{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,23]],"date-time":"2026-06-23T16:59:04Z","timestamp":1782233944263,"version":"3.54.5"},"reference-count":0,"publisher":"Association for the Advancement of Artificial Intelligence (AAAI)","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["AAAI-SS"],"abstract":"<jats:p>Autonomous cyber defense agents increasingly need to query complex enterprise attack graphs under time pressure, yet today\u2019s Active Directory (AD) tools still assume expert-authored Cypher queries. This paper studies natural-language-to-Cypher generation as a core tool-use action for human-aware AD defense agents operating over BloodHound-style graphs. We curate 346 executable English\u2013Cypher pairs from practitioner queries, augment them to 2,768 samples via constrained paraphrasing, and fine-tune an open-weight Mixtral\u20118\u00d77B model using QLoRA. Across ten representative BloodHound-equivalency tasks on five synthetic AD graphs, fine-tuning raises parse success from 0.80 to 0.94 and correct-answer rate from 0.34 to 0.42. These gains should be interpreted as evidence that domain tuning can improve syntactic robustness in a controlled setting, rather than as evidence of production-ready semantic reliability or real-enterprise scalability. Error analysis reveals safety-critical semantic gaps in domain admin identification, unsupported-OS detection, and temporal constraints. We argue that, for cyber defense agents, schema prompting and fine-tuning alone are insufficient: safe autonomy over AD graphs requires execution-grounded correction, explicit domain guardrails, and interaction designs that calibrate human trust in LLM-generated queries.<\/jats:p>","DOI":"10.1609\/aaaiss.v9i1.42949","type":"journal-article","created":{"date-parts":[[2026,6,23]],"date-time":"2026-06-23T16:33:06Z","timestamp":1782232386000},"page":"332-335","source":"Crossref","is-referenced-by-count":0,"title":["Toward Human-Aware Active Directory Defense with Fine-Tuned LLMs"],"prefix":"10.1609","volume":"9","author":[{"given":"Hung X.","family":"Nguyen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tu","family":"Vu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"9382","published-online":{"date-parts":[[2026,6,23]]},"container-title":["Proceedings of the AAAI Symposium Series"],"original-title":[],"link":[{"URL":"https:\/\/ojs.aaai.org\/index.php\/AAAI-SS\/article\/download\/42949\/50509","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ojs.aaai.org\/index.php\/AAAI-SS\/article\/download\/42949\/50509","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,23]],"date-time":"2026-06-23T16:33:07Z","timestamp":1782232387000},"score":1,"resource":{"primary":{"URL":"https:\/\/ojs.aaai.org\/index.php\/AAAI-SS\/article\/view\/42949"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,23]]},"references-count":0,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,6,23]]}},"URL":"https:\/\/doi.org\/10.1609\/aaaiss.v9i1.42949","relation":{},"ISSN":["2994-4317"],"issn-type":[{"value":"2994-4317","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,23]]}}}