Cici: TCR: enhancing the resilience of open source artificial intelligence software for science: vulnerability assessment and deep learning-based remediation

The National Science Foundation Office of Advanced Cyberinfrastructure awarded the Trustees of Indiana University $1,183,632 on August 1, 2026, under the Computer and Information Science and Engineering program (CFDA 47.070) to enhance the resilience of open-source artificial intelligence software for science through vulnerability assessment and deep learning-based remediation.

The project develops two suites of AI-enabled analytics integrated into Jetstream2, NSF's science and engineering cloud platform serving hundreds of federally funded research teams. The first suite learns from open-source software content, relationships, and vulnerability profiles to recommend secure, functionally equivalent alternatives for insecure assets. The second coordinates multiple fine-tuned large language models to automatically generate security patches that preserve program functionality. Both capabilities will be deployed through phased prototyping, pilot testing with scientific partners, production deployment, outreach, and metrics monitoring. Results will be disseminated through publications, workshops, and open-source releases. The project includes workforce development in cybersecurity training to strengthen the nation's research infrastructure.

Performance occurs in Bloomington, Indiana from August 1, 2026, through July 31, 2029.

Abstract

Artificial intelligence (AI) has become an essential engine of modern science, accelerating discovery across biology, astronomy, and physics. Much of this progress rests on open-source artificial intelligence software such as shared code repositories, pretrained models, inference services, and deployment containers that researchers reuse and adapt. These assets, however, can contain AI-specific security weaknesses that compromise scientific workflows, leading to data leakage, unknown and insecure provenance, and more. Scientists who rely on these tools rarely possess the security expertise or resources to find and repair such weaknesses. This project enhances the resilience of the research enterprise by automatically assessing vulnerabilities in open-source AI assets and helping researchers remediate them. The project partners with JETSTREAM2, the national science foundation's first science and engineering cloud, which serves hundreds of federally funded research teams. The project develops two suites of AI-enabled analytics. The first aims to learn from open-source software content, relationships, and vulnerability profiles to recommend secure, functionally equivalent alternatives for insecure assets. The second coordinates multiple fine-tuned large language models to automatically generate security patches that preserve program functionality. Both capabilities are to be integrated into JETSTREAM2's user interface through phased prototyping, pilot testing with scientific partners, production deployment, outreach, and metrics monitoring. Results will be disseminated through publications, workshops, and open-source releases, and the project will train cybersecurity students, strengthening the workforce that safeguards the nation's research infrastructure. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are planned for this award.