Skip to content

A systematic evaluation of large language models for autonomous cyber defense

Jul 2026 · Applied intelligence (Boston) · Vol 56 · 0 citations · 29 references

TL;DR

Overall, the results show that LLMs can produce competitive defense policies without fine-tuning but require manually engineered prompts, and their higher variance and slower response times could render them unsuitable for some real-world scenarios.

View source

Similar papers

Jul 2026

Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations

The use of a Large Language Model (LLM) to improve autonomous defensive decision-making within an ACO environment is investigated and an online policy distillation framework is proposed that transfers the LLM's defensive policy into a lightweight RL agent containing only 64,910 parameters, reducing model size by severa...

Konur Tholl, F. Rivest, Mariam El Mezouar et al. · 0 citations
#machine learning Preprint Aug 2026

Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)

Empirical evaluations reveal a fundamental brittleness in existing defenses: with a single trainable 7B planner, Trident reduces blue agent defensive performance by an average of 522% compared to static red agent baselines while autonomously discovering emergent behaviors such as decoy avoidance and adaptive state prio...

Ryozo Masukawa, Ian Bryant, Armita Kazeminajafabadi et al. · 1 citation
Preprint Aug 2026

Proving the Utility of Large Language Models in Cybersecurity Simulations: A Comprehensive Examination

YAML is employed as a structured representation format for simulating complex network configurations, thereby enabling Large Language Model-driven pipelines to support and improve reinforcement learning (RL) agent training, and underscore the transformative potential of integrating LLMs into cybersecurity research.

S. Kampakis, F. Rovai, Marcos Charalambides et al. · 1 citation
Conference Jul 2026

Can LLM Agents Replace Reinforcement Learning Agents in Cyber Defence Automation: A Case Study Using the DARPA CAGE-2 Challenge

As cyber attacks grow more sophisticated, defenders need autonomous systems that are fast, adaptable, and explainable. Over the last decade, various strategies have been proposed for automated cyber defence (as opposed to static rule-based or signature-based), including those based on reinforcement learning (RL). Resea...

Arijit Diganto, S. Lohrasbi, Euclides Carlos Pinto et al. · 0 citations
2026

Cyber Task Automation With Knowledge-Infused Reinforcement Learning and LLM-Guided Policies

As cyber threats continue to evolve, there is a need for Autonomous Cyber Defense (ACD) strategies capable of fast and context-aware responses. Reinforcement learning (RL) has shown promise in automating cyber defense by exploring and learning effective countermeasures. However, RL often struggles with sparse reward si...

Md. Shamim Towhid, Shahrear Iqbal, E. C. Pinto et al. · 0 citations
Review Open access Aug 2026

Adversarial Machine Learning for Secure and Explainable AI Systems: A Comprehensive Review

A systematic analysis of 207 studies selected from 4447 records following the PRISMA 2020 guidelines, covering work published between 2020 and 2026 across cybersecurity and computer vision finds systems that are robust against adaptive adversaries, interpretable under operational constraints, and auditable in environme...

Hajar Ouazza, Fadoua Khennou, Abderrahim Abdellaoui · 0 citations

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.