LLMs for Cybersecurity

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

19 papers in the last four weeks, up 280% on the four weeks before. 0.2% of all new papers.

Jul 13Week of Sep 28

Latest papers 166

All topics

Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents
Aug 4, 2026Zhenpeng LiIoT Intrusion Detection Cybersecurity
Guangzhou Health Science College, No. 248 Guangyuan Middle Road, Guangzhou, Guangdong 510405, China
DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction
Aug 4, 2026Xuyang Liu, Yibin Han, Zhenwei Zhang +8Retrieval-Augmented Generation LLM Agent Evaluation
KLISS, BNRist, School of Software, Tsinghua University, Beijing, China · CRRC Corporation Limited, Beijing, China
Antares: Foundation Models for Agentic Vulnerability Localization
Aug 3, 2026Supriti Vijay, Aman Priyanshu, Didier Chapoteau +8Software Vulnerability Detection Small Language Models
1Foundation AI–Cisco Systems Inc. · 2Yale University
EntailLLM: Verifying LLM-Generated Vulnerability Discovery Paths with Domain Knowledge via Logic Programming
Aug 3, 2026Kaustuv Mukherji, Jaikrishna Manojkumar Patil, Colton Payne +4Logic Programming Software Vulnerability Detection
Syracuse University · HRL Laboratories
MITRE-SAGE: A Multi-Agent Cybersecurity Question-Answering Model
Aug 3, 2026Ali Habibzadeh, Farid Feyzi, Reza Ebrahimi AtaniRetrieval-Augmented Generation Multi-Agent LLM Systems
Department of Computer Engineering University of Guilan Rasht, Iran
From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness
Aug 1, 2026Jonas Thurner, Nadine Jost, Stefan Albert Horstmann +4Cybersecurity LLMs for Cybersecurity
FH Münster, Germany · Ruhr University Bochum, Germany · University of Cologne, Germany +2
Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations
Jul 30, 2026Konur Tholl, François Rivest, Mariam El Mezouar +2Autonomous Cyber Defense LLM-Guided RL
Department of Electrical and Computer Engineering, Royal Military College of Canada, Kingston, Canada · Department of Mathematics and Computer Science, Royal Military College of Canada, Kingston, Canada · Defence Research and Development Canada, Ottawa, Canada +1
Cybersecurity Detection Classification with Reasoning-enabled Language Models
Jul 30, 2026Amol Khanna, Manu Nandan, Cristian Viorel Popa +10CoT Reasoning Language Model Calibration
CrowdStrike
PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis
Jul 30, 2026Xavier Marjou, Lucas Tamic, Ilan Jaffeux-ChenioutEncrypted Network Traffic Analysis Cybersecurity
Orange
ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping
Jul 29, 2026Cristian Leo, Anton Dykyi, Danny Cortegaca +2LLMs for Cybersecurity
Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA, 98109, United States · Amazon Web Services EMEA SARL, UK Branch, 1 Principal Place, Worship Street, London, EC2A 2FA, United Kingdom
HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models
Jul 29, 2026Petr Simecek, Elnaz Babayeva, Jiri Balhar +23Software Vulnerability Detection LLMs for Cybersecurity
AISLE, San Francisco, CA, USA and Prague, Czech Republic · Central European Institute of Technology, Masaryk University, Brno, Czech Republic
KQFuzz: Knowledge-Guided Fuzzing for Quantum Libraries via Large Language Models
Jul 28, 2026Fuyuan Xia, Qixin Zhang, Chenhao Ying +5Automated Software Testing LLMs for Cybersecurity
1Shanghai Jiao Tong University · 2Nanyang Technological University · 3Hong Kong University of Science and Technology +1
The Disruptive Impact of Large Language Models on Capture the Flag Competitions and the Path Toward Fair Play
Jul 28, 2026Michael Macaulay, Harmony Bouabid, Guo Gen Ang +1Cybersecurity LLMs for Cybersecurity
WMG, University of Warwick, Coventry, United Kingdom
DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense
Jul 27, 2026Trung V. Phan, Tri Gia Nguyen, Thomas BauschertCybersecurity LLMs for Cybersecurity
Chair of Communication Networks, Technische Universität Chemnitz, 09126 Chemnitz, Germany · Department of Information Assurance, FPT University, Da Nang 50509, Vietnam
Every Model Cheats: Prompt-Level Mitigation of Cheating on Offensive Cyber Tasks
Jul 23, 2026Michael Kouremetis, Ads Dawson, Raja Sekhar Rao Dheekonda +1LLM Auditing Deception in Language Models
dreadnode, Principal AI Research Engineer · dreadnode, StaffAI Security Researcher · dreadnode, Distinguished Engineer +1
From Evaluation to Optimisation: Hierarchy-Aware Training Signals for CWE Prediction in Python
Jul 23, 2026Muntasir Adnan, Manile Srun, Carlos C. N. KuhnSoftware Vulnerability Detection LLMs for Cybersecurity
Open Source Institute, Faculty of Science and Technology, University of Canberra, Canberra, Australia.
Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models
Jul 23, 2026Shoya Otsu, Kei Suzuki, Toshiaki Koike-Akino +2Online Anomaly Detection LLMs for Cybersecurity
Mitsubishi Electric Corporation, Japan. · Mitsubishi Electric Research Laboratories, Cambridge, MA, USA.
Evaluating Large Language Models for Symbolic Security Protocol Analysis
Jul 22, 2026Paolo Modesti, Syed Ahmed, Ioannis Sfyrakis +1LLM Evaluation Cybersecurity
Teesside University, Middlesbrough, United Kingdom
Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA
Jul 21, 2026Shaswata Mitra, Subash Neupane, Trisha Chakraborty +4LLM Evaluation LLM Fine-Tuning
The University of Alabama · Meharry Medical College · Mississippi State University +1
Semi-Automated Detection of Gaps in LLM Security Knowledge
Jul 20, 2026Shufan Chai, Liangliang Sun, Jessica StaddonLLM Auditing LLMs for Cybersecurity
Northeastern University Oakland, CA, USA
Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities
Jul 17, 2026Md Erfan, Ahmed Ryan, Md Kamal Hossain Chowdhury +1Cybersecurity LLMs for Cybersecurity
Department of Computer Science, The University of Alabama, Tuscaloosa, USA · Alabama Water Institute, The University of Alabama, Tuscaloosa, USA
Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection
Jul 15, 2026Zhenpeng LiRandomized Smoothing Network Intrusion Detection
AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration
Jul 13, 2026Arastoo Zibaeirad, Marco Vieira, Thomas ZimmermannSoftware Vulnerability Detection Static Code Analysis
University of North Carolina at Charlotte · Charlotte, NC, USA · University of California, Irvine +1
Operational Evidence Gaps for LLMs in Fraud Detection and Trust-and-Safety Workflows
Jul 12, 2026Keyur GabaniLLM Evaluation Financial Fraud Detection
SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification
Jul 10, 2026Ivan Alejandro Montoya Sanchez, Anantaa Kotal, Aritran PiplaiZero-Shot Learning Cyber Threat Intelligence
The University of Texas at El Paso
Secret Scanner Agent: Extracting Secrets and Access Context from Unstructured Documents
Jul 10, 2026Zixiao Chen, Mariko Wakabayashi, Charlotte SiskaDocument Information Extraction LLMs for Cybersecurity
Microsoft, Redmond, WA, USA
From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure
Jul 9, 2026Lea Roxanne Muth, Marian MargrafCybersecurity LLMs for Cybersecurity
Department of Mathematics and Computer Science Freie Universität Berlin Berlin, Germany
Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies
Jul 8, 2026Kiarash Ahi, Saeed ValizadehLLM Security LLMs for Cybersecurity
Virelya Intelligence Research Labs, San Francisco Bay Area, California · Google, Mountain View, California
Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis
Jul 7, 2026Mingchen Li, Meikang Qiu, Zifan Peng +4Software Vulnerability Detection LLMs for Cybersecurity
University of North Texas, USA · Augusta University, USA · Newcastle University, United Kingdom
TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction
Jul 6, 2026Mouhamed Amine Bouchiha, Gregory BlancKG Construction Multi-Agent LLM Systems
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris

Aug 4, 2026, cs.CRJ/K move · Enter open · S save

Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents

Zhenpeng Li

Guangzhou Health Science College, No. 248 Guangyuan Middle Road, Guangzhou, Guangdong 510405, China

IoT Intrusion Detection Cybersecurity Conformal Prediction LLMs for Cybersecurity LLM Agent Reliability

Open paper AskPDF arXiv

Autonomous security agents operate as staged pipelines, such as classifying network traffic and then attributing attacks to a specific technique. Split conformal prediction gives each stage finite-sample coverage, but deployment requires a trajectory-level guarantee across the full chain. These guarantees do not compose automatically when stages are independently trained and calibrated. Bonferroni allocation is distribution-free but conservative under correlated errors. We show that a natural pairwise-correlation extension to three or more stages is invalid because it gives a lower rather than an upper bound, and derive a valid spanning-tree alternative. We distinguish whether stages are dependent from whether an audit sample is large enough to certify that dependence, and give matching upper and information-theoretic lower sample-complexity bounds. We also show that coarse-to-fine label selection can create near-perfect measured correlation without learned dependence. On a two-stage intrusion-detection pipeline across 6 open LLMs and 2 datasets, removing this artifact reduces measured correlation from near 1 to 0-0.78. A direct audit of trajectory failure becomes 13.7% tighter than Bonferroni once the audit reaches the required sample size, but is worse when undersized. A modular certificate using per-stage certificates and a pairwise overlap bound yields a positive average gain of 0.6%, quantifying the cost of lacking joint access. Same-model, cross-model, and permuted-pairing tests show that residual dependence reflects shared sample difficulty, not shared model representations. Average trajectory coverage across 12 configurations is 92.7% +/- 2.4% at alpha = 0.10. Under cross-dataset deployment, single-step miscoverage reaches 100% even when accuracy remains 78%, showing that distribution shift destroys calibrated confidence before raw accuracy.

Momentum

Related topics

Latest papers 166