Evaluating Large Language Models in Cybersecurity: A Systematic Taxonomy and Empirical Analysis

This paper presents a Systematization of Knowledge (SoK) on the evaluation methodologies and capability boundaries of Large Language Models (LLMs) in cybersecurity. We propose a Three-Dimensional Taxonomy Matrix to systematize existing metrics across offensive domains, defensive applications, and inherent architectural flaws. Beyond categorization, this matrix functions as a predictive framework to expose structural evaluation blind spots. Specifically, by intersecting target domains with failure attributions, it identifies a critical, unresolved frontier: measuring cross-architecture semantic equivalence in low-level reverse engineering. Empirically, synthesizing 39 frontier benchmarks reveals a systemic evaluation gap: static metric success rarely translates into end-to-end adversarial efficacy. In offensive domains, high penetration rates correlate strongly with pre-training data contamination. When subjected to semantics-preserving code obfuscation as a stress test, zero-shot, tool-free exploit success rates collapse to near 0%. In defensive contexts, cross-procedural code auditing struggles, yielding a peak F1-score of only 23.83%. Furthermore, models suffer from over-alignment-induced functional degradation, with joint-testing frameworks recording up to a 77% functional loss in automated program repair. Our analysis strongly suggests that purely autoregressive mechanisms drive severe technical hallucinations, evidenced by a 19.7% package dependency fabrication rate. Evaluations also expose significant attack surfaces and a significant safety-utility tradeoff: models succumb to prompt leakage attacks at rates up to 86.2%, while heavily aligned versions simultaneously exhibit excessively high False Refusal Rates (FRR) for benign, borderline security queries. Finally, we delineate a theoretical neuro-symbolic roadmap—integrating LLM heuristics with deterministic formal methods—to structurally mitigate the limitations of the autoregressive paradigm.