SMETA-ZSL: Semantic Meta-Alignment for Zero-Shot Threat Classification

Jul 16, 2026

Upload by Eden

Cybersecurity systems must adapt quickly to newly emerging threats, yet labeled data for new categories is often unavailable at first appearance. Generalized zero-shot learning addresses this by recognizing unseen classes using auxiliary semantic knowledge instead of labeled examples. SMETA-ZSL leverages large language models to transform unstructured CTI reports into semantic prototypes, while handling semantic overlap, cross-modal heterogeneity, severe class imbalance, and open-set conditions. Experiments on 7 benchmarks show state-of-the-art generalized zero-shot performance, improving average results by 10.8 points and up to 18.1.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages17

Reading Time43 min

Introduction

Problem Motivation

Generalized Zero-Shot Learning Formulation

Key Challenges

Proposed Method

Semantic Meta-Alignment (SMETA-ZSL)

Contrastive Finetuning and Prototyping

Episodic Meta-Learning and Knowledge Distillation

Adaptive Routing for Seen-Unseen Generalization

arXiv :2607 .09936v 1 [ cs .LG] 10 Jul 2026 SMETA-ZSL: Semantic Meta-Alignment for Zero-Shot Threat Classification Ivan Alejandro Montoya Sanchez, Anantaa Kotal, Aritran Piplai The University of Texas at El Paso 500 W. University Avenue El Paso, TX 79968, USA [iamontoyasa@miners.utep.edu](iamontoyasa@miners.utep.edu) , {akotal,[apiplai](apiplai}@utep.edu)[}](apiplai}@utep.edu)[@utep.edu](apiplai}@utep.edu) Abstract Cybersecurity systems must adapt rapidly to emerging threats. However, labeled data for new threat categories is unavailable when those threats first appear. Generalized zero-shot learning offers a natural solution by enabling recognition of unseen classes through auxiliary semantic knowledge rather than labeled examples. Large language models are particularly promising in this setting because they can convert unstructured CTI reports into semantic prototypes for emerging threats. However, applying language-driven zero-shot learning to cybersecurity is difficult due to strong semantic overlap between threat descriptions, heterogeneity between behavioral attributes and text, severe class imbalance, and open-set conditions where unseen threats are unknown during training. We propose SMETA-ZSL, that learns semantic prototypes from overlapping language descriptions through contrastive finetuning, aligns behavioral features through episodic meta-learning and knowledge distillation, and performs adaptive routing for generalization across seen-unseen classes. Across 7 benchmarks, SMETA-ZSL delivers the strongest overall generalized zeroshot performance under the strictest inductive setting, surpassing prior methods by 10.8 points on average, with gains up to 18.1 points. Github: [https://github.com/Security-And-Intelligence-Lab-UTEP/SMETA-ZSL](https://github.com/Security-And-Intelligence-Lab-UTEP/SMETA-ZSL) 1 Introduction Cyber defense systems rely on large amounts of raw data, such as malware samples or logs, to train and update models, yet this data is often difficult to obtain, slow to analyze, and not always available when new threats emerge. Consider the task of malware classification: the continuous emergence of new variants and families (Tang et al., 2023) necessitates frequent retraining of classifiers, imposing significant computational overhead (Li et al., 2024a) and making it difficult to obtain timely, labeled data for adapting models to new threats (Barros et al., 2022; Aurna et al., 2025) . In contrast, Cyber Threat Intelligence (CTI) reports are regularly published by analysts and provide timely natural language descriptions of attacker behavior. However, most defense systems do not operate over natural language, and therefore cannot directly use CTI to adapt or update their behavior, leaving valuable intelligence underutilized. Large Language Models (LLMs) offer a way to process CTI and extract information that can be used by downstream systems. Prior work (Chakraborty et al., 2026; Mitra et al., 2025; Bertiger et al., 2025; Schwartz et al., 2025) has largely focused on using LLMs to generate rule-based defenses. In contrast, leveraging CTI to update data-driven, black-box machine learning systems is significantly more difficult, as it requires converting textual descriptions into signals that can influence model behavior without access to raw data. This gap creates an important language modeling problem: can language models convert unstructured threat reports into representations that are useful for updating non-linguistic machine learning systems, even when no labeled examples of the new threat exist? Directly using LLMs for zero-shot malware or attack detection is challenging because cybersecurity artifacts are often too large to analyze in full, making inference costly and frequently exceeding practical context-window limits (Qian et al., 2025) . Truncating these artifacts into abstract features degrades performance (Zhou et al., 2024) . Instead, the goal is to extract and transfer k

FAQs

What techniques does SMETA-ZSL introduce to improve alignment and generalization?

SMETA-ZSL learns semantic prototypes from overlapping language descriptions using contrastive finetuning, aligns behavioral features through episodic meta-learning and knowledge distillation, and applies adaptive routing to generalize across seen and unseen classes.

Jul 16, 2026

Upload by Eden