{"id":"d5f6f995-d131-418e-9828-325f345dbac6","arxiv_id":"2607.05916","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":6,"one_line_summary":"A user study with 10 security experts reveals that while large LLMs (≥70B) generate syntactically valid NIDS rules, experts deem only 37.5% deployable due to low specificity and logic hallucinations, viewing LLMs as support tools rather than autonomous rule generators.","lead":"This paper studies whether security experts trust LLM-generated intrusion detection rules. It finds a syntax-semantics paradox: large LLMs produce syntactically valid rules but experts reject most as too generic or logically flawed, preferring LLMs as drafting assistants rather than autonomous generators.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"The 37.5% deployability figure rests on 40 binary evaluations from 10 participants with no inter-rater reliability reported; the paper's own subgroup analysis shows it is highly sensitive to participant expertise.","rationale":"The reader's verdict of CONDITIONAL is appropriate. The paper makes a genuine empirical contribution as the first expert user study on LLM-generated NIDS rules, and the syntax-semantics paradox is directionally well-supported by both the statistical analysis (Finding 7: rules rely on pure content matching, lacking specificity fields like DISTANCE/WITHIN) and qualitative expert feedback (multiple participants independently citing low specificity, wrong ports, and logic errors). The statistical evaluation of 27 models across 6 scenarios is thorough.\n\nHowever, the 37.5% deployability figure—the quantitative centerpiece of the semantic claim—is fragile for three specific reasons: (1) it is based on ~40 binary evaluations with no IRR, (2) the paper's own subgroup analysis shows it is sensitive to expertise composition, and (3) the rules shown to experts were pre-filtered to remove hallucinations and bad explanations, making 37.5% an upper bound on a curated subset rather than a general deployability rate. These are addressable issues: computing IRR on existing data, reporting the expert-only rate with confidence intervals, and clarifying the filtering ratio would substantially strengthen the claim.\n\nThe reader also correctly flags the LLM-as-a-judge circularity in model selection (Appendix F), the conflation of the 12% hallucination figure (narrow IP/CVE heuristic from Appendix H.1) with broader logic hallucinations identified by experts, and the absence of shipped code despite open-science claims. None of these individually overturn the central finding, but collectively they justify a CONDITIONAL rather than ACCEPT verdict.\n\nI do not recommend changing the verdict. The concern I raise is the same one the reader identified (sample representativeness and composition sensitivity), sharpened around the specific absence of IRR and the pre-filtering of evaluated rules. The concrete test I propose is computable on existing data and would either confirm or weaken the 37.5% figure without requiring new data collection.","tokens_in":32731,"tokens_out":3072,"duration_ms":238260,"concrete_test":"Compute Fleiss' kappa on the existing 10-participant × 4-question binary correctness data (Figure 5a). If κ < 0.4 (slight-to-moderate agreement), the 37.5% figure is unreliable as a measure of rule quality because experts disagree on what counts as deployable. Additionally, recompute the deployability rate using only the 4 'highly expert' participants (≥3 years experience) and report the 95% confidence interval for both the full-sample and expert-only proportions. If the expert-only rate differs from 37.5% by more than 10 percentage points, the headline figure should be reported with the expertise qualifier rather than as a general result.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—the syntax-semantics paradox—has two pillars: (1) LLMs achieve up to 90% syntactic validity (well-supported: 27 models, 6 scenarios, 30 runs each), and (2) experts deem only 37.5% of rules semantically deployable. Pillar (2) is the load-bearing weak point.\n\nThe 37.5% figure derives from 10 participants evaluating rules across 4 scenarios (Q1, Q3, Q7, Q8 in Figure 5a), yielding approximately 40 binary (correct/wrong) judgments. The paper reports no inter-rater reliability statistic (e.g., Fleiss' kappa or Krippendorff's alpha). Without IRR, we cannot distinguish whether the 37.5% reflects genuine rule quality or participant disagreement. This matters because the paper itself demonstrates that expertise composition shifts results substantially: the 'highly expert' subset (≥3 years, n=4) evaluated 11 of 16 rules negatively with high confidence (µ=4), while less-experienced participants were more lenient (Finding 11, Section 5.2.2). If the 4 highly expert participants are the more reliable raters, the deployability rate among them could be as low as ~31% (5/16); if the less-experienced participants are weighted equally, it rises. The 37.5% aggregate is thus an artifact of mixing raters with demonstrably different standards, with no reported measure of whether they actually agreed on any given rule.\n\nAdditionally, Section 4.1.2 states that candidate rules were 'filtered from hallucinations and bad explanations' before expert review. This means the 37.5% applies to a curated subset of the best rules from the best model—not to LLM-generated rules in general. The paper does not clearly state how many rules were filtered out, making it impossible to assess the true base rate of deployability across all generated rules. The abstract's framing ('experts find them only partially deployable') implies this is a general characteristic of LLM output, when it is actually an upper bound on a pre-selected sample.\n\nThe reader correctly identified the sample compositio","agreement_with_reader":"agree"},"referee_report":{"model":"glm-5.2","summary":"This paper investigates whether security experts trust LLMs to generate NIDS (Network Intrusion Detection System) rules. It formalizes an LLM-based rule engineering agent, benchmarks 27 LLM engines across 6 network scenarios (30 runs each), and conducts a user study with 10 domain experts. The central finding is a 'syntax-semantics paradox': large LLMs (≥70B parameters) achieve up to 90% syntactic validity, but experts deem only 37.5% of rules semantically correct and deployable, citing insufficient specificity, over-reliance on content matching, and logic hallucinations. The system received a SUS score of 67, and experts overwhelmingly preferred human-in-the-loop workflows (Q9 mean=4.30) over autonomous deployment (Q8 mean=2.00). The statistical analysis of syntactic validity is well-powered and rigorous. The human evaluation, while informative, rests on a small and heterogeneous sample whose composition materially affects the headline deployability figure.","tokens_in":33619,"tokens_out":1479,"duration_ms":319444,"significance":"The paper addresses a genuine gap: no prior work has empirically assessed expert trust in LLM-generated NIDS rules. The large-scale syntactic benchmarking (27 models, 6 scenarios, 30 runs each, Pearson correlations reported) is a strength, as is the dual model-selection methodology (statistical metric + LLM-as-judge tournament, Appendix F). The qualitative findings about rule specificity deficits and expert workflow preferences are actionable for the community. However, the load-bearing claim about deployability (37.5%) derives from approximately 40 binary evaluations by 10 self-selected participants with no inter-rater reliability statistic, and the paper's own subgroup analysis shows this figure is highly sensitive to participant expertise. This is the primary weakness that must be addressed.","major_comments":[{"comment":"The 37.5% deployability figure (Finding 12, Section 5.2.2) derives from only 10 participants evaluating rules from a single model (DeepSeek-R1 70B) across 4 scenarios, yielding approximately 40 binary judgments. No inter-rater reliability statistic (e.g., Fleiss' kappa or Krippendorff's alpha) is reported. Without IRR, it is impossible to distinguish whether the 37.5% reflects genuine rule quality or participant disagreement. The paper's own subgroup analysis (Finding 11) demonstrates that the 4 'highly expert' participants (≥3 years) evaluated 11 of 16 rules negatively with high confidence (µ=4), while less-experienced participants were more lenient. This means the aggregate 37.5% is an artifact of mixing raters with demonstrably different standards. The authors should either (a) report IRR, or (b) present the deployability rate separately for the highly expert subgroup and the less-exp","section":null},{"comment":"Section 4.1.2 states that candidate rules were 'filtered from hallucinations and bad explanations' before expert review. This pre-filtering means the 37.5% deployability rate applies only to a curated subset of rules, not to the full output of the LLM. The paper should explicitly state what fraction of rules was filtered out and acknowledge that the deployability figure is an upper bound on the true rate for unfiltered LLM output. Without this, the syntax-semantics paradox is understated: the semantic failure rate for the full output is higher than reported.","section":null},{"comment":"The abstract states 'logic hallucinations in 12% of cases,' but the 12% figure appears only in Appendix H.1 and refers to the increase in hallucination rate when PoCs are included (from 2.81% to 12.91%), not to the proportion of rules with logic hallucinations identified by experts. The expert evaluation (Section 5.2.2) discusses logic hallucinations qualitatively (e.g., P4 identifying SMB/SSH confusion, P1 identifying UDP port 445 for SMB over QUIC) but does not report a quantitative rate. The abstract should either clarify that 12% refers to the easy-to-detect hallucination rate from the automated analysis, or report the expert-identified logic hallucination rate separately.","section":null}],"minor_comments":[{"comment":"Table 3: The participant demographics show 5 of 10 participants have ≤3 years of experience, and several are PhD students or professors rather than active SOC practitioners. The paper should acknowledge this heterogeneity more prominently in the main text (not just Appendix) and discuss its implications for the subgroup analysis.","section":null},{"comment":"Section 5.1.2, Finding 7: The claim that generated rules 'rely on pure content matching' is supported by Figure 4c-d, but the comparison to 'commonly available rule databases' (footnote 5) lacks a quantitative baseline. Providing the average body length of rules from the Emerging Threats ruleset would strengthen the specificity deficit claim.","section":null},{"comment":"Appendix F: The weights for the statistical ranking metric are not specified. The paper states it computes 'a weighted sum over the normalized values' but does not report the actual weights. These should be provided for reproducibility.","section":null},{"comment":"Section 5.1.1, Finding 5: The text states input length rises 'from approximately 7,500 (without PoCs) to more than 58,000 (without PoCs)' — the second instance should presumably read 'with PoCs.'","section":null},{"comment":"Figure 5a: The y-axis label 'Percentage of Responses (%)' and the dual-axis design with 'Avg Confidence' are somewhat hard to parse. Consider separating the confidence overlay or adding a legend or annotation.","section":null},{"comment":"Section 5.2.3: The SUS score of 67 is described as satisfying the requirement to consider the system 'well usable (above 67).' The cited threshold [1, 14] is the boundary between 'OK' and 'Good' on the adjective rating scale, not a strict pass/fail. The paper should use more neutral characterization.","section":null},{"comment":"The paper uses 'IDS' and 'NIDS' somewhat interchangeably after the notation note in Section 1. Consider consistent usage, especially in section headings and findings.","section":null},{"comment":"Several references appear to be from 2025-2026 and may not yet be peer-reviewed (e.g., [34], [38], [51]). These should be clearly marked as preprints.","section":null}],"recommendation":"major_revision","confidential_remarks":"The paper is well-motivated and the large-scale benchmarking is genuinely valuable. The main concern is that the headline 37.5% deployability figure is presented with more precision than the evidence supports — 40 binary judgments from 10 self-selected participants, no IRR, and the paper's own subgroup analysis showing sensitivity to expertise. This is fixable: the authors can reframe the claim as exploratory, report IRR or subgroup rates, and acknowledge the filtering step. The qualitative findings about specificity deficits and expert workflow preferences are robust and interesting regardless of the exact deployability percentage. I would encourage the editor to allow revision rather than reject, as the human-centered contribution is novel and the statistical analysis is sound."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and constructive review. The referee raises three major points: (1) the absence of inter-rater reliability statistics and the sensitivity of the 37.5% deployability figure to participant expertise; (2) the pre-filtering of rules before expert evaluation, which means the deployability rate is an upper bound; and (3) a potential conflation in the abstract between the automated hallucination rate (12%) and the expert-identified logic hallucination rate. We agree with all three points and will revise the manuscript accordingly. Specifically, we will report Fleiss' kappa for the expert evaluations, present deployability rates stratified by expertise subgroup, explicitly state the fraction of rules filtered before expert review and frame the 37.5% as an upper bound, and correct the abstract to disambiguate the two hallucination figures. No standing objections remain.","responses":[{"response":"The referee is correct on all counts. We did not report an inter-rater reliability statistic, and we should have. We will compute and report Fleiss' kappa for the binary adoption decisions across the four evaluation questions. We acknowledge that with 10 participants and approximately 40 binary judgments, the statistical power is limited, and we will state this explicitly as a limitation. Regarding the subgroup sensitivity: the referee's observation is accurate. Our Finding 11 already shows that the 4 highly expert participants (>=3 years of experience) evaluated 11 of 16 rules negatively with high confidence (mu=4), while less-experienced participants were more lenient. We will present the deployability rate separately for the highly expert subgroup and the rest of the cohort, and we will reframe the headline 37.5% figure as an aggregate that is materially influenced by the mix of expertise levels. We will also add a caveat in the abstract and in Section 5.2.2 noting that the deployability figure is an aggregate across a heterogeneous sample and that the rate is lower among the most experienced participants. We agree that this transparency is essential for the reader to interpret the finding correctly.","revision_made":"yes","referee_comment":"The 37.5% deployability figure derives from only 10 participants evaluating rules from a single model across 4 scenarios, yielding approximately 40 binary judgments. No inter-rater reliability statistic is reported. Without IRR, it is impossible to distinguish whether the 37.5% reflects genuine rule quality or participant disagreement. The paper's own subgroup analysis shows this figure is highly sensitive to participant expertise. The authors should either (a) report IRR, or (b) present the deployability rate separately for the highly expert subgroup and the less-experienced subgroup."},{"response":"The referee is correct. The pre-filtering step means that the 37.5% deployability rate applies to a curated subset, not to the full LLM output, and we should have stated this explicitly. In the revision, we will report the fraction of rules that were filtered out prior to expert review and will explicitly frame the 37.5% as an upper bound on the true deployability rate for unfiltered LLM output. We agree that this actually strengthens the syntax-semantics paradox: the semantic failure rate for the full output is higher than what we reported. We will add a sentence in Section 4.1.2 clarifying the filtering criteria and the fraction removed, and we will add a corresponding caveat in Section 5.2.2 and in the abstract noting that the deployability figure is conditional on the rules having passed automated pre-filtering.","revision_made":"yes","referee_comment":"Section 4.1.2 states that candidate rules were 'filtered from hallucinations and bad explanations' before expert review. This pre-filtering means the 37.5% deployability rate applies only to a curated subset of rules, not to the full output of the LLM. The paper should explicitly state what fraction of rules was filtered out and acknowledge that the deployability figure is an upper bound on the true rate for unfiltered LLM output. Without this, the syntax-semantics paradox is understated: the semantic failure rate for the full output is higher than reported."},{"response":"The referee is correct. The 12% figure in the abstract conflates the automated hallucination rate from Appendix H.1 (which measures easy-to-detect hallucinations such as non-contextual IP addresses and unrelated CVE references, and which rises from 2.81% to 12.91% when PoCs are included) with the logic hallucinations identified qualitatively by experts in Section 5.2.2. These are distinct phenomena: the automated analysis captures structural hallucinations detectable by pattern matching, while the expert-identified logic hallucinations (e.g., SMB/SSH confusion, UDP port 445 for SMB over QUIC) are semantic errors that require domain knowledge to detect. We will revise the abstract to clarify that the 12% refers to the automated easy-to-detect hallucination rate under PoC-inclusive conditions, and we will separately note that experts identified additional logic hallucinations qualitatively. Given the small sample size of the expert evaluation, we do not think it is appropriate to report a precise quantitative rate for expert-identified logic hallucinations, but we will state this limitation explicitly.","revision_made":"yes","referee_comment":"The abstract states 'logic hallucinations in 12% of cases,' but the 12% figure appears only in Appendix H.1 and refers to the increase in hallucination rate when PoCs are included (from 2.81% to 12.91%), not to the proportion of rules with logic hallucinations identified by experts. The expert evaluation discusses logic hallucinations qualitatively but does not report a quantitative rate. The abstract should either clarify that 12% refers to the easy-to-detect hallucination rate from the automated analysis, or report the expert-identified logic hallucination rate separately."}],"tokens_in":32582,"tokens_out":1225,"duration_ms":183931,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"This paper is the first to put LLM-generated NIDS rules in front of domain experts and ask whether they'd deploy them. That's a real gap — Table 4 shows that of 11 prior LLM-for-NIDS systems, none conducted a human evaluation of rule deployability. The statistical analysis is broad (27 models, 6 scenarios, 30 runs each) and the finding that large models (≥70B) achieve up to 90% syntactic validity while small models (≤4B) produce nothing usable is well-supported. The qualitative feedback from experts — rules lack specificity, over-rely on content matching, contain logic errors like wrong ports or protocols — is consistent across participants and is the most valuable part of the paper. The framing of a syntax-semantics paradox is useful and likely correct in direction. The system formalization (Section 3) is a reasonable synthesis of prior work and the pre-study with 3 experts grounds the design choices. The SUS evaluation and statement-based questions are standard but informative — experts clearly want human-in-the-loop, not autonomous deployment (Q9 mean 4.30, Q8 mean 2.00). That finding alone is worth publishing. The soft spots are real but concentrated. The 37.5% deployability figure rests on 10 participants (self-selected, 7.3% response rate, heterogeneous expertise — 5 of 10 have ≤3 years) making roughly 40 binary judgments across 4 scenarios, with no inter-rater reliability reported. The paper's own subgroup analysis shows this number is sensitive to expertise: the 4 most experienced participants rejected 11 of 16 rules. So 37.5% is an artifact of mixing raters with demonstrably different standards, and we can't tell how much is genuine rule quality vs. participant disagreement. Additionally, Section 4.1.2 states rules were pre-filtered before expert review, so 37.5% is an upper bound on a curated subset of the best model's output, not a general deployability rate. The abstract doesn't make this clear. The model selection for the human study used LLM-as-a-judge (Appendix F), which introduces some circularity, though they cross-validated with a statistical metric and both agreed on DeepSeek-R1 70B, so this is a minor concern. The abstract's '12% hallucination' conflates the narrow IP/CVE heuristic from Appendix H.1 with the broader logic hallucinations experts identified qualitatively — these are different things and shouldn't share a number. No code or data is shipped despite the open science claim in Appendix A. None of these issues undermine the core qualitative finding: experts find LLM-generated rules syntactically valid but not deployable, and they want human oversight. The exact numbers are soft, the direction is not. This paper deserves a serious referee. It's appropriate for a security venue with a human studies component, and a good referee should push for IRR statistics, clearer framing of the 37.5% as an upper bound on a filtered subset, and disentangling the two hallucination figures. The sample size limitation is inherent to expert studies and should be acknowledged but isn't disqualifying.","headline":"First expert user study on LLM-generated NIDS rules; directionally solid but the headline deployability number is soft.","tokens_in":33666,"tokens_out":1301,"would_cite":false,"duration_ms":104228,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"LLMs write valid IDS rules but experts trust only 37.5%","keywords":["NIDS","intrusion detection","LLM","rule engineering","Snort","syntax-semantics paradox","human-in-the-loop","security operations center"],"falsifier":"If a separate study with a larger sample of active SOC practitioners (not researchers or students) found that a majority of LLM-generated rules were deployable with only minor modifications, or if a different LLM architecture produced rules with the specificity and multi-field composition that experts require, the syntax-semantics paradox would narrow or disappear.","tokens_in":32865,"feed_emoji":"🛡️","tokens_out":1062,"duration_ms":258877,"temperature":0.7,"pith_summary":"This paper investigates whether large language models can generate network intrusion detection system (NIDS) rules that security experts would actually deploy. The authors formalize an LLM-based rule generation pipeline that ingests network topology, vulnerability data, and proof-of-concept exploits, then produces Snort-compatible rules with automated syntax checking and correction. They benchmark 27 LLM engines across six network scenarios and conduct a user study with 10 domain experts who evaluate the semantic correctness and deployability of the generated rules. The central discovery is what the authors call a syntax-semantics paradox: large models (70B+ parameters) produce syntactically valid rules up to 90% of the time, yet experts deem only 37.5% semantically correct and deployable. The primary failure modes are insufficient specificity (rules rely on generic content matching rather than precise payload positioning or protocol-specific fields), logic hallucinations in 12% of cases, and contextual inconsistencies such as wrong ports or traffic direction. Experts rated the system usable (SUS score of 67) but near-unanimously rejected autonomous deployment, preferring a human-in-the-loop workflow where the LLM drafts and explains rules while a human reviews and refines them.","feed_headline":"LLMs write valid IDS rules but experts trust only 37.5%","feed_subtitle":"Large models produce syntactically correct network intrusion detection rules 90% of the time, but security experts reject most as too vague,","key_machinery":"The central object is the syntax-semantics paradox: the gap between an LLM's ability to produce syntactically valid NIDS rules (measured by Snort compilation success, reaching 90% for large models) and expert-judged semantic deployability (only 37.5%). The mechanism driving this gap is the LLMs' tendency to rely on generic content matching rather than composing multiple specific rule-body fields (offset, depth, distance, within, protocol-specific fields like http_uri or dns_query) that practitioners need for precise detection with low false positives. A secondary mechanism is logic hallucination, where rules reference incorrect ports, protocols, or traffic directions despite being syntacti","core_discovery":"The paper identifies a syntax-semantics paradox in LLM-generated NIDS rules. While models with 70 billion or more parameters achieve up to 90% syntactic validity (rules that compile in Snort), domain experts find only 37.5% semantically correct and deployable. The gap stems from three failure modes: rules lack specificity (they rely on generic content matching rather than advanced fields like offset, depth, distance, or within), they exhibit logic hallucinations in 12% of cases (e.g., referencing wrong protocols or ports), and they fail to encode the contextual reasoning about traffic direction and protocol behavior that effective intrusion detection requires. Crucially, even the best-perfom","pith_inferences":[],"forward_implications":["If the 37.5% deployability figure holds across larger expert samples, organizations adopting LLM-based rule generation without mandatory human review risk deploying rules that compile but fail to detect or generate excessive false positives, potentially worsening SOC alert fatigue rather than alleviating it.","The finding that small models (4B or fewer parameters) produce zero valid rules suggests a minimum capability threshold for NIDS rule generation, which could guide resource allocation decisions for local or privacy-sensitive deployments that cannot use large API-based models.","The bimodal distribution of correction effort (rules are either immediately valid or require multiple correction iterations) implies that syntax-correction loops are not uniformly effective; this suggests that future work should focus on semantic correction rather than purely syntactic repair.","Expert preference for human-in-the-loop workflows over autonomous deployment indicates that the most impactful near-term design target for LLM-based security tools is not end-to-end automation but rather drafting, explanation, and verification assistance that reduces cognitive load while preserving analyst agency."],"fun_headline_variants":["LLM IDS rules compile but fail expert review on specificity","Syntax-semantics gap blocks LLM-generated NIDS rules from deployment","Experts reject most LLM-written IDS rules as too vague","Large LLMs write valid IDS syntax but semantics lag behind","12% of LLM-generated IDS rules contain logic hallucinations"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The claim that experts remain skeptical of LLM-generated rules rests on a sample of 10 self-selected participants from 137 contacted, five of whom have three or fewer years of experience and several of whom are PhD students or professors rather than active SOC practitioners. The paper itself shows that the four most experienced participants evaluated rules much more harshly, meaning the 37.5% deployability figure is sensitive to participant composition.","fun_headline_variants_meta":{"raw":{"variants":["LLM IDS rules compile but fail expert review on specificity","Syntax-semantics gap blocks LLM-generated NIDS rules from deployment","Experts reject most LLM-written IDS rules as too vague","Large LLMs write valid IDS syntax but semantics lag behind","12% of LLM-generated IDS rules contain logic hallucinations","LLMs draft IDS rules well but experts won't trust them solo","90% syntactic validity, 37.5% deployability for LLM IDS rules","Small models fail at IDS rule generation; large models still fall short","Experts see LLMs as IDS drafting aids, not autonomous generators","Syntax passes, semantics fail: LLM NIDS rule paradox"]},"model":"glm-5.2","effort":"high","cost_usd":0.0,"raw_usage":{"total_tokens":707,"prompt_tokens":510,"completion_tokens":197,"prompt_tokens_details":null},"tokens_in":510,"tokens_out":197,"duration_ms":16160,"temperature":1.0,"reasoning_tokens":53,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-08T20:40:01.687598+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If a separate study with a larger sample of active SOC practitioners (not researchers or students) found that a majority of LLM-generated rules were deployable with only minor modifications, or if a different LLM architecture produced rules with the specificity and multi-field composition that experts require, the syntax-semantics paradox would narrow or disappear.","supporting_citations":[],"review_version":1}