Lev‑3B is a 3‑billion‑parameter decision model built on Granite‑4.1‑3B‑Base that uses a two‑stage training recipe. First, it learns bounded natural‑language decisions without log data, then it trains on logs while mixing target tasks with 35 unrelated auxiliary log tasks. The shared checkpoint performs better on unseen sources than training on logs alone, and outperforms prompted frontier models on anomaly detection at lower serving cost, though it lags on attack‑technique classification and shows calibration issues on excluded logging systems.
arXiv:2605. 22779v2 Announce Type: replace-cross Abstract: Production systems generate millions of log lines daily, yet most anomaly detectors operate at the session or window-level, flagging groups of lines rather than identifying the specific message responsible.
The paper introduces LoRD, a lightweight post‑hoc calibration framework designed to improve confidence reliability in language‑model‑based log anomaly detectors. LoRD learns route‑specific reliability models from latent representations of correctly classified validation samples and uses reconstruction distances to estimate prediction reliability. By selectively recalibrating high‑risk predictions, LoRD reduces overconfident errors while maintaining strong anomaly detection performance across four large‑scale log benchmark datasets.
SecJev is a family of Jev-like decision models specialized for security, ranging from 0.8 B to 9 B parameters. Built on Kev’s single‑pass candidate scorer, it learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories, and is trained on the SecJev‑Corpus that unifies source‑label prediction and explicit‑policy evaluation across 14 tasks and eight sources. The security specialization improves every model, with SecJev‑0.8B outperforming general Kev‑9B by 20.51 percentage points in task‑macro accuracy and matching generative fine‑tuning in accuracy and latency while using less peak inference memory.
SecLog-Bench is a new benchmark designed to evaluate large language models on cybersecurity log reasoning. It features an extensible simulation platform covering 29 attack scenarios, uses multi‑source logs (audit, application, network traffic), and provides dense annotations with step‑by‑step evidence chains. Evaluation of eight mainstream LLMs shows modest performance, with the best model achieving 44.44% accuracy and 45.07% Macro‑F1, and even correct predictions often accompanied by flawed reasoning.
arXiv:2607. 20832v1 Announce Type: cross Abstract: Advanced Persistent Threats (APTs) remain difficult to detect because only a small fraction of events in large-scale logs are attack-related, and investigation is expensive and hard to scale.
The paper investigates how different adaptation strategies, model architectures, parameter scales, and quantization settings influence the performance, efficiency, and robustness of large language models (LLMs) for log anomaly detection. Across three public log datasets, the study finds that adaptation strategies lead to significant performance variations, model scaling offers dataset‑dependent gains, and models with similar accuracy can differ markedly in computational cost. Low‑bit quantization largely preserves detection performance, and the authors also assess robustness to structural, semantic, and label noise at varying perturbation levels.
Large Language Models (LLMs) treat all context tokens uniformly, which creates prompt injection vulnerabilities and unreliable instruction execution. The paper introduces LLMON (LLM Object Notation), a post‑training framework that separates executable instructions from passive data and requires explicit identifier‑based execution. Using a 4.6 B‑token structured corpus and post‑training on Granite‑4.1 models, LLMON reduces indirect prompt‑injection success rates from 53–100 % to 0.02–5.6 % while maintaining general capabilities, and provides attention‑based interpretability metrics to diagnose failure modes.
arXiv:2606. 18190v1 Announce Type: cross Abstract: Multi-stage cyberattacks span system, network, and browser logs.
RH-Detect is a unified benchmark for detecting reward hacking in language models, aggregating 92,761 examples from eleven public datasets into a common schema with six behavior categories. It evaluates six off‑the‑shelf models on 5,021 open‑ended evaluation units, achieving a top AUROC of 0.962 and over 93% accuracy, though performance drops notably on multi‑turn tool‑use datasets. The study also shows that input format changes and single‑token fine‑tuning can influence detector performance, revealing gaps in deployment‑time monitoring.
arXiv:2609.33676v2 Announce Type: replace Abstract: LLM agents increasingly take consequential actions through interactions with users, policies, and external tools. Auditing these agents requires au...
arXiv:2606. 04957v1 Announce Type: cross Abstract: System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension.
arXiv:2609.14762v1 Announce Type: cross Abstract: Cloud-hosted large language models (LLMs) are increasingly used for root cause analysis (RCA) in AIOps pipelines, but they introduce data privacy ris...