physical systems

In robotics and Industrial IoT, calibration is treated not as a metrological afterthought but as a security-critical supply chain. A survey of the robotics security landscape identifies “the supply chain for calibration” as one of four key requirements needing attention, alongside command integrity and authenticity, physical-plane security, and secure logging and auditing. The reasoning is direct: if safety depends on calibrated sensor readings, joint offsets, camera extrinsics, or force thresholds, then calibration parameters, calibration tooling, and calibration certificates become security-critical configuration. The paper explicitly discusses tampering with calibration parameters, counterfeit or non-authenticated calibration hardware or software, broken traceability chains, and the interaction between legitimate commands and maliciously altered calibration states (Shah, 2019).

The IIoT literature makes the same point in traceability terms. “Secure sensor calibration” is defined as ensuring that every measurement can be proven to have been calibrated against a trusted metrological reference, and proven to be currently valid rather than revoked or superseded. The proposed architecture replaces paper-based verification with on-the-fly verification to the root of trust while preserving authentication and non-repudiation. Its implementation uses smart contracts on Ethereum so that calibration status is publicly verifiable, tamper-evident, and queryable without a centralized database. The core verification routine walks a device’s parent calibration chain until a root calibration report is reached and checks signatures and the chain of trust against a ROOT_CERT, thereby turning traceability into an executable security predicate rather than a manual audit exercise (Shah et al., 2019).

A recurring implication is that secure boot, operational authorization, and post-incident forensics all depend on secure calibration state. This suggests that in cyber-physical systems, calibration should be governed by the same integrity, authenticity, and revocation mechanisms as firmware and cryptographic keys.

5. Calibration inside quantum security proofs

Quantum key distribution makes the strongest possible version of the cyber-physical claim: calibration is part of the security proof itself. In commercial and laboratory QKD systems, characterizing the physical channel and calibrating detector timing are prerequisites for establishing the quantum channel, but an inappropriately implemented calibration routine can open a fatal security loophole. A seminal attack on the channel-length calibration routine of Clavis2 shows that by deceiving line length measurement an eavesdropper can induce a large temporal detector efficiency mismatch and then apply a realistic faked-states strategy with low QBER; the proposed fix is to randomize Bob’s phase during calibration so that the routine itself becomes adversarially robust (Jain et al., 2011).

A later analysis generalizes this perspective to passive-basis-choice BB84 and argues that all QKD security proofs implicitly assume that the quantum channel has been established securely. By intercepting calibration signals and resending faked ones, an attacker can induce basis-dependent detector efficiency mismatch and later exploit it with a BEM-based faked-states attack. The same paper therefore treats monitoring of detector activation timings and self-testing of efficiency curves as calibration countermeasures, not mere engineering diagnostics (Fei et al., 2018).

In continuous-variable QKD, the shot-noise unit is likewise security-critical because it is the normalization for all quadrature data and therefore for parameter estimation. The one-time shot-noise calibration method redefines the measured quantity as

$p$5

and embeds that definition into a trusted-detector entanglement-based model. The point is not only procedural simplification: the one-time model closes loopholes left by traditional calibration, reduces statistical fluctuation relative to two-step subtraction, and is analyzed against arbitrary collective attacks in both asymptotic and finite-size regimes (Zhang et al., 2019).

Phase-reference calibration in CV-MDI-QKD is treated with the same discipline. Imperfect calibration is modeled as a practical source of excess noise,

$p$6

and incorporated into the covariance-matrix security analysis. The resulting framework yields a tight security bound on calibration-induced excess noise and shows how laser linewidth, repetition rate, and LO power constrain the secure operating region without changing the underlying system structure (Ma et al., 2019).

The most expansive version of this idea appears in UAV-deployed OAM-BB84. There, “security calibration” means actively tuning which data are trusted, how the channel is modeled, and how finite-key security bounds are computed so that the implemented protocol remains within the assumptions of its security proof under turbulence and pointing jitter. The system couples a unified physical channel model, composable finite-key analysis, and a physics-informed GBDT that classifies pulses or blocks as valid versus corrupted. With operating threshold $p$7, the classifier achieves Accuracy $p$8, Precision $p$9, and Recall $p$0, and simulations indicate a 10 percent to 30 percent improvement in secret key rate while preserving composable security (Deng, 16 Jan 2026).

6. Security calibration in contemporary LLM deployment

Recent LLM work extends security calibration from confidence estimation to deployment control. In code generation, the central question is whether models know when their generated code is insecure. The empirical answer is negative in the aggregate: overconfidence is prevalent across GPT-4o-mini, Gemini-2.0-Flash, and Qwen3-Coder-Next, and calibration-guided automated repair yields only limited improvements while frequently introducing functional regressions. The study also shows that architectural gating improves calibration on controlled benchmarks but that calibration deteriorates in realistic repository-level settings, increasing the risk of high-confidence vulnerable outputs. Its operational metric,

$p$1

formalizes the fraction of wrong or insecure outputs that are nevertheless assigned high confidence, and makes “False Trust” a measurable deployment risk (Siddiq et al., 30 Jun 2026).

A separate line of work turns calibration into a direct security knob for model extraction. “Distillation Traps and Guards” treats distillability as a calibrated, controllable property of an LLM teacher. It identifies three distillation traps—tail noise, off-policy instability, and the teacher-student gap—and then proposes post-hoc reinforcement fine-tuning with objective

$p$2

With $p$3, calibrated teachers become more distillable and produce students that outperform SFT and KD baselines; with $p$4, calibrated teachers retain their own task performance but cause distilled students to collapse, making distillability a practical lever for both robust transfer and model IP protection (Zhan et al., 21 Apr 2026).

Taken together, these results show that security calibration in LLM systems has at least three layers. First, confidence should track whether outputs are secure. Second, runtime or architectural gating may be needed because self-assessed confidence alone degrades in realistic environments. Third, the teacher or tool itself can be calibrated so that downstream reuse, extraction, or invocation becomes either safer or harder, depending on deployment goals. This suggests a broader conclusion already visible in robotics, IoT, and QKD: calibration is increasingly part of the security mechanism, not merely a measurement adjustment performed before the “real” system begins.