🤖 AI

Threat Modelling using Domain-Adapted Language Models: Empirical Evaluation and Insights

This paper presents a comprehensive empirical evaluation of domain-adapted Large and Small Language Models for 5G STRIDE threat modelling, revealing that neither domain adaptation nor model scaling consistently ensures reliable performance, thereby highlighting fundamental limitations in current LLMs for structured security tasks and the need for enhanced reasoning and grounding.

Original authors: Saba Pourhanifeh, AbdulAziz AbdulGhaffar, Ashraf Matrawy

Published 2026-05-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Saba Pourhanifeh, AbdulAziz AbdulGhaffar, Ashraf Matrawy

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a group of different-sized robots how to act as security guards for a complex 5G phone network. Your goal is to get them to look at a specific security threat (like a hacker pretending to be a cell tower) and sort it into one of six specific "bins" labeled STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).

This paper is like a report card from a test where the researchers tried out eight different robots to see which one was the best at this job.

Here is the breakdown of their experiment and what they found, using simple analogies:

1. The Contestants: Generalists vs. Specialists

The researchers tested two types of robots:

The Generalists: These are standard, smart robots trained on everything (books, code, news). They are like a librarian who knows a little bit about everything.
The Specialists: These are the same robots, but they were given extra "crash courses" specifically on telecommunications and cybersecurity. They are like that same librarian who also spent the last year reading only 5G manuals and hacker guides.

The Big Question: Does giving the robot a specialized crash course make it better at sorting security threats than just letting it use its general knowledge?

The Result: Surprisingly, no. The "Specialist" robots didn't consistently beat the "Generalist" ones. Sometimes the specialists were better, but often they were just as good (or sometimes worse) than the generalists. It turns out that just knowing the vocabulary of the field isn't enough; the robot needs to know how to think about the problem, not just the facts.

2. Size Matters (But It's Not Everything)

The researchers tested robots of different sizes:

Tiny Robots (1 Billion parameters): Like a smart toddler.
Medium Robots (3 Billion parameters): Like a teenager.
Big Robots (8 Billion parameters): Like a seasoned adult.

The Result: The Big Robots generally did the best job. They were more accurate and made fewer mistakes. However, the paper warns that just making the robot bigger doesn't guarantee perfection. Even the biggest robots still got confused, missed some threats, or gave answers that didn't make sense. Being big helps, but it's not a magic wand.

3. The "Cheat Sheet" (Prompting)

The researchers tried two ways of asking the robots the questions:

Zero-Shot (ZS): Just asking the question directly, like "What bin does this go in?"
Few-Shot (FS): Giving the robot a few examples first, like "Here is a threat that goes in the 'Spoofing' bin. Here is one for 'Tampering'. Now, where does this new one go?"

The Result: Giving the examples (Few-Shot) usually helped the robots get more of the answers right, especially the bigger ones. It was like showing a student a few practice problems before the test. However, for the tiny robots, the examples sometimes confused them, making them perform worse.

4. The "Stress Test" (Decoding Strategies)

The researchers asked the robots to answer the same question in two ways:

Greedy Decoding: The robot picks the single most obvious answer every time. It's like a robot that always chooses the first path it sees.
Stochastic Sampling: The robot is allowed to be a little random. It picks from a list of "good" answers. If you ask it 10 times, it might give you 10 slightly different answers.

The Result: The Stochastic method was a great way to see how unstable the robots were. The tiny robots were very jittery; if you asked them the same question 10 times, they might give 10 different answers. The big robots were much more consistent. This showed that for security work, you need a robot that doesn't flip-flop on its answers.

5. The "Garbage" Problem (Invalid Outputs)

This was a major finding. The researchers didn't just count right or wrong answers; they also looked for nonsense.

Some robots ignored the rules and wrote long essays instead of just picking a bin.
Some robots made up new bins that didn't exist (hallucinations).
Some robots gave an answer in the bin but then wrote an explanation that contradicted it (e.g., "This is Spoofing" but then wrote "This is actually Tampering").
Some robots just gave up and wrote code or blank space.

The Result: The Invalid Output Rate was high, especially for smaller robots and when they weren't given a strict format (like a chat template). The paper concludes that you cannot trust these robots to work alone yet. Even if they get the right answer 60% of the time, if the other 40% of the time they are writing gibberish or contradicting themselves, a human still has to check every single answer.

The Bottom Line

The paper concludes that:

Specialized training alone isn't enough. You can't just feed a robot security books and expect it to be a security expert; it needs to be trained on how to solve the specific puzzle of threat modeling.
Bigger is better, but not perfect. Bigger robots are more reliable, but they still make mistakes.
How you ask matters. Giving examples and strict formatting helps, but it doesn't fix broken robots.
Reliability is key. For security work, a robot that is 80% accurate but 20% "crazy" is dangerous. We need robots that are consistent and follow instructions perfectly, and current technology isn't quite there yet.

In short: These AI models are promising tools for security, but right now, they are like interns who are smart but prone to daydreaming. They need a human supervisor to double-check their work before it's used in the real world.

Technical Summary: Threat Modelling using Domain-Adapted Language Models

Problem Statement

While Large Language Models (LLMs) show promise in cybersecurity applications like vulnerability detection, their efficacy in structured threat modelling remains underexplored. Prior research has largely focused on general-purpose LLMs under limited prompting settings. A critical gap exists in understanding whether domain-adapted models (specifically those trained on telecommunications and cybersecurity corpora) outperform general-purpose counterparts in the context of STRIDE-based threat classification for 5G networks. Furthermore, the impact of model scale, decoding strategies (deterministic vs. stochastic), and prompting techniques (Zero-Shot vs. Few-Shot) on the reliability and validity of structured outputs has not been systematically evaluated.

Methodology

The study presents a comprehensive empirical evaluation involving 52 distinct configurations across 8 instruction-tuned language models (ranging from 1B to 8B parameters). The models included general-purpose LLMs (e.g., Llama-3 variants) and domain-adapted models (Tele-LLMs for telecommunications and Foundation-Sec for cybersecurity).

Experimental Setup

Task: Multi-label classification of 5G threats into the six STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).
Dataset: Six representative 5G threats covering all STRIDE categories, derived from Mahyoub et al. [14].
Prompting Strategies:
- Zero-Shot (ZS): Direct task instruction without examples.
- Few-Shot (FS): Inclusion of in-context examples demonstrating threat classification.
- Chat Templates: Evaluation with and without model-specific chat templates to assess instruction adherence.
Decoding Strategies:
- Greedy Decoding: Deterministic, single-run evaluation.
- Stochastic Sampling: 10 independent runs per threat (Temperature=0.7, Top_p=0.9) to assess output consistency and uncertainty.
Evaluation Metrics:
- Standard classification metrics (Precision, Recall, F1-Score).
- Invalid Output Rate (IOR): The proportion of outputs failing to conform to the required format (e.g., empty responses, hallucinated labels, contradictory explanations).
- Penalized F1-Score: A composite metric defined as $F1 \times (1 - IOR)$ , prioritizing both accuracy and output validity.

Key Contributions

Systematic Evaluation of Domain Adaptation: The paper provides the first comparative analysis of domain-adapted LLMs (Telecom and Cybersecurity) versus general-purpose models specifically for STRIDE-based threat classification.
Analysis of Model Properties: It investigates the interplay between model scale (1B–8B) and decoding strategies, revealing how stochastic sampling exposes classification uncertainty and stability issues in smaller models.
Prompting Technique Impact: The study quantifies the effects of Few-Shot prompting and chat templates on both classification quality and instruction adherence.
Insights on Output Reliability: Beyond standard accuracy, the paper identifies and categorizes specific failure modes (e.g., hallucinated categories, label-explanation contradictions, and lack of graceful abstention) that render model outputs unusable for automated threat modelling.
Practical Prompting Guidelines: Based on empirical observations, the authors propose specific prompting strategies tailored to structured threat modelling to improve output reliability.

Results and Findings

1. Domain Adaptation is Not a Panacea

Contrary to the hypothesis that domain-specific training guarantees superior performance, domain-adapted models did not consistently outperform their general-purpose counterparts. While models like Foundation-Sec-8B-Instruct and Tele-it variants achieved competitive scores in specific settings, general-purpose models (e.g., Llama-3.1-8B-Instruct) often matched or exceeded them, particularly under Few-Shot prompting. This suggests that task-specific reasoning and instruction adherence are as critical as domain knowledge.

2. Model Scale and Decoding Strategy

Scale: Larger models (8B parameters) generally achieved higher Penalized F1-scores and greater stability compared to smaller models (1B and 3B). However, scaling alone did not eliminate classification errors or invalid outputs.
Decoding: Stochastic sampling revealed significant variability in smaller models, which frequently failed to select consistent labels across runs. In contrast, larger models demonstrated more stable label selection.
Few-Shot Prompting: FS prompting generally improved recall and F1-scores for larger models by helping them infer multi-label structures. However, for smaller models (specifically 1B), FS prompting sometimes degraded performance or increased invalid outputs, indicating a capacity limit in interpreting in-context examples.

3. Output Validity and Reliability

A significant portion of the study focuses on Invalid Output Rate (IOR). The results indicate that:

Smaller models and configurations without chat templates produced higher rates of invalid outputs (e.g., explanatory text instead of labels, hallucinated categories, or code generation).
Chat templates did not always improve classification accuracy but significantly improved instruction adherence, reducing the frequency of malformed responses.
None of the evaluated models demonstrated the ability to "gracefully abstain" or express uncertainty when a valid classification could not be determined; they tended to hallucinate labels instead.

Significance and Claims

The paper concludes that current LLMs, even when domain-adapted and scaled, face fundamental limitations in structured threat modelling. The findings challenge the assumption that simply adding more domain-specific training data or increasing model size is sufficient for reliable security automation.

The authors claim that:

Domain adaptation alone is insufficient for structured threat modelling; models require alignment with specific reasoning tasks and output constraints.
Reliability is distinct from accuracy. A model may achieve a reasonable F1-score but still be operationally unreliable due to high rates of invalid or contradictory outputs.
Future improvements must move beyond data scaling to incorporate stronger task-specific reasoning mechanisms and better grounding in security concepts.
Prompt engineering is a critical lever for improving reliability, specifically through the use of Few-Shot examples for larger models and strict formatting constraints (chat templates) to ensure output validity.

The study serves as a cautionary empirical baseline, suggesting that while LLMs can assist in threat modelling, they cannot yet be trusted as autonomous agents without significant human oversight and careful configuration of prompting and decoding parameters.