Researchers have put AI models through their paces against previously unknown vulnerabilities: the defence prevails over the attack in two out of five environments, and a validated patch is not enough to block everything.
AI labs are increasingly relying on cybersecurity benchmarks to decide whether to publish a model. A problem identified by Tobias Heldt, Matt Turk, Christoph Landolt and Mario Fritz is that public benchmarks are based on already documented flaws, whose notices, exploits and fixes may have found their way into training data. Under these conditions, it is impossible to know whether a model is reasoning or remembering.
Five never-before-disclosed environments
The team evaluated open, proprietary models in five non-public software environments, some of which contained privately reported vulnerabilities that had not yet been patched at the time of testing. Three tasks were measured: write an exploit, fix the flaw, and then resist subsequent attacks. The scores were assigned by deterministic correctors designed and reviewed by the researchers, not by another language model playing the judge. The results were also compared to 209 already public vulnerabilities and cryptographic challenges.
No overall verdict
The balance sheet is clear: the defense outperforms the offense in two environments, but lags behind in the other three. Above all, passing the first security test does not guarantee anything: in 92 of the 524 test intervals on the defender's side, another exploit was passed after the first had been blocked. The authors argue for attack-repair comparisons conducted flaw by flaw, followed by repeated stress tests, rather than for aggregate scores on public benchmarks.
Read the full article on the original source
Go to the source →