Pith. sign in

REVIEW 3 major objections 7 minor 42 references

Specialized small LLM agents build more accurate cyber threat knowledge graphs than large single models running end-to-end.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 10:16 UTC pith:2WKPANPM

load-bearing objection Small LoRA agents beat large ICL on CTI KG metrics in a clean systems package, but the win mixes fine-tuning with decomposition. the 3 major comments →

arxiv 2607.05001 v2 pith:2WKPANPM submitted 2026-07-06 cs.CR cs.AIcs.LGcs.MA

TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction

Mouhamed Amine Bouchiha , Gregory Blanc This is my paper
classification cs.CR cs.AIcs.LGcs.MA
keywords Cyber Threat IntelligenceKnowledge GraphsLanguage ModelsAgentic SystemsInformation ExtractionCSKG constructionLoRA
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that turning free-text cyber threat reports into usable knowledge graphs works better when the work is split across small, specialized language-model agents instead of one large model that extracts, types, and completes everything in a single pass. Each agent is given a narrow job—span extraction, ontology typing, faithfulness checking, or constrained graph repair—and is lightly adapted so that lightweight 3B–8B models can do the work. On human-annotated reports the modular pipeline recovers more true relations, types entities more accurately, and produces more coherent graphs while remaining cheaper to run. A sympathetic reader cares because noisy CTI text is abundant, yet current end-to-end systems are expensive, hard to control, and prone to inventing unsupported links; modularity offers a practical route to stable, local, high-recall graphs.

Core claim

Agent specialization with lightweight models consistently outperforms larger monolithic in-context-learning baselines on extraction F1-score, typing accuracy, and structural graph similarity when constructing cybersecurity knowledge graphs from free-text CTI reports.

What carries the argument

TACTIC-KG: a multi-agent pipeline that decomposes CSKG construction into extractor, typer, verifier, and curator agents (each LoRA-adapted on 3B–8B models) under a faithfulness-before-connectivity rule that admits only text-supported triples.

Load-bearing premise

The measured gains rest on the premise that semantic cosine matching of triples at a fixed threshold, together with labels refined by a single human from distant supervision, faithfully scores extraction quality rather than soft matching or annotation noise.

What would settle it

Re-run the identical model comparison on a fully independent double-annotated CTI test set using exact or strict ontology-aligned triple matching instead of cosine threshold 0.6; if the small-agent F1 and graph-similarity advantage disappears or reverses, the central claim is falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Organizations can construct usable CSKGs with small local models, keeping sensitive reports off large external APIs.
  • Higher recall of entities and relations is achievable without a matching rise in unsupported edges.
  • Precision–recall trade-offs become controllable by role: extractors can be aggressive while verifiers and curators prune.
  • A hybrid layout (specialized extractors plus a shared reasoning verifier/curator) further stabilizes typing and graph scores.
  • Only moderate, diverse fine-tuning data (roughly 200 chunks) is needed for small agents to match or beat much larger ICL systems.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same generate-then-verify modular pattern is likely to transfer to other high-stakes information-extraction domains (legal, medical, scientific) where textual faithfulness matters more than forced connectivity.
  • Because full typing accuracy remains the shared bottleneck, stronger multi-sentence entailment supervision or explicit multi-hop evidence extraction is a natural next lever.
  • Local small-agent teams make continuous human-in-the-loop repair loops practical without shipping proprietary CTI to frontier model endpoints.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes TACTIC-KG, a multi-agent pipeline that constructs cybersecurity knowledge graphs from unstructured CTI reports by decomposing the task into specialized LoRA-adapted agents (Extractor, Typer, Verifier, Curator) on 3B–8B models. Motivated by faithfulness, over-completion, and context-size issues in monolithic LLM pipelines, the system enforces ontology-constrained typing, evidence-grounded verification, and bounded curation. On human-annotated CTI reports (CTI-HAL + CTINEXUS-derived splits; TEST0–TEST2), the authors report that specialized small agents outperform larger monolithic ICL baselines (notably CTINEXUS with DeepSeek-V3.1, Devstral-2, Kimi-K2, etc.) in semantic-match extraction F1, partial/full typing accuracy, and graph structural similarity, while arguing for lower deployment cost and better controllability.

Significance. If the gains are real and attributable to the proposed design, the work is practically significant for CTI structuring: it shows that small, specialized, locally deployable models can match or beat frontier ICL systems on CSKG construction, which matters for cost, privacy, and enterprise on-prem use. Strengths include a clear problem framing (faithfulness vs connectivity), modular agent roles with LoRA specialization, multiple held-out test sets with three seeds, role/hybrid/data-volume studies, and sensitivity appendices on matching threshold and embedding models, plus a promised public code/dataset release. The result is useful even if part of the lift comes from supervised adaptation rather than multi-agent structure alone, provided that attribution is clarified.

major comments (3)
  1. The central causal claim—that agent specialization (and multi-stage faithfulness control) drives the gains—is confounded with supervised LoRA adaptation. Extractor/Typer are fine-tuned on up to 187 reports / 539 chunks from the same CTI-HAL+CTINEXUS pool used to form held-out tests, while CTINEXUS baselines remain pure ICL with no parameter updates (Sect. 5.1 Data Splits and Baselines; Tables 2–5). There is no ablation of (a) the same backbone under monolithic end-to-end LoRA extraction+typing versus the four-agent LoRA pipeline, or (b) multi-agent ICL without LoRA. Without these controls, the reported F1/GraphSim lifts (e.g., Ministral-3-8B 80/67 vs DeepSeek-V3.1 72/58 on TEST1) cannot be cleanly attributed to decomposition, verification, or curation rather than domain adaptation and reduced task entropy from fine-tuning. This is load-bearing for the paper’s main claim and should be add
  2. The evaluation protocol softens the measured signal in ways that affect interpretation of “outperformance.” Triplet correctness and GraphSim rely on cosine similarity of concatenated (h,r,t) embeddings with default T=0.6 (Sect. 5.1 Metrics; Appendix A–B). Appendices show non-trivial sensitivity: raising T or changing the embedding model moves F1 by several points, and paraphrase embeddings systematically raise recall. In addition, CTI-HAL labels are produced by distant supervision plus refinement by a single human annotator (Sect. 5.1 Annotation and Task Design), so residual noise and alias/relation alignment choices can favor systems trained on the same distribution. The paper should report primary results at a stricter threshold (or exact/canonical match where possible), quantify inter-annotator agreement or double-annotation on a subset, and discuss how soft matching interacts with fi
  3. Faithfulness-first design and the Curator’s training objective are in tension and under-validated. Sect. 3–4 emphasize minimal over-completion and closed-world grounding, yet the Curator is trained to predict bridging triplets that connect disconnected components from latent/implicit relations (Sect. 4.6), and RQ2 notes curators increase recall via recovered links. There is no separate measurement of unsupported edges introduced at curation (e.g., fraction of curator-added triples that fail human or verifier checks), nor a controlled comparison of graphs with vs without curation against gold disconnected structure. Given that over-completion is a stated failure mode of prior systems, the paper needs an explicit faithfulness audit of curator outputs on TEST1/TEST2.
minor comments (7)
  1. Table 1’s property checklist is useful but somewhat self-favoring (e.g., “Over-completion control” and “Faithfulness verification” marked only for TACTIC-KG). Soften absolute claims or cite concrete mechanisms in competing systems where partial support exists.
  2. Fig. 1 is illustrative but qualitative; a quantitative error breakdown (missed attacker/time/target types) on the same example under both systems would strengthen the motivation.
  3. Human-in-the-loop is shown in Fig. 2 and mentioned as HITL-friendly, but no HITL experiment or interface evaluation is reported; either add a small study or demote the claim to design intent.
  4. E2E timing (Appendix C / Table 10) compares Ollama Cloud large models to local L40S small agents; the paper notes this, but headline efficiency claims in the abstract/conclusion should be qualified or normalized (tokens/s, same hardware).
  5. Related-work systems (AECR, IntelEX, AttacKG+, CRUcialG) are discussed but not run as experimental baselines; even a limited re-evaluation or clear “out of scope” rationale would help position the gains.
  6. Notation: GraphSim is defined with M matched triples but called a “semantic variant of Jaccard”; state the embedding and threshold in the main metric definition, not only the appendix.
  7. Minor typos/style: “the the MALOnt” (Sect. 2); inconsistent hyphenation of “end-to-end” / “in-context-learning”; model suffix omission is fine but keep backbone names consistent across tables.

Circularity Check

0 steps flagged

No circular derivation: empirical train/test evaluation of agent specialization; metrics and claims do not reduce to fitted inputs by construction.

full rationale

TACTIC-KG is an empirical systems paper. The load-bearing claim—that specialized 3B–8B LoRA agents outperform larger monolithic ICL baselines on extraction F1, typing accuracy, and GraphSim—is established by training on partitioned CTI reports (up to 187 reports / 539 chunks for Extractor/Typer; 85 for Verifier/Curator) and scoring on held-out TEST0/TEST1/TEST2 against human-annotated gold graphs (Sect. 5.1). Semantic matching (cosine on sentence embeddings, T=0.6) and PTA/FTA/GraphSim are external evaluation procedures, not algebraic rearrangements of free parameters fitted to the same quantities being reported. Ontology constraints (MALOnt) and faithfulness definitions are design choices and filtering criteria, not self-definitional identities that force the reported F1 or GraphSim numbers. Self-citations (e.g., cosine similarity via [6]) are incidental and not load-bearing for the performance claim. Confounds such as LoRA fine-tuning versus pure ICL, or soft matching, are threats to causal attribution of gains to agent decomposition, but they are experimental-design issues, not circularity of the kinds enumerated (self-definitional, fitted-input-as-prediction, uniqueness-from-authors, etc.). The derivation chain is therefore self-contained against external benchmarks; score 0 with empty steps is the correct finding.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 1 invented entities

Load-bearing content is mostly engineering and evaluation design choices, not new physical entities. The claim rests on standard ML practice (LoRA, ICL baselines), the MALOnt/STIX ontology as ground truth for types, a closed-world textual-entailment definition of support, soft semantic matching for scoring, and the quality of human/distant-supervision labels. Free parameters are evaluation and training knobs that move reported F1/GraphSim.

free parameters (4)
  • semantic_match_threshold_T = 0.6 (default)
    Cosine similarity threshold for counting a predicted triple as a true positive; default T=0.6, ablated in Appendix A. Directly changes Precision/Recall/F1/GraphSim.
  • training_data_volume_and_mix = default ~187 reports / 539 chunks for Ext/Typ
    Number and diversity of chunks/reports used for extractor/typer (up to 539 chunks) vs verifier/curator (85 reports); TC-1–TC-4 show performance depends on this choice (Table 6).
  • LoRA_adapter_configuration
    Rank, target modules (e.g., q_proj, v_proj), and training hyperparameters for each agent are design knobs that determine specialization quality; not fully enumerated as a single fitted scalar in the main text.
  • chunking_overlap_and_boundaries
    Sentence/discourse chunking with controlled overlap controls context size and omission vs dilution trade-off (Sect. 4.1–4.2).
axioms (5)
  • domain assumption A triple is faithful iff it is explicitly stated or implicitly entailed by the input report R under a closed-world reading that forbids external knowledge.
    Defines the verifier target and the paper’s notion of hallucination (Sect. 3; Sect. 4.4).
  • domain assumption MALOnt (revised, STIX-aligned) is an adequate target ontology for typing and compliance of CTI entities and relations.
    All typing accuracy and ontology-compliance claims are measured against this schema (Sect. 2, 5.1).
  • ad hoc to paper Semantic embedding similarity of concatenated (h,r,t) strings is a valid surrogate for triple correctness when computing Precision/Recall/F1 and GraphSim.
    Evaluation core (Sect. 5.1 Metrics; Appendices A–B); not a standard exact-match IE metric.
  • domain assumption Decomposing extraction, typing, verification, and curation into separate agents with constrained objectives reduces hallucination surface and error propagation relative to monolithic generation.
    Design principle stated in Sect. 4 introduction; empirical RQs test consequences of this assumption.
  • standard math Standard transformer + LoRA fine-tuning and ICL prompting behave as described in the cited literature.
    Background ML machinery (Hu et al. LoRA; ICL survey) used without re-derivation.
invented entities (1)
  • TACTIC-KG four-agent pipeline (Extractor, Typer, Verifier, Curator with LoRA adapters) no independent evidence
    purpose: Modular CSKG construction that enforces faithfulness-before-connectivity and enables small-model specialization.
    Engineering system introduced by the paper; not a physical entity. Independent evidence is the empirical tables, not an external measurement channel.

pith-pipeline@v1.1.0-grok45 · 20916 in / 3629 out tokens · 43003 ms · 2026-07-11T10:16:55.432861+00:00 · methodology

0 comments
read the original abstract

Cyber Threat Intelligence (CTI) reports are predominantly unstructured, heterogeneous, and noisy, which limits their direct usability for automated analysis and reasoning. Cybersecurity Knowledge Graphs (CSKGs) provide a structured representation of adversarial entities, actions, and relations, but constructing such graphs from free-text CTI remains a challenge. Recent approaches rely on monolithic Large Language Models (LLMs) to perform end-to-end extraction and completion, leading to high cost, limited controllability, and unstable performance. This paper introduces TACTIC-KG, an agentic framework for CSKG construction that decomposes the task into modular, specialized LLM agents responsible for extraction, typing, verification, and curation. Using lightweight models (3B--8B), TACTIC-KG improves stability, recall, and graph consistency while reducing deployment cost. We implement and evaluate TACTIC-KG against recent state-of-the-art systems. Experiments on human-annotated CTI reports show that agent specialization consistently outperforms larger monolithic in-context-learning (ICL) baselines in extraction F1-score, typing accuracy, and structural graph similarity.

Figures

Figures reproduced from arXiv: 2607.05001 by Gregory Blanc, Mouhamed Amine Bouchiha.

Figure 1
Figure 1. Figure 1: CSKG construction comparison for a real-world CTI report: [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: TACTIC-KG framework. 4 TACTIC-KG Framework TACTIC-KG reformulates CSKG construction as a controlled multi-stage rea￾soning process. Instead of relying on a single monolithic LLM to jointly extract, type, and assemble the graph, we decompose the problem into specialized agents operating under constrained objectives. The core design principle is faithfulness before connectivity. Each stage is responsible for… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 12 linked inside Pith

  1. [1]

    Advances in Neural Information Processing Systems37, 76930–76966 (2024)

    Agarwal, R., Singh, A., Zhang, L., Bohnet, B., Rosias, L., Chan, S., Zhang, B., Anand, A., Abbas, Z., Nova, A., et al.: Many-shot in-context learning. Advances in Neural Information Processing Systems37, 76930–76966 (2024)

    2024

  2. [2]

    arXiv preprint arXiv:2508.10925 (2025)

    Agarwal, S., Ahmad, L., Ai, J., Altman, S., Applebaum, A., Arbus, E., Arora, R.K., Bai, Y., Baker, B., Bao, H., et al.: gpt-oss-120b & gpt-oss-20b model card. arXiv preprint arXiv:2508.10925 (2025)

    Pith/arXiv arXiv 2025

  3. [3]

    In: 26th international symposium on research in attacks, intrusions and defenses

    Alam, M.T., Bhusal, D., Park, Y., Rastogi, N.: Looking beyond iocs: Automatically extracting attack patterns from external cti. In: 26th international symposium on research in attacks, intrusions and defenses. pp. 92–108 (2023)

    2023

  4. [4]

    Pro- cedia computer science246, 3781–3790 (2024)

    Arslan, M., Ghanem, H., Munawar, S., Cruz, C.: A survey on rag with llms. Pro- cedia computer science246, 3781–3790 (2024)

    2024

  5. [5]

    arXiv preprint arXiv:2512.20848 (2025)

    Blakeman, A., Grattafiori, A., Basant, A., Gupta, A., Khattar, A., Renduchintala, A., Vavre, A., Shukla, A., Bercovich, A., Ficek, A., et al.: Nemotron 3 nano: Open, efficient mixture-of-experts hybrid mamba-transformer model for agentic reason- ing. arXiv preprint arXiv:2512.20848 (2025)

    arXiv 2025

  6. [6]

    arXiv preprint arXiv:2404.13236 (2024)

    Bouchiha, M.A., Telnoff, Q., Bakkali, S., Champagnat, R., Rabah, M., Coustaty, M., Ghamri-Doudane, Y.: Llmchain: Blockchain-based reputation system for shar- ing and evaluating large language models. arXiv preprint arXiv:2404.13236 (2024)

    Pith/arXiv arXiv 2024

  7. [7]

    Büchel, M., Paladini, T., Longari, S., Carminati, M., Zanero, S., Binyamini, H., Engelberg, G., Klein, D., Guizzardi, G., Caselli, M., et al.:{SoK}: Automated {TTP}extraction from{CTI}reports–are we there yet? In: 34th USENIX security symposium (USENIX Security 25). pp. 4621–4641 (2025)

    2025

  8. [8]

    Computers & Security150, 104213 (2025)

    Chen, M., Zhu, K., Lu, B., Li, D., Yuan, Q., Zhu, Y.: Aecr: Automatic attack tech- nique intelligence extraction based on fine-tuned large language model. Computers & Security150, 104213 (2025)

    2025

  9. [9]

    IEEE Transactions on Dependable and Secure Computing (2025) 19

    Cheng, W., Zhu, T., Chen, T., Yuan, Q., Ying, J., Li, H., et al.: CRUcialG: Recon- struct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports. IEEE Transactions on Dependable and Secure Computing (2025) 19

    2025

  10. [10]

    In: European Symposium on Security and Privacy (EuroS&P)

    Cheng, Y., Bajaber, O., Tsegai, S.A., et al.: Ctinexus: Automatic cyber threat in- telligence knowledge graph construction using large language models. In: European Symposium on Security and Privacy (EuroS&P). pp. 923–938. IEEE (2025)

    2025

  11. [11]

    DeepSeek-AI: Deepseek-v3 technical report (2024),https://arxiv.org/abs/ 2412.19437

    Pith/arXiv arXiv 2024

  12. [12]

    In: European Symposium on Security and Privacy Workshops (EuroS&PW)

    Della Penna, S., Natella, R., Orbinato, V., Parracino, L., et al.: Cti-hal: A human- annotated dataset for cyber threat intelligence analysis. In: European Symposium on Security and Privacy Workshops (EuroS&PW). pp. 69–78. IEEE (2025)

    2025

  13. [13]

    In: Proceedings of the 2024 conference on empirical methods in natural language processing

    Dong, Q., Li, L., Dai, D., Zheng, C., Ma, J., Li, R., Xia, H., Xu, J., Wu, Z., Chang, B., et al.: A survey on in-context learning. In: Proceedings of the 2024 conference on empirical methods in natural language processing. pp. 1107–1128 (2024)

    2024

  14. [14]

    In: Annual Computer Security Applications Conference Workshops (ACSAC Workshops)

    Fayyazi, R., Taghdimi, R., Yang, S.J.: Advancing ttp analysis: Harnessing the power of large language models with retrieval augmented generation. In: Annual Computer Security Applications Conference Workshops (ACSAC Workshops). pp. 255–261. IEEE (2024)

    2024

  15. [15]

    Fengrui, Y., Du, Y.: Few-shot learning of ttps classification using large language models (2024)

    2024

  16. [16]

    In: European symposium on security and privacy workshops (EuroS&PW)

    Fieblinger, R., Alam, M.T., Rastogi, N.: Actionable cyber threat intelligence using knowledge graphs and large language models. In: European symposium on security and privacy workshops (EuroS&PW). pp. 100–111. IEEE (2024)

    2024

  17. [17]

    In: 37th International Conference on Data Engineering

    Gao, P., Shao, F., Liu, X., Xiao, X., Qin, Z., Xu, F., Mittal, P., Kulkarni, S.R., Song, D.: Enabling efficient cyber threat hunting with cyber threat intelligence. In: 37th International Conference on Data Engineering. pp. 193–204. IEEE (2021)

    2021

  18. [18]

    arXiv preprint arXiv:2309.12501 (2023)

    Ge, X., Wang, Y.C., Wang, B., Kuo, C.C.J.: Knowledge graph embedding: An overview. arXiv preprint arXiv:2309.12501 (2023)

    Pith/arXiv arXiv 2023

  19. [19]

    Iclr1(2), 3 (2022)

    Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al.: Lora: Low-rank adaptation of large language models. Iclr1(2), 3 (2022)

    2022

  20. [20]

    In: Proceedings of the 19th ACM Asia Conference on Computer and Communications Security

    Kumarasinghe, U., Lekssays, A., Sencar, H.T., Boughorbel, S., Elvitigala, C., Nakov, P.: Semantic ranking for automated adversarial technique annotation in security text. In: Proceedings of the 19th ACM Asia Conference on Computer and Communications Security. pp. 49–62 (2024)

    2024

  21. [21]

    In: Findings of the Association for Computational Linguistics

    Lairgi, Y., Moncla, L., Benabdeslem, K., Cazabet, R., Cléau, P.: Atom: Adaptive and optimized dynamic temporal knowledge graph construction using llms. In: Findings of the Association for Computational Linguistics. pp. 950–966 (2026)

    2026

  22. [22]

    In: European Symposium on Research in Computer Security

    Li, Z., Zeng, J., Chen, Y., Liang, Z.: Attackg: Constructing technique knowledge graph from cyber threat intelligence reports. In: European Symposium on Research in Computer Security. pp. 589–609. Springer (2022)

    2022

  23. [23]

    arXiv preprint arXiv:2601.08584 (2026)

    Liu, A.H., Khandelwal, K., Subramanian, S., Jouault, V., Rastogi, A., et al.: Minis- tral 3. arXiv preprint arXiv:2601.08584 (2026)

    Pith/arXiv arXiv 2026

  24. [24]

    In: 3rd workshop on deep learning for low-resource natural language processing

    Liu, L., Omidvar, A., Ma, Z., Agrawal, A., An, A.: Unsupervised knowledge graph generation using semantic similarity matching. In: 3rd workshop on deep learning for low-resource natural language processing. pp. 169–179 (2022)

    2022

  25. [25]

    MISP Project: Misp: Open source threat intelligence platform and open standards for threat information sharing.https://www.misp-project.org/(2026)

    2026

  26. [26]

    MITRE Corporation: Mitre att&ck framework.https://attack.mitre.org/ (2023), accessed: 2025-09-20

    2023

  27. [27]

    https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html(2021), edited by Bret Jordan, Rich Piazza, and Trey Darley

    OASIS Cyber Threat Intelligence (CTI) Technical Committee: Stix version 2.1. https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html(2021), edited by Bret Jordan, Rich Piazza, and Trey Darley. OASIS Standard 20 M. Bouchiha et al

    2021

  28. [28]

    arXiv preprint arXiv:2509.25193 (2025)

    Rastogi, A., Yang, A., Jiang, A.Q., Liu, A.H., Sablayrolles, A., Héliou, A., Martin, A., Agarwal, A., Ehrenberg, A., Lo, A., et al.: Devstral: Fine-tuning language models for coding agent applications. arXiv preprint arXiv:2509.25193 (2025)

    arXiv 2025

  29. [29]

    In: International workshop on deployable machine learning for security defense

    Rastogi, N., Dutta, S., Zaki, M.J., Gittens, A., Aggarwal, C.: Malont: An ontology for malware threat intelligence. In: International workshop on deployable machine learning for security defense. pp. 28–44. Springer (2020)

    2020

  30. [30]

    arXiv preprint arXiv:2410.21228 (2024)

    Shuttleworth, R., Andreas, J., Torralba, A., Sharma, P.: Lora vs full fine-tuning: An illusion of equivalence. arXiv preprint arXiv:2410.21228 (2024)

    arXiv 2024

  31. [31]

    arXiv preprint arXiv:2307.10214 (2023)

    Siracusano, G., Sanvito, D., Gonzalez, R., Srinivasan, M., Kamatchi, S., Takahashi, W., Kawakita, M., Kakumaru, T., Bifulco, R.: Time for action: Automated analysis of cyber threat intelligence in the wild. arXiv preprint arXiv:2307.10214 (2023)

    Pith/arXiv arXiv 2023

  32. [32]

    arXiv preprint arXiv:2507.20534 (2025)

    Team, K., Bai, Y., Bao, Y., Charles, Y., et al.: Kimi k2: Open agentic intelligence. arXiv preprint arXiv:2507.20534 (2025)

    Pith/arXiv arXiv 2025

  33. [33]

    In: 5th International Conference on AI in Cybersecurity (ICAIC)

    Waldrop, S., Dogdu, E., Choupani, R., Mitchell, W., et al.: Semantic chunking and consensus filtering for structured extraction of cyber threat intelligence. In: 5th International Conference on AI in Cybersecurity (ICAIC). pp. 1–11. IEEE (2026)

    2026

  34. [34]

    arXiv preprint arXiv:2508.01059 (2025)

    Weerawardhena, S., Kassianik, P., Nelson, B., Saglam, B., Vellore, A., Priyanshu, A., Vijay, S., Aufiero, M., Goldblatt, A., Burch, F., et al.: Llama-3.1-foundationai- securityllm-8b-instruct technical report. arXiv preprint arXiv:2508.01059 (2025)

    Pith/arXiv arXiv 2025

  35. [35]

    arXiv preprint arXiv:2303.03846 (2023)

    Wei, J., Wei, J., Tay, Y., Tran, D., Webson, A., Lu, Y., Chen, X., Liu, H., Huang, D., Zhou, D., et al.: Larger language models do in-context learning differently. arXiv preprint arXiv:2303.03846 (2023)

    Pith/arXiv arXiv 2023

  36. [36]

    arXiv e-prints pp

    Xu, M., Wang, H., Liu, J., Lin, Y., Yingshi Liu, C.X., Lim, H.W., Dong, J.S.: Intelex: A llm-driven attack-level threat intelligence extraction framework. arXiv e-prints pp. arXiv–2412 (2024)

    2024

  37. [37]

    arXiv preprint arXiv:2505.09388 (2025)

    Yang, A., Li, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Gao, C., Huang, C., Lv, C., et al.: Qwen3 technical report. arXiv preprint arXiv:2505.09388 (2025)

    Pith/arXiv arXiv 2025

  38. [38]

    arXiv preprint arXiv:2602.15763 (2026)

    Zeng, A., Lv, X., Hou, Z., Du, Z., Zheng, Q., et al.: Glm-5: from vibe coding to agentic engineering. arXiv preprint arXiv:2602.15763 (2026)

    Pith/arXiv arXiv 2026

  39. [39]

    arXiv preprint arXiv:2510.04618 (2025)

    Zhang, Q., Hu, C., Upasani, S., Ma, B., Hong, F., Kamanuru, V., Rainton, J., Wu, C., Ji, M., Li, H., et al.: Agentic context engineering: Evolving contexts for self-improving language models. arXiv preprint arXiv:2510.04618 (2025)

    Pith/arXiv arXiv 2025

  40. [40]

    In: Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Lan- guage Technologies (Volume 1: Long Papers)

    Zhao, W., Liu, Y., Wan, Y., Wang, Y., Wu, Q., Deng, Z., Du, J., Liu, S., Xu, Y., Yu, P.S.: knn-icl: Compositional task-oriented parsing generalization with nearest neighbor in-context learning. In: Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Lan- guage Technologies (Volume 1: Lon...

    2024

  41. [41]

    Computers & Security136, 103524 (2024)

    Zhao, X., Jiang, R., Han, Y., Li, A., Peng, Z.: A survey on cybersecurity knowledge graph construction. Computers & Security136, 103524 (2024)

    2024

  42. [42]

    Knowledge-Based Systems130, 30–32 (2017)

    Zhu, G., Iglesias, C.A.: Sematch: Semantic similarity framework for knowledge graphs. Knowledge-Based Systems130, 30–32 (2017)

    2017