# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
However, in prompt-engineering scenarios, this assumption may not strictly hold due to the semantic correlations between prompts. Specifically, prompts generated through gradient-based updates (cf. Algorithm 1) could inherit similar semantic structures, potentially leading to correlated performance patterns. Our UCB-R algorithm incorporates several mechanisms to mitigate the impact of potential prompt dependencies. First, instead of relying on single-trial outcomes, UCB-R employs a batch-based evaluation approach where prompt performance is assessed on batched samples. The success and failure counts are updated based on aggregated scores from these batch evaluations, which helps smooth out potential correlations in individual trials. Second, the algorithm implements a dynamic exploration rate in which the exploration coefficient decreases as the number of trials increases. This adaptive exploration strategy ensures that the algorithm gradually shifts focus from exploration to exploitation as more evidence is gathered. Finally, rather than deterministically selecting prompts with the highest UCB scores, UCB-R employs a weighted random selection mechanism. This stochastic approach introduces additional randomization that can help break potential dependencies between consecutive selections. While these mechanisms do not entirely eliminate the impact of prompt dependencies, they provide practical approaches to maintain the algorithm's effectiveness. Future work could explore more sophisticated methods to explicitly model and account for semantic correlations between prompts, potentially through the introduction of a similarity-based regularization term in the UCB calculation. #### 5.5.1 Limitations

While our approach offers practical solutions to handle prompt dependencies, several theoretical and implementation challenges remain. The current approach lacks theoretical guarantees when trials exhibit dependencies, and extending the convergence analysis to correlated settings remains an open challenge. Moreover, the performance of the algorithm depends on two key hyperparameters: the batch size for evaluation and the rate of exploration coefficient decay. The optimal values for these parameters may vary significantly across different prompt spaces and task domains, necessitating careful tuning based on specific application characteristics. Furthermore, as our framework relies on LLMs, it inherits certain intrinsic limitations. Despite LLMs' capacity for semantic understanding and malicious behavior detection, their effectiveness is contingent on code-comprehension capabilities. The framework faces challenges including potential hallucinations, substantial computational costs, vulnerability to adversarial attacks, and false positives that may reduce system practicality. In particular, LLMs are known to be vulnerable to adversarial attacks, where slight modifications to input payloads (e.g., JavaScript code) can bypass detection mechanisms. Recent work in LLM-based security applications [44; 45] has demonstrated the effectiveness of federated learning and adversarial training against model-poisoning attacks, suggesting promising directions for enhancing XSShield's robustness. Such attacks could undermine XSShield's effectiveness in real-world scenarios. To mitigate this risk, future work could explore the use of private, fine-tuned LLMs, adversarial training techniques, hybrid detection mechanisms combining LLMs with traditional static analysis, and continuous monitoring and updates to address emerging threats. Additionally, there exists a fundamental trade-off between input size and model comprehension--even after code slicing, code fragments may remain too extensive for the model to process effectively, potentially impeding accurate code behavior understanding. The application of LLMs in security domains also introduces inherent risks, as carefully crafted inputs could potentially mislead models into misclassifying malicious code.