💻 computer science

Data-Centric Benchmarking of Exploit Generation in LLMs: Understanding the Impact of Fine-Tuning

This paper presents a data-centric benchmarking study demonstrating that fine-tuning a compact 8B open-weight model on high-quality, curated data significantly improves CVE-conditioned exploit generation, achieving performance comparable to proprietary models and highlighting that data quality and evaluation design are as critical as model scale for cybersecurity applications.

Original authors: Yiwei Chen, Lichi Li, Kai Cheung, Vinny Parla, Ganesh Sundaram

Published 2026-06-16

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yiwei Chen, Lichi Li, Kai Cheung, Vinny Parla, Ganesh Sundaram

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a very smart, but slightly scattered, apprentice how to build a specific type of lockpick. The "lock" in this story is a software vulnerability (a bug in a computer program), and the "lockpick" is a Proof-of-Concept (PoC) exploit—a small piece of code that proves the bug exists and shows how it could be used.

This paper is about a team of researchers at Cisco and Michigan State University who decided to stop worrying about how big the apprentice's brain is (the size of the AI model) and started worrying about the quality of the training manual they were using.

Here is the story of their findings, broken down into simple parts:

1. The Problem: A Messy Library

The researchers started with a massive library of information about software bugs (called CVEs). However, this library was a disaster.

The Mess: The information was scattered across different websites, written in confusing formats, and often incomplete. Some "lockpicks" (exploits) found in the wild were broken, missing instructions, or just plain nonsense.
The Old Way: Most people tried to solve this by hiring bigger and bigger "super-apprentices" (massive AI models) and hoping they could figure it out. But these super-apprentices are expensive to run, often refuse to do the job because they are "too safe," and still make mistakes because the instructions they get are messy.

2. The Solution: The "Data-Centric" Kitchen

Instead of buying a bigger chef, the researchers decided to clean up the ingredients. They built a Data-Centric Framework, which is like a high-tech kitchen assembly line:

Stage 1: Sorting: They gathered all the messy notes and standardized them into a single, clean format (like turning handwritten notes into a typed recipe).
Stage 2: Filtering: They threw away the bad recipes. If an exploit didn't make sense or was too dangerous to test, it was tossed out.
Stage 3: The "Teacher" Edit: They used a very smart AI (a "Teacher") to rewrite the remaining recipes. The Teacher didn't just copy them; it fixed the logic, clarified the steps, and made sure the "lockpick" was actually buildable.

3. The Experiment: Testing the Students

Once they had a clean, high-quality set of recipes, they tested 17 different AI models (from tiny ones to massive ones) to see how well they could build the lockpicks.

The Judge: They didn't use a human to grade every single attempt (that would take forever). Instead, they used another AI as a "Judge." This Judge had a strict 8-point checklist to grade the lockpicks on things like:
- Did it actually hit the right target?
- Could you run it again and get the same result?
- Was it safe (didn't it accidentally destroy the whole computer)?
- Was the code clear and logical?

4. The Big Surprise: Small is Beautiful

Here is the most important part of the paper:

The Result: They took a relatively small, compact AI model (called Qwen3-8B) and fine-tuned it using their clean, high-quality recipes.
The Outcome: This small, trained model became 42.5% better at building lockpicks than it was before. In fact, after training, this small model performed almost as well as some of the giant, expensive "super-apprentices" that cost thousands of dollars to run.
The Catch: The training worked wonders for complex tasks (like Remote Code Execution, which is like picking a high-security vault). However, for simpler tasks (like Path Traversal, which is more like finding an unlocked back door), the training didn't help much and sometimes even made things slightly worse.

5. The Takeaway

The paper concludes that in the world of cybersecurity AI, data quality is just as important as model size.

Think of it like this: You can give a genius a messy, contradictory instruction manual, and they will fail. But if you give a smart, average student a crystal-clear, perfectly written manual, they can often outperform the genius.

The researchers proved that by focusing on cleaning the data and structuring the lessons, you can create efficient, reliable AI tools for finding software bugs without needing to spend a fortune on massive, energy-hungry super-computers.

In short: Don't just make the AI bigger; make the training data better. That's the secret sauce.

Technical Summary: Data-Centric Benchmarking of Exploit Generation in LLMs

Problem Formulation

The paper addresses the task of CVE-conditioned exploit generation, defined as the synthesis of structured proof-of-concept (PoC) exploits given heterogeneous software vulnerability context. While recent Large Language Models (LLMs) have demonstrated capabilities in discovering vulnerabilities, practical limitations persist in exploit generation:

Resource Intensity: Frontier models often require massive API costs and compute resources for low success rates (e.g., Anthropic's collaboration with Mozilla incurred ~$4,000 for two successful generations).
Safety Refusals: Strong safety alignment in modern models leads to high refusal rates for exploit generation tasks (e.g., >82% for GPT-5 in early tests).
Data and Evaluation Gaps: Existing approaches are largely model-centric, under-exploring the impact of data quality and structured supervision. There is a lack of unified benchmarks enabling controlled, reproducible comparisons across models and scales.

The authors formalize the task where a model $f_\theta$ maps a contextual prompt $x_{c,k}$ (aggregating CVE descriptions, metadata, advisories, and code artifacts) to a structured output $y_{c,k} = (s_{c,k}, a_{c,k})$ , consisting of a concise exploit summary ( $s$ ) and a structured artifact/code snippet ( $a$ ).

Methodology

1. Data-Centric Framework

The core contribution is a multi-stage data refinement pipeline designed to transform fragmented, noisy raw CVE data into high-quality structured supervision:

Standardization: Aggregating features from multiple sources (CVE, NVD, GHSA, GitHub) into unified JSON templates.
Quality Control: Applying deterministic filtering and CWE-aware heuristic selection (regex/pattern matching) to remove non-textual or weakly associated samples.
Semantic Refinement: Utilizing a "Teacher" LLM to rewrite labels, separate code from descriptive text, and consolidate fragmented implementations into executable scripts. This process includes "Offline Label Denoising," where the teacher treats raw data as auxiliary guidance rather than ground truth to improve logical consistency.

2. Evaluation Pipeline

The authors introduce a scalable evaluation framework using LLM-as-a-Judge (specifically GPT-5.2) with a fine-grained, 8-criterion rubric. The criteria are weighted by priority:

High Priority: Targeting Accuracy, Reproducibility & Determinism, Environment Safety & Side-effects, Provability & Verification.
Medium Priority: Logic Flow Clarity, Collateral Detection & Handling.
Low Priority: Implementation Quality, Code Documentation.
Scores are summed to a maximum of 26. The evaluation dataset consists of 68 handpicked, expert-reviewed CVEs (22 Path Traversal, 46 Remote Code Execution) separate from the training data.

3. Model Benchmarking and Fine-Tuning

Zero-Shot Benchmarking: 17 state-of-the-art LLMs (including o3, GPT-5, Claude Opus, DeepSeek, Llama, and Qwen variants) were evaluated across 8 criteria and 6 context levels (varying information density).
Supervised Fine-Tuning (SFT): The authors fine-tuned a compact Qwen3-8B model using QLoRA (4-bit quantization). The training data consisted of the refined dataset (~4,500 CVEs) where the student model was trained on teacher-rewritten labels including reasoning traces (Chain-of-Thought).

Key Results

Zero-Shot Performance

Model Hierarchy: Frontier models like o3 achieved the highest total scores (16.96/26), demonstrating strong consistency across all criteria. GPT-5.2 and Kimi-K2.5 formed a competitive second tier.
Scale vs. Capability: Smaller models (e.g., Qwen3-8B, Llama variants) scored significantly lower (e.g., Qwen3-8B at 6.58), particularly in targeting accuracy and reproducibility, though they retained some reasoning capability.
Context Impact: All models benefited from increased context (moving from Level 1 to Level 3), but performance gains saturated at higher levels.

Impact of Fine-Tuning (SFT)

The study reveals a task-dependent behavior of SFT on the compact Qwen3-8B model:

Complex Tasks (RCE): SFT yielded substantial improvements. The total score increased from 6.58 to 9.38 (+2.80). Notably, the fine-tuned 8B model significantly outperformed the zero-shot GPT-4o (7.09) and narrowed the gap with larger models like Qwen3-30B. Gains were most pronounced in Environment Safety (+0.87) and Reproducibility (+0.72).
Simple Tasks (Path Traversal): In contrast, SFT degraded performance on Path Traversal (PT) vulnerabilities, dropping the score from 13.53 to 10.18. The authors hypothesize that PT relies more on memorization of simple patterns, whereas RCE requires complex, long-horizon compositional reasoning which benefits from the structured supervision provided by SFT.

Significance and Claims

The paper argues that data quality, structured supervision, and evaluation design are as critical as model scale for adapting LLMs to cybersecurity tasks.

Data-Centric Efficiency: A compact 8B model, when fine-tuned on curated, high-quality data, can rival proprietary frontier models in complex exploit generation tasks, challenging the notion that scale is the sole driver of performance.
Structured Supervision: The use of teacher-guided label denoising and reasoning traces is essential for generating coherent, executable exploits, particularly for complex vulnerability types like Remote Code Execution (RCE).
Evaluation Rigor: The proposed unified framework and 8-criterion rubric provide a necessary baseline for controlled, reproducible analysis, disentangling the effects of data, training signals, and model architecture.

The authors conclude that while current general-purpose models struggle with structured exploit generation under strict constraints, task-specific training on high-quality data offers a viable, cost-effective path toward reliable exploit generation systems, provided that fine-tuning strategies are tailored to the complexity of the target vulnerability type.