[Submitted on 20 Jul 2026]

View PDF HTML (experimental)

Abstract:Large language models (LLMs) are increasingly used for a range of software, hardware and human-centered security tasks. Consequently, LLM performance on security tasks is an active area of measurement and research, often with a focus on identifying areas in which LLM security ``knowledge'' may be insufficient. Popular strategies for identifying LLM security knowledge gaps include building corpora of challenge questions or task benchmarks, strategies that require substantial manual work and security expertise to design and execute. We introduce a partially-automated method for assessing LLM knowledge of a security this http URL method uses authoritative information from Consumer Protection Agencies (CPAs) to identify instability in LLM responses that can be indicative of knowledge gaps. We demonstrate the method for 2 security topics, identity theft and impostor scams, and 5 LLMs in 2 leading LLM families, Gemini and GPT, using publicly available information about identity theft and impostor scams from 6 this http URL method distinguishes between models that have and don't have sufficient knowledge to accurately identify the security topics in text narratives.

Submission history

From: Jessica Staddon [view email]
[v1] Mon, 20 Jul 2026 20:37:37 UTC (1,003 KB)