研究拆解 LLM 网络威胁情报实体抽取失败模式：主要问题不是幻觉
From Unreliable to Usable: Decomposing Failure Modes and Confidence Signals in LLM Entity Extraction - Evidence from Cyber Threat Intelligence
DeepSeek-V4-Flash 和 GPT-6.1-Sol 抽实体都不靠谱，但坏的原因不是幻觉，而是把背景信息当成攻击实体。用置信度分层排审核优先级，别当真值。
一项预注册的冻结评估测试了 DeepSeek-V4-Flash、GLM-5.3-Flash 和 GPT-6.1-Sol 在 354 起安全事件报告（630 次模型-报告评估）上的实体抽取表现。micro precision 仅为 0.03-0.34，且旗舰级模型的差距并未缩小。对 360 个样本的三级标注显示 65.6% 是背景提及、19.9% 是 gold 范围缺口，真正无依据的候选只有 1.2%。零成本的自一致性频率分层在全部六个测试单元通过了 top-30% 精度提升门槛，但 45 个目标的反事实实验中，95.6-100% 的高置信判断会被一句错误归因句子翻转。
From Unreliable to Usable: Decomposing Failure Modes and Confidence Signals in LLM Entity Extraction - Evidence from Cyber Threat Intelligence
Audits of large language model (LLM) extraction from full-length documents report severe unreliability, leaving two questions open: what the failures actually consist of, and whether confidence signals can turn unreliable output into usable output. We run a preregistered, fully frozen evaluation of two new-generation low-cost LLMs (DeepSeek-V4-Flash, GLM-5.3-Flash) with a flagship-tier control (GPT-6.1-Sol) on a public corpus of 354 incident campaigns (315 unique reports, 630 model-report evaluations), scoring extraction quality against gold, confidence calibration, and robustness to single-sentence perturbations. Three findings emerge. (1) Unreliability persists across tiers: micro precision is 0.03-0.34 and verbalized calibration error (ECE) 0.53-0.94 across both splits; the gap does not close at the flagship tier. (2) The dominant failure is not hallucination: a full mention census plus a three-tier annotation of 360 sampled candidates (two independent LLM annotators from vendors outside the evaluated set, Cohen's kappa = 0.79 on the preregistered acceptance line, fully disclosed) back-projects to 65.6% background mentions and 19.9% gold-scope gaps, with only 1.2% unsupported candidates. (3) Confidence ranks but does not verify: zero-cost self-consistency-frequency tiering passes a preregistered top-30% precision-gain bar in all six test-split model-type cells (4/6 on train), the zero-cost text-frequency x SC frequency combination wins 3, ties 2, loses 1 across cells, yet relation-level counterfactuals on all 45 targets show that a single misattribution sentence flips high-confidence judgments in 95.6-100% of cases, and even a background sentence explicitly marked as unrelated still binds a fake vulnerability in up to 26.7% of them. We conclude with a deployment boundary: confidence tiering may set review priorities, never truth.
