ProofSec Benchmark Tests Whether LLMs Can Tell Security Indicators from Real Evidence

A new benchmark called ProofSec has been developed to evaluate how well large language models reason about cybersecurity vulnerabilities using actual evidence rather than surface-level pattern recognition. The benchmark addresses a core weakness in current LLMs: their tendency to flag a vulnerability based on semantic cues, such as predictable identifiers or familiar attack terminology, even when the available evidence does not conclusively prove one exists. ProofSec requires models to classify each scenario into one of three states — Vulnerable, Not Vulnerable, or Insufficient Evidence — making uncertainty a first-class outcome rather than a forced binary choice. The benchmark tests capabilities including evidentiary sufficiency, contradiction resolution, resistance to authority bias, and the ability to incorporate falsifying information. It was submitted as part of the Kaggle Benchmarking Challenge and aims to shift security-focused AI evaluation toward epistemic rigor rather than mere pattern matching.