Basic AI Concepts Related to Cybersecurity · Topic 1 of 4
AI Types and Language Models
Compare AI types for the SecAI+ exam: machine learning, statistical learning, deep learning, transformers, GANs, NLP, LLMs and small language models.
- 6 min
- Deep learning is a subset of machine learning, and transformers are a deep learning architecture.
- Statistical learning models are usually smaller and easier to explain than deep networks.
- Generative AI creates new content; discriminative models label existing input.
What it is
Artificial intelligence (AI) is the broad field of building systems that perform tasks that normally need human judgement, such as recognising patterns, understanding language or making decisions. Most AI used in security today is machine learning (ML): models that learn patterns from data instead of following hand-written rules.
The exam expects you to tell the types apart by what they learn from, what they produce and what risk each one brings. A spam filter, a deepfake generator and a chat assistant are all AI, but they are attacked and defended in different ways.
How it works
The family of AI types
The types nest inside each other rather than sitting side by side. Deep learning is a kind of machine learning, and transformers are a kind of deep learning.
| Type | What it is | Security example |
|---|---|---|
| Machine learning | Algorithms that learn a mapping from example data to an output | Classifying web links as malicious or benign |
| Statistical learning | ML grounded in statistics, such as regression, decision trees, naive Bayes and clustering; models are often small and explainable | A naive Bayes spam filter or a logistic regression fraud score |
| Deep learning | ML using neural networks with many layers that learn their own features from raw data | Classifying malware from raw bytes, recognising voices |
| Transformers | A deep learning architecture that uses attention to weigh every part of the input against every other part | The engine behind modern language models |
| Generative AI | Models that create new content such as text, code, images or audio, rather than only labelling input | Drafting incident summaries; also deepfakes |
| Generative adversarial networks (GANs) | Two networks trained against each other: a generator makes fakes and a discriminator tries to spot them | Synthetic training data; realistic fake faces |
| Natural language processing (NLP) | The field of making machines read, understand and produce human language | Extracting indicators from threat reports, sorting tickets |
Discriminative versus generative models
A discriminative model answers "which class is this?", for example phishing or not phishing. A generative model produces something new, such as a reply, a script or an image.
The difference matters for security. A classifier that is fooled gives a wrong label, while a generative model that is fooled can write harmful text, leak data or produce malicious code.
Transformers, tokens and context
Transformers split input into tokens, which are words or pieces of words, and use self-attention to decide which tokens relate to each other. The context window is the maximum number of tokens the model considers at once, covering the prompt, any retrieved documents and the answer.
Everything inside the context window influences the output. That is why instructions hidden in a web page or email that a model reads can steer it, a theme that returns in the attacks chapter.
GANs in defence and attack
In a GAN the generator improves until the discriminator can no longer tell real from fake. Defenders use the technique to create synthetic samples of rare attacks for training.
Attackers use the same idea for convincing fake faces and voices. A model trained to spot fakes can itself be used as a discriminator to make the next fakes harder to detect.
Large versus small language models
A language model is an NLP model that predicts the next token. Its size is described by the number of parameters, the learned weights inside the network.
| Feature | Large language model (LLM) | Small language model (SLM) |
|---|---|---|
| Size | Very many parameters | Far fewer parameters |
| Typical hosting | Provider cloud service or large clusters of graphics processing units (GPUs) | On premises, at the edge or on a single device |
| Strengths | Broad knowledge, complex reasoning, many tasks | Narrow tasks, low latency, low cost |
| Data exposure | Prompts often leave the organisation when hosted by a third party | Data can stay inside the network |
| Weaknesses | Cost, larger attack surface, harder to audit | Less general capability, may need fine-tuning for the task |
A worked example
A security operations centre (SOC) has three needs. It must score login events for fraud with a reason auditors can follow, summarise alert queues in plain English, and classify maintenance tickets on an isolated operational technology (OT) network.
The team picks a statistical learning model for the login scores because it is explainable, a hosted LLM for alert summaries using sanitised data, and an SLM on local hardware for the isolated network. Each choice balances capability against explainability and data exposure.
How the exam asks about this
- "A team needs a model that runs on an isolated network on modest hardware and must not send ticket text to a third party. Which of the following is the best choice?" A small language model hosted locally.
- "Which of the following AI types trains a generator and a discriminator against each other?" A generative adversarial network (GAN).
- "Auditors require a clear reason for every flagged transaction. Which of the following approaches is most appropriate?" A statistical learning model, such as a decision tree or logistic regression, which is easier to explain than a deep neural network.
What to remember for the exam
- Deep learning is a subset of machine learning, and transformers are a deep learning architecture.
- Statistical learning models are usually smaller and easier to explain than deep networks.
- Generative AI creates new content; discriminative models label existing input.
- GANs pair a generator with a discriminator, which makes them a classic deepfake technique, alongside autoencoders and diffusion models.
- SLMs trade general capability for lower cost, lower latency and the option to keep data local.
A model reads everything in its context window as potential instruction. Retrieved documents, emails and tool output are not "just data" to an LLM.
Common mistakes
Treating generative AI and machine learning as separate fields. Generative AI is built with machine learning, usually deep learning. The useful contrast is generative versus discriminative.
Assuming bigger is always better. An LLM is not the right answer when the scenario stresses cost, latency, isolation or keeping data on site. Those words point to an SLM or a smaller ML model.
Confusing NLP with LLMs. NLP is the field of working with human language, and LLMs are one powerful technique inside it. Older NLP methods such as keyword extraction are still NLP.
Check yourself
What is the role of the discriminator in a GAN?
It tries to tell real samples from the generator's fakes, which pushes the generator to produce more convincing output.
Why might a security team choose an SLM over an LLM?
An SLM can run locally on modest hardware with low cost and latency, so sensitive data does not have to leave the organisation.
What does a transformer's attention mechanism do?
It weighs how much each token in the input relates to every other token, which lets the model use context across the whole prompt.
Topic 1 of 4 in Basic AI Concepts Related to Cybersecurity
Test yourself on Basic AI Concepts Related to Cybersecurity
The full CompTIA SecAI+ CY0-001 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.