Narrow vs. General, Discriminative vs. Generative: The AI Taxonomy SecAI+ Tests, and the Attack Each Branch Invites

Objective 1.1 of SecAI+ reads like a glossary: generative AI, machine learning, deep learning, transformers, GANs, NLP, LLMs, SLMs, then five training techniques. Candidates memorize the definitions and then meet a question that never asks for one. The stem describes a system, a malware classifier, a chat assistant, a fraud model, an autonomous pentest agent, and asks which attack it should worry about first, or which technique fits a task. Those questions are only answerable if you hold the vocabulary as a taxonomy with axes, because each axis predicts a different way the system fails.

Three axes, not one list

The terms in 1.1 nest. Artificial intelligence is the umbrella: any system that simulates intelligent behavior. Machine learning is the subset that learns patterns from data instead of following hand-written rules. Deep learning is the subset of ML built on multi-layer neural networks, and transformers, CNNs and RNNs are specific deep-learning architectures. NLP and generative AI cut across that stack: one is a domain (human language), the other is an output type (new content rather than a label).

That hierarchy answers "what is a subset of what." It does not answer the questions the scenarios ask. For those you need three further axes:

• Scope: narrow or general. Is the system built for one task, or for any task?
• Output: discriminative or generative. Does it draw a boundary between classes, or produce new content?
• Learning signal: supervised, unsupervised, semi-supervised or reinforcement. What told the model it was right during training?

Layered over all three are the technique families, natural language processing, computer vision, recommender systems, agents and multimodal systems, which describe what kind of input and output the system handles. Every family can sit at any point on the three axes.

Narrow versus general

Every AI system in production today is narrow AI: built, trained and validated for a bounded task on a bounded distribution of data. A spam filter classifies email. A fraud model scores transactions. Even a frontier LLM is narrow in the sense that matters for security: it predicts the next token, and everything else is a consequence of that one task. General AI, a system that can learn and perform any intellectual task a person can, remains hypothetical, and the exam does not ask you to secure it.

Why does the distinction matter if only one side exists? Because narrowness defines the failure mode. A narrow model is only trustworthy inside its training distribution. Inputs from outside it, a malware family it never saw, a language it was not trained on, a network the week after a data-center migration, produce confident predictions that mean nothing. The term for this is out-of-distribution input, and a large share of AI security is about keeping a narrow system inside the world it understands, or noticing when it has left.

Discriminative versus generative

This is the axis with the largest security consequences, and the one candidates most often skip because the outline names only one side of it.

A discriminative model learns the boundary between classes. Give it an input and it returns a label or a score: malicious or benign, fraud or legitimate, this user or not this user. Malware classifiers, spam filters, intrusion detection models, fraud scoring and biometric matching are all discriminative. The model does not need to know what malware looks like in general; it needs to know where the line runs.

A generative model learns the distribution of the data itself, well enough to produce new samples from it. LLMs generate text, diffusion models generate images, GANs generate whatever their discriminator was trained to judge. Generative AI is an output type, not a position in the hierarchy, and a GAN contains both kinds: a generator and a discriminator that train each other until the fakes pass.

The attack row is the point. A classifier's entire job is a boundary, so the attack against it is an input engineered to land on the wrong side of that boundary while still doing what the attacker wants: an adversarial example, the family of evasion attacks that red teams test for. A generative model's job is to follow instructions and produce content, so the attack against it is an instruction it should not follow, arriving inside content it was asked to process: prompt injection. You cannot inject a malware classifier, and you cannot evade an LLM in the classifier's sense. When a stem describes the system, it has already told you which attack to expect.

The learning signal: four ways a model learns it was right

The outline lists five training techniques: supervised, unsupervised, reinforcement, federated and fine-tuning. Only the first three are learning paradigms, meaning they describe what signal shaped the weights. Federated learning describes where training happens (at the data, with only model updates centralized), and fine-tuning describes when (after pretraining, on a smaller domain set). Semi-supervised learning is the fourth paradigm, less often named but the way most security models are actually trained, because labeled attacks are scarce and unlabeled telemetry is not.

The guide's exam tip is worth memorizing verbatim: email security and BEC detection point to NLP; zero-day malware to deep learning; SIEM and UEBA anomaly detection to unsupervised ML; fraud detection to supervised ML trained on labeled outcomes. But read the right-hand column too, because it is the same mapping from the attacker's side. A supervised model trusts its labels, so poison the labels. An unsupervised model trusts its baseline, so shift the baseline slowly. A reinforcement agent trusts its reward, so earn the reward without doing the job. That is reward hacking: a pentest agent paid per finding that reports the same finding six ways, or an agent rewarded for closing tickets that closes them without fixing anything.

The technique families

The families describe what a system perceives and produces. Each carries a use-case list and a threat list, and the stems borrow from both.

Natural language processing works with human language: tokenization, sentiment analysis, named-entity recognition, translation, summarization. In security it parses threat reports, phishing email, logs and dark-web chatter at a scale no analyst team can read. Its attack is the one every text channel shares: language that is data to the analyst is instructions to the model.

Computer vision works with images and video, and with anything that can be represented as one; CNNs classify raw malware binaries by treating byte patterns as visual structure. Its attack is the adversarial perturbation: pixel-level changes invisible to a person that flip the classification, or a printed patch that makes a camera see nothing.

Recommender systems rank items for a user from behavior and similarity. They are what prioritizes a vulnerability queue, ranks alerts, and suggests the next playbook step. Their attack is manipulation of the signal they rank on: fake interactions or planted history that push a malicious item to the top or bury a real finding.

Agents wrap a model in a loop that plans, calls tools and acts on results. Underneath they are usually a generative LLM plus permissions, which is why their attack surface is the permissions: excessive agency, tool misuse, and an injected instruction that becomes an action instead of a sentence.

Multimodal systems accept more than one kind of input, text plus image plus audio. A multimodal model inherits every family's attack at once and adds a new one: an instruction hidden in an image or an audio track that the text-only filters in front of the model never see.

One system, one primary attack

Put the axes together and the reason the exam teaches taxonomy becomes clear. Classify a system on the three axes, name its family, and you have predicted its primary attack class before anyone has tested it.

Two cautions. First, "primary" does not mean "only": every model that learns from data can be poisoned in training, whatever its type; the grid shows the attack on what the model does at inference. Second, real systems stack. A SOC assistant is a generative LLM (injection) acting as an agent (excessive agency) over an unsupervised anomaly model (drift). Securing it means securing every layer against its own attack, which is why a scenario so often describes a system in one sentence and expects you to unpack three.

Four stems, decoded

1. A vendor's malware classifier is fooled by a sample whose bytes were padded so that its features resemble a benign installer. Discriminative model, evasion attack. The defense is adversarial training and ensembling, not filtering the input for instructions.
2. A SOC summarization assistant, asked to condense a threat report, instead emails the report to an external address named inside the document. Generative model acting as an agent, indirect prompt injection turned into an action. Treat every document as untrusted, and remove the tool permission that made a sentence executable.
3. An autonomous pentest agent rewarded per reported vulnerability floods the queue with duplicates of one finding. Reinforcement learning, reward hacking. Fix the reward and the constraints, because the agent did exactly what it was paid to do.
4. A team has three thousand labeled alerts and forty million unlabeled events and wants a triage model. Semi-supervised learning. Supervised alone starves on three thousand labels; unsupervised alone throws away the labels you have.

AI types and techniques are objective 1.1 of SecAI+ Domain 1, Basic AI Concepts Related to Cybersecurity, 17% of the exam. The generative branch's internals are in how large language models actually work, and the attacks named in the grid are catalogued in MITRE ATLAS. Work all 18 Domain 1 topics, from the AI landscape through data security and the AI lifecycle, with our SecAI+ Domain 1 study guide.

#SecAIplus #CY0001 #ArtificialIntelligence #MachineLearning #GenerativeAI #ReinforcementLearning #AdversarialML #ExamPrep #InfoSec #CyberSecurity