Search papers, labs, and topics across Lattice.
This paper introduces a partially-automated method for assessing large language models' (LLMs) knowledge of security topics by leveraging authoritative information from Consumer Protection Agencies (CPAs) to detect response instability indicative of knowledge gaps. The approach was validated on two security topics鈥攊dentity theft and impostor scams鈥攁cross five LLMs from the Gemini and GPT families, revealing significant differences in their ability to accurately identify these security issues. The findings highlight the potential for this method to streamline the evaluation of LLMs in security contexts, reducing reliance on manual benchmarking.
LLMs exhibit significant variability in their understanding of security topics, with some models failing to accurately identify critical issues like identity theft and impostor scams.
Large language models (LLMs) are increasingly used for a range of software, hardware and human-centered security tasks. Consequently, LLM performance on security tasks is an active area of measurement and research, often with a focus on identifying areas in which LLM security ``knowledge''may be insufficient. Popular strategies for identifying LLM security knowledge gaps include building corpora of challenge questions or task benchmarks, strategies that require substantial manual work and security expertise to design and execute. We introduce a partially-automated method for assessing LLM knowledge of a security area.The method uses authoritative information from Consumer Protection Agencies (CPAs) to identify instability in LLM responses that can be indicative of knowledge gaps. We demonstrate the method for 2 security topics, identity theft and impostor scams, and 5 LLMs in 2 leading LLM families, Gemini and GPT, using publicly available information about identity theft and impostor scams from 6 CPAs.The method distinguishes between models that have and don't have sufficient knowledge to accurately identify the security topics in text narratives.
