Improving Generalization on Cybersecurity Tasks with Multi-Modal Contrastive Learning
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2026
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866910061500039168 |
|---|---|
| author | Huang, Jianan Valentim, Rodolfo V. Vassio, Luca Boffa, Matteo Mellia, Marco Drago, Idilio Rossi, Dario |
| author_facet | Huang, Jianan Valentim, Rodolfo V. Vassio, Luca Boffa, Matteo Mellia, Marco Drago, Idilio Rossi, Dario |
| contents | The use of ML in cybersecurity has long been impaired by generalization issues: Models that work well in controlled scenarios fail to maintain performance in production. The root cause often lies in ML algorithms learning superficial patterns (shortcuts) rather than underlying cybersecurity concepts. We investigate contrastive multi-modal learning as a first step towards improving ML performance in cybersecurity tasks. We aim at transferring knowledge from data-rich modalities, such as text, to data-scarce modalities, such as payloads. We set up a case study on threat classification and propose a two-stage multi-modal contrastive learning framework that uses textual vulnerability descriptions to guide payload classification. First, we construct a semantically meaningful embedding space using contrastive learning on descriptions. Then, we align payloads to this space, transferring knowledge from text to payloads. We evaluate the approach on a large-scale private dataset and a synthetic benchmark built from public CVE descriptions and LLM-generated payloads. The methodology appears to reduce shortcut learning over baselines on both benchmarks. We release our synthetic benchmark and source code as open source. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2603_20181 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Improving Generalization on Cybersecurity Tasks with Multi-Modal Contrastive Learning Huang, Jianan Valentim, Rodolfo V. Vassio, Luca Boffa, Matteo Mellia, Marco Drago, Idilio Rossi, Dario Cryptography and Security Artificial Intelligence The use of ML in cybersecurity has long been impaired by generalization issues: Models that work well in controlled scenarios fail to maintain performance in production. The root cause often lies in ML algorithms learning superficial patterns (shortcuts) rather than underlying cybersecurity concepts. We investigate contrastive multi-modal learning as a first step towards improving ML performance in cybersecurity tasks. We aim at transferring knowledge from data-rich modalities, such as text, to data-scarce modalities, such as payloads. We set up a case study on threat classification and propose a two-stage multi-modal contrastive learning framework that uses textual vulnerability descriptions to guide payload classification. First, we construct a semantically meaningful embedding space using contrastive learning on descriptions. Then, we align payloads to this space, transferring knowledge from text to payloads. We evaluate the approach on a large-scale private dataset and a synthetic benchmark built from public CVE descriptions and LLM-generated payloads. The methodology appears to reduce shortcut learning over baselines on both benchmarks. We release our synthetic benchmark and source code as open source. |
| title | Improving Generalization on Cybersecurity Tasks with Multi-Modal Contrastive Learning |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2603.20181 |