Large Language Models as a (Bad) Security Norm in the Context of Regulation and Compliance

• URL: http://arxiv.org/abs/2512.16419v1
• Date: Thu, 18 Dec 2025 11:14:21 GMT
• Title: Large Language Models as a (Bad) Security Norm in the Context of Regulation and Compliance
• Abstract summary: This paper asks how AI can negatively affect cybersecurity and law when used for the design and deployment of security infrastructure.<n>The paper discusses the use of Large Language Models (LLM) in security, either directly or indirectly, and briefly tackles other types of AI.<n>It then lists norms in cybersecurity, then a range of legal cybersecurity obligations from the European Union, to create a frame of reference.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The use of Large Language Models (LLM) by providers of cybersecurity and digital infrastructures of all kinds is an ongoing development. It is suggested and on an experimental basis used to write the code for the systems, and potentially fed with sensitive data or what would otherwise be considered trade secrets. Outside of these obvious points, this paper asks how AI can negatively affect cybersecurity and law when used for the design and deployment of security infrastructure by its developers. Firstly, the paper discusses the use of LLMs in security, either directly or indirectly, and briefly tackles other types of AI. It then lists norms in cybersecurity, then a range of legal cybersecurity obligations from the European Union, to create a frame of reference. Secondly, the paper describes how LLMs may fail to fulfil both legal obligations and best practice in cybersecurity is given, and the paper ends with some economic and practical consequences for this development, with some notions of solutions as well. The paper finds that using LLMs comes with many risks, many of which are against good security practice, and the legal obligations in security regulation. This is because of the inherent weaknesses of LLMs, most of which are mitigated if replaced with symbolic AI. Both also have issues fulfilling basic traceability obligations and practice. Solutions are secondary systems surrounding LLM based AI, fulfilment of security norms beyond legal requirements and simply not using such technology in certain situations.

Related papers

• ReCon: A Resource-Constrained Benchmark for LLM-Based Cybersecurity Compliance Across Ingestion and Retrieval Pipelines [0.6773121102591491]
  Governance failure is one of the major reasons for a weakened cybersecurity posture.<n>The policy document must be in compliance with international or national standards.<n>It is often observed that policy documents are often incomplete with respect to industry standards or regulations.
  arXiv  Detail & Related papers  (2026-07-24T19:53:00Z)
• LLM Scalability Risk for Agentic-AI and Model Supply Chain Security [1.1205855201611814]
  Large Language Models (LLMs) & Generative AI are transforming cybersecurity, enabling both advanced defenses and new attacks.<n>This paper presents a unified analysis integrating offensive and defensive perspectives on GenAI-driven cybersecurity.
  arXiv  Detail & Related papers  (2026-02-22T03:20:49Z)
• Guardrails for trust, safety, and ethical development and deployment of Large Language Models (LLM) [0.0]
  Large Language Models (LLM) are the AI models that are the power house behind generative AI applications such as ChatGPT.<n>They have a propensity to leak private information, produce false information, and can be coerced into generating content that can be used for nefarious purposes.<n>This study proposes a Flexible Adaptive Sequencing mechanism with trust and safety modules, that can be used to implement safety guardrails for the development and deployment of LLMs.
  arXiv  Detail & Related papers  (2026-01-16T20:44:06Z)
• Large Language Models for Cyber Security [0.0]
  This paper studies the integration off Large Language Models into cybersecurity tools and protocols.<n>The main issue discussed in this paper is how traditional rule-based and signature based security systems are not enough to deal with modern AI powered cyber threats.
  arXiv  Detail & Related papers  (2025-11-06T16:25:35Z)
• Safety Compliance: Rethinking LLM Safety Reasoning through the Lens of Compliance [49.50518009960314]
  Existing safety methods rely on ad-hoc taxonomy and lack a rigorous, systematic protection.<n>We develop a new benchmark for safety compliance by generating realistic LLM safety scenarios seeded with legal statutes.<n>Our experiments demonstrate that the Compliance Reasoner achieves superior performance on the new benchmark.
  arXiv  Detail & Related papers  (2025-09-26T12:11:29Z)
• A.S.E: A Repository-Level Benchmark for Evaluating Security in AI-Generated Code [49.009041488527544]
  A.S.E is a repository-level evaluation benchmark for assessing the security of AI-generated code.<n>Current large language models (LLMs) still struggle with secure coding.<n>A larger reasoning budget does not necessarily lead to better code generation.
  arXiv  Detail & Related papers  (2025-08-25T15:11:11Z)
• From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs [5.438441265064793]
  Large Language Models (LLMs) are set to reshape cybersecurity by augmenting red and blue team operations.<n>This position paper maps LLM applications across cybersecurity frameworks such as MITRE ATT&CK and the NIST Cybersecurity Framework (CSF)<n>Key limitations include hallucinations, limited context retention, poor reasoning, and sensitivity to prompts.<n>We recommend maintaining human-in-the-loop oversight, enhancing model explainability, integrating privacy-preserving mechanisms, and building systems robust to adversarial exploitation.
  arXiv  Detail & Related papers  (2025-06-16T12:52:19Z)
• LLM Agents Should Employ Security Principles [60.03651084139836]
  This paper argues that the well-established design principles in information security should be employed when deploying Large Language Model (LLM) agents at scale.<n>We introduce AgentSandbox, a conceptual framework embedding these security principles to provide safeguards throughout an agent's life-cycle.
  arXiv  Detail & Related papers  (2025-05-29T21:39:08Z)
• Automated Consistency Analysis of LLMs [0.1747820331822631]
  Generative AI with large language models (LLMs) are being widely adopted across the industry, academia and government.<n>One of the key challenge to the trustworthiness and reliability of LLMs is: how consistent an LLM is in its responses.<n>This paper proposes two approaches to validate consistency: self-validation, and validation across multiple LLMs.
  arXiv  Detail & Related papers  (2025-02-10T21:03:24Z)
• Emerging Security Challenges of Large Language Models [6.151633954305939]
  Large language models (LLMs) have achieved record adoption in a short period of time across many different sectors.<n>They are open-ended models trained on diverse data without being tailored for specific downstream tasks.<n>Traditional Machine Learning (ML) models are vulnerable to adversarial attacks.
  arXiv  Detail & Related papers  (2024-12-23T14:36:37Z)
• Position: Mind the Gap-the Growing Disconnect Between Established Vulnerability Disclosure and AI Security [56.219994752894294]
  We argue that adapting existing processes for AI security reporting is doomed to fail due to fundamental shortcomings for the distinctive characteristics of AI systems.<n>Based on our proposal to address these shortcomings, we discuss an approach to AI security reporting and how the new AI paradigm, AI agents, will further reinforce the need for specialized AI security incident reporting advancements.
  arXiv  Detail & Related papers  (2024-12-19T13:50:26Z)
• Global Challenge for Safe and Secure LLMs Track 1 [57.08717321907755]
  The Global Challenge for Safe and Secure Large Language Models (LLMs) is a pioneering initiative organized by AI Singapore (AISG) and the CyberSG R&D Programme Office (CRPO) This paper introduces the Global Challenge for Safe and Secure Large Language Models (LLMs), a pioneering initiative organized by AI Singapore (AISG) and the CyberSG R&D Programme Office (CRPO) to foster the development of advanced defense mechanisms against automated jailbreaking attacks.
  arXiv  Detail & Related papers  (2024-11-21T08:20:31Z)
• Proceedings of the Artificial Intelligence for Cyber Security (AICS) Workshop at AAAI 2022 [55.573187938617636]
  The workshop will focus on the application of AI to problems in cyber security. Cyber systems generate large volumes of data, utilizing this effectively is beyond human capabilities.
  arXiv  Detail & Related papers  (2022-02-28T18:27:41Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.