Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA

Source

arXiv

arxiv.org/abs/2607.18725v1

Read the source

Source

Plain-Language Brief

The paper presents a diagnostic framework called FiT (Find before Fine-Tune) to evaluate the suitability of small language models for cybersecurity question-answering tasks. The study finds that fine-tuning these models doesn't always improve their performance and can sometimes degrade certain capabilities, particularly vocabulary recognition and parametric knowledge. The authors suggest that this diagnostic framework can help avoid unnecessary fine-tuning and ensure safer deployment of small language models in cybersecurity question-answering pipelines.

What the Document Says

  • The study investigates the challenge of choosing a suitable small language model for fine-tuning in critical domains like cybersecurity.
  • FiT (Find before Fine-Tune) is a diagnostic framework that assesses three capabilities required for cybersecurity question-answering: vocabulary recognition, parametric knowledge, and contextualization of retrieved information.
  • The study evaluates five open-weight 7-billion-parameter models under two fine-tuning regimes (knowledge-focused and instruction-focused).
  • Fine-tuning doesn't uniformly help; it degrades vocabulary and parametric knowledge in small models, with different trade-offs between the fine-tuning regimes.
  • Knowledge-focused tuning causes moderate, rank-preserving degradation of knowledge, whereas instruction-focused tuning leads to induced abstention, inverting the knowledge ranking while leaving retrieval-grounded contextualization intact.
  • The study uses rank-correlation analysis to quantify these regime-specific patterns and shows that pre-fine-tuning FiT scores predict the direction of post-tuning change.
  • The results indicate that task-oriented diagnosis can help screen out unsuitable models, avoid unnecessary fine-tuning, and ensure safer deployment in cybersecurity question-answering pipelines.

Key Concepts Mentioned

  • Language Models
  • Fine-Tuning
  • Cybersecurity Question-Answering
  • Diagnostic Framework
  • Vocabulary Recognition
  • Parametric Knowledge
  • Contextualization

Claims Made by the Document

  • Choosing a suitable small language model for fine-tuning in critical domains is challenging.
  • FiT can characterize small language models' capabilities for cybersecurity question-answering.
  • Fine-tuning degrades vocabulary and parametric knowledge in small models.
  • Knowledge-focused tuning causes moderate, rank-preserving degradation of knowledge.
  • Instruction-focused tuning leads to induced abstention and inversion of the knowledge ranking.

Evidence Used

  • The text describes a study on the difficulty of selecting suitable small language models for fine-tuning in critical domains.
  • The study presents FiT, a diagnostic framework that assesses three capabilities required for cybersecurity question-answering.
  • The results section discusses the degradation of vocabulary and parametric knowledge in small models after fine-tuning.

Methods / Approach

  • Empirical study
  • Diagnostic framework (FiT)
  • Evaluation of five open-weight 7-billion-parameter models under two fine-tuning regimes

Limitations Stated by the Authors

  • The study focuses on five specific models, which may not represent the performance of all small language models.

Limitations Noted by the Agent

Agent interpretation — not from the source.

  • The study does not provide a comparison between fine-tuning and other model training methods.
  • The study does not discuss potential solutions for addressing the degradation of vocabulary and parametric knowledge in fine-tuning.

Open Questions

  • What factors contribute to the degradation of vocabulary and parametric knowledge in small language models during fine-tuning?
  • Are there alternative training methods that can avoid or minimize this degradation?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The paper does not provide information on the specific cybersecurity question-answering tasks used in the study.
  • The term 'open-weight' is not defined in the provided text.

Raw Abstract / Excerpt

Large Language Models (LLMs) are increasingly fine-tuned for critical-domain Question-Answering (QA), yet choosing which small model to adapt, before paying the cost of adaptation, remains difficult. Fine-tuning can improve domain alignment, but it may also erode prior knowledge, weaken instruction-following, or increase hallucination, especially when labeled data are scarce or rapidly evolving as in cybersecurity. We present FiT (Find before Fine-Tune), a task-oriented diagnostic framework that characterizes small LLMs along three capabilities required for cybersecurity QA: vocabulary recognition, parametric knowledge, and contextualization of retrieved information. Using FiT, we conduct an empirical study of five open-weight 7-billion-parameter models under two fine-tuning regimes. We find that fine-tuning does not uniformly help: it consistently degrades vocabulary and parametric knowledge in small models, and the two regimes trade off differently. Knowledge-focused tuning causes moderate, rank-preserving degradation, whereas instruction-focused tuning collapses measured knowledge through induced abstention, inverting the knowledge ranking while leaving retrieval-grounded contextualization essentially intact. We quantify these regime-specific patterns with rank-correlation analysis and show that pre-fine-tuning FiT scores anticipate the direction of post-tuning change. Our results suggest that task-oriented diagnosis can screen out unsuitable models, avoid unnecessary fine-tuning, and support safer deployment of small LLMs in cybersecurity QA pipelines.