Cyber Threat Intelligence (CTI) plays a crucial role in cybersecurity. However, traditional information extraction has low accuracy due to the specialization of CTI and the concealment of relations. To improve the performance of CTI relation extraction in the knowledge graph, we propose a relation extraction architecture called Adversarial Training for Cyber Threat Intelligence Relation Extraction (AT4CTIRE). Additionally, we developed a large-scale cybersecurity dataset for CTI analysis and evaluation called Cyber Threat Intelligence Analysis (CTIA). Inspired by Generative Adversarial Networks, we integrate contextual semantics to refine our study. Firstly, we use some wrong triples with incorrect relations to train the generator and produce high-quality generated triples as adversarial samples. Secondly, the discriminator used actual and generated samples as training data. Integrating the discriminator and the context-embedding module facilitates a deeper understanding of contextual CTI within threat triples. Finally, training a discriminator identified the relation between the threat entities. Experimentally, we set two CTI datasets and only one baseline that we could find to test the effect in the cybersecurity domain. We also took general knowledge graph completion tests. The results demonstrate that AT4CTIRE outperforms existing methods with improved extraction accuracy and a remarkable expedited training convergence rate.

Cyber Threat Intelligence (CTI) plays a crucial role in cybersecurity. However, traditional information extraction has low accuracy due to the specialization of CTIs and the concealment of relations. To improve the performance of CTI relations extraction in the knowledge graph, we propose a relation extraction architecture called Adversarial Training for Cyber Threat Intelligence Relation Extraction (AT4CTIRE). Besides, we developed a large-scale cybersecurity dataset for CTI analysis and evaluation, called Cyber Threat Intelligence Analysis (CTIA). Inspired by the Generative Adversarial Network, we integrate contextual semantics into this framework to refine our study. Firstly, we use some wrong triples with incorrect relations to train the generator and produce high-quality generated triples as adversarial samples. Secondly, the discriminator used actual and generated samples as training data. Integrating the discriminator and the context embedding module facilitates a deeper understanding of contextual CTI within threat triples. Finally, training a discriminator identified the relation between the threat entities. Experimentally, we set two CTI datasets and only one baseline that we could find to test the effect of the proposed method in the cybersecurity domain. We also set other knowledge graph completion comparisons that conclude three entity completion datasets and nine baselines, one relation completion dataset, and eight baselines. Experimental results demonstrate that AT4CTIRE outperforms existing methods with substantially improved extraction accuracy and a remarkable expedited training convergence rate.

Continual learning (CL) is critical for large language models (LLMs) to tackle multiple tasks in various downstream applications. However, LLMs struggle to maintain performance in multiple-task training due to catastrophic forgetting, which undermines the learned parameters for old tasks during training for new tasks. Although existing studies typically employ three methods to address this issue, including regularization-based, rehearsal-based, and parameter isolation-based methods, these methods simultaneously lead to new issues, such as privacy concerns, difficulties in handling long sequences. To address existing problems and enhance performance, we propose DPP-CL, a Dialogue Policy Planner (DPP) utilized by CL to facilitate forgetting and improve performance. Specifically, we used gradient descent in an orthogonal subspace to learn new tasks for DPP in multitask learning. Regarding the parameter isolation-based approach that struggles to handle long sequences, we introduce the concatenation of hyperbolic spherical embeddings and Euclidean embeddings to form a novel representation, thereby enhancing the capability of LLMs to understand long-sequence texts. In particular, the DPP training process proceeds sequentially through supervised learning, knowledge distillation, and reinforcement learning. We performed comparison experiments using the standard CL benchmarks and incorporated retrieval-augmented generation into the dialogue architecture for multitask inference in cybersecurity.

Steering large language models (LLMs) toward desired behaviors while preserving privacy is a critical challenge in AI alignment. Existing differentially private (DP) steering methods, such as PSA, add high-dimensional noise that can severely degrade steering accuracy. We propose DP-JL, a novel approach that combines Johnson–Lindenstrauss (JL) random projection with differential privacy to reduce noise while maintaining formal privacy guarantees. DP-JL projects steering vectors into a lower-dimensional space (dimension k) before adding DP noise, reducing total noise magnitude from $O\left(\sqrt{d}\right)$ to $O\left(\sqrt{k}\right)$ where $k\ll d$, while the privacy budget $\epsilon$ remains unchanged. We evaluate DP-JL on seven behavioral datasets with LLaMA-2-7B, Mistral-7B, Qwen2.5-7B, and Gemma-2-9B, alongside general capability benchmarks (MMLU, TruthfulQA). All accuracy values are measured on held-out test sets. Results show that DP-JL achieves: (1) up to 22.76 percentage points higher steering accuracy than PSA on the myopic-reward dataset (at fixed privacy budget $\epsilon \approx 0.22$, $\delta ={10}^{-5}$); (2) 91.7% win rate on sycophancy with an average accuracy improvement of 3.01 percentage points; (3) systematic advantages in high-privacy regimes ($\epsilon <0.2$); and (4) superior capability preservation on related tasks (TruthfulQA), achieving 6.6 percentage points better accuracy than PSA. Furthermore, visualizations and layer-sensitivity analyses reveal that DP-JL faithfully preserves the geometric structure of activation spaces, explaining its robustness. Our findings demonstrate that DP-JL offers superior privacy–utility trade-offs while better preserving model capabilities.