Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts

• URL: http://arxiv.org/abs/2609.00578v1
• Date: Tue, 01 Sep 2026 02:16:56 GMT
• Title: Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts
• Abstract summary: Large Language Models (LLMs) can solve complex problems, but their misuse in high-risk domains can lead to severe consequences.<n>We introduce 3R-Bench, a benchmark of 150 real-world cybersecurity requests augmented with two adversarial conversational settings.
• Score: 25.330089031016076
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large Language Models (LLMs) can solve complex problems, but their misuse in high-risk domains can lead to severe consequences. Model providers therefore restrict assistance for potentially harmful requests. Refusing all cybersecurity requests would therefore harm legitimate users. Providers need a mechanism to block malicious use without denying legitimate assistance to defenders. Existing cybersecurity-specific datasets evaluate this mechanism, but none considers the conversational context of a request. We introduce 3R-Bench (Refusal, Repetition, and Revision), a benchmark of 150 real-world cybersecurity requests augmented with two adversarial conversational settings, and evaluate eight LLMs on it. Prior assistant behavior strongly changes responses to an unchanged request: among 376 available pairs from a 400-pair panel, compliance rises from 62.0% after refused history to 85.1% after accepted history. The opposite pattern appears under dialogue decomposition. In comparison, compliance falls from 501/800 direct responses to 172/800 after dialogue; among 738 pairs returning model-authored text in both conditions, the decrease is 45.1 points. Failure feedback recovers only a small fraction of this loss.

Related papers

• How AI Models Manage Epistemic Authority: A Taxonomy and Comparative Analysis of Responses to User Disagreement [0.573978744524696]
  We study how a model manages its authority, referring here to its claim to knowledge, competence, or the right to advise, once a user challenges its answer.<n>We construct a new dataset of 2,310 controlled challenge scenarios and 32,340 corresponding responses from 14 models.<n>We find that models show conflicting behaviour: they validate users in 85% of responses but maintain their original claim in 65%.
  arXiv  Detail & Related papers  (2026-09-07T15:47:29Z)
• TAF-MED: Multi-Turn Safety Refusal Collapse in LLMs Under Declared Self-Treatment Intent [0.0]
  We introduce TAF-MED, a physician-reviewed benchmark of 500 fixed three-turn scenarios.<n>We evaluate eight large language models (LLMs) across 4,000 conversations.
  arXiv  Detail & Related papers  (2026-08-10T21:43:58Z)
• PsychoSafe: Eliciting Psychologically-Informed Refusals in Large Language Models [20.805546078350524]
  PsychoSafe reframes refusal as structured supportive communication grounded in evidence-based intervention strategies.<n>On a validation set of 500 prompts, PsychoSafe prompting improves overall refusal quality by 28.1% over a generic baseline.<n>Fine-tuning achieves near-perfect refusal and resource-referral rates but reduces response relevance.
  arXiv  Detail & Related papers  (2026-06-08T16:19:18Z)
• A New Framework for Cybersecurity Refusals in AI Agents [52.94784168139071]
  We present the first framework for establishing refusal boundaries in offensive security contexts.<n>We apply this framework to assess how current LLM-powered agents adhere to appropriate refusal boundaries across a range of web-based offensive security scenarios.
  arXiv  Detail & Related papers  (2026-05-31T15:39:39Z)
• Code as a Weapon: A Consensus-Labeled Prompt Bank for Measuring Coding-Model Compliance with Malicious-Code Requests [0.0]
  Coding-specialized models should clear a higher refusal bar than general-purpose chat models.<n>Eight corpora (ASTRA, CySecBench, AdvBench/harmful_behaviors, JailbreakBench, MalwareBench, RedCode, RMCBench, Scam2Prompt) are consolidated and classified under a five-judge consensus protocol.<n>The bank is the validated instrument the field has lacked: a reliability-quantified basis for testing whether coding models meet the stricter refusal standard.
  arXiv  Detail & Related papers  (2026-05-27T16:55:15Z)
• Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents [64.80318459073526]
  We show that adversarial content can persist across interactions served by the same agent, making such threats harder to detect and mitigate.<n>Specifically, adversarial content may persist in the agent state, remain dormant across interactions, and later be activated by a benign user query.<n>We formalize this type of safety threat as Sleeper Attack. To evaluate it, we construct a benchmark with 1,896 instances covering six real-world harmful outcomes, three attack strategies, and three agent state targets.
  arXiv  Detail & Related papers  (2026-05-27T09:25:37Z)
• ProactBench: Beyond What The User Asked For [5.422521416406412]
  ProactBench decomposes it into three phase-tied types: textscEmergent, inference from a single disclosed anchor; textscCritical, synthesis across multiple anchors; and textscRecovery, grounded forward-looking value after task completion.<n>Our information asymmetries defend against style-confounding scoring, leakage, external-context contamination, and information dumps.
  arXiv  Detail & Related papers  (2026-05-09T23:56:04Z)
• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition [48.32744727426218]
  LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories.<n>This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness.<n>We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings.
  arXiv  Detail & Related papers  (2026-03-16T14:49:36Z)
• Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders [1.038167357593269]
  Safety alignment in large language models (LLMs) primarily focuses on preventing misuse.<n>We study Defensive Refusal Bias -- the tendency of safety-tuned frontier LLMs to refuse assistance for authorized defensive cybersecurity tasks.<n>Highest refusal rates occur in the most operationally critical tasks: system hardening (43.8%) and malware analysis (34.3%)
  arXiv  Detail & Related papers  (2026-03-01T19:53:19Z)
• Learning to Extract Context for Context-Aware LLM Inference [60.376872353918394]
  User prompts to large language models (LLMs) are often ambiguous or under-specified.<n> contextual cues shaped by user intentions, prior knowledge, and risk factors influence what constitutes an appropriate response.<n>We propose a framework that extracts and leverages such contextual information from the user prompt itself.
  arXiv  Detail & Related papers  (2025-12-12T19:10:08Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• AutoReply: Detecting Nonsense in Dialogue Introspectively with Discriminative Replies [71.62832112141913]
  We show that dialogue models can detect errors in their own messages introspectively, by calculating the likelihood of replies that are indicative of poor messages. We first show that hand-crafted replies can be effective for the task of detecting nonsense in applications as complex as Diplomacy. We find that AutoReply-generated replies outperform handcrafted replies and perform on par with carefully fine-tuned large supervised models.
  arXiv  Detail & Related papers  (2022-11-22T22:31:34Z)
• Counterfactual Off-Policy Training for Neural Response Generation [94.76649147381232]
  We propose to explore potential responses by counterfactual reasoning. Training on the counterfactual responses under the adversarial learning framework helps to explore the high-reward area of the potential response space. An empirical study on the DailyDialog dataset shows that our approach significantly outperforms the HRED model.
  arXiv  Detail & Related papers  (2020-04-29T22:46:28Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.