KuTIE: Runtime Topology Context Improves LLM-Generated Kubernetes Security Patches

Forum topic · 小凯 · 2026-07-30

Summary

A 2026 arXiv paper (arXiv:2607.25995) by Farooq Shaikh examines whether live runtime topology context improves the correctness of LLM-generated Kubernetes security patches. Existing LLM-based remediation systems generate configuration patches from Kubernetes Security Posture Management (KSPM) findings in isolation, without knowledge of the live service call graph, risking destructive blast radius when patches break invisible runtime dependencies. The author introduces KuTIE (Kubernetes Topology Intelligent Engine), which builds live cluster context from Istio call edges, Trivy KSPM findings, and service account bindings, then conditions LLM patch generation on this context. Evaluation on VulnCare, a purpose-built 36-deployment, four-namespace medical cluster with 31 injectable findings across seven dependency classes, shows that topology context raises topology-dependent patch correctness from 11.1% to 78.0% over 248 trials (Δ=0.669), with gains across six of seven dependency classes, while topology-independent controls show no effect (Δ=0.0).

Paper Overview

Field: Machine Learning Author: Farooq Shaikh Published: 2026-07-28 arXiv: 2607.25995

Background

Kubernetes is central to the cloud-native ecosystem, orchestrating containerised workloads. Recent work suggests that large language models (LLMs) can automate cluster security remediation, generating configuration patches from Kubernetes Security Posture Management (KSPM) findings without human authoring.

However, such systems prompt the model with each finding in isolation from the live service call graph, assuming general hardening knowledge suffices. This assumption breaks down whenever a patch must preserve a runtime service dependency invisible to the model: an otherwise compliant fix then carries a destructive functional blast radius, crashing downstream callers or silently severing call edges across the cluster.

KuTIE

The paper introduces KuTIE (Kubernetes Topology Intelligent Engine), which constructs live cluster context from:

Istio call edges
Trivy KSPM findings
Service account bindings read by workloads

and conditions LLM patch generation on this runtime context.

Evaluation on VulnCare

KuTIE is evaluated on VulnCare, a purpose-built medical cluster with:

36 deployments across four namespaces
31 injectable findings across seven dependency classes
Each finding labeled by topological dependency against cluster ground truth

Key Results

Across 248 trials:

Topology context improved topology-dependent patch correctness from 11.1% to 78.0% (Δ=0.669)
The gap held for every model tested and for six of the seven dependency classes, ranging from credentials and network policies (Δ=0.95) to role-based access control (Δ=0.31)
Topology-independent controls showed no such effect (Δ=0.0), isolating the result from generic prompt augmentation

Conclusion

Providing a live service call graph and its exposed service account bindings substantially improves remediation of topology-dependent findings compared to scanner-only context.

--- *Auto-collected on 2026-07-30*