When AI Investigators Cannot Trust Their Tools: Conflict-Aware Evidence Verification for Cyber Threat Investigation

When AI Investigators Cannot Trust Their Tools: Conflict-Aware Evidence Verification for Cyber Threat Investigation Yuchen Zhang

arXiv:2610.41191v1 [cs.CR] 30 Oct 2026

Khoury College of Computer Sciences, Northeastern University Seattle, WA, USA zhang.y19@northeastern.edu

Abstract—LLM agents increasingly triage security alerts by combining the outputs of several detection tools, implicitly treating those tools as trustworthy. Unlike prior work on conflicts between a model’s knowledge and its context, we study conflicts among the tools themselves: what happens when this machine-generated evidence is conflicting or wrong. On the corrected CIC-IDS2017 dataset, four heterogeneous detectors emit labels and confidences that we corrupt under a threat model varying the number of corrupted tools, the persistence of the corruption, and the confidence attached to wrong outputs. Across open-weight LLMs from 3B to 14B parameters, unverified investigators are fragile: one corrupted detector out of four lowers naive accuracy to .50–.72, three lower every unverified investigator to .13 or less, and honest disagreement alone makes them abstain on up to 63% of flows. We propose Conflict-Aware Evidence Verification (CAV), built from established components: an equal-weight vote that ignores reported confidences, an evidence-conflict gate, and an independent nearest-neighbour trust check that tests the leading candidates. With its prompt frozen before testing, CAVLLM improves on the naive investigator in every corrupted condition (p < 0.001), reaching .84–.88 with three corrupted detectors against at most .08, while calling the LLM on 0.4% of clean traffic. A fixed verification rule is as accurate or better unless most tools are corrupted. When we make the independent channel itself noisy, CAV inherits its errors: it stays ahead when two or more tools are corrupted, but adding the channel as an extra voter is better when at most one is. Verification thus moves trust from the tools to the check, which must be measured and protected in turn. Index Terms—LLM agents, cyber threat intelligence, intrusion detection, evidence conflict, robustness, selective prediction

1. Introduction

This design assumes that the tools are trustworthy. In practice, detectors disagree, degrade under drift [4], and can be misconfigured, poisoned, or compromised. Because their outputs enter the agent’s context, they are also an attack surface [5]. LLMs are known to adopt contradicting context over their own knowledge [6] and to defer to confident assertions [7]. We therefore ask: when an AI investigator receives conflicting or unreliable machine-generated evidence, does it identify the unreliable evidence, or propagate it into the final threat assessment? Existing work frames evidence conflict for LLMs as a conflict between what a model knows and what it reads [6], [8], or between retrieved documents of unknown reliability [9]. Tool-mediated investigation is a different regime, which we call inter-tool conflict. The agent has essentially no prior about an individual flow, so its verdict is decided entirely by how it reconciles the tools; each source is a predictor with a measurable error rate, so a principled answer exists (Dawid–Skene estimation [10], weak supervision [11], truth discovery [12]); and the confidence attached to each claim is itself an attack surface. LLMs over-trust a single faulty tool [13], but to our knowledge no prior work measures how they resolve conflicts among several corrupted tools, or compares them with the statistical aggregators built for this problem. We present a controlled study of this behaviour and a lightweight mitigation; we do not propose a new detector. We instrument the evidence layer between four heterogeneous detectors and the investigating agent on the corrected CIC-IDS2017 dataset [14], [15], corrupt a controlled share of the evidence, and ask how robust LLM investigators are (RQ1), how much the confidence a tool reports influences them (RQ2), whether conflict-aware verification helps, also when the independent evidence is itself noisy (RQ3), and at what cost (RQ4). Our contributions are: 1)

Security operations centers (SOCs) face alert volumes in which most alarms are false positives [1], and LLM agents are now being placed in the loop to triage alerts and draft assessments [2], [3]. Such an agent rarely inspects raw traffic. It reasons over machine-generated evidence: the labels and confidences emitted by intrusion detection systems, classifiers, and anomaly detectors.

2)

a threat model and testbed for inter-tool evidence conflict in AI-assisted threat investigation that separates the number, persistence, and confidence of corrupted tool outputs (Sections 3–4); a controlled evaluation of open-weight LLM investigators (3B–14B) against statistical aggregators, showing that they over-escalate honest disagreement, follow corrupted majorities, and are paralysed

3)

rather than persuaded by confidently wrong tools; Conflict-Aware Evidence Verification (CAV), built entirely from established components, which improves accuracy in every corrupted condition while calling the LLM on 0.4% of clean traffic, with an ablation showing that a leaner variant is stronger, a failure analysis tracing the remaining errors to misread evidence, and a first test with a degraded independent channel (Sections 5–7).

2. Related Work LLMs for threat analysis. Benchmarks evaluate LLM knowledge and reasoning on threat intelligence [16] and agents that investigate incidents over security logs [3]. Multiagent systems triage SOC alerts [2], and agents also perform offensive tasks such as penetration testing [17], and contentgrounded agents answer from supplied literature [18]. These works typically assume that their inputs are correct. Untrusted context. Indirect prompt injection hijacks tool-using agents through adversarial instructions [5], [19]. Our threat model is quieter: corrupted tools inject no instructions, only plausible but wrong data, so instructionlevel defences do not apply; memory-based attacks likewise evade such detectors [20]. LLMs often accept silently wrong outputs of a single faulty tool [13]. We study several tools that contradict one another. Research on knowledge conflicts distinguishes context–memory, inter-context, and intra-memory conflicts [9]. LLMs readily adopt incorrect retrieved context, especially when their prior is weak [6], [8], and defer to confident assertions [7]. Unlike free-text documents, our sources are predictors with measurable error rates and an attackable confidence field. Combining and verifying unreliable sources. Dawid– Skene [10], weak supervision [11], and truth discovery [12] estimate per-source error rates from agreement, and log-odds weights are optimal for independent sources of known accuracy [21]. Score-level fusion, e.g., for fraud detection [22], assumes that every member reports honestly, and aggregation of multiple LLMs exploits their correlation [23]. We study the reverse configuration, in which an LLM aggregates detectors whose corrupted errors are maximally correlated. Whether to trust a prediction can be checked against nearby training data [24], and selective classification trades coverage for risk [25]. We place an LLM in the aggregator’s position, measure how far it departs from these principled rules, and reuse them as the backbone of CAV.

3. Threat Model System model. A flow x with true family y ∈ Y is analysed by D detectors. Detector d has output space Od , either Y or {BENIGN, ANOMALOUS}, and emits an evidence tuple ed = (od , cd , πd ): output, reported confidence, and provenance (detector type and training data). An investigator maps the evidence set E(x), optionally with verification context, to a verdict ŷ ∈ Y ∪ {ABSTAIN}, where ABSTAIN escalates to a human analyst.

Corruption. A corruption picks a subset S of k detectors and replaces their outputs with a common wrong family { BENIGN if y ̸= BENIGN, (1) ỹ(x) = a ∼ U (Y \ {BENIGN}) if y = BENIGN, mapped into each detector’s output space. The first case models a missed detection, the second a false alarm. Because only tool outputs change, this models compromised, misconfigured, poisoned, or drifting tools. It does not model traffic-level evasion, which perturbs the flow itself and hence also the raw features that our independent channel reads (Section 8). A shared wrong label is the hardest case for consensus. Under matched confidence, cd is drawn from detector d’s confidences on flows it classifies correctly, so the corruption is invisible in the confidence. Under injected confidence, cd is fixed to c ∈ {0.5, . . . , 0.99}. Under persistent scope, the same S is corrupted for a block of flows, modelling a compromised or drifting tool. Under sporadic scope, S is drawn per flow, modelling transient faults. Assumptions and goals. The adversary controls what tools report, but not the raw telemetry, provenance metadata, or the investigator’s instructions. The corruption is nonadaptive. We first assume clean labelled reference data and then relax this by corrupting the reference labels (Section 6). An investigator should not propagate corrupted evidence. We measure the follow rate, the fraction of corrupted flows whose verdict equals the injected label, together with accuracy (abstentions count as errors) and coverage.

4. Experimental Testbed Dataset. We use the corrected release [15] of CICIDS2017 [14], which fixes labelling and feature-extraction errors of the original. We drop payload-less attempted flows and group labels into six families: BENIGN, DOS, DDOS, PORTSCAN, BRUTEFORCE (FTP/SSH-Patator), and BOT. Heartbleed, Infiltration, and web attacks (104 nonattempted flows) are too rare for per-family evaluation. After removing identifier and time columns, invalid values, and constant columns, and de-duplicating before splitting, 1,790,909 flows with 82 features remain. We split them 60/20/20 with stratification and cap training data at 300,000 flows per family. Validation data serve calibration, reliability estimation, thresholds, and prompt piloting; all results use the test split. We use a random split: CIC-IDS2017 runs each attack family on a single day, so a split by day removes whole families, and a chronological split within a family, common in fraud detection [26], [27], tests little drift, since each attack lasts 20 minutes to 7 hours and comes from one tool. Detectors. D1 is a random forest [28] (100 trees) and D2 XGBoost [29] (300 rounds, depth 8), both multi-class. D3 is an Isolation Forest [30] trained on benign flows only, with outputs BENIGN/ANOMALOUS. D4 is a rule-based IDS: a depth-4 decision tree (at least 200 flows per leaf) whose leaves read as signatures, standing in for signature engines

that would require raw packet captures. All probabilities are calibrated by temperature scaling [31]. Test accuracies are .99997 (D1), .99998 (D2), .813 (D3), and .993 (D4). The family-level detectors disagree on 0.67% of test flows. Evidence and sampling. Each condition corrupts a fixed, family-balanced batch of up to 5,000 test flows, which batch-level estimators use. Statistical aggregators and CAV are evaluated on 420 flows per condition (70 per family). The unverified LLM investigators were run on the first 35 flows per family (210 flows), a subset of the 420. All comparisons use paired exact McNemar tests on shared flows; we report 95% bootstrap intervals. LLM investigators. All LLMs run locally through Ollama with 4-bit weights. Main models are Qwen2.5-7BInstruct [32] and Llama-3.1-8B-Instruct [33], plus Qwen2.53B and -14B for the scale analysis. Decoding uses temperature 0, a fixed seed, and a JSON schema restricting the verdict to Y ∪ {ABSTAIN}. Naive receives the evidence table (tool, provenance, output, reported confidence) and a family glossary. CoT additionally reasons step by step [34]. CAVLLM receives the verification context of Section 5.

5. Conflict-Aware Evidence Verification CAV sits between the detectors and the investigator (Fig. 1). Every step is an established technique. The contribution is their composition: reported confidences are ignored, conflict is quantified explicitly, and only conflicting flows are verified, against evidence the tools cannot influence. We present the lean variant used as our main system. The submitted version (full CAV) also weighted tools by estimated reliability and showed SHAP features; Section 6 shows that both additions hurt. Candidates and conflict. Let κd (y) = 1 if output od is consistent with family y . For the binary detector, ANOMALOUS is consistent with every attack family. The support and conflict are 1 ∑ s(y) = κd (y), C(x) = 1 − max s(y), (2) y D d

i.e., the variation ratio. The aggregate verdict ȳ(x) is the plurality vote, with the binary vote split over attack families. Reported confidences enter neither, because a corrupted tool controls them. Measured reliability. For each detector we estimate a confusion matrix Md [k, o] = P (od =o | y=k) on the validation split. Because a tool may be compromised later, we re-estimate Md on each unlabelled analysis window with MAP Dawid–Skene EM [10], using a Dirichlet prior centred on the validation estimate (50 pseudo-flows per class). Lean CAV only reports these estimates to the LLM. Full CAV also used them in (2), with log-odds weights accd wd = clip(log 1− accd , 0, 8), which are optimal for independent voters [21], and took ȳ(x) from the EM posterior. EM cannot identify the honest side when at least half of the tools are corrupted in the same way, and our analysis windows coincide with the corruption blocks, the most favourable setting for it.

Independent check. All of the above depends on tool outputs, so CAV adds the trust score [24], computed from raw features that the corruption does not touch: miny′ ̸=y dist(x, Xy′ ) T (x, y) = , (3) dist(x, Xy ) where Xy holds up to 20,000 training flows of family y (features log-scaled and standardised). T (x, y) > 1 means x lies closer to known flows of y than to any other family. T does not vote; it tests the tools’ candidates. Gate and decision. A flow is escalated if C(x) > τ , if arg maxy T (x, y) ̸= ȳ(x), or if T (x, ȳ(x)) < 1. Otherwise it receives ȳ(x) without an LLM call. We use τ = 0.25, fixed on validation data before testing, so that a single dissenting tool does not escalate a flow. On clean validation traffic this escalates 0.4% of flows. On the test conditions, CAV-rule’s decisions are identical for all τ ∈ {0, . . . , 0.5}, so τ only affects cost. Escalated flows are resolved in one of two ways: • CAV-rule returns whichever of the two most probable families has the higher trust score, if that score exceeds 1, and ABSTAIN otherwise. • CAV-LLM receives, per detector, the output, the reported confidence, its validated precision, and its re-estimated accuracy. It also receives C(x) and the trust scores of the candidates stated in plain language. Full CAV adds the top-5 SHAP features [35] of D2 for the two leading candidates. The instructions (prompt v2, frozen before testing) state that tool agreement is not proof, that reported confidence is not reliability, and that the nearest-neighbour check is independent of all tools. The context deliberately omits the posterior P (y | E(x)). In a validation pilot, showing it made the agent follow a corrupted majority on nearly every flow with three corrupted tools. Post-hoc prompt revision (v3). The failure analysis (Section 7) showed that full CAV-LLM with prompt v2 often misread the trust scores. We revised the prompt once. It was motivated by test-set failures but designed on validation data only, so we report it separately and base no main claim on it. The check is stated categorically (“RESULT: supports DoS”; each candidate SUPPORTED or NOT SUPPORTED), and the JSON schema requires the model to restate the supported family before its verdict. Baselines. We compare against majority vote (the binary vote split over attack families, ties broken at random), confidence-weighted vote, which trusts reported confidences, reliability-weighted (naive-Bayes) vote under M val , and Dawid–Skene alone. To test whether CAV adds anything beyond access to the independent channel, + kNN adds the nearest training family arg maxy T (x, y) to the reliabilityweighted vote as a fifth, uncorrupted voter.

6. Experiments The main experiment crosses k ∈ {0, 1, 2, 3} corrupted detectors with both scopes under matched confidence (Table 1); we report every condition separately, since aggregate

Threat model: corrupt (od , cd ) of k tools

Verdict ȳ(x) (no LLM call)

D1 RF no Network flow x

D2 XGBoost D3 IForest

Evidence table ed = (od , cd , πd )

Conflict C(x) = 1−maxy s(y)

Equal-weight vote ⇒ ȳ(x), candidates (confidences ignored)

Escalate? yes

D4 Rules Trust score T (x, y) on raw flow features (independent of all tools)

Verify: CAV-rule or CAV-LLM (trust, measured reliability) ⇒ verdict or ABSTAIN

Figure 1. Conflict-Aware Evidence Verification. Lean CAV ignores reported confidences, derives candidates and conflict C(x) from an equal-weight vote, and escalates a flow if C(x) > τ or the independent trust score (green), computed from raw features the tools cannot influence, disagrees with the vote. CAV-rule or CAV-LLM resolves escalated flows and may abstain.

scores can hide regime-dependent failures [36] and violations of the task’s logic [37]. Across all experiments, LLM investigators produced 33,652 test verdicts, all of which parsed under the JSON schema.

(a) Abstention rate

(b) Follow rate

0.6

0.6

0.4

0.4

0.2

0.2

6.1. RQ1: Robustness of LLM Investigators Unverified LLM investigators are fragile. One corrupted detector reduces Naive accuracy to .64–.72 (Qwen-7B) and .50–.54 (Llama-8B). With three corrupted detectors, every unverified LLM falls to .13 or below. CoT helps Llama-8B at k=1 (.86–.88) but raises the follow rate at k=3 (.50–.61 versus .39–.52). At k ≤ 2, unverified LLMs mostly abstain rather than follow (follow rate ≤ .19; Naive coverage at k=2 .23–.50); at k=3, about half of the corrupted flows receive the corrupted label. Corruption is not even needed. On 300 test flows where the honest detectors disagree, reliability-weighted voting, Dawid–Skene, and CAV-rule are at least .99 accurate. Naive Llama-8B, however, abstains on 63% of these flows (accuracy .37), and CoT lowers its accuracy to .23. At the 0.67% disagreement rate, a naive LLM investigator would escalate about 2,400 easily resolved flows per day of this traffic [1].

6.2. RQ2: Influence of Reported Confidence We fix one corrupted detector (k=1, sporadic) and vary only its reported confidence (Fig. 2). No model adopts the wrong label more often as confidence rises (follow rate ≤ .09). Confidence instead drives abstention. Qwen7B abstains on 1% of flows at 0.5, on 13% at 0.99, and on 25–34% under matched confidence, where corrupted outputs carry near-certain confidences. Scale does not help: Qwen14B abstains more than Qwen-7B at every level (29–48%). A lone confidently wrong tool thus paralyses rather than persuades these investigators. CAV-LLM is insensitive to the injected confidence (abstention 5–7%, follow rate ≤ .03).

6.3. RQ3: Conflict-Aware Verification Lean CAV-LLM, with the prompt frozen before testing, improves over the Naive investigator of the same model

0.0

0.0 0.5

0.7

0.9 .99

0.5

Injected confidence Naive Qwen-3B

Naive Qwen-14B

Naive Qwen-7B

Naive Llama-8B

0.7

0.9 .99

Injected confidence CAV-LLM Qwen-7B

Figure 2. Confidence injection (k=1, sporadic). (a) Abstention rises with the confidence of the wrong detector; larger models do not abstain less. (b) No investigator adopts the wrong label at a meaningful rate.

in every corrupted condition (exact McNemar on the 210 shared flows, p < 0.001 for all 12 pairs). With three corrupted detectors it reaches .87–.88 (Qwen-7B) and .84 (Llama-8B), against at most .08 for Naive, and it adopts the injected label on at most .005 (Qwen) and .08 (Llama) of corrupted flows. Lean CAV-rule never adopts a corrupted label and is perfect up to k=2. At k=3 it abstains when the trust score supports neither leading candidate, and its accuracy falls to .83/.80. The LLM is significantly less accurate than the rule at k=2 (−.08 to −.11, p < 0.001), where it abstains on 5–8% of flows. Only at k=3 does it help: Qwen gains +.04 (p=0.13, persistent) and +.08 (p=0.004, sporadic), while Llama’s gains (+.01, +.04) are not significant. With a perfect independent channel, the LLM therefore adds value over a fixed rule only when most tools are corrupted. Lean versus full. Removing reliability weighting and SHAP features helps wherever two or more tools are corrupted. On the 210 shared flows the rule gains .22 at k=2 and .37 at k=3 persistent, and the LLM gains .06–.32 in 7 of the 8 model–condition pairs with k ≥ 2 (p < 0.05). On

TABLE 1. ACCURACY (FOLLOW RATE IN PARENTHESES); k OF 4 DETECTORS CORRUPTED, MATCHED CONFIDENCE; ABSTENTIONS COUNT AS ERRORS; BEST PER COLUMN IN BOLD. STATISTICAL ROWS AND LEAN CAV (MAIN SYSTEM): 420 FLOWS PER CONDITION (95% CI HALF-WIDTH ≤ .05); NAIVE, COT, FULL CAV (SUBMITTED VERSION), AND POST-HOC V3: 210-FLOW SUBSET (≤ .07).

k=0

k=1

k=2

k=3

Investigator

clean

pers.

spor.

pers.

spor.

pers.

spor.

Majority vote Confidence-weighted vote Reliability-weighted vote Dawid–Skene

1.00 1.00 1.00 1.00

.71 (.29) .99 (.01) .98 (.02) 1.00 (.00)

.72 (.28) .99 (.01) .98 (.02) .87 (.13)

.31 (.69) .45 (.55) .53 (.47) .45 (.55)

.28 (.72) .46 (.54) .55 (.45) .84 (.16)

.00 (1.00) .00 (1.00) .07 (.93) .00 (1.00)

.00 (1.00) .00 (1.00) .07 (.93) .00 (1.00)

Reliability-weighted + kNN kNN alone (reference)

1.00 1.00

1.00 (.00) 1.00 (.00)

1.00 (.00) 1.00 (.00)

.86 (.10) 1.00 (.00)

.87 (.09) 1.00 (.00)

.53 (.41) 1.00 (.00)

.54 (.42) 1.00 (.00)

Naive (Qwen-7B) Naive (Llama-8B) CoT (Qwen-7B) CoT (Llama-8B)

1.00 .97 1.00 .99

.72 (.02) .50 (.00) .69 (.05) .88 (.01)

.64 (.02) .54 (.00) .69 (.11) .86 (.00)

.29 (.19) .16 (.07) .32 (.30) .35 (.19)

.34 (.17) .21 (.10) .39 (.24) .42 (.17)

.07 (.49) .00 (.39) .13 (.56) .02 (.50)

.08 (.52) .00 (.40) .10 (.61) .02 (.56)

Lean CAV-rule Lean CAV-LLM (Qwen-7B) Lean CAV-LLM (Llama-8B)

1.00 1.00 1.00

1.00 (.00) 1.00 (.00) 1.00 (.00)

1.00 (.00) 1.00 (.00) 1.00 (.00)

1.00 (.00) .91 (.00) .90 (.04)

1.00 (.00) .92 (.00) .89 (.04)

.83 (.00) .87 (.00) .84 (.08)

.80 (.00) .88 (.00) .84 (.06)

Full CAV-rule Full CAV-LLM (Qwen-7B) Full CAV-LLM (Llama-8B)

1.00 1.00 1.00

1.00 (.00) 1.00 (.00) 1.00 (.00)

.94 (.00) .91 (.02) .88 (.04)

.77 (.00) .77 (.21) .85 (.10)

1.00 (.00) .87 (.01) .91 (.07)

.45 (.00) .55 (.43) .72 (.25)

.82 (.00) .78 (.12) .74 (.19)

Full CAV-LLM v3 (Qwen-7B) Full CAV-LLM v3 (Llama-8B)

1.00 1.00

1.00 (.00) 1.00 (.00)

1.00 (.00) .96 (.00)

1.00 (.00) .94 (.00)

1.00 (.00) .96 (.01)

1.00 (.00) .95 (.00)

1.00 (.00) .99 (.00)

(a) k = 1

(b) k = 2

(c) k = 3

1.0

Accuracy

validation data, the lean rule is at least as accurate as the full rule in six of seven conditions, so the choice does not rest on test data alone. An ablation of full CAV at k=2 persistent locates the gain: removing reliability weights raises the rule from .77 to 1.00, because weighting prunes the true family from the candidates (Section 7); removing SHAP raises the LLM from .77 to .96; removing the trust score drops both to .42. The lean LLM is not better than removing SHAP alone (.90/.93 versus .96/.94), so the rule drives the lean choice. Verification versus an extra voter. The nearestneighbour signal as a fifth voter makes reliability-weighted voting much stronger (.86–.87 at k=2, .53–.54 at k=3), so the independent channel is the key ingredient. With most tools corrupted, however, the channel is outvoted (follow rate .41–.42). Lean CAV-rule beats it by .13–.14 at k=2 and .27–.30 at k=3, and lean CAV-LLM by .30–.35 at k=3 (all p < 0.001). Using the independent channel to test candidates, rather than to outvote the tools, keeps the corruption out of the verdict. An imperfect independent channel. We move 5–30% of the trust score’s reference labels to a random other family and rerun lean CAV (210 flows per condition), which lowers the accuracy of kNN alone to .90–.59 (Fig. 3). With at most one corrupted tool, CAV inherits the channel’s errors: its accuracy tracks kNN alone, even at k=0, where four correct tools are overruled, whereas the +kNN vote stays at ≥ .98 because the tools outvote the channel. On flows where kNN is wrong, the rule abstains on 87–92%, Qwen adopts the wrong check (accuracy ≤ .04), and Llama recovers only .14–.17, whereas the +kNN vote recovers about half. The ordering reverses with more corruption. At k=2 CAV is

0.5

0.0 1.0

0.8

0.6

1.0

0.8

0.6

1.0

0.8

0.6

Accuracy of the trust score alone (kNN) CAV-LLM Qwen-7B CAV-LLM Llama-8B

CAV-rule Rel.-weighted + kNN

kNN alone

Figure 3. Lean CAV with a noisy trust score (5–30% of reference labels corrupted), k corrupted tools, 420 flows per point (both scopes).

ahead at every noise level, and at k=3 CAV-LLM reaches .81–.52 against .27–.07 for the +kNN vote. The LLM’s advantage over the rule at k=3 grows to +.10–.11 for Qwen (p < 0.001) and +.03–.09 for Llama (p < 0.05 from 10% noise). Verification keeps corrupted tools out of the verdict, but not errors of the channel: it moves trust to the check. Post-hoc prompt (v3). Applied to full CAV-LLM, the revised prompt reaches 1.00 in every condition for Qwen-7B and .94–1.00 for Llama-8B. A corrupted label is followed on only 2 flows, both by Llama-8B at k=2 sporadic (the .01 in Table 1). In both, the model restated the correct family and then overrode it because two tools agreed with high confidence. Since kNN alone is also perfect here and v3 was motivated by test-set failures, we treat it as a hypothesis, not a result.

6.4. RQ4: Cost Unverified LLMs call the model on every flow. Like cloud–edge agents that hand off to a larger model only above an uncertainty threshold [38], lean CAV calls it only on escalated flows: 0.7% of clean test flows, 54% of flows with one corrupted detector, and every flow with two or more. Calls are longer (about 580 versus 300 prompt tokens; 3.4 versus 2.3 s on a laptop). Full CAV escalated far less (2% at k=1 persistent) because reliability weights silenced the dissenting tool, the same mechanism that caused its errors. Escalation also exposes the LLM’s habit of abstaining on honest disagreement. Lean CAV escalates 158 of the 300 naturally disagreeing flows, mostly two-against-two splits involving the weak Isolation Forest. Qwen resolves them (.99), but Llama abstains on 85 (accuracy .71), calling the check “inconclusive”. CAV-rule resolves them all at .99. On mostly clean traffic, CAV needs about two orders of magnitude fewer LLM calls than an always-on investigator.

pipelines [43], so candidate generation should be robust rather than optimal for honest tools. This is why lean CAV drops both components.

8. Discussion and Limitations What the contribution is. Our primary contribution is the measurement in RQ1–RQ2 and the design rules it yields, not a claim that an LLM out-predicts its evidence; a fixed rule is the most accurate investigator in most of our conditions. The LLM helps only where that rule abstains: when most tools are corrupted. CAV is also only as good as its channel: with a noisy channel and few corrupted tools, adding the channel as a voter is better (Fig. 3). Implications. Four design rules follow. •

•

7. Failure Analysis Unverified LLMs count tools. Accuracy alone does not show how a verdict was reached [39], so we read the rationales. When unverified LLMs abstain on corrupted evidence, 94% of their rationales cite conflict between tools, even when three of four agree; when they follow a corruption, 95% cite the number of agreeing tools. Their verdict is a function of how many tools agree, which is exactly what the corruption controls. CAV-LLM misreads rather than misses evidence. In all 307 escalated flows where full CAV-LLM adopted the corrupted label, the trust score pointed to the true family. Yet 88% of these rationales invoke the nearest-neighbour check in support of the wrong label (“nearest-neighbour check supports Benign over DDoS” for a DDoS flow whose trust score favoured DDoS). Lean CAV-LLM follows far less often (100 flows, 94 by Llama-8B) with the same pattern: the trust score was right in all, and 91% of rationales cite it. CAV-rule, reading the same number, never follows. More evidence can hurt. The aggregate posterior is derived from corrupted outputs but looks like a single confident summary, and the LLM defers to it. SHAP features rarely discriminate between two attack candidates, since every attack deviates from the benign median, and they distract from the trust score; prototype-based text classifiers likewise find explanations by similarity to known training cases easier to use than feature attributions [40], [41]. Reliability weighting backfires for a related reason. With two tools persistently corrupted alike, Dawid–Skene assigns the corrupted side near-certain reliability: only 58% of flows are escalated, and the true family is among the two verification candidates for only 60% of them. With equal weights, every flow is escalated and the truth is a candidate in 99.5% of cases. As in retrieval fusion, adaptive weights need not beat a fixed blend [42]. Verification can only confirm candidates that the upstream aggregation keeps alive, as early hard selection likewise propagates errors in retrieve-then-plan

•

•

Treat a tool’s reported confidence as an untrusted field, and do not let estimated reliability prune the candidates that verification will test. Withhold derived summaries, which look like independent evidence, and state independent evidence as a categorical result. Keep an evidence channel the tools cannot touch (raw flows, packet samples, endpoint telemetry) and measure its accuracy: consensus fails when enough tools are corrupted alike, and verification is only as good as the channel. Spend LLM reasoning only where tools conflict, and prefer a fixed, auditable rule where it suffices, as regulated fraud modelling prefers auditor-readable encodings that cost little accuracy [44].

The same structure arises in anti-money-laundering triage, fraud review [45], and threat-intelligence enrichment. Limitations. CIC-IDS2017 is a 2017 laboratory dataset, and our random split overstates deployed detector accuracy [4]. Three rare families are excluded, and we do not evaluate unseen families. For a novel attack, the trust score can at best support no known family, which CAVrule turns into an abstention. Corruptions are synthetic and non-adaptive. Traffic-level evasion [46] perturbs the raw features that D1, D2, D4, and the trust score share, so our channel is independent of tool compromise but not of evasion; that requires telemetry the attacker cannot shape. Random reference-label noise is only a first step towards targeted poisoning. We evaluate open-weight models up to 14B with 4-bit quantisation; larger models may weigh evidence differently, and trust-related scores drift even across releases of one model line [47].

9. Conclusion Open-weight LLM investigators degraded sharply once one of four detectors was corrupted. CAV recovers most of the lost accuracy at a fraction of the LLM cost by testing the tools’ claims against evidence they cannot influence. The cost is a new point of trust: with a noisy independent channel, CAV inherits its errors, so that channel must be measured in turn.

LLM Usage Statement LLMs as research subject. The investigators evaluated in this paper are open-weight LLMs (Qwen2.5 3B/7B/14B, Llama-3.1-8B) run locally. Their weights are public, decoding is deterministic, and every response is cached, so all reported results can be regenerated exactly. LLMs as a writing and engineering aid. The authors used a proprietary LLM-based coding assistant (Claude, Anthropic) to help implement the experimental pipeline, run and analyse experiments, draft and edit text, and check bibliographic entries against publisher records. All experimental results were produced by the authors’ code from stored predictions, and every number in the paper was checked against those outputs. The authors reviewed all text, code, and references and take full responsibility for the content. Because the assistant is not openly available, its contributions cannot themselves be reproduced. Our code, configuration, and response cache make the reported results reproducible independently of the assistant.

References [1]

B. A. Alahmadi, L. Axon, and I. Martinovic, “99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms,” in Proc. USENIX Security Symposium, 2022, pp. 2783–2800.

[2]

B. Wei, Y. S. Tay, H. Liu, J. Pan, K. Luo, Z. Zhu, and C. Jordan, “CORTEX: Collaborative LLM agents for high-stakes alert triage,” arXiv preprint arXiv:2510.00311, 2025.

[3]

[4]

[5]

Y. Wu, M. Velazco, A. Zhao, M. R. M. Luján, S. Movva, Y. K. Roy, Q. Nguyen, R. Rodriguez, Q. Wu, M. Albada, J. Kiseleva, and A. Mudgerikar, “ExCyTIn-Bench: Evaluating LLM agents on cyber threat investigation,” in Proc. Int. Conf. on Machine Learning (ICML), 2026, arXiv:2507.14201. D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” in Proc. USENIX Security Symposium, 2022, pp. 3971–3988. K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection,” in Proc. ACM Workshop on Artificial Intelligence and Security (AISec), 2023, pp. 79–90.

[6]

J. Xie, K. Zhang, J. Chen, R. Lou, and Y. Su, “Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts,” in Proc. Int. Conf. on Learning Representations (ICLR), 2024.

[7]

M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman et al., “Towards understanding sycophancy in language models,” in Proc. Int. Conf. on Learning Representations (ICLR), 2024.

[8]

[9]

K. Wu, E. Wu, and J. Zou, “ClashEval: Quantifying the tug-of-war between an LLM’s internal prior and external evidence,” in Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024. R. Xu, Z. Qi, Z. Guo, C. Wang, H. Wang, Y. Zhang, and W. Xu, “Knowledge conflicts for LLMs: A survey,” in Proc. Conf. on Empirical Methods in Natural Language Processing (EMNLP), 2024, pp. 8541–8565.

[10] A. P. Dawid and A. M. Skene, “Maximum likelihood estimation of observer error-rates using the EM algorithm,” Journal of the Royal Statistical Society: Series C (Applied Statistics), vol. 28, no. 1, pp. 20–28, 1979.

[11] A. Ratner, S. H. Bach, H. Ehrenberg, J. Fries, S. Wu, and C. Ré, “Snorkel: Rapid training data creation with weak supervision,” Proceedings of the VLDB Endowment, vol. 11, no. 3, pp. 269–282, 2017. [12] Y. Li, J. Gao, C. Meng, Q. Li, L. Su, B. Zhao, W. Fan, and J. Han, “A survey on truth discovery,” ACM SIGKDD Explorations Newsletter, vol. 17, no. 2, pp. 1–16, 2016. [13] J. Sun, S. Y. Min, Y. Chang, and Y. Bisk, “Tools fail: Detecting silent errors in faulty tools,” in Proc. Conf. on Empirical Methods in Natural Language Processing (EMNLP), 2024, pp. 14 272–14 289. [14] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. 4th Int. Conf. on Information Systems Security and Privacy (ICISSP), 2018, pp. 108–116. [15] L. Liu, G. Engelen, T. Lynar, D. Essam, and W. Joosen, “Error prevalence in NIDS datasets: A case study on CIC-IDS-2017 and CSE-CIC-IDS-2018,” in Proc. IEEE Conf. on Communications and Network Security (CNS), 2022, pp. 254–262. [16] M. T. Alam, D. Bhusal, L. Nguyen, and N. Rastogi, “CTIBench: A benchmark for evaluating LLMs in cyber threat intelligence,” in Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024. [17] G. Deng, Y. Liu, V. Mayoral-Vilches, P. Liu, Y. Li, Y. Xu, T. Zhang, Y. Liu, M. Pinzger, and S. Rass, “PentestGPT: Evaluating and harnessing large language models for automated penetration testing,” in Proc. USENIX Security Symposium, 2024, pp. 847–864. [18] F. Ma, Z. Rao, X. Li, Z. Chen, H. Sun, Y. Zhao, X. Chen, and Z. Xiang, “IntrAgent: An LLM agent for content-grounded information retrieval through literature review,” in Proc. Annual Meeting of the Association for Computational Linguistics (ACL), 2026, pp. 674–715. [19] E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” in Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024, pp. 82 895–82 920. [20] Z. Rao, W. Zhu, C. A. Lu, Z. Chen, W. Niu, L. Guan, B. Li, and Z. Xiang, “FragFuse: Bypassing access control of large language model agents via memory-based query fragmentation and fusion,” in Proc. USENIX Security Symposium, 2026, to appear; arXiv:2606.15609. [21] S. Nitzan and J. Paroush, “Optimal decision rules in uncertain dichotomous choice situations,” International Economic Review, vol. 23, no. 2, pp. 289–297, 1982. [22] X. Han and C. Wu, “Validation-stage combinatorial fusion analysis for imbalanced credit-card fraud detection,” arXiv:2606.10393, 2026. [23] R. Ai, Y. Pan, D. Simchi-Levi, M. Tambe, and H. Xu, “Beyond majority voting: LLM aggregation by leveraging higher-order information,” in Proc. Int. Conf. on Machine Learning (ICML), 2026, arXiv:2510.01499. [24] H. Jiang, B. Kim, M. Y. Guan, and M. R. Gupta, “To trust or not to trust a classifier,” in Advances in Neural Information Processing Systems (NeurIPS), 2018, pp. 5546–5557. [25] Y. Geifman and R. El-Yaniv, “Selective classification for deep neural networks,” in Advances in Neural Information Processing Systems (NeurIPS), 2017, pp. 4878–4887. [26] Q. Yan, “Temporal heterogeneous graph transformer for credit card fraud detection,” arXiv:2609.07100, 2026. [27] C. Wu, “Class weighting versus amount conditioning in credit-card fraud detection: A dollar-metric study with a temporal explanation audit,” arXiv:2607.14686, 2026. [28] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. [29] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” in Proc. ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining (KDD), 2016, pp. 785–794.

[30] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. IEEE Int. Conf. on Data Mining (ICDM), 2008, pp. 413–422. [31] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in Proc. Int. Conf. on Machine Learning (ICML), 2017, pp. 1321–1330. [32] Qwen, A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng et al., “Qwen2.5 technical report,” arXiv preprint arXiv:2412.15115, 2024. [33] A. Grattafiori, A. Dubey, A. Jauhri et al., “The Llama 3 herd of models,” arXiv preprint arXiv:2407.21783, 2024. [34] J. Wei, X. Wang, D. Schuurmans, M. Bosma, B. Ichter, F. Xia, E. Chi, Q. V. Le, and D. Zhou, “Chain-of-thought prompting elicits reasoning in large language models,” in Advances in Neural Information Processing Systems (NeurIPS), 2022. [35] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems (NeurIPS), 2017, pp. 4765–4774. [36] Y. Wang, X. Sun, L. Kong, W. Gao, Y. Li, Z. Fan, and Z. Zhuang, “Do time series foundation model benchmarks hide regime-dependent failures? Evidence from traffic speed forecasting,” in ICML Workshop on Forecasting as a New Frontier of Intelligence, 2026, arXiv:2606.18367. [37] Y. Wang, X. Sun, Y. Li, Z. Fan, and Z. Zhuang, “Embedding foundation model predictions in discrete-choice models with structural guarantees,” arXiv:2606.26432, 2026. [38] Y. Huang, M. Zhang, H. Lei, C. Ji, J. Wang, and H. Zhu, “CE-Agent: A cloud-edge collaborative agent framework with dynamic offloading and synergistic distillation,” Journal of Cloud Computing, 2026. [39] X. Sun, W. Gao, Y. Wang, L. Kong, Y. Li, Z. Fan, Z. Zhuang, W. Dong, Z. Zheng, H. Paranjape, A. Mandal, and J. R. Zhang, “Beyond accuracy: Measuring bias acknowledgment in chain-ofthought reasoning for responsible AI evaluation,” in ICML Workshop on Trustworthy AI for Good, 2026, arXiv:2606.15127. [40] X. Wen and R. Rezapour, “A transformer and prototype-based interpretable model for contextual sarcasm detection,” in Proc. 15th Workshop on Computational Approaches to Subjectivity, Sentiment & Social Media Analysis (WASSA), 2026, pp. 278–288. [41] X. Wen, W. Tan, and R. O. Weber, “GAProtoNet: A multi-head graph attention-based prototypical network for interpretable text classification,” in Proc. Int. Conf. on Computational Linguistics (COLING), 2025, pp. 9891–9901. [42] C. Wu and Y. Lin, “Evidence-unit fairness and the limits of query-adaptive sparse-dense fusion in financial document retrieval,” arXiv:2608.00183, 2026. [43] Z. Ye, L. Zhang, S. Zhou, Y. Yu, Y. Shi, J. Xuan, S. Dong, G. Tong, M. Zhang, and B. Li, “OSEF: One-step evidence fusion for crossvideo scene procedure planning,” arXiv:2607.29401, 2026. [44] X. Han, J. Liu, M. Zheng, Z. Zhang, and C. Wu, “Interpretable vs learned encoders for high-cardinality fraud detection,” arXiv:2607.00477, 2026. [45] Q. Yan, “Target aware contrastive learning for bank account fraud detection under extreme imbalance and temporal distribution shift,” Preprints.org, doi:10.20944/preprints202610.2462.v1, 2026. [46] G. Apruzzese, M. Andreolini, L. Ferretti, M. Marchetti, and M. Colajanni, “Modeling realistic adversarial attacks against network intrusion detection systems,” Digital Threats: Research and Practice, vol. 3, no. 3, pp. 1–19, 2022. [47] Z. Fan, Y. Li, Z. Zhuang, X. Sun, and Y. Wang, “The moving target: A longitudinal audit of trust-benchmark score drift across open-source chat LLM release lines,” in Proc. IEEE Int. Conf. on Machine Learning and Applications (ICMLA), 2026, to appear; arXiv:2607.02587.

Related documents

• Cognitive Trust Architecture for Mitigating Agentic AI Threats: Adaptive Reasoning and Resilient Cyber Defense#716294
• Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation#1216673
• BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense#999533
• Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges#1050085
• Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges#1028606