Context segmentation improves task solving in local cybersecurity AI
Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks
Cryptography and SecurityArtificial Intelligence
Summary
Small language models (SLMs) can help with cybersecurity problems but often get overwhelmed when working on complex tasks because they mix too much information at once. The authors created a method called context segmentation that breaks big problems into smaller, separate parts so the AI can focus better. They tested this on a cybersecurity challenge set and found their method solved more tasks and used computing resources more efficiently than usual approaches. This helps demonstrate how local AI tools can be made smarter for security tasks without needing cloud-based software.
What this means in practice
- •For cybersecurity teams: Enable local AI tools to break down complex exploits into smaller tasks for more effective automated penetration testing.
- •For devops engineers: Use this method to improve efficiency and success rates of scriptable AI security testing agents running on constrained hardware.
Authors
Sebastiano Nordio, Michele Lotto
Abstract
The proliferation of highly capable open-weight Small Language Models (SLMs) democratizes access to advanced cybersecurity capabilities, posing a escalating risk as these models can bypass proprietary API guardrails when deployed locally. However, SLMs deployed as autonomous agents often struggle with long-horizon, exploratory tasks like cybersecurity Capture The Flag (CTF) challenges due to context bloat and cognitive degradation from accumulated tool-call outputs. To understand and mitigate this cybersecurity threat, we introduce \textit{context segmentation}, a two-level agentic framework that divides complex exploitation tasks into manageable, contextually isolated sub-problems. Evaluating on the \texttt{picoCTF} dataset using memory-constrained \texttt{gemma-4} models, we demonstrate that for the E4B model, our strategy acts as an intelligent search, achieving competitive rewards with superior token efficiency compared to brute-force retries, and successfully solving 18.52\% of tasks that standard agentic execution fails to complete. Code is available at https://github.com/9xeb/context-segmentation.