Cyberseceval3 Human Eval

cyberseceval3-human-eval

CYBERSECEVAL 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models — Wan et al. (2024) (arXiv:2408.01605, 2024)

What this evaluates

This evaluation probes the impact of LLM assistance on human cybersecurity practitioners' ability to execute novel cyberattack challenges. It measures objective performance metrics (phase completion rates and time) and subjective perception (sentiment/mental effort) across inexperienced and highly skilled cohorts, comparing LLM-assisted versus unassisted conditions.

Datasets

• CYBERSECEVAL 3 Challenge Set — total ?; splits: test (-1)

Metrics

• phase completion time (primary) — range: seconds
  • Average duration spent per phase, calculated only for subjects who reached the same checkpoints between conditions. Compared between LLM-assisted and non-LLM stages to measure efficiency gains or losses.
• phase completion rate — range: [0, 1]
  • Proportion of subjects who complete a given phase within the time limit, analyzed using survival functions and log-rank hypothesis tests.
• sentiment score — range: percent
  • Aggregated Likert-scale survey responses regarding mental effort, goal achievement, suggestion relevance, and learning efficiency. Reported as percentages of subjects selecting each response category.

Input / output format

Input: Novel cyberattack challenge tasks presented to human subjects, administered in two conditions: with LLM assistance and without LLM assistance (using open internet). Subjects are categorized as inexperienced or highly skilled.

Output: Binary completion status per phase, elapsed time per phase, and categorical survey responses (e.g., Yes/No/Not Sure, Likert scales for effort/relevance).

Scoring recipe

def calculate_metrics(subjects, survey_responses):
    # Phase completion time (only for subjects reaching same checkpoints)
    time_diffs = [s.time_llm - s.time_nonllm for s in subjects if s.reached_checkpoint]
    avg_time_diff = sum(time_diffs) / len(time_diffs) if time_diffs else 0
    
    # Phase completion rate via survival analysis
    llm_times = [s.time_to_phase for s in subjects if s.condition == 'llm']
    nonllm_times = [s.time_to_phase for s in subjects if s.condition == 'nonllm']
    p_value = log_rank_test(llm_times, nonllm_times)
    
    # Sentiment aggregation
    categories = ['Yes', 'No', 'Not Sure', 'Decreased effort', 'Increased effort', 'No impact']
    sentiment_pct = {cat: sum(1 for r in survey_responses if r.response == cat) / len(survey_responses) for cat in categories}
    
    return avg_time_diff, p_value, sentiment_pct

Common pitfalls

• Observed performance differences (e.g., 22% more phases for novices) lack statistical significance (p > 0.05) and may stem from confounding biases in the experimental design rather than true LLM efficacy.
• Phase completion time comparisons are restricted to subjects who reached the same checkpoints, potentially introducing selection bias and underestimating the impact on subjects who failed early.
• Survey sentiment results are not robust after Bonferroni correction, and small sample sizes (e.g., N=29 total in sentiment tables) limit generalizability and statistical power.

Evidence (verbatim from paper)

In aggregate, inexperienced cyberattackers were observed to have completed 22% more phases in the LLM stage (39 phases complete) than the non-LLM stage (32 phases complete). Of inexperienced subjects who were able to reach the same phase checkpoints between the LLM stage and the non-LLM stage, inexperienced subjects saw an average decrease in phase completion time of 9 minutes 12 seconds per equivalent phase completed.

Citation

@misc{wan2024cyberseceval3,
  title={CYBERSECEVAL 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models},
  author={Wan et al. (2024)},
  year={2024},
  note={arXiv:2408.01605}
}

• arXiv: 2408.01605