Autonomous OSS Threat Detection via Taxonomy-Aligned LLMs

arXiv:2610.01263 · cs.CR · Submitted 2026-10-01 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Autonomous OSS Threat Detection via Taxonomy-Aligned LLMs".

Elias: A taxonomy-aligned large language model framework for automated detection and classification of open source software (OSS) supply chain threats has been proposed,

Nadia: First, who's behind it and why it matters.

Title and authors: Nadia: Now we move into summarizing what this paper actually achieved in terms of its methodology and findings for "Autonomous OSS Threat Detection via Taxonomy-Aligned LLMs." Essentially, they laid out their plan to solve the problem and then showed us the results of applying that plan.

Elias: I'm ready for the breakdown of how they built that system, specifically focusing on the taxonomy and how they integrated it with GPT-four to tackle these evolving threats.

Priya: I'm hoping we can get a clear picture of the overall process, from gathering those nine hundred ninety-nine incidents all the way through to the final classification output. What’s their step-by-step approach?

Nadia: The paper starts by defining that structured AV-xxx threat taxonomy across five categories and then builds a curated dataset of nine hundred ninety-nine verified real-world OSS supply chain incidents from sources spanning two thousand eighteen to two thousand twenty-six.

Elias: So they aren't just using any text; they are grounding their entire experiment in these five specific buckets, which gives the model something concrete to learn from rather than just general language patterns.

Priya: That curated dataset is definitely a strength because it addresses the problem of having too much noisy data; it’s focused on actual supply chain events, not just random code snippets.

Nadia: Next, they implement taxonomy-aligned prompt engineering by creating a very specific instruction for GPT-four telling it exactly which categories to use and providing explicit semantic definitions for each AV category.

Elias: The instruction is quite strict—it demands that the model classify the incident into *exactly* one of those five labels and respond with only the label. That constraint is what we discussed earlier as being so important for limiting its output space.

Priya: So, this isn't just asking a question; it’s setting up a very rigid classification task where the model has to perform deep semantic understanding to pick the right bucket based on context clues.

Nadia: Precisely; it forces the LLM to look at what’s happening in the incident description and match it against those explicit definitions, which is how they claim it achieves high accuracy.

Elias: That ability to disambiguate between related attack vectors is key, especially for things like distinguishing a malicious build from pipeline poisoning because the prompt defines them clearly.

Priya: It sounds like the entire methodology hinges on that careful construction of the prompt and taxonomy, rather than relying on a model being inherently "smart" enough to guess what we want to hear.

Nadia: That’s what they are demonstrating; that by giving it the map, it can navigate to the correct location reliably across a wide variety of incident descriptions.

Elias: So they're effectively using the taxonomy as an external knowledge base and forcing the LLM to use it as its primary decision-making guide during classification.

Priya: And that brings us right up to what they found: a high classification accuracy rate of ninety-seven point zero percent across all five categories on their test set.

Nadia: That ninety-seven percent figure is what really stands out when you compare it against the other methods they compared, confirming the effectiveness of this taxonomy-aligned approach over traditional classifiers.

Elias: It’s a solid demonstration that domain expertise encoded into the prompt structure provides a substantial lift over general model capabilities when accuracy matters this much.

Priya: We have to remember that this high score is based on their specific, curated dataset and their very specific prompting strategy, so we need to keep an eye on how it performs when the input data shifts in the real world.

The paper's summary: Nadia: Now let's talk about what the authors suggest for improving this framework, as this is where we look at how they plan to take this from a successful experiment into something more robust and applicable. They don't stop at just getting a high score; they think about scaling the solution.

Elias: I’m interested in what kind of next steps they are suggesting—are we talking about expanding the dataset, or refining the prompt structure further?

Priya: I want to know if they suggest anything related to making this system more dynamic, perhaps something that keeps it updated as new threats emerge or changes in attack patterns become apparent.

Nadia: They suggest several areas for improvement, including expanding the dataset size substantially, aiming for five thousand or more verified incidents to make the foundation even stronger.

Elias: More data is always good for any machine learning project, but I’m curious if they are suggesting something more about how the model itself learns from new information over time.

Priya: I'm hoping they suggest a mechanism for continuous adaptation, because security threats aren't static; we need a system that can evolve with them.

Nadia: They propose developing real-time monitoring of package registry submissions as a way to get fresh data, and also incorporating multi-modal threat analysis to better handle complex cases.

Elias: Multi-modal analysis sounds interesting, suggesting they might look at things beyond just the text description—maybe looking at code structure or network flow if that helps differentiate between those tricky AV-four hundred and AV-four hundred ten incidents.

Priya: That multi-modal aspect is what I think will give us the real power to handle those high-confusion boundaries they flagged, which is a very practical direction for deployment.

Nadia: They also touched on the issue of fine-tuning, pointing out that with only seven hundred ninety-nine training examples, it wasn't enough to get competitive results when trying to adapt models like Llama three point one 8B in this specific domain.

Elias: That limitation is a clear signal that we shouldn't rely solely on scaling up the model size or fine-tuning; it points back to the necessity of that initial, high-quality, taxonomy-aligned foundation.

Priya: So, it seems the improvement direction isn't just about throwing more computing power at it; it’s about improving the data quality and making sure we can continuously feed new information into the system effectively.

Nadia: It sounds like the path forward involves a combination of expanding that high-quality dataset and building continuous monitoring pipelines to keep that knowledge fresh.

The paper's improvements: Nadia: So, to wrap up this discussion on "Autonomous OSS Threat Detection via Taxonomy-Aligned LLMs," we’ve seen how the team successfully used structured prompting and a curated dataset to get very strong classification results against traditional methods. The core finding is that giving the AI a clear taxonomy is significantly better than trying to just tune it up with standard fine-tuning for this task.

Elias: It seems the main implication for us is that we should prioritize designing these security tools around creating explicit, semantic frameworks first, because that structural guidance proves to be a more reliable path than chasing model scale alone.

Priya: I think the big picture impact is that we can move toward automated systems where initial threat triage isn't just reactive to known signatures but actively guided by a deep understanding of how different attacks relate to each other.

Nadia: Exactly; this research gives us a blueprint for building detection systems that can handle the complexity of modern supply chain attacks by systematically organizing the threat landscape into actionable categories.

Elias: We're looking forward to seeing those future works focusing on those real-time data feeds and multi-modal analysis, because that’s where the next big gains will likely come from in making these systems truly operational.

Priya: I just hope we see those real-time adaptations happen quickly, because having a static system is useless when the threat landscape changes every single day.

Nadia: That's what we're all waiting for; moving from a successful proof-of-concept to a continuously operating security tool that keeps up with the pace of these attacks.

Conclusion: Nadia: So, we’ve been looking at how they built this framework for autonomous OSS threat detection using taxonomy-aligned LLMs, and honestly, the results are pretty compelling when you look at the accuracy against those traditional machine learning baselines.

Elias: I agree with Nadia; that ninety-seven percent classification score is solid evidence that structuring the prompt around explicit semantic definitions really does give the AI a clear path to follow.

Priya: From my side, what truly stands out for me is how they handled those confusing boundaries between related attacks, like malicious builds versus pipeline poisoning; it shows the framework has some real depth in understanding the underlying mechanisms.

Nadia: It’s that deep understanding that makes a difference when we’re talking about security incidents in the wild, and I wonder if this kind of structured approach is something we can actually implement cheaply for smaller teams.

Elias: The methodology itself assumes a very precise taxonomy, so if you want to exploit this system, you'd need to understand the assumptions baked into those AV-xxx categories; otherwise, you just get garbage output.

Priya: I’m interested in what the data actually shows regarding privacy concerns; since they used real-world incidents from public advisories, it gives us a good feel for how these threats manifest without needing access to private systems.

Nadia: And that's exactly why it matters so much; we’re not just talking about theoretical models anymore, we’re talking about practical applications in securing open source software.

Elias: Looking ahead, their suggestion to expand the dataset is where things get interesting; if they can keep feeding it more verified incidents, the model’s ability to handle novel threats should keep improving.

Priya: I hope they eventually manage to move toward that continuous adaptation you mentioned earlier, because security isn't a one-time fix; it needs to evolve alongside the attackers.

Nadia: Absolutely; keeping that knowledge current is what keeps any detection system relevant in the long run.

Elias: Well, moving on from this paper, we’re going to shift gears completely and look at how other researchers are tackling those very hard problems of agent safety and privacy risk.

Md. Robiul Islam Niloy

BRAC University

cs.CR

Submitted: 2026-10-01

Updated: 2026-10-01

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 89/100

The gist: A taxonomy-aligned large language model framework for automated detection and classification of open source software (OSS) supply chain threats has been proposed, demonstrating that structured

Key concepts

AV-xxx Threat Taxonomy
This is a structured classification system with five specific attack categories: Typosquatting (AV-200), Trojan Source (AV-300), Malicious Builds (AV-400), Pipeline Poisoning (AV-410), and Dependency Confusion (AV-509). It was built by analyzing real security reports from 2018 to 2026, ensuring the classification system covers diverse, known OSS risks.
Taxonomy-Aligned Prompt Engineering
This involves giving an LLM a very strict instruction set. The prompt explicitly defines all five threat categories and tells the model to classify an incident into exactly one of them. This forces the model to use its knowledge precisely, ensuring it understands the subtle differences between related attacks.
Structured Prompt Constraint
The strategy uses a rigid prompt structure that restricts the LLM's output to only five valid category labels. This constraint prevents vague answers and ensures high precision in classification, allowing the model to correctly distinguish between closely related security incidents like malicious builds versus pipeline poisoning.
Comparative Evaluation Protocol
The framework's performance was tested against several baselines, including simple random classifiers and various TF-IDF models. It also compared the GPT-4 approach against other LLMs (Mistral 7B) and fine-tuned neural networks (Llama 3.1), proving that taxonomy alignment is the crucial factor for success, not just model complexity.

Terminology

Summary

A taxonomy-aligned large language model framework for automated detection and classification of open source software (OSS) supply chain threats has been proposed, demonstrating that structured prompting significantly outperforms traditional machine learning approaches in classifying diverse OSS security incidents.

The Gist

Using taxonomy-aligned prompt engineering with GPT-4, the framework achieves 97.0% multi-class classification accuracy and 97.0% macro F1 score across five threat categories, outperforming all evaluated methods by a substantial margin.

Dataset Construction and Taxonomy

The research introduces a structured AV-xxx threat taxonomy covering five attack categories: AV-200 (Typosquatting), AV-300 (Trojan Source), AV-400 (Malicious Builds), AV-410 (Pipeline Poisoning), and AV-509 (Dependency Confusion). This taxonomy was constructed based on analysis of real-world incident patterns documented in GitHub Security Advisories, CISA alerts, and security research reports spanning 2018 to 2026. The dataset consists of 999 verified real-world OSS supply chain incidents sourced from multiple package ecosystems including npm, PyPI, RubyGems, Cargo, Maven, Go modules, Docker, and VS Code Extensions. The dataset exhibits a near-uniform class distribution ranging from 18.5% to 22.4% across the five categories.

Taxonomy-Aligned Prompt Engineering Strategy

The classification approach utilizes instruction-tuned LLMs guided by a taxonomy-aligned system prompt that provides explicit definitions of all five attack categories. The prompt is strictly structured: "You are an expert in open source software supply chain security. Classify the following security incident into exactly one of these categories: AV-200 (Typosquatting), AV-300 (Trojan Source), AV-400 (Malicious Builds), AV-410 (Pipeline Poisoning), AV-509 (Dependency Confusion). Respond with only the category label. This strategy constrains the model output space to exactly five valid labels and provides explicit semantic definitions of each category, enabling the model to disambiguate between related attack vectors."

Comparative Evaluation Protocol

The framework is evaluated against a comprehensive set of baselines using 5-fold stratified cross-validation on the full 999-entry dataset. The methods compared include:

  1. Random Classifier

  2. Majority Class

  3. TF-IDF + Naïve Bayes (using unigram and bigram features)

  4. TF-IDF + Logistic Regression (using sublinear term frequency scaling and l2-regularized Logistic Regression)

  5. TF-IDF + LinearSVC (using a Linear Support Vector Classifier)

Additionally, the study compares the framework against:

** One zero-shot open source LLM: Mistral 7B, evaluated via the same taxonomy-aligned prompt on a stratified sample of 200 incidents.**

** Two fine-tuned neural models: Llama 3.1 8B (fine-tuned using QLoRA) and SecRoBERTa (fine-tuned using standard sequence classification).**

Experimental Results and Key Findings

The GPT-4 taxonomy-aligned approach achieved 97.0% accuracy and 97.0% macro F1 score, significantly outperforming all evaluated methods. A critical finding is that fine-tuned Llama 3.1 8B (70.5%) and SecRoBERTa (77.5%) both underperform simple TF-IDF classifiers (82.3%), while Mistral 7B without taxonomy alignment achieves only 65.7%. This confirms that taxonomy-aligned prompting rather than model scale, domain pretraining, or fine-tuning is the critical factor enabling high classification accuracy. Error analysis showed that classification challenges concentrate at the boundary between semantically related attack categories particularly AV-400 (Malicious Builds) and AV-410 (Pipeline Poisoning). Qualitative analysis illustrated that LLM reasoning correctly identified the attack vector in complex cases, such as distinguishing between a malicious package installation (AV-400) and a compromised GitHub Action workflow component (AV-410).

Limitations and Future Work

The study notes limitations, including the reliance on a proprietary GPT-4 model whose performance may change over time, the dataset's focus on retrospective incidents rather than real-time detection, and the finding that 799 training examples are insufficient for competitive LLM fine-tuning in this domain. Future work is directed toward expanding the dataset to 5,000 or more verified incidents, developing real-time monitoring of package registry submissions, and incorporating multi-modal threat analysis to improve classification at the AV-400 and AV-410 boundary.

Improvements for AI systems

Here are specific improvements to AI systems derived from this research, categorized by capability:

)Improvement 1: Taxonomy-Aligned Threat Classification System (Core Capability)

The improved system will be a multi-stage pipeline utilizing the GPT-4 taxonomy-aligned prompt engineering strategy.

Aspect Specific Improvement What the Improved System Can Do

:---:---:---

Classification Accuracy & Precision Replace generic text classification or simple keyword matching with a structured prompt that forces the LLM to select one of five semantically defined categories (AV-200 to AV-509). Accurately classify OSS supply chain threats with 97.0% accuracy, specifically distinguishing between closely related attacks like Malicious Builds (AV-400) and Pipeline Poisoning (AV-410), based on the underlying attack mechanism rather than surface keywords.

Contextual Reasoning Implement a reasoning layer that explicitly prompts the LLM to analyze the relationship between elements in an incident description to determine if it represents package naming (AV-200), code obfuscation (AV-300), installation hooks (AV-400), CI/CD components (AV-410), or registry resolution priority (AV-509). Correctly resolve high-confusion boundaries identified in the baseline, such as correctly identifying a GitHub Action compromise as AV-410 instead of AV-400, demonstrating semantic understanding that keyword matching fails to capture.

Generalization across Ecosystems Adapt the taxonomy and prompt structure to handle varied package ecosystems (npm, PyPI, Maven, Cargo) by incorporating ecosystem context into the prompt instructions. Apply threat detection logic consistently across disparate package managers with distinct naming conventions and attack patterns, improving detection robustness in heterogeneous environments.

)Improvement 2: Automated Threat Intelligence Pipeline (Data-Driven Capability)

The improved system will integrate the curated dataset and data collection methodology into a continuous monitoring framework.

Aspect Specific Improvement What the Improved System Can Do

:---:---:---

Dataset Curation & Verification Automation Build an automated ingestion pipeline that ingests raw data from GitHub Security Advisories, CISA alerts, and vendor blogs. This pipeline must include a verification module (manual or semi-automated) to confirm the incident's authenticity and assign the correct AV-xxx label. Proactively build a growing, verified dataset of real-world incidents in near real-time, ensuring the training data remains high-fidelity and reflects current threat landscapes (2018–2026).

Continuous Model Retraining/Adaptation Establish a mechanism to periodically retrain or update the taxonomy-aligned LLM using new verified incidents. This addresses the limitation that fine-tuning on small sets (799 examples) underperforms traditional methods. Maintain state-of-the-art classification performance by leveraging larger, continuously updated datasets, overcoming the bottleneck observed in current fine-tuning experiments and ensuring the model stays relevant to emerging attack vectors.

Boundary Analysis & Error Reporting Implement an automated system that flags incidents where the LLM's prediction confidence is low or where a human expert review (or a secondary, more specialized model) is triggered due to high confusion between AV-400 and AV-410. Provide actionable feedback to security analysts by highlighting borderline cases requiring deeper manual investigation, significantly reducing false positives in automated triage.

)Improvement 3: Enhanced Model Selection Strategy (Efficiency Capability)

The improved system will incorporate a dynamic model selection mechanism based on the incident type and required performance level.

Aspect Specific Improvement What the Improved System Can Do

:---:---:---

Hybrid Detection Triage Layer Deploy a triage layer that first runs a fast, simple TF-IDF baseline classifier. If the confidence score is low or if the incident involves highly distinctive textual patterns (like AV-300 Unicode characters), it routes the incident to the high-accuracy GPT-4 taxonomy model for definitive classification. Optimize resource usage by using lightweight models for high-confidence, easy cases while reserving expensive, high-reasoning LLMs only for complex or ambiguous supply chain incidents where semantic understanding is critical.

Model Performance Monitoring Continuously monitor the performance delta between the current production LLM and a newly fine-tuned open-source model (Llama/SecRoBERTa) on a held-out validation set. Automatically trigger alerts when a new, more efficient open-source model surpasses the performance of the proprietary GPT-4 approach, enabling strategic migration and reducing reliance on external APIs while maintaining high security standards.

Abstract

Open source software (OSS) ecosystems face growing threats from sophisticated supply chain attacks including typosquatting, dependency confusion, Trojan Source obfuscation, malicious build injection, and CI/CD pipeline poisoning. Existing detection approaches rely on signature-based tools and rule-based systems that struggle to generalize across attack variants and emerging threat patterns. In this paper we propose a taxonomy-aligned large language model framework for automated detection and classification of OSS supply chain threats. We introduce a structured AV-xxx threat taxonomy covering five attack categories and construct a curated dataset of 999 verified real-world OSS supply chain incidents sourced from GitHub Security Advisories, CISA alerts, and security research reports spanning 2018 to 2026. Using taxonomy-aligned prompt engineering with GPT-4, our framework achieves 97.0% multi-class classification accuracy and 97.0% macro F1 score across all five threat categories. Comparative evaluation against five traditional machine learning baselines, one zero-shot open source LLM, and two fine-tuned neural models reveals a surprising finding: fine-tuned Llama 3.1 8B (70.5%) and SecRoBERTa (77.5%) both underperform simple TF-IDF classifiers (82.3%), while Mistral 7B without taxonomy alignment achieves only 65.7%. These results confirm that taxonomy-aligned prompting rather than model scale, domain pretraining, or fine-tuning is the critical factor enabling high classification accuracy. Our dataset and code are publicly available to support reproducible supply chain security research.

Sources

Related papers