Developers routinely use GenAI tools (large language models enriched in various ways) to generate useful components of programs, such as regular expressions. While pleasant and often effective, this can easily lead to subtle bugs. The developer may have been unclear in their specification, they may not fully understand the language of the output, there may be systematic misconceptions suffered by the user and perhaps even embedded in the language model, and so on. Responsible use of GenAI requires humans in the loop. To be effective, the human interaction must be both meaningful and moderate. We accomplish this as follows. First, we generate multiple candidate expressions instead of one. We then use formal language containment properties to generate distinguishing concrete scenarios that illustrate the differences between the candidates. We then have users rate these concrete scenarios. This process converges in a few steps, while also giving the user insight into any lack of clarity on their part. We have built a tool, pick, that implements this iterative process. We apply it to three formal languages with the necessary properties: regexes, linear temporal logic, and access-control policies. We show through experiments that pick is a significant improvement over showing users the candidate expressions, and also helps catch situations where no output is a match.

Cybersecurity is a growing field with ample opportunities for experiential learning, including challenge-based capture-the-flag (CTF) competitions. CTFs are popular training tools among established cybersecurity professionals, and these events grow in participation every year. Because of their popularity among those with prior experience, however, only a small percentage of CTF events are designed to be genuinely beginner-friendly. To effectively respond to the global shortage in cybersecurity skills, we must equip students and teachers with educational tools such as tailored CTFs. This paper investigates the efficacy of hosting CTF competitions developed for high school students with little to no prior cybersecurity experience. The survey feedback indicated the events were not only enjoyable, but also effective at teaching technical skills and concepts through hands-on learning.