Shufan Chai | arXiv Science

arXiv2026

Towards an Automated Test of LLM Security Knowledge

Large language models (LLMs) are increasingly used for a range of software, hardware and human-centered security tasks. Consequently, LLM performance on security tasks is an active area of measurement and research, often with a focus on identifying areas in which LLM security "knowledge" may be insufficient. Popular strategies for identifying LLM security knowledge gaps include building corpora of challenge questions or task benchmarks, strategies that require substantial manual work and security expertise to design and execute. We introduce a partially-automated method for assessing LLM knowledge of a security area. The method uses authoritative information from Consumer Protection Agencies (CPAs) to identify instability in LLM responses that can be indicative of knowledge gaps. We demonstrate the method for 2 security topics, identity theft and impostor scams, and 5 LLMs in 2 leading LLM families, Gemini and GPT, using publicly available information about identity theft and impostor scams from 6 CPAs. The method distinguishes between models that have and don't have sufficient knowledge to accurately identify the security topics in text narratives.

cs.CR↗

arXiv2026

Using Codebooks to Detect Cybercrime Topics in Text Narratives

In the United States, management of cybercrime-related consumer complaints increasingly falls on state and city governments given de-staffing of federal agencies. AI, and in particular, large language models (LLMs), shows promise for detecting cybercrime in text complaints, but often via specialized models that local governments are not resourced to develop and maintain. We present an LLM prompting method that uses codebooks from qualitative cybercrime research to detect cybercrime topics in consumer narratives. For two cybercrime topics, impostor scams and identity theft, we demonstrate the method achieves high precision and recall across multiple runs of 5 models in the Gemini and GPT model families. This strategy suggests a path for resource-constrained organizations, like many local governments, to leverage frontier models to support community safety.

cs.CY↗