Pith. sign in

REVIEW 3 major objections 5 minor 32 references

Randomized smoothing certifies LLM-based intrusion detectors when noise is confined to the attacker-controllable feature subspace and the model is fine-tuned under that same noise.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 03:40 UTC pith:EPCGVLPV

load-bearing objection Honest, well-scoped application of randomized smoothing to LLM-IDS; the certificate math is standard, and the real open question is whether the DC/IC/UC feature taxonomy it leans on holds up in practice. the 3 major comments →

arxiv 2607.13801 v1 pith:EPCGVLPV submitted 2026-07-15 cs.CR cs.AIcs.LG

Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection

Zhenpeng Li This is my paper
classification cs.CR cs.AIcs.LG
keywords randomized smoothingcertified robustnessLLM-based intrusion detectiondirectly controllable featurestraffic-aware noisenoise-augmented fine-tuningCIC-IDS-2018HIKARI-2021
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that standard randomized smoothing fails on LLM-based intrusion detection systems because it perturbs features the attacker cannot realistically modify, causing abstention and weak certificates. The author's remedy is to restrict Gaussian smoothing to the 'directly controllable' (DC) feature subspace — the packet fields and flow headers a remote attacker can actually change — and to fine-tune the LLM with noise in that same subspace. Doing so recovers certified accuracy of 68–100% on CIC-IDS-2018 and HIKARI-2021, compared with 14–33% for clean-trained models, and yields median certified radii 1.8–5× larger than the L∞-equivalent budget. The paper identifies noise stability of the base model as the binding prerequisite: without it, subspace alignment alone cannot save the certificate, and with it, the method's advantage over isotropic smoothing largely comes from eliminating abstention on uncontrollable features.

Core claim

The central claim is that a certified defense for LLM-based network intrusion detection is achievable by aligning the randomized-smoothing distribution with the attacker's feasible manipulation space. Formally, TA-RS smooths with Gaussian noise supported only on the DC feature subspace (Theorem 2), certifying perturbations δ* with support in that subspace and ||δ*||_2 ≤ σΦ^{-1}(p_A). The discovery has two coupled parts: (1) clean-trained LLM-IDS are too unstable under even DC-only noise to certify (14–33% certified accuracy, at or below random), and noise-augmented fine-tuning on the DC subspace is a prerequisite; (2) once the base model is stable, traffic-aware smoothing outperforms isotrop

What carries the argument

The central object is the DC/IC/UC controllability taxonomy (from a companion paper): features are partitioned into directly controllable (attacker can set), indirectly controllable (emergent from behavior), and uncontrollable (determined by remote host). TA-RS uses the DC indicator matrix I_F_DC to define a traffic-aware Gaussian noise distribution N(0, σ²I_F_DC) applied during both fine-tuning and certification. The theorem is a restricted-support version of Cohen et al.'s randomized-smoothing certificate: because both noise and adversarial perturbation have support in F_DC, the Neyman–Pearson argument applies verbatim in that subspace, yielding a DC-subspace L2 radius. The clip-to-protoco

Load-bearing premise

The certificate is only as strong as the assumed DC/IC/UC feature partition: if a real attacker's packet-level manipulations also shift features classified as indirectly controllable or uncontrollable (or if a DC feature is mis-assigned), the certified radius does not cover the attacker's actual manipulations.

What would settle it

Conduct a packet-level adversarial test using real network traffic (e.g., modifying actual packets sent by a client) and measure whether features outside the DC set change by more than the certified budget. If such changes occur and induce misclassification within the certified radius, the certificate's soundness is violated. Alternatively, compare the hand-assigned DC mask against a brute-force feature-influence analysis (e.g., occluding each feature and measuring the classifier's decision change) to see whether features assigned to IC/UC are actually uncontrollable in practice.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the DC/IC/UC taxonomy is correct, then any future LLM-IDS defense should smooth only over the directly controllable features; isotropic smoothing wastes certification budget on features the attacker cannot touch.
  • Noise-augmented fine-tuning on the DC subspace is a necessary precondition for certification; clean LLM-IDS cannot be certified with randomized smoothing regardless of the smoothing distribution.
  • The L2 certificate, at radius R_∞=ε√|F_DC|, covers the companion L∞ threat model (ε=0.05) for 55–100% of samples on CIC-IDS-2018 and HIKARI-2021, giving a concrete security guarantee at a small traffic-manipulation budget.
  • Dataset-specific tuning is non-negotiable: a model fine-tuned on one dataset achieves near-chance certified accuracy zero-shot on another, so pretrained LLM knowledge does not transfer without traffic-aware fine-tuning.
  • The method's advantage is largely abstention-driven: isotropic test-time noise perturbs uncontrollable features, triggering abstention rates up to 68% on CIC-IDS-2018, whereas TA-RS abstains only 8%.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The presented framework likely generalizes to any classifier, not just LLMs, as long as the base model can be made noise-stable; the paper already shows tree ensembles (XGBoost, LightGBM) can be wrapped without noise augmentation to varying effect.
  • A native L∞ certificate (rather than the L2-converted one) would be tighter and could close the gap between the certificate and the actual attack budget; the paper leaves this as future work, and its feasibility may depend on per-feature noise distributions shaped like hypercubes.
  • A testable extension: the same DC-subspace smoothing principle could be applied to other security domains where an adversary controls a known feature subspace, such as spam filtering or malware detection on structured headers.
  • The hand-assigned DC masks (Table 1) are a domain assumption; an independent verification of the taxonomy (e.g., via real packet-level attack experiments) would directly test whether the certified radius covers actual feasible manipulations.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Traffic-Aware Randomized Smoothing (TA-RS) for LLM-based network intrusion detection. It partitions network-flow features into directly controllable (DC), indirectly controllable (IC), and uncontrollable (UC) sets, following a companion paper [1], and applies Gaussian smoothing only to the DC subspace during fine-tuning and certification. Theorem 2 gives a DC-subspace L2 certificate: if the smoothed classifier predicts c_A with probability p_A > 1/2 under DC noise, then for every perturbation δ* with supp(δ*)⊆F_DC and ||δ*||_2 ≤ σΦ^{-1}(p_A), the prediction is unchanged. Experiments with LLaMA3-8B and Qwen3-8B on CIC-IDS-2018, HIKARI-2021, and RT-IoT2022 report certified accuracy up to 100%, and the paper candidly discusses the L2/L∞ gap, data leakage, and the need for noise-augmented fine-tuning.

Significance. The contribution is primarily a domain-aware application of randomized smoothing rather than a new certificate theory. Its strength is the careful decomposition: clean-trained baselines are shown to be unusable under RS, noise-augmented fine-tuning restores certified accuracy on two datasets, and a battery of controls (iso-trained isotropic RS, random-subspace RS, anisotropic RS, MC-budget sensitivity, cross-domain transfer) is reported. The paper also explicitly quantifies the L2/L∞ gap and data leakage. These are valuable elements for a security audience. The main caveat is that the certificate's real-world meaning hinges on the DC/IC/UC partition imported from [1], and the empirical evidence is based on small evaluation sets and a single training seed. If those limitations are addressed, the framework would be a useful baseline for certified LLM-IDS research.

major comments (3)
  1. [Sections 3.2, 3.3, Theorem 2 (Eq. 4)] The certificate requires supp(δ*)⊆F_DC, but the paper does not establish that feasible packet-level manipulations satisfy this. Retiming packets to change fwd IAT will also change bidirectional Flow IAT aggregates (IC); changing packet sizes/counts can alter server-side response byte counts (UC). Such induced δ* has nonzero IC/UC support, so Theorem 2 does not cover the actual manipulation. Remark 1 only argues conservatism relative to the feasible manifold, not the possibility that dependencies push mass into IC/UC coordinates. To make the central claim 'certifies feasible traffic manipulation' load-bearing, the author should release the DC masks and demonstrate (or prove) that real manipulations induce zero IC/UC change, or certify over the full feasible support. Currently, the threat model rests entirely on the unverified companion taxonomy [1] and hand-assigned Table 1.
  2. [Sections 5.4, 7.7 and Tables 4, 10] Headline certified-accuracy numbers are computed from 40 samples per class (120–168 total), N=200 MC samples, and one LoRA seed. Per-class Wilson intervals are ±15 pp, and the N=200 vs 1,000 comparison in Table 14 shifts CA by up to 4.1 pp; training-seed variance is uncharacterized. Several claimed advantages are within this uncertainty (e.g., CIC/Qwen3 TA-RS 68% vs iso-trained 64% at n_aug=2 in Table 10). Please report confidence intervals, run at least 3–5 fine-tuning seeds, and enlarge the certification subset, or explicitly mark the reported percentages as indicative.
  3. [Section 6.6, Table 8] The RT-IoT2022 recovery is obtained by a post-hoc increase of n_aug from 2 to 4, and the same change hurts CIC/LLaMA3 (76% → 61%). The paper labels this diagnostic, but the abstract and conclusion present it as a recovery (76/69%). Because the recipe is dataset-dependent and no principled selection of n_aug is given, the boundary claim 'recovers with stronger noise augmentation' is not yet a stable result. Either provide a criterion for choosing n_aug or temper the claim.
minor comments (5)
  1. [Abstract and Section 7.2] The notation for the L∞-equivalent threshold is inconsistent: the abstract writes R∞=ε√|DC|, while Section 7.2 uses R∞=ε√|FDC|. Please unify.
  2. [Section 1] Typo: 'absten-tion' should be 'abstention'.
  3. [Section 7.6] The abbreviation 'NAXGB' is used without definition. If it refers to a tabular XGBoost baseline, define it at first use and state whether it is the same as the XGBoost model in Section 6.7.
  4. [Section 6.8, Table 12] The comparison of empirical L∞ attack success with CA at r=ε (an L2 radius) is not norm-matched; the caption warns about this, but the main text should explicitly state that no norm-matched empirical validation of the L2 certificate is claimed.
  5. [Section 5.4 and Table 2] The text says '40 samples per class' but Table 2 lists 168 test samples for RT-IoT2022 (5 classes), with one minority class contributing 8 samples. Please reconcile the description.

Circularity Check

1 steps flagged

Certificate itself is externally grounded in Cohen et al., but its applicability to 'feasible traffic manipulation' rests on the unverified DC/IC/UC taxonomy imported from the author's companion paper [1].

specific steps
  1. self definitional [Section 3.2 'Attacker Capability Model' and Section 3.3 'Threat Model'; Theorem 2 (Eq. 4); Section 7.2 Table 13]
    "Following [1], we partition the d features into three disjoint sets: • Directly controllable (DC): F_DC ⊂ [d], features the attacker can set precisely ... An adversary observes a flow x that f correctly classifies as malicious and seeks a perturbation δ∗ with support in F_DC such that f(x+δ∗)≠f(x)."

    Theorem 2 certifies exactly the perturbation set it assumes: Eq. (4) guarantees g_TA(x+δ*)=c_A for every δ* with supp(δ*)⊆F_DC, and Section 3.3 defines the attacker's feasible manipulations as precisely that set. The set F_DC is imported from the author's own companion paper [1], whose taxonomy is not independently verified or released here (no masks, no attack code). Thus the headline claim that the certificate covers 'feasible traffic manipulation' is true by construction of the threat model, and its real-world validity depends entirely on an unverified self-citation. This is a conditional, externally grounded guarantee (Cohen et al.), not a fitted prediction, so it is partial rather than complete circularity.

full rationale

The core randomized-smoothing derivation is not circular: Theorem 2 is a faithful restriction of Cohen et al. to a linear subspace, and the reported certified accuracies are empirical outputs, not fitted parameters. The noise-stability findings (clean-trained LLMs give weak certificates; noise-augmented fine-tuning recovers them) are dataset experiments with external benchmarks. The only significant circularity burden is the DC/IC/UC controllability taxonomy, which is load-bearing for the security interpretation. The taxonomy is taken from the author's companion arXiv paper [1] and is not independently verified in this preprint; if real packet-level manipulations also perturb IC/UC coordinates (e.g., re-timing packets shifts Flow IAT aggregates), Theorem 2's supp(δ*)⊆F_DC condition may not cover the actual attack. The paper's own Remark 1 acknowledges feature dependencies but argues conservatism, not the possibility that dependencies inject adversarial mass into IC/UC coordinates. This is a partial self-citation/self-definition issue rather than a full circularity: the certificate remains mathematically valid conditional on the assumed threat model, and the paper is transparent that the support condition is part of the claim. Score 4 reflects one load-bearing self-citation with independent content elsewhere.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

No new physical entities are postulated. The DC-masked noise distribution is a construction over existing features, and the DC/IC/UC taxonomy is imported from the author's companion paper rather than newly posited here.

free parameters (3)
  • Noise level σ = 0.25 default; also 0.50, 1.00
    Chosen by hand; certified accuracy and radii are reported per σ. It is a standard RS hyperparameter, not fitted, but the headline results depend on it.
  • Noise-copy count n_aug (K) = 2 default; 4 for RT-IoT2022 recovery
    Default K=2; increased to 4 post hoc to make RT-IoT2022 work, so the recovered 76%/69% numbers use a selected configuration.
  • Monte Carlo budget (N0=20, N=200, α=0.001) = N=200, α=0.001
    Chosen for cost; yields conservative Clopper–Pearson certificates. A larger N (1000) changes CA by ≤4.1 pp.
axioms (5)
  • standard math Cohen et al. randomized-smoothing certificate (Theorem 1) is valid
    Theorem 2 is a direct subspace restriction of [4]; the paper relies on the Neyman–Pearson argument for Gaussian noise.
  • domain assumption DC/IC/UC feature partition from companion paper [1] is correct
    Section 3.2 partitions features by attacker controllability and defines the DC mask; if wrong, the certificate does not cover real attacks.
  • domain assumption Adversary perturbations are confined to the normalized feature vector with support exactly F_DC
    Section 3.3 threat model; feature-space attack model imported from [1], not derived from packet-level causality.
  • domain assumption Base classifier f = LM ∘ ser is deterministic and fixed at certification
    RS requires a fixed base classifier; the paper uses greedy decoding, but the LLM+serializer is treated as a black-box deterministic function.
  • domain assumption Protocol-derived clipping bounds are valid and do not change classification semantics
    Section 4.1 absorbs clipping into h(x)=f(clip(x)), assuming clip is non-expansive and the composed classifier is what is actually deployed.

pith-pipeline@v1.3.0-alltime-deepseek · 27153 in / 19948 out tokens · 187143 ms · 2026-08-02T03:40:30.733170+00:00 · methodology

0 comments
read the original abstract

Large language model (LLM)-based intrusion detection systems (IDS) are increasingly studied for security monitoring, yet their robustness against feasible traffic manipulation remains largely empirical. We present Traffic-Aware Randomized Smoothing (TA-RS), a classifier-agnostic certified defense that injects Gaussian noise exclusively into the directly controllable (DC) subspace -- features a remote attacker can modify -- during both fine-tuning and certification, aligning the smoothing distribution with the attacker-controllable subspace. We identify a critical prerequisite: applying standard randomized smoothing to clean-trained LLM-IDS yields weak certified accuracy in three of four (model, dataset) pairs tested (14-33%, at or below random) and only 57% in the fourth (43 pp below the noise-augmented result); noise-augmented fine-tuning recovers to 68-100% on two of three benchmark datasets (at sigma=0.25). At the L_inf-equivalent threshold R_inf = epsilon*sqrt(|DC|) (epsilon=0.05), TA-RS achieves 55-100% certified accuracy on CIC-IDS-2018 and HIKARI-2021, with median certified radii (R approx 0.45-0.96) exceeding R_inf by 1.8-5x (across sigma=0.25-1.00). Against a fairly trained iso-trained RS baseline the residual advantage is dataset-dependent (4-19 pp on CIC-IDS-2018). The larger gap -- up to 72 pp against an isotropic RS baseline that shares the DC-noise-augmented training recipe -- primarily reflects the training-certification mismatch rather than DC alignment alone: isotropic test-time noise perturbs uncontrollable features the attacker cannot exploit, triggering abstention rates up to 68%. RT-IoT2022 probes the limits of the method: it fails under the default fine-tuning recipe but recovers to 76%/69% certified accuracy (LLaMA3-8B/Qwen3-8B) when noise augmentation is increased.

Figures

Figures reproduced from arXiv: 2607.13801 by Zhenpeng Li.

Figure 1
Figure 1. Figure 1: Certified accuracy at r=0.05 (TA-RS, σ=0.25) for clean-trained vs. noise￾augmented LLM-IDS on CIC-IDS-2018 and HIKARI-2021. Clean-trained models often have weak certified accuracy; noise-augmented fine-tuning recovers certified accuracy to 68–100%. models fall to or below the 4-class random baseline (25%). These rows sup￾port the first condition in the thesis: the LLM must be stable under the same DC featu… view at source ↗
Figure 2
Figure 2. Figure 2: Certified accuracy at r=0.05, σ=0.25. Both TA-RS and isotropic RS employ the same DC-noise-augmented model; the 72 pp gap reflects training–certification mismatch, not DC alignment alone (fair comparison: 4–19 pp, [PITH_FULL_IMAGE:figures/full_fig_p020_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Abstention rate (%) for TA-RS vs. isotropic RS ( [PITH_FULL_IMAGE:figures/full_fig_p021_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: CA(r) vs. certification radius r at σ=0.25 for CIC-IDS-2018/LLaMA3-8B (left) and HIKARI-2021/Qwen3-8B (right). TA-RS (solid) degrades gracefully and remains ≥60% past r=0.15, while isotropic RS (dashed) drops near zero by r=0.05. Vertical lines mark the two reporting thresholds r ∈ {0.05, 0.15}. 74–82% smooth accuracy across the tested σ values, compared with the clean￾trained model’s ≈ 84% clean accuracy … view at source ↗
Figure 5
Figure 5. Figure 5: Certified accuracy CA(0.05) vs. noise level [PITH_FULL_IMAGE:figures/full_fig_p024_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: (a) SA, abstention rate, and CA@0.05 for TA-RS ( [PITH_FULL_IMAGE:figures/full_fig_p026_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

32 extracted references · 2 canonical work pages

  1. [1]

    Li, Controllability-aware adversarial examples against llm-based net- work traffic classifiers (2026).arXiv:2607.07739

    Z. Li, Controllability-aware adversarial examples against llm-based net- work traffic classifiers (2026).arXiv:2607.07739. URLhttps://arxiv.org/abs/2607.07739

    Pith/arXiv arXiv 2026

  2. [2]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, in: Proceedings of the International Conference on Learning Representations, 2018. URLhttps://openreview.net/forum?id=rJzIBfZAb

    2018

  3. [3]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing ad- versarial examples, in: Proceedings of the International Conference on Learning Representations, 2015. URLhttps://arxiv.org/abs/1412.6572

    Pith/arXiv arXiv 2015

  4. [4]

    J. M. Cohen, E. Rosenfeld, J. Z. Kolter, Certified adversarial robustness via randomized smoothing, ArXiv abs/1902.02918 (2019). URLhttps://api.semanticscholar.org/CorpusID:59842968

    Pith/arXiv arXiv 1902

  5. [5]

    G. Katz, C. W. Barrett, D. L. Dill, K. D. Julian, M. J. Kochenderfer, Reluplex: An efficient smt solver for verifying deep neural networks, ArXiv abs/1702.01135 (2017). URLhttps://api.semanticscholar.org/CorpusID:516928

    Pith/arXiv arXiv 2017

  6. [6]

    Tjeng, K

    V. Tjeng, K. Y. Xiao, R. Tedrake, Evaluating robustness of neural net- works with mixed integer programming, in: International Conference on Learning Representations, 2019. URLhttps://openreview.net/forum?id=HyGIdiRqtm

    2019

  7. [7]

    4944–4953

    H.Zhang, T.-W.Weng, P.-Y.Chen, C.-J.Hsieh, L.Daniel, Efficientneu- ral network robustness certification with general activation functions, in: Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS’18, Curran Associates Inc., Red Hook, NY, USA, 2018, p. 4944–4953

    2018

  8. [8]

    Lécuyer, V

    M. Lécuyer, V. Atlidakis, R. Geambasu, D. J. Hsu, S. S. Jana, Certified robustness to adversarial examples with differential privacy, 2019 IEEE Symposium on Security and Privacy (SP) (2018) 656–672. URLhttps://api.semanticscholar.org/CorpusID:49431481 36

    2019

  9. [9]

    G. Yang, T. Duan, J. E. Hu, H. Salman, I. Razenshteyn, J. Li, Random- ized smoothing of all shapes and sizes, in: H. D. III, A. Singh (Eds.), Proceedings of the 37th International Conference on Machine Learning, Vol. 119 of Proceedings of Machine Learning Research, PMLR, 2020, pp. 10693–10705. URLhttps://proceedings.mlr.press/v119/yang20c.html

    2020

  10. [10]

    Salman, J

    H. Salman, J. Li, I. Razenshteyn, P. Zhang, H. Zhang, S. Bubeck, G. Yang, Provably robust deep learning via adversarially trained smoothed classifiers, in: H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, R. Garnett (Eds.), Advances in Neural Infor- mation Processing Systems, Vol. 32, Curran Associates, Inc., 2019. URLhttps://proceedings...

    2019

  11. [11]

    Kumar, A

    A. Kumar, A. Levine, T. Goldstein, S. Feizi, Curse of dimensionality on randomized smoothing for certifiable robustness, in: H. D. III, A. Singh (Eds.), Proceedings of the 37th International Conference on Machine Learning, Vol.119ofProceedingsofMachineLearningResearch, PMLR, 2020, pp. 5458–5467. URLhttps://proceedings.mlr.press/v119/kumar20b.html

    2020

  12. [12]

    Levine, S

    A. Levine, S. Feizi, (de)randomized smoothing for certifiable defense against patch attacks, in: Proceedings of the 34th International Con- ference on Neural Information Processing Systems, NIPS ’20, Curran Associates Inc., Red Hook, NY, USA, 2020

    2020

  13. [13]

    H. Hong, Y. Hong, Certified adversarial robustness via anisotropic ran- domized smoothing (2022).arXiv:2207.05327. URLhttps://arxiv.org/abs/2207.05327

    Pith/arXiv arXiv 2022

  14. [14]

    Corona, G

    I. Corona, G. Giacinto, F. Roli, Adversarial attacks against in- trusion detection systems: Taxonomy, solutions and open is- sues, Information Sciences 239 (2013) 201–225.doi:https: //doi.org/10.1016/j.ins.2013.03.022. URLhttps://www.sciencedirect.com/science/article/pii/ S0020025513002119

    work page doi:10.1016/j.ins.2013.03.022 2013

  15. [15]

    Biggio, I

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Gi- acinto, F. Roli, Evasion attacks against machine learning at test time, in: 37 H. Blockeel, K. Kersting, S. Nijssen, F. Železný (Eds.), Machine Learn- ing and Knowledge Discovery in Databases, Springer Berlin Heidelberg, Berlin, Heidelberg, 2013, pp. 387–402

    2013

  16. [16]

    K. Yang, J. Liu, C. Zhang, Y. Fang, Adversarial examples against the deep learning based network intrusion detection systems, 2018, pp. 559– 564.doi:10.1109/MILCOM.2018.8599759

    arXiv 2018

  17. [17]

    D. Han, Z. Wang, Y. Zhong, W. Chen, J. Yang, S. Lu, X. Shi, X. Yin, Evaluating and improving adversarial robustness of machine learning- based network intrusion detectors, IEEE Journal on Selected Areas in Communications 39 (8) (2021) 2632–2647.doi:10.1109/JSAC.2021. 3087242

    work page doi:10.1109/jsac.2021 2021

  18. [18]

    Apruzzese, P

    G. Apruzzese, P. Laskov, E. Montes de Oca, W. Mallouli, L. Brdalo Rapa, A. V. Grammatopoulos, F. Di Franco, The role of ma- chine learning in cybersecurity, Digital Threats: Research and Practice 4 (1) (2023).doi:10.1145/3545574

    doi:10.1145/3545574 2023

  19. [19]

    Cortellazzi, E

    J. Cortellazzi, E. Quiring, D. Arp, F. Pendlebury, F. Pierazzi, L. Cav- allaro, Intriguing properties of adversarial ml attacks in the problem space [extended version], ACM Trans. Priv. Secur. 28 (4) (Sep. 2025). doi:10.1145/3742895. URLhttps://doi.org/10.1145/3742895

    doi:10.1145/3742895 2025

  20. [20]

    V.-H. Le, H. Zhang, Log parsing: How far can chatgpt go?, in: 2023 38th IEEE/ACM International Conference on Automated Software Engineer- ing (ASE), 2023, pp. 1699–1704.doi:10.1109/ASE56229.2023.00206

    arXiv 2023

  21. [21]

    M. Fu, C. K. Tantithamthavorn, V. Nguyen, T. Le, Chatgpt for vulner- ability detection, classification, and repair: How far are we?, in: 2023 30th Asia-Pacific Software Engineering Conference (APSEC), 2023, pp. 632–636.doi:10.1109/APSEC60848.2023.00085

    arXiv 2023

  22. [22]

    H. Ji, J. Yang, L. Chai, C. Wei, L. Yang, Y. Duan, Y. Wang, T. Sun, H. Guo, T. Li, C. Ren, Z. Li, Sevenllm: Benchmarking, eliciting, and enhancing abilities of large language models in cyber threat intelligence, ArXiv abs/2405.03446 (2024). URLhttps://api.semanticscholar.org/CorpusID:269605791 38

    Pith/arXiv arXiv 2024

  23. [23]

    Sharafaldin, A

    I. Sharafaldin, A. H. Lashkari, A. A. Ghorbani, Toward generating a new intrusion detection dataset and intrusion traffic characterization, in: International Conference on Information Systems Security and Privacy, 2018. URLhttps://api.semanticscholar.org/CorpusID:4707749

    2018

  24. [24]

    E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, A. A. Ghorbani, Ciciot2023: A real-time dataset and benchmark for large- scale attacks in iot environment, Sensors 23 (13) (2023).doi:10.3390/ s23135941. URLhttps://www.mdpi.com/1424-8220/23/13/5941

    2023

  25. [25]

    A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, C. Zheng, D. Liu, F. Zhou, F. Huang, F. Hu, H. Ge, H. Wei, H. Lin, J. Tang, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Zhou, J. Lin, K. Dang, K. Bao, K. Yang, L. Yu, L. Deng, M. Li, M. Xue, M. Li, P. Zhang, P. Wang, Q. Zhu, R. Men, R. Gao, S. Liu, S. Luo, T. ...

    Pith/arXiv arXiv 2025

  26. [26]

    Dubey, A

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan, A. Goyal, A. S. Hartshorn, A. Yang, A. Mitra, A. Sravankumar, A. Korenev, A. Hinsvark, A. Rao, A. Zhang, A. Rodriguez, A. Gregerson, A. Spataru, B. Rozière, B. M. Biron, B. Tang, B. Chern, C. lotte Caucheteux, C. Nayak, C. Bi, C. Marra, C. McConnell...

    2024

  27. [27]

    E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, LoRA: Low-rank adaptation of large language models, Inter- national Conference on Learning Representations (2022). URLhttps://openreview.net/forum?id=nZeVKeeFYf9

    2022

  28. [28]

    Carlini, D

    N. Carlini, D. Wagner, Towards evaluating the robustness of neural networks, in: 2017 IEEE Symposium on Security and Privacy, IEEE, 2017, pp. 39–57.doi:10.1109/SP.2017.49

    doi:10.1109/sp.2017.49 2017

  29. [29]

    T. Chen, C. Guestrin, XGBoost: A scalable tree boosting system, in: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Association for Computing Machinery, New York, NY, USA, 2016, pp. 785–794.doi:10.1145/ 2939672.2939785

    arXiv 2016

  30. [30]

    G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, T.-Y. Liu, LightGBM: A highly efficient gradient boosting decision tree, in: Advances in Neural Information Processing Systems, Vol. 30, 2017, pp. 3146–3154

    2017

  31. [31]

    Engelen, V

    G. Engelen, V. Rimmer, W. Joosen, Troubleshooting an intrusion de- tection dataset: the cicids2017 case study, in: 2021 IEEE Security and Privacy Workshops (SPW), 2021, pp. 7–12.doi:10.1109/SPW53761. 2021.00009

    arXiv 2021

  32. [32]

    R. Zhai, C. Dan, D. He, H. Zhang, B. Gong, P. Ravikumar, C.-J. Hsieh, L. Wang, MACER: Attack-free and scalable robust training via maxi- mizing certified radius, in: Proceedings of the International Conference on Learning Representations, 2020. URLhttps://openreview.net/forum?id=rJx1Na4Fwr 42

    2020