The Dual-Use Nature of Large Language Models in Cybersecurity: A Bibliometric Analysis and Critical Review
This paper combines a bibliometric analysis of 7,369 documents with a critical review to reveal that research on large language models in cybersecurity is fragmented across isolated offensive and defensive roles, prompting the authors to propose a coupled dual-use framework and eight prioritized research directions to address the lack of adaptive evaluation and integrated security strategies.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the last few years, a new kind of computer program has emerged that can read, write, and reason with human language. These programs, known as large language models, are not just chatbots; they are powerful tools that organizations are beginning to use to manage their digital security. They can scan thousands of security alerts to find real threats, write code to fix software holes, or even help security teams plan their defenses. But these same tools have a dark side. Because they are so good at following instructions and generating text, bad actors can trick them into writing malware, creating convincing fake emails, or bypassing safety rules. This creates a unique situation where a single technology serves as the shield, the weapon, and the target all at once. It is the shield when it protects a network, the weapon when it helps an attacker, and the target when someone tries to trick the program itself. Understanding how these three roles interact is critical, because if we only study the tool as a defender, we might miss the fact that the tool itself is vulnerable to the very attacks it is trying to stop.
A team of researchers set out to map this complex landscape, not by reading a few papers, but by analyzing thousands of them to see how the scientific community is actually thinking about these problems. They gathered nearly 13,000 records published between 2023 and late 2026, filtering them down to a core group of 7,369 documents that directly addressed the intersection of these language models and cybersecurity. Using a method that treats research like a map, they looked at how often different topics appeared together and which studies were cited most often. They wanted to know if scientists were studying the three roles of these models together, or if they were working in separate silos. They also wanted to see if the evidence supporting the safety of these tools was as solid as it seemed.
The researchers found that the field is growing incredibly fast, with the number of relevant documents doubling or tripling almost every year. However, the research is deeply divided. The vast majority of studies focus on just one of the three roles in isolation. Only about eight percent of the documents examined more than one role at the same time. This means that the people studying how to attack these models are rarely talking to the people studying how to use them for defense. Even more concerning, when researchers build a defensive system using these models, they almost never test whether that system can be tricked by the very attacks it is supposed to stop. In the defensive studies they reviewed, only about eleven percent mentioned the risk of the model itself being compromised. The researchers concluded that while the technology is naturally connected—where a defensive tool is also a potential target—the research community has not yet caught up to this reality.
When the team looked closer at the evidence for how well these models work as weapons or shields, they found that the numbers reported in different studies were wildly inconsistent. For example, when researchers tested how well an artificial intelligence could hack a computer system, the reported success rates ranged from zero percent to ninety percent. This huge gap was not because the models were changing, but because the way the tests were designed was different. Some studies gave the model a huge advantage by telling it exactly what the weakness was, while others tested it in a realistic environment where it had to find the weakness on its own. The researchers noted that many studies did not test their defenses against attackers who were actively trying to figure out how to break them. Instead, they tested against static, predictable attacks. This is like testing a lock against a key that never changes, rather than against a locksmith who is trying to pick it.
The study also revealed that the most dangerous threats are moving up the ladder. Early research focused on simple tricks to make the model say something it shouldn't. Now, the focus is shifting to more complex systems where the model can remember past conversations, use tools, and make decisions over time. These "agentic" systems are much harder to protect because a single mistake can lead to a chain of bad actions that spreads across a network. The researchers found that while there are many new ways to attack these systems, the defenses are often fragile. A defense that works today might fail tomorrow if the attacker changes their approach slightly. Furthermore, the tools used to measure success are often outdated or only available in English, which means they might not work for the rest of the world.
Ultimately, the paper argues that we cannot treat these models as simple tools that are either good or bad. They are dual-use technologies where the line between offense and defense is blurred. The researchers suggest that the most important work for the future is not just inventing new attacks or new defenses, but building better ways to test them. We need to stop assuming that a defense works just because it passed a simple test. Instead, we need to test every defensive system as if it were also a target, constantly checking if it can be tricked by the content it is supposed to analyze. Until the research community starts studying these three roles together, we will remain blind to the full picture of how these powerful tools can be used, misused, and protected.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.