Pith. sign in

REVIEW 3 major objections 6 minor 89 references

LLM-Driven Auto Configuration for Transient IoT Device Collaboration

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CollabIoT claims an LLM pipeline can turn plain-language requests into correct IoT access-control policies with 100% accuracy.

desk verdict A sound integrated IoT access-control system whose headline 100% accuracy claim rests on a self-confirming LLM-as-judge; revise the evaluation, then publish. read the letter →

arxiv 2507.03064 v1 pith:BT6PGJPE submitted 2025-07-03 cs.CR cs.AI

Hetvi Shastri , Walid A. Hanafy , Li Wu , David Irwin , Mani Srivastava , Prashant Shenoy This is my paper · ORCID
classification cs.CRcs.AI
keywords LLMpolicygenerationIoTaccesscontrolcapability-basedtransientdevicesautoconfigurationproxydataplaneratelimiting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper presents CollabIoT, a system that lets non-expert users describe IoT access rules in natural language and automatically converts those descriptions into fine-grained, enforceable policies. The system couples an LLM-based policy generator with a multi-stage validation loop, then uses capability tokens and lightweight proxies to configure and police transient guest devices at runtime. If the claims hold, homeowners could securely let delivery robots, friends' phones, and other visiting devices interact with their devices without manually authoring policies or installing vendor-specific drivers. The reported numbers are strong: 100% policy-generation accuracy on the test prompts, roughly 150 ms to configure a newly arrived device, and under 2 ms of network overhead plus 0.3 ms of access-control overhead per proxied request.

What carries the argument

The load-bearing component is the LLM-based actor-critic validation loop: an LLM agent generates a policy constrained by a Pydantic schema, and the same LLM, acting as critic, compares the original user prompt against a templated text description of the generated policy to detect semantic drift. This loop, together with syntax and attribute checks, is what the paper credits for turning unreliable LLM outputs into 100% accurate policies. The runtime side relies on capability-based access-control tokens (JWTs carrying allowed capabilities and rate limits) and per-device proxies that provide hardware-independent RPC interfaces, token verification, and token-bucket rate limiting.

What would settle it

Take the 40 test prompts, generate policies with each of the five models, and have human raters who never see the LLM output label whether each generated policy truly matches the prompt. If the LLM-based semantic validator agrees with the human raters on only a subset of mismatched pairs, the reported 100% accuracy is a self-confirming measure, not an independent one. A concrete test: deliberately inject subtle attribute swaps (e.g., 'living room' instead of 'baby room') into prompts and count how often the validator flags the resulting semantic drift.

Watch

Extended reading notes

Core claim

CollabIoT demonstrates a complete pipeline that compiles a user's high-level intent into validated fine-grained access-control policies, and then enforces those policies automatically for transient devices. The LLM agent produces structured YAML policies constrained by Pydantic schemas; a validator catches syntax/scheme errors, semantic mismatches between the original prompt and a text rendering of the generated policy, and attribute/conflict errors against the device database, reprompting the LLM when needed. The paper reports that this pipeline generated functional and accurate policies with 100% accuracy across five LLM models and both structured and unstructured prompts. At runtime, the system issues cryptographically signed capability tokens that encode allowed capabilities and rate limits, and devices communicate through lightweight proxies that verify tokens, enforce rate limits, and translate to vendor-specific APIs, with configuration time around 150 ms and proxy overhead under 2 ms.

Load-bearing premise

The system assumes that the same LLM that writes a policy can reliably judge whether the policy matches the user's request, so any mistake the model tends to make can pass through both generation and semantic validation unnoticed.

Editorial extensions

If this is right

  • Non-expert users could move from all-or-nothing guest access to fine-grained policies (e.g., a delivery robot may stream a camera at 5 fps and unlock a door twice) by typing a sentence.
  • Transient devices could join a network and receive appropriately scoped credentials automatically, without manual configuration at the hub.
  • The proxy-based data plane lets heterogeneous devices interoperate through vendor-neutral calls while enforcing per-device rate limits and priority scheduling at the edge.
  • Policy generation time ranges from roughly 1 to 22 seconds depending on the LLM, so the approach is practical for configuration-time (not per-request) generation.
  • Because the proxy adds only milliseconds, fine-grained per-request checks can be applied for latency-sensitive interactions like live camera streaming.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 100% accuracy result is measured with the same LLM acting as both generator and semantic critic; an independent judge or formal verification would be needed to estimate real-world correctness on prompts outside the test set.
  • The per-device capability-token design could produce many tokens when a guest device accesses many native devices, though proxy-side token caching and microsecond verification may keep this manageable in practice.
  • A stronger validation stage could combine the LLM critic with a separate, smaller model trained to flag semantic mismatches, or with a rule-based check of capability-vs-attribute consistency, to reduce self-confirmation bias.
  • The same proxy abstraction could be extended to enforce organization-level policies (beyond device-level) if the capability tokens carried hierarchical scope claims.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents CollabIoT, a system that enables transient IoT devices to collaborate with native devices in visited environments. Its control plane converts a user's natural-language intent into capability-based access control policies using an LLM-based generation pipeline, then auto-configures arriving guest devices by issuing signed JWT capability tokens. A proxy-based data plane enforces the policies and exposes hardware-independent device interfaces. The evaluation, on a small physical testbed and in emulated settings, reports 100% accuracy for LLM-generated policies, ~150 ms for runtime device configuration, and proxy network overhead up to 2 ms with access-control overhead up to 0.3 ms. The core systems contributions are a concrete prototype, a multi-stage validation pipeline, and a set of runtime measurements.

Significance. If the headline accuracy claim were established, CollabIoT would be a useful step toward making fine-grained IoT access control accessible to non-expert users in transient, multi-trust-level settings. The strengths of the paper are its concrete implementation (approximately 2.6k SLOC), the real testbed with a delivery robot and camera/lock emulators, the detailed proxy scheduling experiments, and the admission that LLM outputs need validation. The runtime overhead measurements are plausible and constitute the most convincing part of the evaluation. The central weakness is that the correctness claim rests on a self-referential evaluation: the same LLM both generates the policy and judges whether the policy matches the prompt, so the reported 100% accuracy is a measure of self-consistency rather than agreement with an independent ground truth. Because the entire contribution is aimed at security-sensitive access control, this distinction is load-bearing and must be addressed before the central claim can be accepted.

major comments (3)
  1. [III-C and V-C] The semantic validation stage is not an independent correctness check. As described in Section III-C, the actor-critic loop converts the generated policy into a text representation and asks an LLM whether it matches the original prompt. Section V-C then states explicitly that 'the same model is used both in the generation and validation parts.' This makes the validation self-consistent, not externally correct: an over-permissive or semantically wrong policy—such as one with swapped source/destination groups or a missing exclusion—can be accepted if the judge LLM shares the generator's blind spots, and the feedback loop can converge on a wrong but internally consistent policy. The Pydantic and attribute checks catch format and schema issues but cannot detect this class of error. This undermines the abstract and conclusion's claim of 'functional and correct policies with 100% accuracy.' Please either re-frame the claim as self-consistency, or add an external ground-truth evaluation using human-annotated policies or an independently trained judge model, and report agreement rather than raw acceptance rates.
  2. [V-C, Figures 10 and 11] The accuracy evaluation is too small and too unconstrained to support a 100% claim. Each scenario uses only 20 grouping and 20 access-control policies, all hand-written by the authors, and the unstructured prompts are manual paraphrases of the same 40 policies, so the test set may share systematic biases. There are no confidence intervals or error bars, and no external ground-truth policy set is defined. In particular, Figure 11a shows that Gemma 3 (12B) initially fails 20% of unstructured grouping tasks and is 'repaired' to 100% by the feedback loop, but the paper provides no evidence that the repaired policies are correct rather than merely approved by the same model. Please report the number and nature of repair iterations, the distribution of final outputs, and at least binomial confidence intervals for the accuracy figures. Ideally, hold out a set of prompts that were not used to tune the few-shot examples.
  3. [III-B and V-C] The paper does not define a security-relevant correctness metric for 'accuracy.' The grouping and access-control schemes allow include/exclude lists, rate limits, and capability sets, so a policy can be syntactically valid and still violate the user's intent—for example, by granting a capability that should be excluded or by omitting a required exclusion. The current evaluation does not test such adversarial cases, and the semantic validator is not designed to detect them. Please specify the correctness criterion (e.g., exact canonical-policy match, or property-based checks such as the absence of over-permission) and include explicit prompts designed to elicit over-permissive or under-permissive policies, with external labels.
minor comments (6)
  1. [IV-A] The paragraph under Figure 5 contains a duplicated sentence: 'Fig. 5a lists the living room devices (see Fig. 2) where the resource owner creates a group that selects “locks, TVs, and bulbs in the living room”' appears twice in a row. Please remove the duplicate.
  2. [V-B1] In the last sentence, 'across all promotes' should read 'across all prompts.'
  3. [V-C] The opening line 'we address the following question? Are LLMs able to create valid fine-grained access control policies?' should use a colon or be rephrased as a statement, since it is not a grammatically complete question with a question mark in that position.
  4. [II-B] The phrase 'can requires manual configuration' is a subject-verb agreement error; it should be 'can require manual configuration.'
  5. [III-E] There is a missing space in 'InCollabIoT, devices communicate' at the start of Section III-E; it should read 'In CollabIoT, devices communicate.'
  6. [V-D1] The text refers to 'Steps 3.1 to 3.4 in Fig. 4,' but Figure 4 labels only a single step '3. Policy Resolution.' Please clarify the step numbering or update the figure.

Circularity Check

1 steps flagged · score 6.0 of 10

The headline 100% accuracy claim is partly self-confirming: the same LLM generates and validates policies, so the semantic correctness signal measures generator-critic agreement rather than ground-truth correctness.

  1. self definitional [Section III-C (LLM Policy Generation Pipeline) and Section V-C (LLM-based Policy Generation)]
    "we implement an LLM-based actor-critic feedback loop that verifies semantic errors to ensure the original prompt retains the same semantic meaning as the generated prompts. To do so, we convert the generated policy into a text representation using a predefined template and feed it, along with the original prompt, to the LLM, asking it to validate that both hold the same semantics. ... Note that we use each model across the entire pipeline (i.e., the same model is used both in the generation and validation parts, but with different contexts)."

    The semantic-correctness verdict used to compute 100% accuracy is produced by asking the same LLM that generated the policy whether the policy matches the prompt. The pipeline can reprompt until the judge approves, and Section V-C reports that Gemma 3 12B 'fails to generate correct result for 20% times but due to the validation and feedback loop it repairs and gains 100% accuracy.' Thus the reported accuracy is agreement between the generator and its own critic, not agreement with user intent or an external ground-truth policy. Pydantic and attribute checks are independent but only catch syntax, undefined attributes, and conflicts; they cannot detect semantically wrong but well-formed policies such as swapped groups or over-permissive capabilities.

full rationale

The runtime and performance claims (approximately 150 ms configuration, up to 2 ms proxy overhead, and up to 0.3 ms access control overhead) are measured against a real testbed and emulation, so they are independent and not circular. The policy-generation accuracy claim, however, is partly circular: Section III-C defines semantic validation as an LLM-based actor-critic loop, and Section V-C explicitly discloses that the same model is used in both generation and validation. Because the feedback loop regenerates until the critic approves, the reported 100% accuracy is not an independent measure of correctness; it is the generator agreeing with itself. This does not invalidate the system's non-LLM validation stages (Pydantic scheme checks, Python attribute/conflict validation, token and proxy enforcement) or its systems contributions, but it does mean the headline correctness claim should be read as self-consistency unless external ground-truth semantic evaluation is added. No load-bearing self-citation chain is present in the paper.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No numerical free parameters are fitted to data; the central claims rest on engineering and domain assumptions about LLM reliability, device attribute trustworthiness, schema expressiveness, and standard cryptography. The paper introduces no new physical or conceptual entities beyond the system design itself.

assumptions (4)
  • ad hoc to paper An LLM can reliably judge semantic equivalence between a user prompt and a generated policy.
    Invoked in Sections III-C and IV-B; no external evidence is provided that the same LLM family used to generate policies can reliably detect its own semantic errors.
  • domain assumption Guest and native devices expose trustworthy, vendor-independent attributes and capabilities.
    Sections III-B and III-D assume attributes from authentication certificates or admin tagging are accurate; spoofed or mis-tagged attributes would yield incorrect capability tokens.
  • domain assumption The NGAC-inspired YAML and Pydantic scheme is expressive enough to capture users' intended access control semantics.
    Section IV-A defines include and exclude lists, capabilities, and rate limits; more complex intents, such as rich temporal or contextual conditions, may not be expressible.
  • standard math JWT signing with EdDSA and TLS encryption provide the assumed integrity, authenticity, and confidentiality.
    Invoked in Sections IV-C and IV-D; these are standard cryptographic background assumptions, not introduced by the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLM-Driven Auto Configuration for Transient IoT Device Collaboration." pith.science (2026). https://pith.science/paper/BT6PGJPE

@misc{pith2026250703064,
  author       = {Pith},
  title        = {Pith review of: LLM-Driven Auto Configuration for Transient IoT Device Collaboration},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BT6PGJPE}},
  note         = {Machine review of arXiv:2507.03064}
}
read the original abstract

Today's Internet of Things (IoT) has evolved from simple sensing and actuation devices to those with embedded processing and intelligent services, enabling rich collaborations between users and their devices. However, enabling such collaboration becomes challenging when transient devices need to interact with host devices in temporarily visited environments. In such cases, fine-grained access control policies are necessary to ensure secure interactions; however, manually implementing them is often impractical for non-expert users. Moreover, at run-time, the system must automatically configure the devices and enforce such fine-grained access control rules. Additionally, the system must address the heterogeneity of devices. In this paper, we present CollabIoT, a system that enables secure and seamless device collaboration in transient IoT environments. CollabIoT employs a Large language Model (LLM)-driven approach to convert users' high-level intents to fine-grained access control policies. To support secure and seamless device collaboration, CollabIoT adopts capability-based access control for authorization and uses lightweight proxies for policy enforcement, providing hardware-independent abstractions. We implement a prototype of CollabIoT's policy generation and auto configuration pipelines and evaluate its efficacy on an IoT testbed and in large-scale emulated environments. We show that our LLM-based policy generation pipeline is able to generate functional and correct policies with 100% accuracy. At runtime, our evaluation shows that our system configures new devices in ~150 ms, and our proxy-based data plane incurs network overheads of up to 2 ms and access control overheads up to 0.3 ms.

Figures

Figures reproduced from arXiv: 2507.03064 by the authors.

Figure 1
Figure 1. CollabIoT design overview. are probabilistic and can introduce hallucinated or logically inconsistent content. For example, research work [42] explores the use of LLMs to synthesize AWS Identity and Access Management (IAM) policies using zero-shot prompting. The study found that the synthesized policies were frequently incomparable to the ground-truth policies and tended to be overly permissive. These deviations lar… view at source ↗
Figure 2
Figure 2. An end-to-end access control policy description, where [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. LLM-based policy generation and validation pipeline. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: End-to-end workflow, where a friend’s phone is given access to the door lock. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Grouping scheme and access control policy to describe [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Experimental testbed. Router MacMini Intel MacMini M4 Jetson Orin Nano Delivery Robot [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: CollabIoT real testbed. plane and data plane with multiple micro-benchmarks and large-scale emulations. A. Experimental Setup In this section, we detail our experimental setup, LLM models, and IoT devices. Hardware Testbed. Our testbed, shown in [PITH_FULL_IMAGE:figur…
Figure 8
Figure 8. Figure 8: Delivery robot policy configuration. TABLE II: Results of Case Study 1 (Delivery Robot). Event Time (ms) Verification Time (ms) Robot Entering 151.51 NA Lock Access 43.22 1.07 Camera Access 85.36 1.13 devices (e.g., a door lock). Lastly, we also developed sensor and de…
Figure 9
Figure 9. Figure 9: Applying rate limits on an AI processing service in different settings. [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: LLM agent performance against structured prompts [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 12
Figure 12. Figure 12: Evaluating policy resolution time when varying the [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 14
Figure 14. Figure 14: Evaluating the performance of proxy-based architecture across three service types. [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]
Figure 15
Figure 15. Figure 15: Response time of get status service for different [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

89 extracted references · 71 canonical work pages

  1. [1]

    A Novel Secure IoT-Based Smart Home Automation System Using a Wireless Sensor Network

    Sandeep Pirbhulal, Heye Zhang, Md Eshrat E Alahi, Hemant Ghayvat, Subhas Chandra Mukhopadhyay, Yuan-Ting Zhang, and Wanqing Wu. A Novel Secure IoT-Based Smart Home Automation System Using a Wireless Sensor Network. Sensors, 17(1), 2017

    2017

  2. [2]

    A review of internet of things for smart home: Challenges and solutions

    Biljana Risteska Stojkoska and Kire Trivodaliev. A review of internet of things for smart home: Challenges and solutions. Journal of Cleaner Production, 140:1454–1464, 2017

    2017

  3. [3]

    A framework for collaborative computing and multi-sensor data fusion in body sensor networks

    Giancarlo Fortino, Stefano Galzarano, Raffaele Gravina, and Wenfeng Li. A framework for collaborative computing and multi-sensor data fusion in body sensor networks. Information Fusion, 22:50–70, 2015

    2015

  4. [4]

    Mobile health (m-health) system in the context of iot

    Sultan H Almotiri, Murtaza A Khan, and Mohammed A Alghamdi. Mobile health (m-health) system in the context of iot. In 2016 IEEE 4th international conference on future internet of things and cloud workshops (FiCloudW), pages 39–42. IEEE, 2016

    2016

  5. [5]

    An iot-based mobile gateway for intelligent personal assistants on mobile health environments

    João Santos, Joel JPC Rodrigues, Bruno MC Silva, João Casal, Kashif Saleem, and Victor Denisov. An iot-based mobile gateway for intelligent personal assistants on mobile health environments. Journal of Network and Computer Applications , 71:194–204, 2016

    2016

  6. [6]

    Magichand: Interact with iot devices in augmented reality environment

    Yongbin Sun, Alexandre Armengol-Urpi, Sai Nithin Reddy Kantareddy, Joshua Siegel, and Sanjay Sarma. Magichand: Interact with iot devices in augmented reality environment. In 2019 IEEE Conference on Virtual Reality and 3D User Interfaces (VR) , pages 1738–1743. IEEE, 2019

    2019

  7. [7]

    Erebus: Access Control for Augmented Reality Systems

    Yoonsang Kim, Sanket Goutam, Amir Rahmati, and Arie Kaufman. Erebus: Access Control for Augmented Reality Systems. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 929–946, Anaheim, CA, August 2023

    2023

  8. [8]

    Vilar-Montesinos, and Tiago M Fernández-Caramés

    Óscar Blanco-Novoa, Paula Fraga-Lamas, Miguel A. Vilar-Montesinos, and Tiago M Fernández-Caramés. Creating the internet of augmented things: An open-source framework to make iot devices and augmented and mixed reality systems talk to each other. Sensors, 20(11):3328, 2020

    2020

Show all 89 references
  1. [9]

    Internet of Things in Industries: A Survey

    Li Da Xu, Wu He, and Shancang Li. Internet of Things in Industries: A Survey. IEEE Transactions on Industrial Informatics, 10(4):2233–2243, 2014

    2014

  2. [10]

    State of iot 2024: Number of connected iot devices grow- ing 13 https://iot-analytics.com/number-connected-iot-devices/, 2024

    Satyajit Sinha. State of iot 2024: Number of connected iot devices grow- ing 13 https://iot-analytics.com/number-connected-iot-devices/, 2024. Accessed: 2025-06-19

    2024

  3. [11]

    The iot trends shaping industry in 2024 and beyond

    Chris Baird. The iot trends shaping industry in 2024 and beyond. https://iotbusinessnews.com/2024/09/01/ 08700-the-iot-trends-shaping-industry-in-2024-and-beyond/, 2024. Accessed: 2024-11-12

    2024

  4. [12]

    Fundamentals, Algorithms, and Technologies of Occupancy Detec- tion for Smart Buildings Using IoT Sensors

    Pratiksha Chaudhari, Yang Xiao, Mark Ming-Cheng Cheng, and Tieshan Li. Fundamentals, Algorithms, and Technologies of Occupancy Detec- tion for Smart Buildings Using IoT Sensors. Sensors, (7), 2024

    2024

  5. [13]

    Edge-centric Computing: Vision and Challenges

    Pedro Garcia Lopez, Alberto Montresor, Dick Epema, Anwitaman Datta, Teruo Higashino, Adriana Iamnitchi, Marinho Barcellos, Pascal Felber, and Etienne Riviere. Edge-centric Computing: Vision and Challenges. SIGCOMM Comput. Commun. Rev. , 45(5):37–42, September 2015

    2015

  6. [14]

    An overview of iot sensor data processing, fusion, and analysis techniques

    Rajalakshmi Krishnamurthi, Adarsh Kumar, Dhanalekshmi Gopinathan, Anand Nayyar, and Basit Qureshi. An overview of iot sensor data processing, fusion, and analysis techniques. Sensors, 20(21):6076, 2020

    2020

  7. [15]

    UCLA Food Delivery with Starship Robots

    Associated Students UCLA (ASUCLA). UCLA Food Delivery with Starship Robots. Accessed: 2024-11-05

    2024

  8. [16]

    Dominos Drone Delivery, 2025

    Dominos. Dominos Drone Delivery, 2025. Accessed: 2025-06-27

    2025

  9. [17]

    Amazon Key In-Garage Delivery: What It Is and How It Works, 2023

    Stacey Wolfson. Amazon Key In-Garage Delivery: What It Is and How It Works, 2023. Accessed: 2024-11-10

    2023

  10. [18]

    A survey of ddos attacking techniques and defence mechanisms in the iot network

    Ruchi Vishwakarma and Ankit Kumar Jain. A survey of ddos attacking techniques and defence mechanisms in the iot network. Telecommuni- cation Systems, 73(1):3–25, 2020

    2020

  11. [19]

    Rethinking Access Control and Authentication for the Home Internet of Things (IoT)

    Weijia He, Maximilian Golla, Roshni Padhi, Jordan Ofek, Markus Dürmuth, Earlence Fernandes, and Blase Ur. Rethinking Access Control and Authentication for the Home Internet of Things (IoT). In 27th USENIX Security Symposium (USENIX Security 18) , pages 255–272, Baltimore, MD, ...

    2018

  12. [20]

    Understanding and Improving Secu- rity and Privacy in Multi-User Smart Homes: A Design Exploration and In-Home User Study

    Eric Zeng and Franziska Roesner. Understanding and Improving Secu- rity and Privacy in Multi-User Smart Homes: A Design Exploration and In-Home User Study. In 28th USENIX Security Symposium (USENIX Security 19), pages 159–176, August 2019

    2019

  13. [21]

    Boucadair, R

    M. Boucadair, R. Penno, and D. Wing. Rfc 6970: Universal plug and play (upnp) internet gateway device - port control protocol interworking function (igd-pcp iwf), 2013

    2013

  14. [22]

    Apple. Bonjour. https://developer.apple.com/bonjour/, 2025. Accessed: 2025-06-19

    2025

  15. [23]

    Apache river

    Sun Microsystems. Apache river. https://river.apache.org/, 2025. Ac- cessed: 2025-06-19

    2025

  16. [24]

    Securing smart home iot systems with attribute-based access control

    Gaurav Goyal, Peng Liu, and Shamik Sural. Securing smart home iot systems with attribute-based access control. In Proceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems , pages 37–46, 2022

    2022

  17. [25]

    Fluid-iot: Flexible and fine-grained access control in shared iot environments via multi-user ui distribution

    Sunjae Lee, Minwoo Jeong, Daye Song, Junyoung Choi, Seoyun Son, Jean Y Song, and Insik Shin. Fluid-iot: Flexible and fine-grained access control in shared iot environments via multi-user ui distribution. In Proceedings of the 2024 CHI Conference on Human Factors in Computing S...

    2024

  18. [26]

    Logan Blue, Samuel Marchal, Patrick Traynor, and N. Asokan. Lux: Enabling Ephemeral Authorization for Display-Limited IoT Devices. In Proceedings of the International Conference on Internet-of-Things Design and Implementation , IoTDI ’21, page 15–27, New York, NY , USA, 2021. ...

    2021

  19. [27]

    Google nest

    Google. Google nest. https://safety.google/security-privacy/, 2023. Accessed: 2023-10-23

    2023

  20. [28]

    Amazon alexa

    Amazon. Amazon alexa. https://www.amazon.com/dp/B0DCCNHWV5? ref=aucc_web_red_xaa_evgn_tx_0002, 2025. Accessed: 2025-06-25

    2025

  21. [29]

    Samsung smartthings

    Samsung. Samsung smartthings. https://www.samsung.com/us/ smartthings/, 2025. Accessed: 2025-06-25

    2025

  22. [30]

    Wyze. Wyze. https://www.wyze.com/?srsltid= AfmBOopL3p7Rek-xibYqFso1jSLiEaps6vQxe5jLdu2DT_ r58DZFIXu-, 2025. Accessed: 2025-06-25

    2025

  23. [31]

    Apple Home App, 2024

    Apple Inc. Apple Home App, 2024. Accessed: 2024-11-12

    2024

  24. [32]

    Amazon. Aws iot. https://aws.amazon.com/iot/, 2025. Accessed: 2025- 06-25

    2025

  25. [33]

    Azure iot - internet of things

    Azure. Azure iot - internet of things. https://azure.microsoft.com/en-us/ solutions/iot, 2023. Accessed: 2023-10-23

    2023

  26. [34]

    Aws iot greengrass documentation

    AWS. Aws iot greengrass documentation. https://docs.aws.amazon.com/ greengrass/, 2023. Accessed: 2023-10-23

    2023

  27. [35]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems , 30, 2017

    2017

  28. [36]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    2023 arXiv

  29. [37]

    Recent advances in natural language processing via large pre- trained language models: A survey

    Bonan Min, Hayley Ross, Elior Sulem, Amir Pouran Ben Veyseh, Thien Huu Nguyen, Oscar Sainz, Eneko Agirre, Ilana Heintz, and Dan Roth. Recent advances in natural language processing via large pre- trained language models: A survey. ACM Computing Surveys, 56(2):1– 40, 2023

    2023

  30. [38]

    Using an llm to help with code understanding

    Daye Nam, Andrew Macvean, Vincent Hellendoorn, Bogdan Vasilescu, and Brad Myers. Using an llm to help with code understanding. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, pages 1–13, 2024

    2024

  31. [39]

    Competition-level code generation with alphacode

    Yujia Li, David Choi, Junyoung Chung, Nate Kushman, Julian Schrit- twieser, Rémi Leblond, Tom Eccles, James Keeling, Felix Gimeno, Agustin Dal Lago, et al. Competition-level code generation with alphacode. Science, 378(6624):1092–1097, 2022

    2022

  32. [40]

    A Review on Code Generation with LLMs: Application and Evaluation

    Jianxun Wang and Yixiang Chen. A Review on Code Generation with LLMs: Application and Evaluation. In 2023 IEEE International Conference on Medical Artificial Intelligence (MedAI) , pages 284–289, 2023

    2023

  33. [41]

    Intent-based access control: Using llms to intelligently manage access control

    Pranav Subramaniam and Sanjay Krishnan. Intent-based access control: Using llms to intelligently manage access control. arXiv preprint arXiv:2402.07332, 2024

    2024 arXiv

  34. [42]

    Synthesizing ac- cess control policies using large language models

    Adarsh Vatsa, Pratyush Patel, and William Eiers. Synthesizing ac- cess control policies using large language models. arXiv preprint arXiv:2503.11573, 2025

    2025 arXiv

  35. [43]

    Say What You Mean: Natural Language Access Control with Large Lan- guage Models for Internet of Things, 2025

    Ye Cheng, Minghui Xu, Yue Zhang, Kun Li, Hao Wu, Yechao Zhang, Shaoyong Guo, Wangjie Qiu, Dongxiao Yu, and Xiuzhen Cheng. Say What You Mean: Natural Language Access Control with Large Lan- guage Models for Internet of Things, 2025

    2025

  36. [44]

    A survey on large language model (llm) security and privacy: The good, the bad, and the ugly

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing , page 100211, 2024

    2024

  37. [45]

    Zhao, Eric Wallace, Shi Feng, Dan Klein, and Sameer Singh

    Tony Z. Zhao, Eric Wallace, Shi Feng, Dan Klein, and Sameer Singh. Calibrate Before Use: Improving Few-Shot Performance of Language Models, 2021

    2021

  38. [46]

    The pol- icy machine: A novel architecture and framework for access control policy specification and enforcement

    David Ferraiolo, Vijayalakshmi Atluri, and Serban Gavrila. The pol- icy machine: A novel architecture and framework for access control policy specification and enforcement. Journal of Systems Architecture , 57(4):412–424, 2011

    2011

  39. [47]

    Pydantic AI, 2024

    Pydantic Team. Pydantic AI, 2024. Accessed: 2025-06-18

    2024

  40. [48]

    Ollama: Run large language models locally

    Ollama Inc. Ollama: Run large language models locally. https://ollama. com/, 2025. Accessed on June 20, 2025

    2025

  41. [49]

    Json Web Token (JWT)

    Michael Jones, John Bradley, and Nat Sakimura. Json Web Token (JWT). https://datatracker.ietf.org/doc/html/rfc7519, 2015

    2015

  42. [50]

    Siris, George C

    Nikos Fotiou, Vasilios A. Siris, George C. Polyzos, Yki Kortesniemi, and Dmitrij Lagutin. Capabilities-based access control for iot devices using verifiable credentials. In 2022 IEEE Security and Privacy Workshops (SPW), pages 222–228, 2022

    2022

  43. [51]

    Short Group Sig- natures

    Dan Boneh, Xavier Boyen, and Hovav Shacham. Short Group Sig- natures. In Annual international cryptology conference , pages 41–55. Springer, 2004

    2004

  44. [52]

    Wyze-sdk, 2023

    Shaun Tarves. Wyze-sdk, 2023

    2023

  45. [53]

    Network traffic characterization using token bucket model

    Puqi Perry Tang and T-YC Tai. Network traffic characterization using token bucket model. In IEEE INFOCOM’99. Conference on Computer Communications. Proceedings. Eighteenth Annual Joint Conference of the IEEE Computer and Communications Societies. The Future is Now (Cat. No. 99...

    1999

  46. [54]

    Donkeycar: a python self driving library

    Autorope. Donkeycar: a python self driving library. https://github.com/ autorope/donkeycar, 2023. Accessed: 2023-11-30

    2023

  47. [55]

    Gemma: Open models based on gemini research and technology

    Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295 , 2024

    2024 arXiv

  48. [56]

    The llama 3 herd of models

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  49. [57]

    Gpt-4o system card

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276 , 2024

    2024 arXiv

  50. [58]

    The ponder policy specification language

    Nicodemos Damianou, Naranker Dulay, Emil Lupu, and Morris Sloman. The ponder policy specification language. In Policies for Distributed Systems and Networks: International Workshop, POLICY 2001 Bristol, UK, January 29–31, 2001 Proceedings , pages 18–38. Springer, 2001

    2001

  51. [59]

    Rei : A Policy Language for the Me- Centric Project

    Lalana Kagal. Rei : A Policy Language for the Me- Centric Project. Technical report, HP Labs, September 2002. http://www.hpl.hp.com/techreports/2002/HPL-2002-270.html

    2002

  52. [60]

    Uszok, J.M

    A. Uszok, J.M. Bradshaw, M. Johnson, R. Jeffers, A. Tate, J. Dalton, and S. Aitken. Kaos policy management for semantic web services. IEEE Intelligent Systems , 19(4):32–41, 2004

    2004

  53. [61]

    Giovanni Campagna, Silei Xu, Rakesh Ramesh, Michael Fischer, and Monica S. Lam. Controlling fine-grain sharing in natural language with a virtual assistant. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., 2(3), September 2018

    2018

  54. [62]

    Demo: Building comprehen- sible access control for the internet of things using beetle

    James Hong, Amit Levy, and Philip Levis. Demo: Building comprehen- sible access control for the internet of things using beetle. InProceedings of the 14th Annual International Conference on Mobile Systems, Appli- cations, and Services Companion , MobiSys ’16 Companion, page 10...

    2016

  55. [63]

    Automated extraction of attributes from natural language attribute-based access control (abac) policies

    Manar Alohaly, Hassan Takabi, and Eduardo Blanco. Automated extraction of attributes from natural language attribute-based access control (abac) policies. Cybersecurity, 2(1):2, 2019

    2019

  56. [64]

    A systematic mapping study on automated analysis of privacy policies

    Jose M Del Alamo, Danny S Guaman, Boni García, and Ana Diez. A systematic mapping study on automated analysis of privacy policies. Computing, 104(9):2053–2076, 2022

    2022

  57. [65]

    Access control policy generation from user stories using machine learning

    John Heaps, Ram Krishnan, Yufei Huang, Jianwei Niu, and Ravi Sandhu. Access control policy generation from user stories using machine learning. In Data and Applications Security and Privacy XXXV: 35th Annual IFIP WG 11.3 Conference, DBSec 2021, Calgary, Canada, July 19–20, 202...

    2021

  58. [66]

    Sok: Access control policy generation from high- level natural language requirements

    Sakuna Harinda Jayasundara, Nalin Asanka Gamagedara Arachchilage, and Giovanni Russello. Sok: Access control policy generation from high- level natural language requirements. ACM Computing Surveys, 57(4):1– 37, 2024

    2024

  59. [67]

    Automated extraction of abac policies from natural- language documents in healthcare systems

    Yutang Xia, Shengfang Zhai, Qinting Wang, Huiting Hou, Zhonghai Wu, and Qingni Shen. Automated extraction of abac policies from natural- language documents in healthcare systems. In 2022 IEEE International Conference on Bioinformatics and Biomedicine (BIBM) , pages 1289–

    2022

  60. [68]

    Lmn: A tool for generating machine enforceable policies from natural language access control rules using llms

    Pratik Sonune, Ritwik Rai, Shamik Sural, Vijayalakshmi Atluri, and Ashish Kundu. Lmn: A tool for generating machine enforceable policies from natural language access control rules using llms. arXiv preprint arXiv:2502.12460, 2025

    2025

  61. [69]

    D. Hardt. Rfc 6749: The oauth 2.0 authorization framework, 2012

    2012

  62. [70]

    A capability-based security approach to manage access control in the internet of things

    Sergio Gusmeroli, Salvatore Piccione, and Domenico Rotondi. A capability-based security approach to manage access control in the internet of things. Mathematical and Computer Modelling , 58(5- 6):1189–1205, 2013

    2013

  63. [71]

    Siris, and George C

    Nikos Fotiou, Vasilios A. Siris, and George C. Polyzos. Capability- based access control for multi-tenant systems using oauth 2.0 and verifiable credentials. In 2021 International Conference on Computer Communications and Networks (ICCCN) , pages 1–9, 2021

    2021

  64. [72]

    Caplets: Resource aware, capability-based access control for iot

    Fatih Bakir, Chandra Krintz, and Rich Wolski. Caplets: Resource aware, capability-based access control for iot. In 2021 IEEE/ACM Symposium on Edge Computing (SEC) , pages 106–120, 2021

    2021

  65. [73]

    Berkay Celik, Abbas Acar, Hidayet Aksu, Patrick McDaniel, Engin Kirda, and A

    Amit Kumar Sikder, Leonardo Babun, Z. Berkay Celik, Abbas Acar, Hidayet Aksu, Patrick McDaniel, Engin Kirda, and A. Selcuk Uluagac. KRATOS: Multi-User Multi-Device-Aware Access Control System for the Smart Home. In Proceedings of the 13th ACM Conference on Security and Privacy...

    2020

  66. [74]

    Who’s control- ling my device? multi-user multi-device-aware access control system for shared smart home environment

    Amit Kumar Sikder, Leonardo Babun, Z Berkay Celik, Hidayet Aksu, Patrick McDaniel, Engin Kirda, and A Selcuk Uluagac. Who’s control- ling my device? multi-user multi-device-aware access control system for shared smart home environment. ACM Transactions on Internet of Things, 3...

    2022

  67. [75]

    An attribute-based ap- proach toward a secured smart-home iot access control and a comparison with a role-based approach

    Safwa Ameer, James Benson, and Ravi Sandhu. An attribute-based ap- proach toward a secured smart-home iot access control and a comparison with a role-based approach. Information, 13(2):60, 2022

    2022

  68. [76]

    Securing home iot environments with attribute-based access control

    Bruhadeshwar Bezawada, Kyle Haefner, and Indrakshi Ray. Securing home iot environments with attribute-based access control. In Proceed- ings of the Third ACM Workshop on Attribute-Based Access Control , ABAC’18, page 43–53, New York, NY , USA, 2018. Association for Computing Machinery

    2018

  69. [77]

    Access control in the internet of things: a survey of existing approaches and open research questions

    Emmanuel Bertin, Dina Hussein, Cigdem Sengul, and Vincent Frey. Access control in the internet of things: a survey of existing approaches and open research questions. Annals of telecommunications , 74:375– 388, 2019

    2019

  70. [78]

    Fecac: Fine-grained and efficient capability-based access control for enterprize-scale iot systems

    Qiong Wang, Xia Feng, Liangmin Wang, Haiqin Wu, and Boris Düd- der. Fecac: Fine-grained and efficient capability-based access control for enterprize-scale iot systems. IEEE Internet of Things Journal , 12(7):8669–8684, 2025

    2025

  71. [79]

    Hassanein

    Ashraf Alkhresheh, Khalid Elgazzar, and Hossam S. Hassanein. Daciot: Dynamic access control framework for iot deployments. IEEE Internet of Things Journal , 7(12):11401–11419, 2020

    2020

  72. [80]

    https://ifttt.com/, 2025

    Ifttt. https://ifttt.com/, 2025. Accessed: 2025-06-26

    2025

  73. [81]

    Tteo (things talk to each other): Programming smart spaces based on iot systems

    Jaeseok Yun, Il-Yeup Ahn, Sung-Chan Choi, and Jaeho Kim. Tteo (things talk to each other): Programming smart spaces based on iot systems. Sensors, 16(4):467, 2016

    2016

  74. [82]

    Alexaroutines

    Amazon. Alexaroutines. https://www.amazon.com/alexa-routines/b?ie= UTF8&node=21442922011/, 2025. Accessed: 2025-06-25

    2025

  75. [83]

    Mosden: An internet of things middleware for resource constrained mobile devices

    Charith Perera, Prem Prakash Jayaraman, Arkady Zaslavsky, Peter Christen, and Dimitrios Georgakopoulos. Mosden: An internet of things middleware for resource constrained mobile devices. In 2014 47th Hawaii International Conference on System Sciences, pages 1053–1062, 2014

    2014

  76. [84]

    Maat: Mobile apps as things in the iot

    Wyatt Lindquist, Sumi Helal, Ahmed Khaled, Gerald Kotonya, and Jaejoon Lee. Maat: Mobile apps as things in the iot. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., 3(4), September 2020

    2020

  77. [85]

    The design of a generalised approach to the programming of systems of systems

    Geoff Coulson, Gordon Blair, Yehia Elkhatib, and Andreas Mauthe. The design of a generalised approach to the programming of systems of systems. In 2015 IEEE 16th International Symposium on A World of Wireless, Mobile and Multimedia Networks (WoWMoM) , pages 1–6, 2015

    2015

  78. [86]

    The social internet of things (siot)–when social networks meet the internet of things: Concept, architecture and network characterization

    Luigi Atzori, Antonio Iera, Giacomo Morabito, and Michele Nitti. The social internet of things (siot)–when social networks meet the internet of things: Concept, architecture and network characterization. Computer networks, 56(16):3594–3608, 2012

    2012

  79. [87]

    Open connectivity foundation. Alljoyn. https://openconnectivity.org/ technology/reference-implementation/alljoyn/, 2025. Accessed: 2025- 06-25

    2025

  80. [88]

    https://iotivity.org/, 2025

    Iotivity. https://iotivity.org/, 2025. Accessed: 2025-06-25

    2025

  81. [89]

    CSA. Matter. https://csa-iot.org/all-solutions/matter/, 2025. Accessed: 2025-06-25

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.