DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense

arXiv:2607.24348 · cs.CR, cs.AI · Submitted 2026-07-27 · Read on arXiv

Trung V. Phan, Tri Gia Nguyen, Thomas Bauschert

cs.CR, cs.AI

Submitted: 2026-07-27

Comments: This paper has been submitted to the IEEE International Conference on Network and Service Management (CNSM) 2026

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Verification — 20× in this paper · explained in 2 episodes
• Provenance — 17× in this paper · explained in 3 episodes
• Grounding — 15× in this paper · explained in 3 episodes
• Consistency — 14× in this paper · explained in 3 episodes
• Explainability — 10× in this paper · explained in 3 episodes
• Temporal consistency — 10× in this paper · explained in 2 episodes
• Reinforcement Learning — 9× in this paper · explained in 4 episodes
• Advanced Persistent Threat — 7× in this paper
• Alignment — 7× in this paper · explained in 1 episode
• Hallucination — 6× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 4× in this paper · explained in 6 episodes
• Interpretability — 3× in this paper · explained in 15 episodes
• Regularization — 3× in this paper · explained in 3 episodes
• Structured Prompting — 3× in this paper · explained in 2 episodes
• Ablation — 2× in this paper · explained in 1 episode
• Deep Reinforcement Learning — 2× in this paper · explained in 2 episodes
• GNNs — 2× in this paper · explained in 2 episodes
• Graph Construction — 2× in this paper · explained in 3 episodes
• Graph Neural Networks (GNNs) — 2× in this paper · explained in 7 episodes
• Human-in-the-Loop — 2× in this paper · explained in 3 episodes
• Reinforcement Learning (RL) — 2× in this paper · explained in 25 episodes
• Representation Learning — 2× in this paper · explained in 2 episodes
• Robustness — 2× in this paper · explained in 5 episodes
• Ablation study — 1× in this paper · explained in 1 episode
• Accuracy — 1× in this paper · explained in 1 episode
• Adaptive Response — 1× in this paper · explained in 1 episode
• Chain-of-Thought (CoT) — 1× in this paper · explained in 4 episodes
• Chain-of-Thought (CoT) Prompting — 1× in this paper · explained in 3 episodes
• Chain-of-Thought Prompting — 1× in this paper · explained in 2 episodes
• Cognitive Load — 1× in this paper · explained in 2 episodes
• Cumulative Unsupported Claims — 1× in this paper
• Embeddings — 1× in this paper · explained in 2 episodes
• Epistemic Uncertainty — 1× in this paper · explained in 9 episodes
• Evidence Coverage Ratio — 1× in this paper
• Explainable AI (XAI) — 1× in this paper · explained in 7 episodes
• Fine-Tuning — 1× in this paper · explained in 5 episodes
• Knowledge Graph — 1× in this paper · explained in 7 episodes
• Knowledge graphs — 1× in this paper · explained in 2 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Temporal Reasoning — 1× in this paper · explained in 2 episodes
• Unified Framework — 1× in this paper · explained in 5 episodes
• Unsupported Claim Rate — 1× in this paper

Sources

• DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns
• DeepXplain: XAI-Guided Autonomous Defense Against Multi-Stage APT Campaigns
• Large Language Models for Security Operations Centers: A Comprehensive Survey
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• Qwen2.5 Technical Report
• Gemma: Open Models Based on Gemini Research and Technology
• The Llama 3 Herd of Models
• The Falcon Series of Open Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs