◇ OpenCyber Academy
Doctoral research · Chapter 7 · English

Chapter 7 — Thesis synthesis and reproducibility archive

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Thesis synthesis and reproducibility archive

Lesson map

Lesson 07 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 The thesis as an argument"]
  N2["7.2 Threats to validity"]
  N3["7.3 The reproducibility archive"]
  N4["7.4 Release decisions"]
  N5["7.6 Practice activities"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 The thesis as an argument"]
  N2["7.2 Threats to validity"]
  N3["7.3 The reproducibility archive"]
  N4["7.4 Release decisions"]
  N5["7.6 Practice activities"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX039"]

[Learning outcomes]
    |
    v
[7.1 The thesis as an argument]
    |
    v
[7.2 Threats to validity]
    |
    v
[7.3 The reproducibility archive]
    |
    v
[7.4 Release decisions]
    |
    v
[7.6 Practice activities]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) structure a thesis so that each chapter answers a research question with evidence; (2) write a synthesis chapter that states contributions, limitations and threats to validity; (3) build a reproducibility archive (code, configurations, data cards, model cards, hashes, logs); (4) decide what to release, gate or withhold; and (5) verify that a stranger can regenerate the main results.

7.1 The thesis as an argument

A thesis is one argument, not a scrapbook of papers. Open with the problem and the gap (Chapter 2), state research questions and contributions, then give each empirical chapter one question and its answer. Close with a synthesis that integrates: what is now known that was not; under what conditions; what remains open. When the thesis includes published papers, add bridging text that explains how each paper's threat model and terminology fit the whole, and harmonise terms so that "attack success rate" means one thing throughout.

7.2 Threats to validity

Organise limitations by validity type. Internal validity: could something other than the treatment explain the effect (grader bias, leakage, seed effects)? Construct validity: does the metric measure the property (does "unauthorised tool call" capture harm)? External validity: does the result transfer to other models, tools, languages, deployment patterns? Conclusion validity: are the statistics appropriate (power, multiplicity, dependence between tasks)? In AI security add adversarial validity: was the strongest reasonable adversary within the threat model actually tried? For each threat, state what you did about it and what remains.

7.3 The reproducibility archive

The archive is the artefact that lets another researcher regenerate your figures. Include: a README with exact commands; the environment (lock files, container recipe, hardware notes); code at a tagged commit; configuration files for every run; model identifiers and SHA-256 hashes of checkpoints you used (not necessarily the weights, if licence forbids redistribution); datasets or generators with datasheets (Gebru et al., arXiv:1803.09010); model cards for any model you release (Mitchell et al., arXiv:1810.03993); raw per-trial logs or a documented reason they are withheld; the analysis notebook or script that turns logs into tables; and a manifest listing every file's hash. Archive in a repository that issues persistent identifiers and choose licences deliberately (code, data and text may need different ones).

7.4 Release decisions

Apply the release table from Chapter 3 to the final artefacts. Defence code, harness, synthetic task generators and analysis scripts are usually public. Adaptive payload corpora may be gated (access on request to verified researchers, with terms). Anything specific to a named live product waits for coordinated disclosure to complete. Do not include personal data. If you redact, say what was redacted and why so that reviewers can judge the effect on reproducibility. Ana's release followed this pattern: harness and defence public, payload corpus gated, as planned in her proposal.

7.5 Worked example (synthetic MAAL case)

Ana's archive README contains three commands: build the container, run make pilot (about 2 GPU-hours) and make main (about 140 GPU-hours), then make tables. A smoke target reruns 30 tasks per condition in ten minutes and checks the numbers fall within stored tolerances. The manifest lists 1,412 files with hashes. A labmate who had not seen the project followed the README on a fresh machine; the smoke test failed because a tokenizer version had changed, and the lock file was fixed. Ana's synthesis chapter lists her contributions as (1) evidence that separation adds a measurable reduction on top of least-privilege tools, (2) an adaptive-attack harness, and (3) the discovery of tool-chaining echoes as a residual family; threats include only three models from two families and synthetic tasks.

The stats lab doubles as an archive check: a reviewer can run it and obtain exactly the printed numbers because every random generator is seeded.

"""Lab S: reporting attack-success rates honestly: Wilson intervals,
seed variation and a paired bootstrap. Synthetic trial outcomes only."""
import math, random
def wilson(k, n, z=1.96):
    p = k/n; d = 1 + z*z/n
    c = (p + z*z/(2*n))/d; h = z*math.sqrt(p*(1-p)/n + z*z/(4*n*n))/d
    return c - h, c + h
for k, n in ((3, 20), (30, 200), (300, 2000)):
    lo, hi = wilson(k, n); print(f"successes={k}/{n} rate={k/n:.3f} wilson95=[{lo:.3f}, {hi:.3f}]")
# five seeds of a synthetic defence evaluation: per-seed attack success rate
rates = []
for seed in range(5):
    r = random.Random(seed); rates.append(sum(r.random() < 0.12 for _ in range(200))/200)
m = sum(rates)/5; sd = math.sqrt(sum((x-m)**2 for x in rates)/4)
print("per-seed rates:", " ".join(f"{x:.3f}" for x in rates), f"mean={m:.3f} sd={sd:.3f}")
# paired bootstrap: baseline vs defence on the same 300 synthetic prompts
r = random.Random(42)
base = [r.random() < 0.30 for _ in range(300)]
defn = [b and r.random() < 0.6 for b in base]   # defence blocks ~40% of successes
diffs = []
for _ in range(2000):
    idx = [r.randrange(300) for _ in range(300)]
    diffs.append(sum(base[i] for i in idx)/300 - sum(defn[i] for i in idx)/300)
diffs.sort()
print(f"baseline_asr={sum(base)/300:.3f} defended_asr={sum(defn)/300:.3f} "
      f"reduction_ci95=[{diffs[50]:.3f}, {diffs[1949]:.3f}]")

Expected output:

successes=3/20 rate=0.150 wilson95=[0.052, 0.360]
successes=30/200 rate=0.150 wilson95=[0.107, 0.206]
successes=300/2000 rate=0.150 wilson95=[0.135, 0.166]
per-seed rates: 0.110 0.130 0.135 0.105 0.145 mean=0.125 sd=0.017
baseline_asr=0.350 defended_asr=0.190 reduction_ci95=[0.120, 0.203]

7.6 Practice activities

  1. Write your synthesis chapter's contributions and validity table. 2. Build a manifest of your project files with SHA-256 hashes. 3. Ask a peer to reproduce one figure from your README alone, and record what failed. For the validity table, use the five types and say for each threat what you did and what remains, as Ana did for model families and synthetic tasks. For the manifest, hash every file in the archive and store the list with it. For the peer test, give only the README and a fresh machine; record each failure and fix, as Ana's labmate's run found the tokenizer change.

7.7 Errors and limits

Each of these errors weakens the archive or the argument:

A run by a labmate on a fresh machine, like the one in 7.5, is the cheapest check against several of these errors at once.

Exercises

Synthesis

The thesis argues; the archive proves. A clear validity table and an archive that a stranger has actually rerun turn a set of experiments into a contribution others can build on.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →