{"id":"6f417fe7-3c8d-486b-91f4-8e70640988d7","arxiv_id":"2509.23573","paper_version":5,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"LLMs assisting cyber threat intelligence fail mainly due to spurious correlations, contradictory knowledge, and constrained generalization that stem from the threat landscape itself.","lead":"This paper studies why large language models make mistakes when they help analysts handle cyber threat intelligence. It finds three recurring failure modes: over-trusting superficial patterns, being confused by conflicting reports, and failing on new or emerging attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Failure-mode taxonomy is the linchpin: ~95% of labels come from LLM majority vote with no reliability check, so the claimed dominance and 'three fundamental vulnerabilities' are unestablished.","rationale":"The paper's central contribution is the claim that three domain-specific failure modes dominate LLM behavior in CTI, driven by the threat landscape rather than model architecture. Every downstream conclusion, including the proposed 'roadmap' for defenses, depends on the reliability and completeness of the failure-mode taxonomy in Figure 2. The methodology in §3 deliberately avoids full manual annotation for scalability: stratification inspects only ~3% of instances, and the autoregressive refinement loop relies on LLM classification of the remaining instances, with human review limited to 'other' or uncertain cases (<1.8%). No inter-annotator agreement, label release, or error analysis is provided. This is the weakest link in the argument. The reader's weakest_assumption identifies exactly this concern, and I agree. The missing causal interventions mentioned in the top abstract are also concerning, but even if those experiments were present, the taxonomy would still need to be trustworthy; without reliable labels, any intervention results would be uninterpretable. Thus the taxonomy reliability is the more load-bearing issue. The proposed test—independent re-annotation of a stratified random sample with blinded annotators—directly tests both the reliability of the existing labels and the completeness of the taxonomy. It would settle whether the claimed dominance percentages and the 'three fundamental vulnerabilities' framing are supported. The current verdict of CONDITIONAL is appropriate; this concern does not change it, but it sharpens the condition: the authors must provide reliability evidence and data release to move toward acceptance.","tokens_in":37098,"tokens_out":5313,"duration_ms":41564,"concrete_test":"Independently re-annotate a stratified random sample of 1,000 instances (250 per CTI stage) drawn from both the human-inspected and the LLM-labeled portions. Two blinded human annotators with CTI expertise classify each instance into the 15 subtypes in Figure 2 or 'other', using Appendix C.2 criteria. Compute Cohen's kappa between annotators and the paper's labels, and the fraction of 'other'. If kappa < 0.6 or >5% of samples require a new label not in the 15 subtypes, the taxonomy is not reliable enough to support the claimed dominance and the bottleneck conclusion.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that the threat landscape itself dominates LLM failure in CTI and manifests as three fundamental vulnerabilities—rests on the failure-mode taxonomy in Figure 2. That taxonomy is produced by the pipeline in §3: stratification anchors (§3.1) manually inspect at most 3% of instances; the autoregressive loop (§3.2) seeds the taxonomy from a small D0 and only humans review 'other' or disagreement/fluctuation (<1.8%, §3.3). The remaining roughly 95% of instances are labeled by majority vote of four LLMs with no reported inter-annotator reliability, no confidence intervals, and no release of the label set. If the initial D0 is unrepresentative, or if the LLM voters systematically mislabel novel failures as one of the existing 15 subtypes, the loop can terminate (ΔT=∅) with an incomplete taxonomy. The paper also does not report the overlap size in the stratification score distributions or the accuracy of the anchor-derived thresholds, so the failure set itself may be contaminated. Consequently, the dominance percentages in Figure 2 and the 'three fundamental vulnerabilities' claim are not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper evaluates 15 general-purpose and cyber-specialized LLMs on cyber threat intelligence (CTI) tasks spanning contextualization, attribution, prediction, and mitigation. It proposes a human-in-the-loop categorization pipeline (§3) that combines stratification, an autoregressive taxonomy-refinement loop, and multi-agent LLM labeling with human arbitration. Using this pipeline, the authors report three failure-mode categories—spurious correlations, contradictory knowledge, and constrained generalization—with subtype-level percentages in Figure 2 and qualitative root-cause case studies in §4 and Appendix D. The abstract further claims that these mechanisms are validated by causal interventions and that targeted defenses significantly reduce failure rates. The central thesis is that the threat landscape itself, rather than model architecture, is the dominant bottleneck for LLM-assisted CTI.","tokens_in":37346,"tokens_out":4425,"duration_ms":37617,"significance":"If the taxonomy and the claimed dominance ratios are reliable, the paper offers a valuable reframing of LLM failure in CTI: the problem is not only model reasoning but also the heterogeneous, volatile, and fragmented nature of threat evidence. The study is broad in scope, drawing on multiple benchmarks and real-world CTI databases, and the qualitative case studies in Appendix D are often concrete and informative. The authors also state that they release code, which aids reproducibility. However, the significance is conditional on two load-bearing points that are currently not established: the reliability and completeness of the failure taxonomy (Section 3 and Figure 2), and the causal-intervention/defense experiments promised in the abstract but absent from the manuscript.","major_comments":[{"comment":"The abstract states: 'We validate these mechanisms via causal interventions and show that targeted defenses reduce failure rates significantly.' No such experiments appear anywhere in the manuscript. Sections 2–6 and Appendices A–E contain no intervention design, no control condition, no defense evaluation, and no effect-size measurement; §4's 'Design Insight' only recommends future directions. Because this validation claim is part of the paper's stated contribution, the central claim is currently unsupported. The authors must either add the missing experiments or revise the abstract to describe what was actually performed.","section":"Abstract / §4"},{"comment":"The taxonomy underpinning the dominance claims is labeled by four-LLM majority vote for approximately 95% of instances. §3.3 reports that fewer than 1.8% of cases are flagged as uncertain and human-verified, but the manuscript provides no inter-annotator agreement among the four models, no LLM-human agreement on a held-out sample, no confidence intervals for the proportions in Figure 2, and no sensitivity analysis for the initial taxonomy D0 or the coverage threshold ρ in Algorithm 2. If the voting models share a label bias or systematically under-report 'other', the loop can terminate with an incomplete taxonomy, and the claimed dominance of spurious correlations, contradictory knowledge, and constrained generalization is not established. Quantitative reliability evidence and a robustness check are needed.","section":"§3.2–3.3 / Figure 2"},{"comment":"The stratification step classifies instances as failed or correct by comparing similarity scores to anchor-derived ranges, but the manuscript does not report the score distributions for 'correct' versus 'failed' anchors, the size of the overlapping region, or the accuracy of the derived thresholds. The statement that 'practically, this process is efficient as it requires manually inspecting no more than 3% of instances' is an assertion rather than a measured outcome. Without stratification diagnostics, the failure set D itself may be contaminated, and this contamination propagates to every downstream ratio and percentage. Please report these diagnostics and the actual manual-inspection counts.","section":"§3.1 / Algorithm 1"},{"comment":"In the second round of multi-agent labeling, each LLM observes the first-round predictions of the other models. This can induce conformity and artificially reduce the size of the uncertainty set U, so the reported '<1.8%' human-verification rate may reflect deliberation dynamics rather than genuine labeling stability. The manuscript should report first-round agreement separately and validate the final labels on a random sample of agreed cases, not only on cases that the models themselves flagged as uncertain.","section":"§3.3, Step 2"}],"minor_comments":[{"comment":"The percentages are given without denominators or confidence intervals, and because vulnerabilities may overlap, the legend is hard to parse. Please clarify how the 'General' and 'Agent' ratios are computed and what the base population is.","section":"Figure 2"},{"comment":"The column headers run together (e.g., 'GRKFSC', 'LLY CBS SPT DHT'). Adding separators would greatly improve readability and avoid misreading model abbreviations.","section":"Table 2"},{"comment":"The disclosure says LLMs were 'not employed in experimental execution,' but §3.3 uses four LLMs to label failure instances. Please clarify whether the disclosure refers only to manuscript preparation or also covers the LLM-assisted categorization pipeline.","section":"Appendix E"},{"comment":"There are scattered typos and spacing artifacts, e.g., 'Temporal forcasting' and 'Y ARA'. A copyedit pass would help.","section":"Appendix A.3 / Table 3"},{"comment":"The termination condition 'the distribution of failure modes ... converges to a stable ratio' is not formally defined. Please provide an operational criterion, e.g., a bound on the change in proportions between iterations.","section":"§3.1 / Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":"The absent causal-intervention experiments are the most serious issue: the abstract promises validation that the manuscript does not deliver. The taxonomy-reliability concern is equally important because the central 'three fundamental vulnerabilities' claim rests on a labeling pipeline whose accuracy is not measured. I would ask for either the experiments or a revised abstract, plus reliability analysis (inter-annotator agreement, held-out human labels, sensitivity to D0 and ρ). The Appendix E statement should also be reconciled with §3.3. The paper's scope and empirical breadth fit the journal; the claims just need to be supported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe useful core here is the taxonomy: 14 failure subtypes in three families—spurious correlations, contradictory knowledge, constrained generalization—specific to CTI, grounded in a large evaluation and concrete case studies. That's a real contribution, giving the LLM-CTI community a shared vocabulary. The human-in-the-loop method (stratification, autoregressive refinement, human review) is a thoughtful attempt to scale failure analysis without trusting LLM-as-judge. Worth engaging with.\n\nTwo soft spots keep it from matching its own abstract. First, the abstract promises causal interventions and targeted defenses that reduce failure rates significantly. Those experiments are not in this manuscript. The paper ends at analysis and design insights. That mismatch should be fixed, either by adding the experiments or revising the abstract.\n\nSecond, the headline claim—that these three families dominate—rests on a labeling pipeline where humans inspect at most 3% of instances as anchors and resolve under 1.8% of uncertain cases; the remaining ~95% are labeled by majority vote of four LLMs, with no inter-annotator reliability or confidence intervals reported. If the voters are biased toward the existing taxonomy or the anchor set is unrepresentative, the loop can terminate with an incomplete typology. The failure ratios in Figure 2 are therefore provisional, not established. This is not fatal—the methodology is transparent and the fix is straightforward: report reliability metrics, release the label set, and do sensitivity analysis on the stratification thresholds.\n\nCredit where due: the case studies are specific and the appendix gives detailed criteria for each subtype. The authors also state the termination conditions in the methodology, so they're not hiding the procedure. Citation pattern looks fine; related work is adequately covered.\n\nThis paper is for researchers building LLM agents in security, especially CTI pipelines. They'll get a useful vocabulary and testable hypotheses. It deserves peer review—a serious referee can push for the missing experiments and reliability analysis. My recommendation: send it out, expecting substantial revision.\n\nBest.","headline":"A useful CTI failure taxonomy, but the abstract's causal-claims experiments are missing and the labeling reliability is unmeasured.","tokens_in":37825,"tokens_out":2938,"would_cite":true,"duration_ms":24678,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"LLMs fail at cyber threat intelligence mainly because the threat landscape itself is messy—contradictory, volatile, and crowdsourced—not because of generic model flaws, and three specific failure modes capture most of the damage.","keywords":["large language models","cyber threat intelligence","spurious correlation","contradictory knowledge","constrained generalization","failure taxonomy","human-in-the-loop labeling","threat landscape"],"falsifier":"Two checks would settle the claim. First: a clean-evidence control—build a synthetic CTI corpus with no source conflicts, no temporal drift, no reused IOCs, and single-vendor provenance; if LLM failure rates remain comparable, the threat-landscape bottleneck claim is wrong. Second: an independent re-labeling audit—have fresh annotators, without access to the anchor taxonomy, classify a random sample of the machine-labeled instances; if a fourth mode (e.g., pure format or instruction-following errors) dominates or the three-mode distribution shifts materially, the converged taxonomy and Figure","tokens_in":37004,"feed_emoji":"🛡️","tokens_out":5212,"duration_ms":37653,"temperature":0.7,"pith_summary":"This paper argues that when large language models fail at cyber threat intelligence (CTI), the dominant cause is not hallucination or weak model architecture but the nature of the threat evidence itself: CTI is heterogeneous, volatile, and fragmented, and its evidence is intertwined, crowdsourced, and temporally unstable. Drawing on a large evaluation spanning CTI benchmarks and real-world threat reports, the authors identify three fundamental failure modes—spurious correlations from superficial metadata, contradictory knowledge from conflicting sources, and constrained generalization to emerging threats—and break them into 15 subtypes across the CTI lifecycle of contextualization, attribution, prediction, and mitigation. The taxonomy is built with a human-in-the-loop framework that avoids relying on 'LLM-as-judge' labels. The authors' conclusion, if right, redirects the field: reliability cannot be engineered by prompts or scale alone; it requires data curation, adversarially aware fine-tuning, and inference-time safeguards aimed at the evidence conditions.","feed_headline":"Threat data, not model flaws, trips LLM security tools","feed_subtitle":"Spurious links, conflicting reports, and stale patterns explain most CTI reasoning errors—and point to data-centered fixes.","key_machinery":"The load-bearing object is a human-in-the-loop failure-categorization framework with three stages. First, stratification: because most CTI tasks lack hard correct/incorrect labels, outputs are scored against authoritative references and partitioned into quantile strata; human inspection of anchors (no more than 3% of instances) defines failed vs. correct score ranges, so the remaining instances can be labeled without per-item annotation. Second, autoregressive taxonomy refinement: humans seed an initial failure-mode taxonomy, an LLM classifies the rest, humans inspect every 'other' case, and new modes are added until the taxonomy converges. Third, multi-agent human-in-the-loop labeling: four","core_discovery":"The paper's central claim is that three domain-specific cognitive failures—spurious correlations, contradictory knowledge, and constrained generalization—explain a large share of LLM failures across the CTI pipeline, and that these failures are rooted in the threat landscape rather than in generic model weaknesses. Spurious correlation means the model treats co-mention or shared metadata as causal evidence, e.g., linking a benign CVE to an active campaign because both appear in one bulletin. Contradictory knowledge means inconsistent or outdated sources destabilize reasoning, e.g., one advisory declaring a patch sufficient while another documents post-patch persistence. Constrained generaliz","pith_inferences":["An extension the paper leaves implicit: corpus-level diagnostics—such as contradiction density across sources, IOC reuse rate, or co-mention frequency—could predict an agent's expected failure mix before deployment, turning the taxonomy into a dataset assessment tool.","The same three-mode structure likely appears in other reasoning domains built on crowdsourced, volatile evidence (e.g., open-source medical or financial intelligence), though the paper only claims CTI scope; a transfer test would be a natural follow-up.","The paper's own observation that format errors are a universal gap suggests a possible fourth mode that the convergence criterion either absorbed into the three categories or omitted; checking where such errors were labeled would test the taxonomy's completeness.","If the threat-landscape framing is right, benchmark construction for LLM security should deliberately inject evidence noise (contradictions, temporal drift, skewed sources) rather than presenting clean ground truth, so that evaluation scores reflect operational readiness."],"forward_implications":["If the three-mode taxonomy is correct, CTI failure analysis can be decomposed by dominant vulnerability type, letting practitioners target the specific mechanism (e.g., filtering co-mentioned entities vs. reconciling source conflicts) rather than applying generic model fixes.","The abstract's claim that targeted defenses reduce failure rates significantly implies these vulnerabilities are addressable in practice, not immovable limits of LLMs.","Because the failures persist across both general-purpose and cybersecurity-specialized models, domain fine-tuning alone cannot close the gap; data curation and evidence conditioning become central to LLM-CTI systems.","The categorization framework itself is a reusable methodology for studying LLM failures in domains where hard labels are scarce, as an alternative to LLM-as-judge pipelines.","The propagation of upstream errors through the CTI pipeline (contextualization to attribution to prediction to mitigation) means defenses at early stages may pay off downstream."],"fun_headline_variants":["Why LLMs fail at cyber threat intelligence: it's the data","CTI errors stem from data chaos, not model flaws","Three data-driven failure modes trip up LLM security tools","Spurious links, conflicts, and stale patterns derail LLM CTI","Fix the threat data, not the LLM, to cut CTI errors"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The framework assumes that manually inspecting at most 3% of instances as anchors, plus resolving fewer than 1.8% of uncertain cases, produces a complete and unbiased taxonomy that correctly classifies the remaining roughly 95%—if that anchor set is unrepresentative, the dominance of the three failure modes is not established.","fun_headline_variants_meta":{"raw":{"variants":["Why LLMs fail at cyber threat intelligence: it's the data","CTI errors stem from data chaos, not model flaws","Three data-driven failure modes trip up LLM security tools","Spurious links, conflicts, and stale patterns derail LLM CTI","Fix the threat data, not the LLM, to cut CTI errors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000685,"raw_usage":{"total_tokens":2930,"prompt_tokens":714,"completion_tokens":2216,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":458,"completion_tokens_details":{"reasoning_tokens":2139}},"tokens_in":458,"tokens_out":2216,"duration_ms":11403,"temperature":1.0,"reasoning_tokens":2139,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T14:38:55.509791+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Two checks would settle the claim. First: a clean-evidence control—build a synthetic CTI corpus with no source conflicts, no temporal drift, no reused IOCs, and single-vendor provenance; if LLM failure rates remain comparable, the threat-landscape bottleneck claim is wrong. Second: an independent re-labeling audit—have fresh annotators, without access to the anchor taxonomy, classify a random sample of the machine-labeled instances; if a fourth mode (e.g., pure format or instruction-following errors) dominates or the three-mode distribution shifts materially, the converged taxonomy and Figure","supporting_citations":[],"review_version":1}