{"id":"https://openalex.org/W4416258627","doi":"https://doi.org/10.1145/3733799.3762968","title":"CyberLLMInstruct: A Pseudo-Malicious Dataset Revealing Safety-Performance Trade-offs in Cyber Security LLM Fine-tuning","display_name":"CyberLLMInstruct: A Pseudo-Malicious Dataset Revealing Safety-Performance Trade-offs in Cyber Security LLM Fine-tuning","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W4416258627","doi":"https://doi.org/10.1145/3733799.3762968"},"language":"en","primary_location":{"id":"doi:10.1145/3733799.3762968","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762968","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3733799.3762968","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5107375816","display_name":"Adel ElZemity","orcid":null},"institutions":[{"id":"https://openalex.org/I20581793","display_name":"University of Kent","ror":"https://ror.org/00xkeyj56","country_code":"GB","type":"education","lineage":["https://openalex.org/I20581793"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Adel ElZemity","raw_affiliation_strings":["School of Computing, University of Kent, Canterbury, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-5402-7837","affiliations":[{"raw_affiliation_string":"School of Computing, University of Kent, Canterbury, United Kingdom","institution_ids":["https://openalex.org/I20581793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025663670","display_name":"Budi Arief","orcid":"https://orcid.org/0000-0002-1830-1587"},"institutions":[{"id":"https://openalex.org/I20581793","display_name":"University of Kent","ror":"https://ror.org/00xkeyj56","country_code":"GB","type":"education","lineage":["https://openalex.org/I20581793"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Budi Arief","raw_affiliation_strings":["School of Computing, University of Kent, Canterbury, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-1830-1587","affiliations":[{"raw_affiliation_string":"School of Computing, University of Kent, Canterbury, United Kingdom","institution_ids":["https://openalex.org/I20581793"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100745576","display_name":"Shujun Li","orcid":"https://orcid.org/0000-0001-5628-7328"},"institutions":[{"id":"https://openalex.org/I20581793","display_name":"University of Kent","ror":"https://ror.org/00xkeyj56","country_code":"GB","type":"education","lineage":["https://openalex.org/I20581793"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Shujun Li","raw_affiliation_strings":["School of Computing, University of Kent, Canterbury, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0001-5628-7328","affiliations":[{"raw_affiliation_string":"School of Computing, University of Kent, Canterbury, United Kingdom","institution_ids":["https://openalex.org/I20581793"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I20581793"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"77","last_page":"88"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5655999779701233,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5655999779701233,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.125,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.10249999910593033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6521000266075134},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.605400025844574},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5745999813079834},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.5583000183105469},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.531000018119812},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.44589999318122864},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.37940001487731934},{"id":"https://openalex.org/keywords/critical-infrastructure","display_name":"Critical infrastructure","score":0.3301999866962433},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.30309998989105225}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7689999938011169},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6521000266075134},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6230000257492065},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.605400025844574},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5745999813079834},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.5583000183105469},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.531000018119812},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.44589999318122864},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.37940001487731934},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.3301999866962433},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.30309998989105225},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.2955000102519989},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.2856999933719635},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.2824999988079071},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2759000062942505},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.27570000290870667},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.273499995470047},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.27090001106262207},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C2985105721","wikidata":"https://www.wikidata.org/wiki/Q13479512","display_name":"Incident response","level":2,"score":0.25940001010894775},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.2590000033378601},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.25600001215934753},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.2540000081062317},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.251800000667572},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.25130000710487366},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.2508000135421753},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3733799.3762968","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762968","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2503.09334","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2503.09334","pdf_url":"https://arxiv.org/pdf/2503.09334","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:kar.kent.ac.uk:113336","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762968>)","pdf_url":"https://kar.kent.ac.uk/113336/1/AISec2025-AAM.pdf","source":{"id":"https://openalex.org/S4377196264","display_name":"Kent Academic Repository (University of Kent)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I20581793","host_organization_name":"University of Kent","host_organization_lineage":["https://openalex.org/I20581793"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference proceeding"}],"best_oa_location":{"id":"doi:10.1145/3733799.3762968","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762968","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2055966976","display_name":"Countering HArms caused by Ransomware in the Internet Of Things (CHARIOT)","funder_award_id":"EP/X036707/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320314731","display_name":"UK Research and Innovation","ror":"https://ror.org/001aqnf71"},{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0,91],"integration":[1],"of":[2,23,110,120],"large":[3],"language":[4],"models":[5,73],"(LLMs)":[6],"into":[7],"cyber":[8,29,54,111],"security":[9,30,55,81,112],"applications":[10],"presents":[11],"both":[12],"opportunities":[13],"and":[14,37,74,103,126],"critical":[15,49,129],"safety":[16,68,140],"risks.":[17],"We":[18],"introduce":[19],"CyberLLMInstruct,":[20],"a":[21,48],"dataset":[22,92],"54,928":[24],"pseudo-malicious":[25],"instruction-response":[26],"pairs":[27],"spanning":[28],"tasks":[31],"including":[32,96],"malware":[33],"analysis,":[34],"phishing":[35],"simulations,":[36],"zero-day":[38],"vulnerabilities.":[39],"Our":[40,114],"comprehensive":[41,108],"evaluation":[42],"using":[43],"seven":[44],"open-source":[45],"LLMs":[46,122],"reveals":[47],"trade-off:":[50],"while":[51],"fine-tuning":[52,133],"improves":[53],"task":[56],"performance":[57,137],"(achieving":[58],"up":[59],"to":[60,89,106],"92.50%":[61],"accuracy":[62],"on":[63],"CyberMetric),":[64],"it":[65],"severely":[66],"compromises":[67],"resilience":[69],"across":[70],"all":[71],"tested":[72],"attack":[75],"vectors":[76],"(e.g.,":[77],"Llama":[78],"3.1":[79],"8B\u2019s":[80],"score":[82],"against":[83],"prompt":[84],"injection":[85],"drops":[86],"from":[87],"0.95":[88],"0.15).":[90],"incorporates":[93],"diverse":[94],"sources":[95],"CTF":[97],"challenges,":[98],"academic":[99],"papers,":[100],"industry":[101],"reports,":[102],"CVE":[104],"databases":[105],"ensure":[107],"coverage":[109],"domains.":[113,144],"findings":[115],"highlight":[116],"the":[117,128],"unique":[118],"challenges":[119],"securing":[121],"in":[123,142],"adversarial":[124],"domains":[125],"establish":[127],"need":[130],"for":[131],"developing":[132],"methodologies":[134],"that":[135],"balance":[136],"gains":[138],"with":[139],"preservation":[141],"security-sensitive":[143]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}