Evaluating Generative Reasoning Models for Credential Tweaking and Lightweight Client-Side Defense in IoT Ecosystems

Generative reasoning models introduce a new paradigm in cybersecurity, enabling not only novel defenses but also sophisticated attack simulations. This paper investigates the use of open-source reasoning models to simulate credential tweaking behavior and enhance password-based authentication security in IoT environments. We propose Hybrid Similarity Scoring (HSS) and its user-contextualized variant HSSuser, a lightweight, client-side similarity metric combining structural (Damerau-Levenshtein) and character-distribution (cosine similarity) components to detect password reuse and subtle modifications or tweaks in real time. Following NIST guidelines, we analyzed over 4 billion password pairs from breached datasets and used five prompt designs in various reasoning models such as DeepSeek-R1, Qwen-QwQ, Phi4-Reasoning, Qwen3, and Magistral series to generate password variants mimicking attacker strategies. Experimental results show that reasoning models can produce highly similar modifications resembling real-world password reuse patterns, while prompt reframing significantly reduces risky outputs. HSS effectively quantifies these behaviors and is suitable for deployment in constrained IoT devices, offering an intent-aware, proactive layer of client-side defense against AIenhanced credential attacks.