CARE-SD: Explainable Reasoning Architecture for Local SLM Self-Disclosure Analysis in Textual Data

Aisvarya Adeseye; Adeyemi Adeseye; Mohammad Tahir; Jouni Isoaho

cs.CROct 15, 2026

CARE-SD: Explainable Reasoning Architecture for Local SLM Self-Disclosure Analysis in Textual Data

Authors: Aisvarya Adeseye, Adeyemi Adeseye, Mohammad Tahir, Jouni Isoaho

Organizations: Department of Computing, University of Turku, Turku, Finland

Abstract

Cybersecurity interviews uncover critical security experiences, behaviors, and privacy concerns often not fully captured by conventional technical assessments. Consequently, identifying genuine self-disclosures is challenging because statements are context-dependent, categories overlap, and automated interpretations may introduce unsupported claims. Locally deployed Small Language Models (SLMs) protect sensitive participant data by keeping processing within controlled environments, but their limited reasoning capabilities make simple prompting insufficient for context-aware and factually reliable analysis. This study developed CARE-SD (Context-Adaptive Reasoning and Explanation for Self-Disclosure), a novel four-module architecture integrating context-adaptive processing, hierarchical disclosure reasoning, explanation-consistency verification, and cross-batch reconciliation. We evaluated three local SLMs, including Llama 1B, Qwen 1.5B, and Llama 3B, using 82 independently annotated cybersecurity interviews across five organizational sectors. Comparisons included conventional classifiers, three prompting strategies, larger 8B--32B models, and architectural ablations. Two independent reviewers assessed disclosure labels, factual claims, and explanation correctness. CARE-SD improved the accuracy and evidence reliability of SLMs, increasing Llama 3B Macro-F1 from 0.80 to 0.88 while reducing unsupported claims by 60%. Remarkably, the 3B model matched the 20B reference model in category Macro-F1, demonstrating the effectiveness of the architecture without requiring a larger model.

Figures & tables

Fig. 1: The proposed four-module CARE-SD architecture for context-adaptive, explainable self-disclosure analysis using local SLMs. The four-module design separates semantic reasoning from deterministic context management, verification, and aggregation, reducing the complexity of individual SLM tasks while improving classification accuracy, evidence reliability, and consistency across transcript segments.

Split	Interviews	Annotated Responses	C0	C1	C2	C3
Training	58	1,028	240	360	450	420
Validation	12	225	53	80	95	88
Test	12	229	56	81	98	85
Total	82	1,482	349	521	643	593

TABLE I: Dataset statistics and participant-disjoint partitions.

Exp.	Objective	Metrics	Measurement and comparison
E1	Architecture effectiveness: detect and classify disclosures.	$F1=\frac{2TP}{2TP+FP+FN}$ ; $MF1=\frac{1}{3}\sum_{c=1}^{3}F1_{c}$ .	Against adjudicated labels: binary disclosure (C1–C3 versus C0) and mean binary F1 across C1–C3; compare prompting strategies and conventional classifiers.
E2	Hallucination reduction: limit unsupported and contradictory claims.	$UCR=U/N$ ; $CR=C/N$ ; $N=S+U+C$ .	Two blinded human reviewers adjudicated generated claims as supported ( $S$ ), unsupported ( $U$ ), or contradicted ( $C$ ) against source transcripts.
E3	Component ablation: isolate module contributions.	$MF1$ ; $UCR$ (defined above).	Remove each module individually ( $-j$ ); compare with full CARE-SD, keeping the SLM and test set fixed.
E4	Model-scale comparison: assess smaller versus larger models.	$MF1$ ; $UCR$ (defined above).	Evaluate CARE-SD-enhanced 1B–3B SLMs and 8B–32B references on identical held-out samples.
E5	Explanation correctness: assess the validity of explanations.	$ECR=E_{\rm ok}/E_{\rm all}$ .	Two independent reviewers adjudicate correct explanations ( $E_{\rm ok}$ ) among evaluated explanations ( $E_{\rm all}$ ). Sector-wise Macro-F1 was proposed but not available for reporting.

TABLE II: Experimental objectives, metrics, and evaluation procedures.

Conventional classifiers
Model / method	Det. F1	MF1	UCR	CR	ECR
TF-IDF + SVM	.78	.71	–	–	–
DeBERTa-v3-base	.84	.79	–	–	–
Local small language models
Llama 1B / direct	.79	.72	.21	.09	.75
Llama 1B / few-shot	.81	.75	.19	.08	.78

TABLE III: Disclosure classification and factual reliability.

\uparrow

: higher is better;

\downarrow

: lower is better.

Fig. 2: CARE-SD performance: (a) category Macro-F1 across prompting approaches; (b) Macro-F1 versus unsupported claim rate for three SLMs and three larger reference models. Ablation appears in Table IV .

Configuration	Disabled architectural functionality	Macro-F1 $\uparrow$	F1 loss (pp) $\downarrow$	UCR $\downarrow$	UCR rise (pp) $\downarrow$	Relative UCR rise
Full CARE-SD	All four modules enabled: adaptive context, hierarchical reasoning, explanation verification, and cross-batch reconciliation	0.88	–	0.06	–	–
Without M1	Context-adaptive input selection and targeted conversational context expansion	0.84	4	0.11	5	83.3%
Without M2	Hierarchical disclosure detection followed by independent multi-label classification of C1–C3	0.83	5	0.12	6	100.0%
Without M3	Explanation-consistency verification, supporting-quotation checks, and targeted validation of model outputs	0.85	3	0.15	9	150.0%
Without M4	Cross-window reconciliation, overlap handling, and aggregation of disclosure predictions	0.86	2	0.09	3	50.0%

TABLE IV: Component-wise ablation of CARE-SD with Llama-3.2-3B-Instruct (same evaluation data; MF1 higher and UCR lower are better).

Small Language Models

Small language models are compact neural language systems designed to deliver useful text and reasoning capabilities with limited compute, memory, and energy.

See all 276 papers

Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks
Sep 11, 2026Sebastiano Nordio, Michele LottoCybersecurity Small Language Models
Independent · University of Genoa, Via All’Opera Pia, 16145 Genoa, Italy
Decomposing Memorization Reduction in Privacy-Preserving Fine-Tuning of SLMs for CSIRTs
Jun 26, 2026Cristhian Kapelinski, Diego KreutzPrivacy-Preserving Language Models Memorization in Language Models
Federal University of Pampa (UNIPAMPA), Alegrete, Brazil
It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs
May 18, 2026Sangwoo Park, Woongyeong Yeo, Seanie Lee +6Contextual Integrity LLM Alignment
KAIST

Sep 11, 2026J/K move · Enter open · S save

Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks

Sebastiano Nordio, Michele Lotto

Independent · University of Genoa, Via All’Opera Pia, 16145 Genoa, Italy

Cybersecurity Small Language Models LLMs for Cybersecurity

Open paper AskPDF arXiv

The proliferation of highly capable open-weight Small Language Models (SLMs) democratizes access to advanced cybersecurity capabilities, posing an escalating risk as these models can bypass proprietary API guardrails when deployed locally. However, SLMs deployed as autonomous agents often struggle with long-horizon, exploratory tasks like cybersecurity Capture The Flag (CTF) challenges due to context bloat and cognitive degradation from accumulated tool-call outputs. To understand and mitigate this cybersecurity threat, we introduce context segmentation, a two-level agentic framework that divides complex exploitation tasks into manageable, contextually isolated sub-problems. Evaluating on the picoCTF dataset using memory-constrained gemma-4 models, we demonstrate that for the E4B model, our strategy acts as an intelligent search, achieving competitive rewards with superior token efficiency compared to brute-force retries, and successfully solving 18.52% of tasks that standard agentic execution fails to complete. Code is available at https://github.com/9xeb/context-segmentation.

Abstract

Small Language Models

Explore similar work

Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks

Decomposing Memorization Reduction in Privacy-Preserving Fine-Tuning of SLMs for CSIRTs

It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs