Large language models (LLMs) are increasingly being explored in cyber-physical system design as a promising tool to facilitate the conversion of natural-language requirements into formal specifications, and the generation of plans and controllers that provably satisfy them. Existing LLM-based pipelines, however, mostly validate the designed controllers by simulation, and carry no mechanism for improving their outcomes from past designs. We present ACIES, a self-evolving agentic contract-based framework for cyber-physical system control synthesis. Given a set of system requirements, ACIES automatically generates a control architecture that realizes the requirements using a sequence of synthesis episodes. Within each episode, a Translator agent formalizes the system requirements into temporal logic, and a Decomposer agent structures them into a system-level contract and proposes a decomposition into component-level contracts that can be independently implemented. A formal verification step is then integrated in the decomposition loop to check whether the component-level contracts are consistent, compatible, and provide a correct refinement of the system-level contract. Each failed check, at the verification or implementation step, returns a diagnostic signal that drives automated contract repair at the system or the component level. Across episodes, a Summarizer agent distills verification outcomes into reusable lessons stored in a memory. Evaluation results on five control synthesis tasks with eight LLM backbones show that the formalized system requirements are successfully decomposed and mapped to a synthesizable control architecture that realizes them, while self-evolution reduces the Decomposer token consumption by up to 65% and the end-to-end synthesis latency by up to 62%.

Large language models (LLMs) are increasingly deployed in security-sensitive applications, where they must follow system- or developer-specified instructions that define the intended task behavior, while completing benign user requests. When adversarial instructions appear in user queries or externally retrieved content, models may override intended logic. Recent defenses rely on supervised fine-tuning with benign and malicious labels. Although these methods achieve high attack rejection rates, we find that they rely on narrow correlations in defense data rather than harmful intent, leading to systematic rejection of safe inputs. We analyze three recurring shortcut behaviors induced by defense fine-tuning. Position bias arises when benign content placed later in a prompt is rejected at much higher rates; across reasoning benchmarks, suffix-task rejection rises from below 10% to as high as 90%. Token trigger bias occurs when strings common in attack data raise rejection probability even in benign contexts; inserting a single trigger token increases false refusals by up to 50%. Topic generalization bias reflects poor generalization beyond the defense data distribution, with defended models suffering test-time accuracy drops of up to 40%. These findings suggest that current prompt-injection defenses frequently respond to attack-like surface patterns rather than the underlying intent. We introduce controlled diagnostic datasets and a systematic evaluation across two base models and multiple defense pipelines, highlighting limitations of supervised fine-tuning for reliable LLM security.