The true potential of SLMs is unlocked when they can learn from user interactions, particularly from instances where their responses fall short. By capturing signals of dissatisfaction\u2014such as follow-up questions indicating confusion or frustration\u2014we can create a feedback loop that drives continuous improvement. This approach ensures that the model not only provides accurate information but also aligns with the user’s expectations and needs.<\/p>\n
Large Language Models (LLMs), like GPT-4, offer a unique opportunity to enhance this process. Their generative capabilities can be harnessed to augment training data, creating new question-answer pairs that address gaps identified through user feedback. This synergy between SLMs and LLMs fosters a self-learning memory system, enabling cybersecurity models to evolve in real-time, much like a seasoned analyst refining their expertise with each new challenge.<\/p>\n
In this blog, we will explore how to build such a self-learning memory for SLMs from a cybersecurity perspective. We will delve into the steps of capturing user dissatisfaction, suppressing sensitive information, generating enhanced training data, and fine-tuning models to create a continuous learning loop. By the end, you’ll have a comprehensive understanding of how to transform your SLM into a self-improving cybersecurity assistant.<\/p>\n
When to Use Fine-Tuning vs Retrieval Augmentation (RAG) in Cybersecurity<\/h2>\n
Choosing between fine-tuning a Small Language Model (SLM) and using Retrieval-Augmented Generation (RAG) depends heavily on the cybersecurity use case and the nature of the data involved.<\/p>\n
Fine-Tuning: Embedding Domain Expertise Deeply<\/h3>\n
Fine-tuning updates the model\u2019s internal weights to incorporate new knowledge, making it an excellent choice when you need the model to intrinsically understand evolving cyber defense tactics, attacker behaviors, and threat intelligence. For example, if a SOC analyst notices recurring patterns of novel phishing attacks or new malware behaviors, fine-tuning the SLM with these examples ensures the model inherently grasps these subtleties and can respond accurately without external context.<\/p>\n
Fine-tuning is best when:<\/p>\n
- \n
- The knowledge updates are structured and stable over time.<\/li>\n
- You want consistent, fast responses without relying on external document retrieval.<\/li>\n
- The use case demands deep domain reasoning that benefits from the model\u2019s latent understanding.<\/li>\n<\/ul>\n
![\"\"](\"https:\/\/blogs.infosys.com\/emerging-technology-solutions\/wp-content\/uploads\/2025\/06\/Learning-on-the-fly-2.png\")
Flow Diagram<\/figcaption><\/figure>\n Retrieval Augmentation (RAG): Leveraging Dynamic, Growing Corpora<\/h3>\n
RAG combines a fixed language model with a retrieval system that pulls in relevant external documents or data at query time. This approach is ideal when the knowledge base is rapidly changing, such as newly released threat reports, vulnerability disclosures, or real-time incident logs.<\/p>\n
RAG is preferred when:<\/p>\n
- \n
- The corpus is large, dynamic, and frequently updated.<\/li>\n
- You want to maintain a lightweight core model without constant retraining.<\/li>\n<\/ul>\n
Responses must incorporate the latest information that may not yet be part of the model\u2019s training.<\/p>\n
Prompt Tuning: Lightweight Adaptation for Rapid Adjustments<\/h3>\n
Prompt tuning (also known as instruction tuning or prefix tuning) enables targeted behavioural changes in Small Language Models without modifying their core weights. Instead of retraining the entire model, prompt tuning appends learnable embeddings or text prompts that guide the model’s output in a specific domain or context.<\/p>\n
This approach is especially effective in cybersecurity scenarios where:<\/p>\n
- \n
- The team wants rapid updates without large compute resources.<\/li>\n
- The model is hosted in a restricted environment (e.g., on-prem SOC, air-gapped systems).<\/li>\n
- You want to experiment with user-intent shifts or temporary guidance without committing to full fine-tuning.<\/li>\n<\/ul>\n
For instance, a model can be prompt-tuned to prioritize threat intelligence from a particular vendor or emphasize a zero-trust policy context across all interactions.<\/p>\n
Prompt tuning is best when:<\/p>\n
- \n
- You need fast, low-cost iteration over behavior.<\/li>\n
- You are experimenting with A\/B testing new model styles or tones.<\/li>\n
- Infrastructure limitations restrict model retraining.<\/li>\n<\/ul>\n
Cybersecurity Example<\/h3>\n
Consider a scenario where a SOC chatbot supports analysts by answering questions about attacker Tactics, Techniques, and Procedures (TTPs):<\/p>\n
- \n
- If new TTPs emerge and need to be embedded into the chatbot\u2019s core knowledge, fine-tuning the SLM ensures the model can reason and generalize about these tactics seamlessly.<\/li>\n
- However, if analysts need quick access to the latest threat intelligence reports or incident data, a RAG approach allows the chatbot to pull in up-to-date documents without retraining.<\/li>\n<\/ul>\n
In practice, many cybersecurity solutions combine both\u2014using RAG for fresh data and fine-tuning for stable core knowledge. This blog focuses on advancing the fine-tuning side by building a self-learning memory that continually updates the SLM based on user feedback and dissatisfaction signals.<\/p>\n
Steps to Create Long Term Memory<\/h2>\n
<\/p>\n
![\"Steps](\"https:\/\/blogs.infosys.com\/emerging-technology-solutions\/wp-content\/uploads\/2025\/06\/Learning-on-the-fly-3.png\")
<\/p>\nStep 1: Building the Fine-Tuning Pipeline for Cyber SLMs<\/h3>\n
To enable a Small Language Model (SLM) to learn continuously from user interactions, we need a modular, auditable, and secure fine-tuning pipeline. The goal is to create a loop where model performance improves based on real-world chat data\u2014particularly on questions that expose limitations in the model\u2019s current knowledge.<\/p>\n
Key Components of the Pipeline:<\/h4>\n
- \n
- Chat Interaction Capture: Capture question-answer pairs from end-user interactions, especially focusing on cases where follow-up questions indicate confusion or dissatisfaction.<\/li>\n
- Dissatisfaction Detection: Use sentiment analysis and heuristics to identify follow-up questions that imply the previous response was unsatisfactory.<\/li>\n
- Sensitive Data Redaction: Automatically scrub personally identifiable information (PII), such as emails, IP addresses, names, and organization details, to ensure compliance and data safety.<\/li>\n
- Augmented Data Generation: Use a secure GPT-4 API backend to create improved or alternate Q&A pairs, based on the gaps identified.<\/li>\n
- Dataset Curation & Formatting: Structure the collected and cleaned data into instruction-tuning format (e.g., Alpaca-style) for ingestion.<\/li>\n
- Model Fine-Tuning: Use QLoRA or LoRA-based adapters on top of the LLaMA 3.1 8B base model to reduce compute requirements while achieving high adaptability.<\/li>\n
- Benchmark & Feedback Loop: After fine-tuning, evaluate the model on both known and new queries to validate learning improvement.<\/li>\n<\/ol>\n
Step 2: Logging User Conversations in a Relational Database<\/h3>\n
Capturing real-world interactions between users and your cyber defense chatbot is the foundation of a self-learning system. However, instead of logging entire session histories or user identifiers, the focus should remain on contextually meaningful Q&A pairs\u2014especially those where a user’s next question reveals ambiguity, confusion, or dissatisfaction with the previous answer.<\/p>\n
What to Log (Minimalist Schema):<\/h4>\n