Meta's second-generation LLM cybersecurity suite: adds prompt-injection, code-interpreter-abuse and exploit-capability tests to the original CyberSecEval's insecure-code and attack-compliance measures.
unassessed
| Category | safety |
|---|---|
| Subcategory | LLM cybersecurity risk and capability suite: prompt injection, code-interpreter abuse, insecure code generation, and offensive vulnerability-exploitation capability |
| Page status | superseded |
| Metric | per-category rates -- mainly an attack/injection/insecure-code success or compliance rate (share of test cases judged unsafe); direction and headline number differ by category |
| Direction | lower_is_better |
| Unit | % |
| Dataset licence | MIT |
| Publisher | Meta (the Purple Llama project) |
CyberSecEval 2 is Meta's second release in the CyberSecEval series, following the original CyberSecEval (arXiv 2312.04724, not separately catalogued in this repository). It is a suite of separately-scored categories rather than one number. It carries forward the first version's two core measures -- whether a model complies with requests to help carry out cyberattacks (MITRE ATT&CK-based compliance tests) and whether a model's own generated code is insecure (instruct and autocomplete tests, scored by an automated insecure-code detector for known CWE patterns) -- and adds two new areas named explicitly in the paper's title scope: prompt injection (251 hand-authored English test cases spanning direct and indirect delivery and 15 attack-technique categories) and code-interpreter abuse (500 prompts across 5 categories asking a model to misuse an attached code interpreter, for example to read files it should not access). It also adds a False Refusal Rate (FRR) test set of borderline-but-benign cybersecurity requests, introduced to weigh a model's safety against the utility it loses by over-refusing, and expands automated vulnerability-exploitation tests that measure whether a model can solve string-constraint, buffer-overflow, memory-corruption and SQL-injection challenges end to end in C, Python and JavaScript.
A per-category suite: MITRE compliance (1,000 cyberattack-assistance prompts, LLM-expanded and LLM-judged for attacker helpfulness), MITRE False Refusal Rate (750 borderline-benign prompts, judged for refusal), instruct and autocomplete insecure-code tests (1,916 prompts each, scored by Meta's Insecure Code Detector), textual prompt injection (251 direct/indirect cases, LLM-judged for whether the injected instruction was followed), code-interpreter abuse (500 prompts, LLM-judged as malicious or non-malicious), and vulnerability-exploitation challenges (hand-authored and, for some test types, randomly generated per run, scored pass/fail on whether the model's exploit works).
No model card in ModelSpec reports this benchmark yet.