LLMs for Cybersecurity

LLM: Large Language Model

This field studies how large language models can help identify and explain vulnerabilities, interpret threat intelligence and security logs, and support tasks such as incident response and penetration testing. Common approaches include retrieval-augmented generation, cybersecurity domain adaptation, multi-agent workflows, and integration with static analysis, command-line tools, fuzzers, or execution-based verification. Evaluation spans code datasets, CTI and log benchmarks, and interactive cyber ranges, where results often depend on data quality, tool access, prompts, and scoring methods. Models can assist with specific tasks, but unreliable reasoning, weak generalization to real systems, and the dual-use risks of offensive capability remain central challenges.

Latest papers

258 papers32 papers in the last four weeks, up 52% on the four weeks before. 0.2% of all new papers.

Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders
Mar 1, 2026David Campbell, Neil Kale, Udari Madhushani Sehwag +5LLM Safety Alignment LLM Refusal Behavior
Security and Policy Research Lab Scale AI · Security Engineering Scale AI
ATLAS: AI-Assisted Threat-to-Assertion Learning for System-on-Chip Security Verification
Mar 1, 2026Ishraq Tashdid, Kimia Tasnia, Alexander Garcia +2Cybersecurity Formal Hardware Verification
Department of Electrical and Computer Engineering, University of Central Florida · Intel Corporation
AWE: Adaptive Agents for Dynamic Web Penetration Testing
Mar 1, 2026Akshat Singh Jaswal, Ashish BaghelAutomated Penetration Testing LLMs for Cybersecurity
Stux Labs
Enhancing Continual Learning for Software Vulnerability Prediction: Addressing Catastrophic Forgetting via Hybrid-Confidence-Aware Selective Replay for Temporal LLM Fine-Tuning
Feb 27, 2026Xuhui Dou, Hayretdin Bahsi, Alejandro Guerra-ManzanaresSoftware Vulnerability Detection Continual Learning for LLMs
School of Computer Science, University of Nottingham, Nottingham, United Kingdom · School of Informatics and Computing, Northern Arizona University, Flagstaff, United States of America · School of Computer Science, University of Nottingham, Ningbo, China
Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments
Feb 23, 2026Kunal Mukherjee, Spandan MukherjeeLLMs for Cybersecurity LLM Red Teaming
Virginia Tech Blacksburg, Virginia, USA · The University of Texas at Dallas Richardson, Texas, USA
MultiVer: Zero-Shot Multi-Agent Vulnerability Detection
Feb 19, 2026Shreshth RajanSoftware Vulnerability Detection LLMs for Cybersecurity
Harvard College, Cambridge, MA, USA
Benchmarking Zero-Shot Reasoning Approaches for Error Detection in Solidity Smart Contracts
Feb 17, 2026Eduardo Sardenberg, Antonio José Grandson Busson, Daniel de Sousa Moraes +2Software Vulnerability Detection LLMs for Cybersecurity
TeleMídia Lab - PUC-Rio, Rio de Janeiro, RJ - Brazil · BTG Pactual, São Paulo, SP - Brazil · Instituto Militar de Engenharia, Rio de Janeiro, RJ - Brazil
A Content-Based Framework for Cybersecurity Refusal Decisions in Large Language Models
Feb 17, 2026Noa Linder, Meirav Segal, Omer Antverg +5LLM Refusal Behavior Refusal Behavior in Language Models
Irregular · University of Zurich
TrojanGYM: A Detector-in-the-Loop LLM for Adaptive RTL Hardware Trojan Insertion
Jan 23, 2026Saideep Sreekumar, Zeng Wang, Akashdeep Saha +6Backdoor Attacks Adversarial Robustness
NYU Abu Dhabi, Abu Dhabi, UAE · NYU Tandon School of Engineering, New York, USA
From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection
Dec 11, 2025Chaomeng Lu, Bert LagaisseSoftware Vulnerability Detection LLMs for Cybersecurity
DistriNet Group-T, KU Leuven · Leuven, Belgium
Toward Cybersecurity-Expert Small Language Models
Oct 15, 2025Matan Levi, Daniel Ohayon, Ariel Blobstein +3Cyber Threat Intelligence Cybersecurity
1IBM Research.
What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale
Sep 24, 2025Rameen Mahmood, Tousif Ahmed, Sai Teja Peddinti +1Internet of Things LLMs for Cybersecurity
New York University, New York, NY, USA · Google, Mountain View, CA, USA
FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection
Aug 26, 2025Shaswata Mitra, Subash Neupane, Martin Duclos +5Cyber Threat Intelligence Network Intrusion Detection
The University of Alabama · Meharry Medical College · The University of Texas at El Paso
Less Data, More Security: Advancing Cybersecurity LLMs Specialization via Resource-Efficient Domain-Adaptive Continuous Pre-training with Minimal Tokens
Jun 30, 2025Salahuddin Salahuddin, Ahmed Hussain, Jussi Löppönen +1Language Model Pretraining Domain-Adaptive Pretraining
SSH Communications Security, Helsinki, Finland · Aalto University, Espoo, Finland · Networked Systems Security (NSS) Group, KTH Royal Institute of Technology, Stockholm, Sweden
ShIOEnv: A Command Evaluation Environment for Grammar-Constrained Synthesis and Execution Behavior Modeling
May 23, 2025Jarrod Ragsdale, Rajendra BoppanaSynthetic Data Generation for Language Models Cybersecurity
Department of Computer Science, University of Texas at San Antonio, San Antonio, USA.
DMind Benchmark: Toward a Holistic Assessment of LLM Capabilities across the Web3 Domain
Apr 18, 2025Enhao Huang, Pengyu Sun, Shuxun Wang +13LLM Evaluation Software Vulnerability Detection
Zhejiang University Hangzhou, China · The State Key Laboratory of Blockchain and Data Security · DMind.ai Singapore +1
Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study
Jan 30, 2025Yuchen Lei, Yuexin Xiang, Rafael Dowsley +5LLM Evaluation LLMs for Cybersecurity
School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Faculty of Information Technology, Monash University, Clayton, VIC 3800, Australia · CSIRO’s Data61, Eveleigh, NSW 2015, Australia +2
ANVIL: Anomaly-based Vulnerability Identification without Labelled Training Data
Aug 28, 2024Weizhou Wang, Eric Liu, Xiangyu Guo +3Software Vulnerability Detection LLMs for Cybersecurity
University of Toronto, Toronto, Canada

Mar 1, 2026J/K move · Enter open · S save

Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders

David Campbell, Neil Kale, Udari Madhushani Sehwag, Bert Herring+4

Security and Policy Research Lab Scale AI · Security Engineering Scale AI

LLM Safety Alignment LLM Refusal Behavior LLMs for Cybersecurity Over-Refusal

Open paper AskPDF arXiv

Safety alignment in large language models (LLMs), particularly for cybersecurity tasks, primarily focuses on preventing misuse. While this approach reduces direct harm, it obscures a complementary failure mode: denial of assistance to legitimate defenders. We study Defensive Refusal Bias -- the tendency of safety-tuned frontier LLMs to refuse assistance for authorized defensive cybersecurity tasks when those tasks include similar language to an offensive cyber task. Based on 2,390 real-world examples from the National Collegiate Cyber Defense Competition (NCCDC), we find that LLMs refuse defensive requests containing security-sensitive keywords at

2.72\times

the rate of semantically equivalent neutral requests (

p < 0.001

). The highest refusal rates occur in the most operationally critical tasks: system hardening (43.8%) and malware analysis (34.3%). Interestingly, explicit authorization, where the user directly instructs the model that they have authority to complete the target task, increases refusal rates, suggesting models interpret justifications as adversarial rather than exculpatory. These findings are urgent for interactive use and critical for autonomous defensive agents, which cannot rephrase refused queries or retry. Our findings suggest that current LLM cybersecurity alignment relies on semantic similarity to harmful content rather than reasoning about intent or authorization. We call for mitigations that analyze intent to maximize defensive capabilities while still preventing harmful compliance.