Experimental Prompt Engineering Using Structured Language Refinement for Attack Path Analysis

Abstract

Designing cyber-physical systems (CPS) that minimize vulnerabilities is difficult even with security engineering expertise. As a system becomes increasingly complex in terms of size, functionality, or usability, security analysis quickly becomes stale. Reasoning about vulnerability mitigation could be assisted with large language model (LLM) technology. This paper presents a methodology that progressively qualifies LLMs on the task of analyzing systems for attack paths and countermeasures, using Bloom’s Revised Taxonomy as a task-language refinement instrument: each successive rung is treated as a behavioral target to qualify prompt language. The methodology is applied to two open-weight 7–8 billion parameter LLMs deployable on 8GB VRAM hardware. The primary result is diagnostic: at the Understand rung the models default to an enterprise information technology (IT) framing of security terminology, requiring the prompt to carry the cyber-physical context explicitly rather than leaving it to the model’s training. Comparisons of the base task versus reasoning scaffolds such as Chain-of-Thought did not detect an improvement at this parameter scale; a structural analysis of the outputs offers a candidate explanation: models often emitted reasoning after the answer, where it cannot condition the result under autoregressive decoding. As a twomodel pilot, these results bound scope rather than establish generality; future work may re-use the methodology to specify task language within other domains or on LLMs with greater parameter counts.