Ishita Soryan

Auditing unsupported claims in LLM-written intrusion alert explanations

Large language models (LLMs) are now used to explain intrusion-detection alerts, yet an explanation can sound confident while stating things the evidence does not support. We divide such statements into two tiers. Tier 1 covers unsupported specifics and Tier 2 covers background knowledge that is absent from the evidenc...