(U) CNET LAB Reverse Engineering and Artificial Intelligence (REAI) FY28.pdf

UNCLASSIFIED

CNET LAB Reverse Engineering and Artificial Intelligence FY28

Requirements and Questions Document

(U) Background. The Joint Warfare Analysis Center (JWAC) provides combatant commands, Joint Staff and other customers with effects-based, innovative precision network targeting options in order to carry out the national security and military strategies of the United States during competition, crisis and conflict. JWAC maintains and enhances leading-edge technology and world-class subject matter expertise to provide the warfighter specialized engagement options against or adversaries' critical infrastructure and related systems.

(U) Work Area. The work area is telecommunications, computer networking, and computing automation. This includes the development of tools to support analysis and model development to simulate infrastructure/networks.

(U) Objective. The JWAC utilizes computer network and telecommunications lab environments to conduct comprehensive modeling and network system emulations as required for the purpose of experimentation and proof of concept tactic development to support customer requirements.

This effort is to procure specialized engineering support as required for equipment maintenance, troubleshooting, equipment updates/patches and proof of concept development. Additionally, hardware, software, and firmware tools will be developed as required to support proof of concept development for potential cyber capability development initiatives. The contractor will provide on-site support that includes reverse engineering and artificial intelligence expertise.

(U) Technical Requirements.

- (U) Software Reverse Engineer. The contractor will provide software reverse engineers on site in Dahlgren, VA with expertise of software and/or telecommunications/computer components that deal with national security interests. JWAC may provide the contractor source code, binaries or hardware for firmware extraction. Reverse engineering will be used to support threat network and Tactics, Techniques and Procedure (TTP) development.

- (U) Artificial Intelligence. The contract will need to possess deep expertise across the full lifecycle of foundation model development, spanning pre-training at trillion-token scale through post-training alignment and production deployment. Subject Matter Expertise will be utilized in the following:

- (U) Designing and executing distributed training runs on graphics processing unit

(GPU) clusters.

- (U) Architect and maintain high-throughput ingestion, deduplication, filtering, and streaming pipelines that transform massive internal datasets-including packet capture (PCAP) archives, digital twin simulation outputs, and software reverse engineering artifacts-into high-quality training data.

- (U) Full-stack hardware-software co-design for latency-constrained and throughput constrained workloads on available compute infrastructure.

- (U) Apply expertise in the rapidly evolving landscape of agentic artificial intelligence (Al), test-time compute scaling to allocate more inference compute for harder problems, and neurosymbolic integration to combine neural networks with symbolic reasoning engines for verifiable logic.

- (U) As needed, utilize machine learning (ML) security, adversarial robustness, and model reverse engineering-capabilities that intersect directly with the supported team's mission in cyber security, software reverse engineering, and PCAP analytics.

(U) Technical Questions:

(U) Software Reverse Engineer

1. (U) Does your company have analysts at the TS//SCI level?

2. (U) Does your company have the ability to have analyst(s) sit at Joint Warfare Analysis

Center in Dahlgren, VA 100% of the time?

3. (U) What are your experience levels (Jr, mid-tier, Sr)/(#years) with:

a. x86 / x86-64 (Intel/AT&T syntax)

b. ARM / AArch64 (ARMv7, ARMv8/9)

c. MIPS/ PowerPC/ RISC-V

d. Calling Conventions

e. Instruction Set Extensions

4. (U) What work have you done with operating systems in relation to the details of how they function/operate? (Windows Internals, Linux/Unix Internals, MacOS/iOS Internals)

5. (U) Identify skill levels and pertinent projects related to:

a. Pattern Recognition

b. Optimization Artifacts

c. Link Time Optimization (LTO) / Whole Program Optimization

6. (U) How have you dealt with cryptography & obfuscation analysis? Specifically address areas related to:

a. Algorithm Identification

b. White-Box Crypto

c. De-obfuscation

7. (U) Provide examples of tools used to perform work in each of the following areas:

a. Static Analysis (Disassemblers/Decompilers)

b. Dynamic Analysis (Debuggers)

c. Instrumentation / Emulation

d. Scripting / Automation

e. Binary Diffing / Patching

8. (U) Have you worked in any/all of these areas?

a. Malware Analysis / Threat Intel

b. Embedded / IOT / Firmware

c. Mobile (Android / iOS)

d. DRM / Anti-Cheat / Software Protection

e. Decompilation / Lifting / Binary Translation

(U) Artificial Intelligence

1. (U) Are you able to address the specific aspects of a complex foundation model you have taken from pre-training data curation through to a hardened production deployment?

a. Would you be able to address these specifics in a capability statement in follow-on discussions?

(a) How you designed the pre-training corpus (deduplication, filtering, domain mixing, curriculum) at trillion-token scale, and what distributed data framework (Spark/Dask/Polars) and orchestrator

(Slurm/Airflow/Dagster) you used.

ii. (b) The distributed training topology (GPIJ count, interconnect, parallelism strategy—tensor/pipeline/expert), framework

(PyTorch/JAX/TensorFlow), custom optimizer or training-loop modifications, and fault-tolerance mechanisms you implemented.

(c) Your post-training alignment pipeline: which combination of SFT, RLHF, RLAIF, DPO, or reasoning-oriented methods (COT distillation, process-supervised reward models) you applied, and how you designed evaluation benchmarks and synthetic data to distinguish genuine capability gains from memorization or evaluation artifacts.

iv. (d) The inference optimization stack you deployed (vLLM/TensorRT-

LLM/Triton/NlM), quantization strategy (PTQ/QAT/low-bit), parallelism

(tensor/pipeline/expert), speculative decoding or disaggregated prefill-decode, and how you characterized the accuracy—latency Pareto frontier for your target workload.

2. (U) Do you have experience with using Al to ingest proprietary network data pertaining to cyber information from digital twins’ simulation output, PCAP archives, or reverse-engineering artifacts?

3. (U) What additional experience do you have with taking data and continuously incorporating updated Al training or inference pipelines back into the system/network?