{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","short_pith_number":"pith:37IELZL5","canonical_record":{"source":{"id":"2607.20216","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-22T14:36:10Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2171bc00d9423e70703e159053420c5bd384ce1a35ca4f89e60e2186bc0c1193","abstract_canon_sha256":"797dea0f5b49b592729e8f0c4c232b5f9e58dd45047bff007980d36c72a3349b"},"schema_version":"1.0"},"canonical_sha256":"dfd045e57dc4c47ddcf6b1da6b01aabef60247d744f96ebd4e859a5f04f36a58","source":{"kind":"arxiv","id":"2607.20216","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.20216","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"arxiv_version","alias_value":"2607.20216v1","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.20216","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"pith_short_12","alias_value":"37IELZL5YTCH","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"pith_short_16","alias_value":"37IELZL5YTCH3XHW","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"pith_short_8","alias_value":"37IELZL5","created_at":"2026-07-23T01:25:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","target":"record","payload":{"canonical_record":{"source":{"id":"2607.20216","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-22T14:36:10Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2171bc00d9423e70703e159053420c5bd384ce1a35ca4f89e60e2186bc0c1193","abstract_canon_sha256":"797dea0f5b49b592729e8f0c4c232b5f9e58dd45047bff007980d36c72a3349b"},"schema_version":"1.0"},"canonical_sha256":"dfd045e57dc4c47ddcf6b1da6b01aabef60247d744f96ebd4e859a5f04f36a58","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-23T01:25:08.159341Z","signature_b64":"IpkNx+gCA/c8n3Ix7gEtUtM790isgXfYAVrn+wWRBlOPRBxhExd9DyhIKhrKm+mI2WqjoP0l3e3lzf1Bxa6uAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"dfd045e57dc4c47ddcf6b1da6b01aabef60247d744f96ebd4e859a5f04f36a58","last_reissued_at":"2026-07-23T01:25:08.158454Z","signature_status":"signed_v1","first_computed_at":"2026-07-23T01:25:08.158454Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.20216","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-23T01:25:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"XjuBBltCTkIH8y1Sb1NQ7G+XtNBaNMTo9/5o4uYfuUpJcPBG2pIAl2XhcgODRgUlVHb6pHEcf7IOhkQBQanlBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T04:17:53.976270Z"},"content_sha256":"d9adc4dc8d4dbe14e191defa544c06b47ae3deac15e5dfd06cefbe686ab5db35","schema_version":"1.0","event_id":"sha256:d9adc4dc8d4dbe14e191defa544c06b47ae3deac15e5dfd06cefbe686ab5db35"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Adel ElZemity, Budi Arief, Shujun Li","submitted_at":"2026-07-22T14:36:10Z","abstract_excerpt":"Malware analysis demands rapid interpretation of complex detonation reports spanning filesystem, network, and process behaviours. While large language models (LLMs) demonstrate impressive capabilities for technical artifact interpretation, the opacity and escalating API costs of closed-weight frontier models motivate exploration of open-weight alternatives. However, many open-weight models are large, demanding significant compute resources and incurring non-trivial hosting costs that place them beyond reach for resource-constrained deployments. This paper investigates whether orchestrated ense"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.20216","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.20216/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-23T01:25:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RRkQY/jHQSp9PYCUAxepJdl0zUUoMO4QSoG3qa1UgVYTP3BGO6DPZsbCQ3NsOMkMUa2eXcSELk0Y6TFRYv0oAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T04:17:53.976772Z"},"content_sha256":"34ce8893094c7b3f96fb40c1e2fb708c6bcc53d804ec92c66c5bae175751ca2a","schema_version":"1.0","event_id":"sha256:34ce8893094c7b3f96fb40c1e2fb708c6bcc53d804ec92c66c5bae175751ca2a"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","target":"integrity","payload":{"note":"DOI in the printed bibliography is fragmented by whitespace or line breaks. A longer candidate (10.1109/mis.2024.3517792) was visible in the surrounding text but could not be confirmed against doi.org as printed.","snippet":"Zhang, Q., Liu, Z., Pan, S., Wang, C.: The rise of small language models. IEEE Intelligent Systems40, 30–37 (2025).https://doi.org/10.1109/mis.2024.351 7792","arxiv_id":"2607.20216","detector":"doi_compliance","evidence":{"ref_index":72,"verdict_class":"incontrovertible","resolved_title":null,"printed_excerpt":"10.1109/mis.2024.351","reconstructed_doi":"10.1109/mis.2024.3517792"},"severity":"advisory","ref_index":72,"audited_at":"2026-08-01T10:39:55.492004Z","event_type":"pith.integrity.v1","detected_doi":"10.1109/mis.2024.3517792","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"2f190b47eb77a9b9b0676388c16d5afa6c5485721ec001ebb0bccb5847840ffd","paper_version":1,"verdict_class":"incontrovertible","resolved_title":null,"detector_version":"1.1.0","detected_arxiv_id":null,"integrity_event_id":15627,"payload_sha256":"d8b66be917559ab2c1d5f38e106386ed8d75804933795ea24077961ca0ead50a","signature_b64":"WGwWushxbhpAXFEUrWRbq2RwRhPl82mOEgYY4yzM/MJAOyDFli8LoIQ32MEYlJz0UM20Ryimju0MMfBB3T7ZBw==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-01T10:43:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gJBU9hS9A406Sl/wW87u6nMwQ+1uLvQHgaD7xGthGWSpGbRZKMe2uRNolLSIGHhF0NJTBALvjwRABgJqRz2sAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T04:17:53.979389Z"},"content_sha256":"965c1123421d7e0967aedb01f087e560bf67201e48d0aed8389e1ab9b6b69ed5","schema_version":"1.0","event_id":"sha256:965c1123421d7e0967aedb01f087e560bf67201e48d0aed8389e1ab9b6b69ed5"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","target":"integrity","payload":{"note":"DOI is split by whitespace or line breaks in the printed bibliography. Reconstructed DOI 10.3390/s25061666 resolves to 'Generative AI and LLMs for Critical Infrastructure Protection: Evaluation Benchmarks, Agentic AI, Challenges, and Opport'. A reader following the printed text alone cannot reach it.","snippet":"Yigit, Y., Ferrag, M., Ghanem, M.C., Sarker, I.H., Maglaras, L.A., Chrysoulas, C., Moradpoor, N., Tihanyi, N., Janicke, H.: Generative AI and LLMs for critical infrastructure protection: Evaluation benchmarks, agentic AI, challenges, and op","arxiv_id":"2607.20216","detector":"doi_compliance","evidence":{"ref_index":70,"verdict_class":"incontrovertible","resolved_title":"Generative AI and LLMs for Critical Infrastructure Protection: Evaluation Benchmarks, Agentic AI, Challenges, and Opportunities","printed_excerpt":"10.3390/s2","reconstructed_doi":"10.3390/s25061666"},"severity":"advisory","ref_index":70,"audited_at":"2026-08-01T10:39:55.492004Z","event_type":"pith.integrity.v1","detected_doi":"10.3390/s25061666","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"a783c8fcd03e20a8d609a34eff199d6c5d44b8f278e182799708046b02d30508","paper_version":1,"verdict_class":"incontrovertible","resolved_title":"Generative AI and LLMs for Critical Infrastructure Protection: Evaluation Benchmarks, Agentic AI, Challenges, and Opportunities","detector_version":"1.1.0","detected_arxiv_id":null,"integrity_event_id":15626,"payload_sha256":"75f6f6c4e58dccd9f91f907bbb502ec3a1abbac0be67b11b2c2d51789c258ebc","signature_b64":"IezOPbtuPDz7TxxcrYl9TlUZq48A6RMhjYJME4Ot2EUQVqsHwqyAI/P7HFH2Jh97EuwgeBS91HrDsUqzFOk8CA==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-01T10:43:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6wRv2+/3I3vbtK8jVDE8GlNPas+Tv9sJD2dIjKEZN06vfjEEZgIPBIsfBq7PAScrlCChEHKCNrNUHKQxCjIUBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T04:17:53.979789Z"},"content_sha256":"f94a466a23008f3831df7bb37640ace6e1dd3cd85889cd304e11d5ba4693f6b4","schema_version":"1.0","event_id":"sha256:f94a466a23008f3831df7bb37640ace6e1dd3cd85889cd304e11d5ba4693f6b4"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","target":"integrity","payload":{"note":"DOI is split by whitespace or line breaks in the printed bibliography. Reconstructed DOI 10.1093/cybsec/tyad023 resolves to 'A systematic literature review on advanced persistent threat behaviors and its detection strategy'. A reader following the printed text alone cannot reach it.","snippet":"Mat, N., Jamil, N., Yusoff, Y., Kiah, M.L.M.: A systematic literature review on advanced persistent threat behaviors and its detection strategy. Journal of Cyber- security10(1), tyad023:1–tyad023:18 (2024).https://doi.org/10.1093/cybsec /ty","arxiv_id":"2607.20216","detector":"doi_compliance","evidence":{"ref_index":39,"verdict_class":"incontrovertible","resolved_title":"A systematic literature review on advanced persistent threat behaviors and its detection strategy","printed_excerpt":"10.1093/cybsec","reconstructed_doi":"10.1093/cybsec/tyad023"},"severity":"advisory","ref_index":39,"audited_at":"2026-08-01T10:39:55.492004Z","event_type":"pith.integrity.v1","detected_doi":"10.1093/cybsec/tyad023","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"4fb127aab01a3c4bbae49fa4500ec6dfe162f7bda7efa05b85596bab2af7ba74","paper_version":1,"verdict_class":"incontrovertible","resolved_title":"A systematic literature review on advanced persistent threat behaviors and its detection strategy","detector_version":"1.1.0","detected_arxiv_id":null,"integrity_event_id":15625,"payload_sha256":"4de4cb99f5bd5fa661185a1521f65a3d2bacdcf83ad1d1f6040f9fdea73a9f0a","signature_b64":"zrimx2PEbjigO59gulwGLJSVikjkfJO44WAxym7g+vmfbzAqUljrnz+KfvaU7gPEE7DPm81uCr9QnLV5kYARCw==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-01T10:43:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"v/BsvanlJXs5pTP0YNN+/Abovu4fUm8dHgmb2A/r3jfRJQuWVd2Y3BXhaHFsDxvQYaiGzq9zXwhP3/bVUQqsAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T04:17:53.980172Z"},"content_sha256":"b26608b2257ca13383bd715b20db956561024dd19695f11b2ddddcb1ffb0943a","schema_version":"1.0","event_id":"sha256:b26608b2257ca13383bd715b20db956561024dd19695f11b2ddddcb1ffb0943a"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","target":"integrity","payload":{"note":"DOI is split by whitespace or line breaks in the printed bibliography. Reconstructed DOI 10.3390/s23020946 resolves to 'Evaluation of Machine Learning Algorithms for Malware Detection'. A reader following the printed text alone cannot reach it.","snippet":"Akhtar, M.S., Feng, T.: Evaluation of machine learning algorithms for malware detection. Sensors23(2), 946:1–946:17 (2023).https://doi.org/10.3390/s23020 946","arxiv_id":"2607.20216","detector":"doi_compliance","evidence":{"ref_index":1,"verdict_class":"incontrovertible","resolved_title":"Evaluation of Machine Learning Algorithms for Malware Detection","printed_excerpt":"10.3390/s23020","reconstructed_doi":"10.3390/s23020946"},"severity":"advisory","ref_index":1,"audited_at":"2026-08-01T10:39:55.492004Z","event_type":"pith.integrity.v1","detected_doi":"10.3390/s23020946","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"a4de43de76af39a8eca22cc86d1c8a65393d4f67673698f98afb396158252ea8","paper_version":1,"verdict_class":"incontrovertible","resolved_title":"Evaluation of Machine Learning Algorithms for Malware Detection","detector_version":"1.1.0","detected_arxiv_id":null,"integrity_event_id":15624,"payload_sha256":"93d771670237cc656d9295240feb89121beb36c0600e691362d5bf08419d031a","signature_b64":"9eMjI9tKYJdLglvXfyXrAq6sbTUwU5gf6kRBeUtASyF1sKD2yVH6OSiSfDazTKSXOLYJ53+9JMbPe0MFA6sNAA==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-01T10:43:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lWvZF6pot2kyX+/B7fd8mFTxWnq989okD2RO0AkoNa71hiGw/nA/h5gvmIlsCQ2/F81FOMQpF8C7SNoHFytYAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T04:17:53.980538Z"},"content_sha256":"11ed648ae3895cc8b6e62be51374cef530b955eac52b2f05189a52ee1d3e6339","schema_version":"1.0","event_id":"sha256:11ed648ae3895cc8b6e62be51374cef530b955eac52b2f05189a52ee1d3e6339"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/37IELZL5YTCH3XHWWHNGWANKX3/bundle.json","state_url":"https://pith.science/pith/37IELZL5YTCH3XHWWHNGWANKX3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/37IELZL5YTCH3XHWWHNGWANKX3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T04:17:53Z","links":{"resolver":"https://pith.science/pith/37IELZL5YTCH3XHWWHNGWANKX3","bundle":"https://pith.science/pith/37IELZL5YTCH3XHWWHNGWANKX3/bundle.json","state":"https://pith.science/pith/37IELZL5YTCH3XHWWHNGWANKX3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/37IELZL5YTCH3XHWWHNGWANKX3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:37IELZL5YTCH3XHWWHNGWANKX3","merge_version":"pith-open-graph-merge-v1","event_count":6,"valid_event_count":6,"invalid_event_count":0,"equivocation_count":1,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"797dea0f5b49b592729e8f0c4c232b5f9e58dd45047bff007980d36c72a3349b","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-22T14:36:10Z","title_canon_sha256":"2171bc00d9423e70703e159053420c5bd384ce1a35ca4f89e60e2186bc0c1193"},"schema_version":"1.0","source":{"id":"2607.20216","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.20216","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"arxiv_version","alias_value":"2607.20216v1","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.20216","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"pith_short_12","alias_value":"37IELZL5YTCH","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"pith_short_16","alias_value":"37IELZL5YTCH3XHW","created_at":"2026-07-23T01:25:08Z"},{"alias_kind":"pith_short_8","alias_value":"37IELZL5","created_at":"2026-07-23T01:25:08Z"}],"graph_snapshots":[{"event_id":"sha256:34ce8893094c7b3f96fb40c1e2fb708c6bcc53d804ec92c66c5bae175751ca2a","target":"graph","created_at":"2026-07-23T01:25:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.20216/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malware analysis demands rapid interpretation of complex detonation reports spanning filesystem, network, and process behaviours. While large language models (LLMs) demonstrate impressive capabilities for technical artifact interpretation, the opacity and escalating API costs of closed-weight frontier models motivate exploration of open-weight alternatives. However, many open-weight models are large, demanding significant compute resources and incurring non-trivial hosting costs that place them beyond reach for resource-constrained deployments. This paper investigates whether orchestrated ense","authors_text":"Adel ElZemity, Budi Arief, Shujun Li","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-22T14:36:10Z","title":"Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.20216","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d9adc4dc8d4dbe14e191defa544c06b47ae3deac15e5dfd06cefbe686ab5db35","target":"record","created_at":"2026-07-23T01:25:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"797dea0f5b49b592729e8f0c4c232b5f9e58dd45047bff007980d36c72a3349b","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-22T14:36:10Z","title_canon_sha256":"2171bc00d9423e70703e159053420c5bd384ce1a35ca4f89e60e2186bc0c1193"},"schema_version":"1.0","source":{"id":"2607.20216","kind":"arxiv","version":1}},"canonical_sha256":"dfd045e57dc4c47ddcf6b1da6b01aabef60247d744f96ebd4e859a5f04f36a58","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"dfd045e57dc4c47ddcf6b1da6b01aabef60247d744f96ebd4e859a5f04f36a58","first_computed_at":"2026-07-23T01:25:08.158454Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-23T01:25:08.158454Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"IpkNx+gCA/c8n3Ix7gEtUtM790isgXfYAVrn+wWRBlOPRBxhExd9DyhIKhrKm+mI2WqjoP0l3e3lzf1Bxa6uAQ==","signature_status":"signed_v1","signed_at":"2026-07-23T01:25:08.159341Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.20216","source_kind":"arxiv","source_version":1}}},"equivocations":[{"signer_id":"pith.science","event_type":"integrity_finding","target":"integrity","event_ids":["sha256:11ed648ae3895cc8b6e62be51374cef530b955eac52b2f05189a52ee1d3e6339","sha256:965c1123421d7e0967aedb01f087e560bf67201e48d0aed8389e1ab9b6b69ed5","sha256:b26608b2257ca13383bd715b20db956561024dd19695f11b2ddddcb1ffb0943a","sha256:f94a466a23008f3831df7bb37640ace6e1dd3cd85889cd304e11d5ba4693f6b4"]}],"invalid_events":[],"applied_event_ids":["sha256:d9adc4dc8d4dbe14e191defa544c06b47ae3deac15e5dfd06cefbe686ab5db35","sha256:34ce8893094c7b3f96fb40c1e2fb708c6bcc53d804ec92c66c5bae175751ca2a"],"state_sha256":"e6ff23cd437e68a13a34abad59faffe945979949a4f7ea15fcdd5d53bf5a02f3"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"z5qVS5Y6oTgoOELoRgUy95rhSA3RqovwFPP8fnUAFJkVvDylZOxd/MhlyRhH7yCS6R2I66lreJH6gXgseK+mBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T04:17:53.983885Z","bundle_sha256":"3c5a7719fb1168c607b18b05f5940c0271a02b663749c571080290a75edea662"}}