Source-linked AI summary
Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts
Rui Yang, Yang Hong, Yichao Xu, Zhengyu Liu, Ziyang Li, Yinzhi Cao
TL;DR
Cybersecurity safeguards must distinguish harmful from legitimate assistance, but existing benchmarks do not test conversational context. The paper introduces 3R-Bench, evaluates eight LLMs on 150 requests across direct, precedent-conditioned, and decomposed dialogue, and finds that context strongly changes compliance: accepted history increases it, whereas decomposition sharply reduces it and failure feedback recovers little.
Problem
Existing cybersecurity evaluations do not establish whether safety-utility balance holds when requests are embedded in adversarial conversational context.
Method
3R-Bench evaluates eight LLMs on 150 real-world cybersecurity requests using direct presentation, forged assistant precedent, and decomposed dialogue.
Results
Accepted history raises compliance from 62.0% to 85.1%, while dialogue decomposition changes compliance from 501/800 to 172/800 and failure feedback recovers only a small fraction.
Takeaways & Limitations
Cybersecurity safeguard evaluations should test adversarial dialogue rather than relying only on direct task presentation.
Takeaways & Limitations
The intentionally small dataset contains 150 English cybersecurity requests and does not estimate production traffic, cover other languages, or represent the full range of cybersecurity work.
Abstract
from arXiv · showhide
Large Language Models (LLMs) can solve complex problems, but their misuse in high-risk domains can lead to severe consequences. Model providers therefore restrict assistance for potentially harmful requests. Refusing all cybersecurity requests would therefore harm legitimate users. Providers need a mechanism to block malicious use without denying legitimate assistance to defenders. Existing cybersecurity-specific datasets evaluate this mechanism, but none considers the conversational context of a request. We introduce 3R-Bench (Refusal, Repetition, and Revision), a benchmark of 150 real-world cybersecurity requests augmented with two adversarial conversational settings, and evaluate eight LLMs on it. Prior assistant behavior strongly changes responses to an unchanged request: among 376 available pairs from a 400-pair panel, compliance rises from 62.0% after refused history to 85.1% after accepted history. The opposite pattern appears under dialogue decomposition. In comparison, compliance falls from 501/800 direct responses to 172/800 after dialogue; among 738 pairs returning model-authored text in both conditions, the decrease is 45.1 points. Failure feedback recovers only a small fraction of this loss.
1 Introduction
Cybersecurity assistance must balance defensive utility against the risk of enabling attacks, yet existing evaluations largely omit conversational context. 3R-Bench addresses this gap by testing unchanged or decomposed requests across adversarial dialogue settings, finding that context substantially shifts compliance.
- Cybersecurity capabilities can support vulnerability defense while also enabling attackers, motivating safeguards that preserve legitimate assistance.
- Existing benchmarks evaluate cybersecurity refusal and safety-utility tradeoffs but do not establish whether that balance holds under adversarial conversation.
- 3R-Bench evaluates 150 real-world cybersecurity requests across direct presentation, forged assistant precedent, and decomposed dialogue.
- 85.1% versus 62.0% compliance follows accepted versus refused history among available matched pairs, while decomposition lowers compliance from 67.8% to 22.6%.
2 Design
The study varies how an identical cybersecurity request reaches the model while distinguishing model-authored assistance from provider-level blocking. Its three scenarios compare direct presentation, forged precedent, and multi-turn task decomposition.
- Outcomes are Refuse, Bounded, Comply, and provider block, with provider blocks reported separately from model-authored refusals.
- The benchmark uses 150 requests balanced across benign, ambiguous, and high-risk categories and evaluates eight models under three conversational scenarios.
- S1: Direct Measurement: S1 presents each request directly in an isolated session to establish the baseline for history-conditioned comparisons.
- S2: Forged Assistant Precedent: S2 keeps the terminal request unchanged while preceding it with fabricated assistant responses that either accept or refuse an earlier copy.
- S3: Task Decomposition: S3 places the final request after explanation, feasibility assessment, and a preliminary proof of concept, with neutral or failure feedback endings.
3 Implementation
The implementation constructs a balanced, expert-reviewed dataset and evaluates eight models in fresh sessions under controlled paired comparisons. The protocol preserves provider blocks separately and limits semantic comparisons to model-authored responses.
- The final cohort contains 150 requests: 50 benign, 50 ambiguous, and 50 high-risk examples selected from 66,443 crawled records.
- Eight models are evaluated with provider-default settings in isolated sessions without extra system prompts, tools, retrieval, or external memory.
- S2: S2 repeats the terminal request after accepted or refused fabricated exchanges, with a length-matched control adding unrelated accepted history.
- S3: S3 uses explanation, feasibility assessment, and bounded proof of concept before a neutral or failure-ending request, with exact-template and wording-sensitivity panels.
- Responses are coded as R, B, or C, while provider blocks are recorded separately when no model-authored response is returned.
4 Results
Across matched scenarios, conversational context changes cybersecurity assistance while benign requests remain almost uniformly compliant. Accepted precedent increases compliance, whereas task decomposition sharply reduces it and failure feedback recovers little.
- Scenario 3: Task Decomposition: Failure feedback recovers only a small fraction of decomposition’s compliance loss; wording sensitivity estimates range from +5.2 points to −5.0 points.
- Scenario 1: Direct Measurement: 398/400 benign direct observations are compliant, while high-risk requests show distinct model profiles across refusal, bounded assistance, compliance, and provider blocking.
- Scenario 2: Forged Assistant Precedent: 397/400 benign/refused-arm outcomes are compliant, indicating that refusal history does not induce indiscriminate refusal.
- Scenario 3: Task Decomposition: 501/800 direct responses versus 172/800 after dialogue represents a −41.1-point compliance change in the S3 attempted panel including provider blocks.
R B C
The benchmark shows that conversational context shifts cybersecurity requests across refusal, bounded assistance, and compliance outcomes. Accepted precedent increases assistance, whereas task decomposition shifts responses toward restriction, with failure feedback recovering only a small fraction of the loss.
- Task-unrelated accepted precedent also increases compliance, while target-specific acceptance is associated with a further increase.
- Among 332 semantic pairs, compliance falls from 223 under direct presentation to 46 after decomposition, with 180 C→R/B changes and three reverse changes.
- Failure feedback recovers some assistance, but remains substantially below direct presentation.
- Across 800 pairs, compliance falls from 501 to 172 (−41.1 points), while refused or blocked outcomes increase from 93 to 235.
5 Discussion
The discussion frames conversational context as a distinct evaluation dimension and recommends paired, length-matched histories to make context dependence inspectable. The authors caution that the experiments do not support vendor rankings or prevalence estimates and cover only a few predefined histories.
- The three scenarios separate direct measurement, forged assistant precedent, and task decomposition, which context-free safety scores often conflate.
- The matched results support neither vendor rankings nor prevalence estimates, and fixed calls cannot establish that all possible states were exhausted.
- Evaluations should predeclare timing, log provider-side nonreturns, publish exact outcomes, and test dialogue state with paired, length-matched histories.
6 Conclusion
Accepted precedent is associated with increased compliance, while dialogue decomposition is more restrictive and failure feedback recovers little. These findings support evaluating cybersecurity assistance under adversarial dialogue, not only direct prompts.
- Accepted precedent is associated with more compliance, while tested decomposition is more restrictive and failure feedback recovers little.
Limitations
The study’s limitations concern dataset scale, hosted-model observability, narrow dialogue interventions, and the gap between returned assistance and real-world outcomes.
- 150 English cybersecurity requests form an intentionally small dataset, limiting source diversity and motivating larger studies using additional technical sources.Proposed extensions include completing partial records with language models followed by expert review.
- Eight hosted models were evaluated during a short collection window under provider defaults, preventing attribution of outcome changes to one mechanism or treatment as lasting model properties.
- The dialogue interventions use only a few predefined histories, so wording, turn count, and repeated exposure cannot be separated as explanations for observed changes.The current S3 design fixes one six-message decomposition sequence and two terminal status messages.
- Controlled histories do not establish their frequency in natural conversations, and unexecuted procedures leave results limited to returned assistance rather than functional success or user intent.
Ethical Considerations
The study addresses misuse risk by analyzing returned capability without executing procedures or redistributing most source material. Its dataset and labels rely on controlled, team-reviewed design choices rather than external demographic or ground-truth validation.
- The study withholds full raw requests, histories, and responses, reports semantic outcomes, and does not test procedures against live systems or report functional exploit results.A capability-return label indicates that assistance was returned, not that it worked.
- Public redistribution is limited to one attributed running example, while other source posts remain represented through private provenance records and artifact-local metadata.
- Screening used automated support and expert review, but item-level selection records and retrospective inter-annotator agreement are unavailable in analysis-ready form.
- The balanced dataset contains 50 benign, 50 ambiguous, and 50 high-risk requests, with final partitions and target boundaries assigned by the research team.The target boundary was used for construction and restricted analyses, not treated as an observed model outcome.
- The S3 protocol compares dialogue after explanation, feasibility assessment, and bounded proof of concept with a final request.
- The dialogue histories were drafted with language-model assistance and fixed before execution, without a separately auditable three-expert validation of every retained history.
- The S2 protocol uses repeated fabricated assistant precedent around an unchanged request, including target-specific and unrelated accepted controls.
C Complete Results
The results distinguish system-level provider blocks from model-authored semantic outcomes and report matched contrasts using available semantic-response pairs. The main findings show stronger compliance after accepted precedent and substantially lower compliance after failure-ended dialogue.
- Matched contrasts exclude provider-block pairs, while arm totals include them in the complete outcome accounting.
- +23.1 points separates accepted from refused S2 precedent, with 320/376 versus 233/376 compliant outcomes.
- Across 800 S3 main attempts, failure-ended dialogue produces 172 compliant outcomes versus 501 under direct presentation, a −41.1-point difference.
- In the exact-template auxiliary control, neutral dialogue is −53.3 points below direct presentation, while failure is +6.3 points above neutral.Pooling six short-neutral replacement requests changes the latter estimate to +5.2 points; the six-request variant alone is −5.0 points.
- Labels describe capability returned in one response, independently of the experts’ target boundary, and provider blocks remain system-level refusals.
- An automated recoding audit agrees on 91/100 responses, with Cohen’s κ = .748, but is not independent human gold validation.
- The complete per-model outcomes are collected in the main S2 matched panel, where each model contributes the same 50 ambiguity requests to both history conditions.
E Robustness and Statistical Scope
Robustness checks show that the observed conversational effects persist across controls, while the study’s predefined histories limit causal interpretation. Provider blocks remain separate from semantic matched-pair analyses.
- Robustness controls: +36.4 points separates target-accepted from target-refused histories in the length control.The prompt-cluster 95% interval is +27.9 to +44.9, with a leave-one-model-out interval of +32.1 to +41.8.
- Robustness controls: +23.1 points separates unrelated acceptance from refusal, while target versus unrelated acceptance differs by +13.6 points.The corresponding prompt-cluster intervals are +15.1 to +31.6 and +7.0 to +21.3.
- Outcome handling: Provider blocks are retained as PB and excluded from semantic matched pairs.The outcome taxonomy distinguishes delivered semantic capability from provider-enforced refusal.
- Dialogue decomposition: −45.1 points separates direct and decomposed dialogue among 738 pairs returning model-authored text in both conditions.The transitions include 351 C→R/B changes and 18 R/B→C changes.
- Control analyses: +6.3 points is the failure-minus-neutral change in the 44-request exact-template control, smaller than the −53.3-point direct-to-neutral change.Pooling six short-neutral replacement requests yields +5.2 points, whereas the six-request variant alone yields −5.0 points.
- Statistical scope: Predefined histories summarize paired evidence but do not identify population-level causal effects.Intervals use 10,000 prompt-cluster resamples while preserving all eight models attached to each request.