arXiv: Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA

This paper, published on arXiv in July 2026, presents a diagnostic study evaluating the performance of small large language models (LLMs) on cybersecurity question-answering tasks. It introduces a framework called "Find Before You Fine-Tune," which proposes a pre-tuning diagnostic step to assess whether a small LLM is suitable for a specific domain before investing in fine-tuning. The study finds that many small models perform poorly on cybersecurity QA without targeted adaptation, highlighting risks of deploying under-tested models in security-sensitive contexts.

The findings directly affect organizations in the cybersecurity, critical infrastructure, and regulated technology sectors that are considering or currently using small LLMs for threat detection, incident response, or compliance monitoring. Under the AI Safety framework, this research underscores the need for rigorous model validation before deployment, particularly where model outputs could influence security decisions or regulatory reporting.

Compliance teams should immediately review any existing or planned deployments of small LLMs for cybersecurity tasks. They should require evidence of domain-specific performance testing, including the diagnostic approach described in the paper, before approving models for production use. Teams should also update their AI risk assessment procedures to include pre-tuning validation steps and document model suitability for each intended use case, aligning with emerging AI safety expectations.