mlsanityData to 13 Oct 2026

Large Language Models Are Unreliable for Cyber Threat Intelligence

arXiv 2503.23175 ↗First posted 29 Mar 2025cs.CR cs.AI cs.LGcited by 5

Not on the map. Why?

Abstract (arXiv)

Several recent works have argued that Large Language Models (LLMs) can be used to tame the data deluge in the cybersecurity field, by improving the automation of Cyber Threat Intelligence (CTI) tasks. This work presents an evaluation methodology that other than allowing to test LLMs on CTI tasks when using zero-shot learning, few-shot learning and fine-tuning, also allows to quantify their consistency and their confidence level. We run experiments with three state-of-the-art LLMs and a dataset of 350 threat intelligence reports and present new evidence of potential security risks in relying on LLMs for CTI. We show how LLMs cannot guarantee sufficient performance on real-size reports while also being inconsistent and overconfident. Few-shot learning and fine-tuning only partially improve the results, thus posing doubts about the possibility of using LLMs for CTI scenarios, where labelled datasets are lacking and where confidence is a fundamental factor.

Key facts. Cited by 5 papers in the map (data through 13 Oct 2026). Builds on 36 of its 72 references that are in the map. First posted on arXiv 29 Mar 2025.

Builds on

36 of 72 references.

References · 36

  1. 2020Language Models are Few-Shot Learnerscited by 32,320
  2. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,376
  3. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,221
  4. 2017On Calibration of Modern Neural Networkscited by 4,902
  5. 2022Large Language Models are Zero-Shot Reasonerscited by 4,348
  6. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,594
  7. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,417
  8. 2023Semantic Uncertainty: Linguistic Invariances for Uncertainty Estimation in Natural Language Generationcited by 810
  9. 2024Large Language Model based Multi-Agents: A Survey of Progress and Challengescited by 758
  10. 2020How Can We Know When Language Models Know? On the Calibration of Language Models for Question Answeringcited by 440
  11. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 357
  12. 2023Generating with Confidence: Uncertainty Quantification for Black-box Large Language Modelscited by 289
24 more
  1. 2024ReFT: Reasoning with Reinforced Fine-Tuningcited by 237
  2. 2020Selective Question Answering under Domain Shiftcited by 231
  3. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 192
  4. 2023Few-shot Fine-tuning vs. In-context Learning: A Fair Comparison and Evaluationcited by 134
  5. 2023LM-Polygraph: Uncertainty Estimation for Language Modelscited by 131
  6. 2024Benchmarking LLMs via Uncertainty Quantificationcited by 126
  7. 2024The Good, The Bad, and The Greedy: Evaluation of LLMs Should Not Ignore Non-Determinismcited by 115
  8. 2024CyberMetric: A Benchmark Dataset based on Retrieval-Augmented Generation for Evaluating LLMs in Cybersecurity Knowledgecited by 55
  9. 2024Calibration and Correctness of Language Models for Codecited by 49
  10. 2024Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Modelscited by 44
  11. 2024Unveiling the Secret Recipe: A Guide For Supervised Fine-Tuning Small LLMscited by 40
  12. 2023The Janus Interface: How Fine-Tuning in Large Language Models Amplifies the Privacy Riskscited by 36
  13. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
  14. 2024SEvenLLM: Benchmarking, Eliciting, and Enhancing Abilities of Large Language Models in Cyber Threat Intelligencecited by 21
  15. 2024Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaignscited by 19
  16. 2024Can We Trust LLMs? Mitigate Overconfidence Bias in LLMs through Knowledge Transfercited by 19
  17. 2023AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generationcited by 16
  18. 2024Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Modelscited by 14
  19. 2023STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reportscited by 10
  20. 2023"False negative -- that one is going to kill you": Understanding Industry Perspectives of Static Analysis based Security Testingcited by 8
  21. 2024Make Prompts Adaptable: Bayesian Modeling for Vision-Language Prompt Learning with Data-Dependent Priorcited by 8
  22. 2021Threat Actor Type Inference and Characterization within Cyber Threat Intelligencecited by 3
  23. 2022Software Updates Strategies: a Quantitative Evaluation against Advanced Persistent Threatscited by 3
  24. 2022Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sectorcited by 2

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2025: 1; 2026: 4.

5 papers.

  1. 2025On LLMs' Internal Representation of Code Correctnesscited by 5
  2. 2026Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reportscited by 1
  3. 2026RefinementEngine: Automating Intent-to-Device Filtering Policy Deployment under Network Constraintscited by 0
  4. 2026From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readinesscited by 0
  5. 2026BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligencecited by 0