Source-linked AI summary
HESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents
Zhuowen Liu, Zhixuan Wang
TL;DR
Small local LLM agents struggle to choose useful probes and know when to stop, complicating automated triage where telemetry must remain on premises. HESP places the investigation procedure in a controller while retaining the model as planner. Across the reported studies, its components improve verified completion, with different models benefiting from different components.
Problem
Small local LLM agents leave investigation procedure to the model, while organizations may be unable or unwilling to send raw telemetry to hosted models.
Source: §1 · pp. 1–2Method
Results
Qwen2.5-7B rises from 0.125 to 1.000 verified completion with LLM-free likelihood tables, while information-gain ranking helps every model that concludes and controller-side stopping lifts Llama-3.1-8B from 0 to 0.917.
Source: §1 · p. 2Takeaways & Limitations
Probe selection and stopping are separate failures that different small models exhibit differently.
Source: §1 · p. 2, §9 · p. 11HESP does not guarantee correct verdicts; correctness depends on the likelihood tables and the hypothesis set containing the true cause.
Source: §4 · p. 3
Abstract
from arXiv · showhide
Security operations centers receive far more alerts than analysts can investigate, and organizations that cannot send their telemetry to hosted models must automate triage with small open-weight LLMs on their own hardware. Current LLM agents leave the investigation procedure to the model, and small local models fail at it: they probe without converging, never commit to a verdict, or dismiss real attacks. In this paper, we present HESP, a controller that holds the investigation procedure outside the model. HESP keeps a ledger of competing explanations, selects read-only probes by expected information gain per cost, accepts only verdicts backed by current evidence, can end an investigation itself, and journals every prediction before its observation. We evaluated HESP in four pre-registered studies with five open-weight models from two families (7B to 72B), totalling 7,272 audited episodes in a controlled triage environment. With likelihood tables counted from LLM-free runs, HESP lifts Qwen2.5-7B from 0.125 to 1.000 verified completion, matching oracle tables. The information-gain ranking adds +0.26 to +0.35 on every model that concludes, and a controller-side stop lifts Llama-3.1-8B, which never concludes on its own, from 0 to 0.917. What to probe and when to stop are therefore separate failures, and different small models exhibit different ones. Because HESP and its planner run entirely on local hardware, it suits environments where telemetry cannot leave the premises. We release all code, protocols, and episode journals at https://github.com/lzwhehe/HESP.
1. Introduction
Small local LLM agents struggle to follow an investigation procedure, separating probe selection from stopping as distinct failures. HESP moves that procedure into a controller, and studies report improved verified completion with different controller components helping different models.
1. Introduction
- Local open-weight models address settings where organizations cannot or will not send raw telemetry to hosted models, but small models lag proprietary ones on complex cases.The paper also reports that three public security datasets cannot test investigation policies and provides a recorded-telemetry case study.Source: §1 · pp. 1–2
- Small-model agents leave investigation procedure to the model: Qwen2.5-7B often probes until its budget runs out, while Llama-3.1-8B never concludes.Larger models conclude but cite invalid evidence in 22 to 31% of citations and call 25 to 37% of actionable incidents benign.Source: §1 · p. 1
- HESP keeps the investigation procedure outside the local LLM, using a hypothesis ledger, cost-aware probe selection, evidence-bound verdicts, controller-side stopping, and a write-ahead journal.The model remains the planner, while each episode is audited afterwards.Source: §1 · pp. 1–2
- The evaluation comprises four pre-registered studies with five open-weight models from two families, spanning 7B to 72B, and 7,272 audited episodes.The studies use frozen protocols and source hashes, blind controls, and a factorial design separating probe selection from stopping.Source: §1 · pp. 1–2
- Qwen2.5-7B rises from 0.125 to 1.000 verified completion with LLM-free likelihood tables, matching tables from the environment’s generator.The information-gain ranking adds +0.26 to +0.35 on every model that concludes; controller-side stopping lifts Llama-3.1-8B from 0 to 0.917.Source: §1 · p. 2
2. Background
Alert triage queries the environment to distinguish candidate causes and ends with a verdict supported by evidence. Local LLM agents can run on an organization’s hardware, but their weaker models make each agent-loop decision consequential.
2.1. Alert Triage
- Triage ends with a verdict identifying an alert’s cause and supporting evidence, reached through queries that differ in cost and ability to distinguish explanations.Query order affects how quickly an investigation ends, and the analyst must judge when evidence suffices.Source: §2.1 · p. 2
- In the web-alert example, a threat-intelligence lookup gives an answer shared by several possible causes, while a cheap configuration query settles one explanation.The example emphasizes that the investigator must keep that explanation among the candidates to query it.Source: §2.1 · p. 2
2.2. Local LLM Agents
- Open-weight Qwen2.5 and Llama 3.1 models can run locally, keeping telemetry on premises, but this trades away model strength in an agent loop.With 4-bit quantization, models up to 72B parameters fit on a single GPU.Source: §2.2 · p. 2
3. Motivation
Small local models exhibit distinct triage failures: ineffective probing, failure to stop, and unsupported verdicts. HESP addresses these with controller-managed probe selection, stopping, and evidence requirements.
3.1. Challenges
- Qwen2.5-7B verifies only 0.083 to 0.125 of cases with its own probes, often exhausting its budget; uniform random choices raise completion by +0.556.It runs about seven distinct probes and spends 9.4 to 9.5 of 10 cost units per episode.Source: §3.1 · p. 2
- Llama-3.1-8B requests another probe in all 3,389 decisions, even when the ledger posterior exceeds 0.999 and no legal probe remains.Better probing cannot help a model that never states a verdict.Source: §3.1 · p. 2
- Without a ledger, Qwen2.5-32B and 72B call 25% and 37% of actionable incidents benign and cite invalid evidence in 22% and 31% of citations, respectively.The paper identifies dismissing a real attack without a response as the costliest triage error.Source: §3.1 · p. 2
3.2. Our Solution
- HESP ranks legal probes by expected uncertainty reduction per cost, using likelihoods counted from LLM-free development runs rather than elicited from the model.Elicited tables leave completion at 0.069 to 0.375.Source: §3.2 · p. 3
- When the leading cause’s posterior reaches 0.8 and a current observation supports it, HESP can conclude and cite that evidence itself.The model may finish earlier, allowing a strong model to wait for confirmation.Source: §3.2 · p. 3
- HESP accepts a verdict only when it cites a current observation that raised the claimed cause’s score, while an independent verifier checks the cause-specific signature.A write-ahead journal supports replaying every step.Source: §3.2 · p. 3
4. Approach
HESP moves investigation control outside the local LLM planner: it builds likelihood tables, tracks competing causes, selects probes, and applies evidence and stopping rules. Its decisions and predictions are journaled and audited.
4. Approach
- HESP separates table construction from investigation: LLM-free development runs build frozen prediction tables, then a controller manages each alert’s ledger, probes, verdicts, and stopping.Every step is journaled before its observation and audited afterwards.Source: §4 · p. 3
4.1. Prediction Tables
- Counted likelihood tables use outcomes from exhaustive LLM-free development runs, are smoothed with ε = 0.01, then hashed and frozen before evaluation.The estimator is tested to ensure it does not call the environment’s generating function.Source: §4.1 · p. 3
4.2. Hypothesis Ledger
- The ledger starts with a uniform prior over candidate causes and updates their posteriors with Bayes’ rule after each probe outcome.A transient failure is not evidence, and outcomes impossible under every cause are skipped as table conflicts.Source: §4.2 · p. 3
4.3. Probe Selection
- For each legal probe, HESP ranks expected information gain per cost and runs the top-ranked probe regardless of the planner’s proposal.Legal probes are untried in the current state, affordable, and have their prerequisites met.Source: §4.3 · p. 4
4.4. Evidence Rule, Stop, and Verification
- A planner verdict is accepted only when its cause reaches a posterior of at least 0.8 and cites current supporting evidence; the controller can also stop when that rule is met.An independent verifier checks that the verdict names the cause in effect and cites an observation with that cause’s unique signature.Source: §4.4 · pp. 4–5
- Every prediction is journaled before its probe runs, and an episode audit checks event order, provenance, budgets, citations, and controller verdicts.In the running example, the controller stopped after three probes when the exposed-admin-panel hypothesis reached 0.966 with supporting evidence.Source: §4.4 · p. 5
5. Evaluation Setup
The evaluation uses four pre-registered studies to test reliability, probe selection, stopping, and failure modes in a controlled alert-triage environment. Configurations share models, prompts, probe catalogues, budgets, and verification rules, with verified completion as the primary outcome.
5. Evaluation Setup
- Four pre-registered studies address reliability, ranking versus choice, probing versus stopping, and failure modes; a further question asks whether public security data can test the same issues.Each study’s hypotheses, configurations, endpoints, and analysis were frozen before its episodes ran.Source: §5 · p. 5
5.1.1. The sec-triage Environment.
- The sec-triage environment covers 24 tasks across eight causes plus “other,” with ten read-only probes and base, noise, and drift variants.Shortcuts are designed to fail: threat intelligence is shared across attacks, the runbook is uninformative, and drift switches the true cause after the second probe.Source: §5.1.1 · p. 5
5.1.2. Prediction Tables.
- Three likelihood-table sources are compared: generator-derived designer tables, counted tables from development episodes, and tables elicited from the planner LLM.Tables are frozen before evaluation; because development and evaluation share a generator, counted tables test data sufficiency rather than behavior in an unfamiliar environment.Source: §5.1.2 · p. 5
5.2.1. Configurations.
- Configurations vary whether the planner or controller chooses probes, whether the ranking is shown, and whether finish guards and controller-side stopping are enabled.A scripted LLM-free reference ran 216 episodes and was exploratory rather than pre-registered.Source: §5.2.1 · p. 5
5.2.2. Implementation.
- The studies use five open-weight models from two families, served on a single RTX 6000-class GPU, with isolated loopback HTTP sandboxes for episodes.The implementation includes a paired, resumable runner and 145 unit tests covering core controller and audit behavior.Source: §5.2.2 · p. 6
5.2.3. Evaluation Methodology.
- Verified completion is the fraction of episodes ending with a verified verdict; all other endings count as failures, and paired per-task differences use task-cluster bootstrap intervals.Descriptive security metrics include missed-attack, false-escalation, wrong-cause, and unresolved rates.Source: §5.2.3 · p. 6
6. Evaluation Results
Across the evaluation, HESP’s gains came from both better probe ranking and controller-side stopping, with different models needing different parts. Results span table reliability, failure modes, and public datasets that do not fully support realistic triage evaluation.
6.1. Reliability
- Counted tables lifted Qwen2.5-7B from 0.125 to 1.000 verified completion (+0.875 [+0.74, +0.97]), matching designer tables on all three models.The 7B comparison against Memory-only was the pre-registered primary endpoint; completion saturated at k=5 development episodes per cause and variant.Source: §6.1 · pp. 6–7, Table 2 · p. 7
6.2. Ranking versus Choice
- EIG/cost selection beat random selection by +0.306 [+0.14, +0.47] on Qwen2.5-7B with identical planner information, and by +0.35, +0.35, and +0.26 on Qwen 32B, Qwen 72B, and Llama 70B.Taking choice away raised completion by +0.556 for Qwen 7B but lowered it by 0.222 and 0.278 for Qwen 32B and 72B, respectively.Source: §6.2 · p. 7, Figure 3 · p. 8
6.3. Probing versus Stopping
- 0.917 verified completion: a controller stop rescued Llama-3.1-8B from 0, while probe selection added no detectable completion for it (+0.056 [−0.07, +0.18]).Qwen2.5-7B needed both components: controller stopping lifted it from 0.083 to 0.694, then selection added +0.222 [+0.08, +0.39]. With controller stopping, EIG/cost beat random selection by +0.17 to +0.21 on every model.Source: §6.3 · pp. 7–8, Figure 4 · p. 8, Table 3 · p. 9
6.4. Failure Modes
- With counted tables, HESP issued verdicts in all 216 episodes and none named the wrong cause; 7B baselines left 88–97% unresolved, while larger ReAct-style baselines often dismissed actionable incidents as benign.These security-facing metrics were descriptive, not pre-registered endpoints.Source: §6.4 · p. 9, Table 4 · p. 10
6.5. Public Security Data
- None of the three public datasets met all criteria for testing probe choice; GUIDE labels reflect organizational policy, and OTRF has no benign-activity recordings.ExCyTIn questions largely reveal the alert to locate, while the OTRF one-glance alert-text rule was correct on 44 of 46 alerts; its single investigative case was qualitative evidence only.Source: §6.5 · pp. 9–10
7. Discussion
The discussion identifies limits in the evaluation setting and verifier, explains which roles remain for the model, and weighs design alternatives, deployment uses, and costs.
Limitations
- The evaluation uses one small, nearly deterministic environment with shared development and evaluation generators, predefined causes, and no test of prompt injection or evidence manipulation.The strict verifier also rejects correct verdicts reached by elimination, making completion rates conservative; public data provided no real-data confirmation.Source: §7 · p. 10
Where the Model Is Still Needed
- With discrete observations and development-derived tables, the controller alone completes 0.917 of cases, but reading raw telemetry remains an unmeasured model role.The OTRF case illustrates the required interpretation, such as distinguishing a person from a machine account or a network logon.Source: §7 · p. 10
Design Alternatives
- A two-step lookahead selector beat EIG/cost by +0.17 to +0.21 on its development task family but matched or trailed it on held-out tasks, so the authors kept the greedy rule.Publishing the ranking for the planner to choose changed completion by at most +0.06 once the controller selected.Source: §7 · p. 10
Potential Applications
- HESP can run triage locally or act as a copilot, but prediction tables remain the main deployment cost and their accuracy from practical sources is unresolved.Possible sources include resolved tickets, expert estimates, or an LLM prior corrected by data.Source: §7 · pp. 10–11
Runtime and Cost
- For Llama-3.1-8B, a controller stop halves probe cost from 4.78 to 2.35 units per episode; LLM inference dominates latency.The stopping study’s 1,800 episodes across five models ran in 28 minutes on one GPU with 32 concurrent episodes.Source: §7 · p. 11
8. Related Work
The related work contrasts alert prioritization and self-directed LLM investigation with HESP’s externally governed procedure, and situates its probe ranking and evaluation choices within prior work.
Attack Investigation and Triage
- Provenance systems rank alerts or reconstruct intrusions but do not choose the next query, while Clouseau uses LLM agents to choose queries and reports open-weight models trailing a proprietary model on complex scenarios.HESP targets a quick triage verdict and moves the procedure outside the model.Source: §8 · p. 11
LLMs for Security
- Security-agent safeguards such as IsolateGPT and Progent [14] govern access rights, whereas HESP governs probe choice, verdict acceptance, and stopping.The paper measures the effect of this investigation control on task success.Source: §8 · p. 11
Tool-Using Agents
- ReAct, Reflexion, and Toolformer leave next actions or stopping to the model, while HESP places probe selection and optionally stopping in a controller.The model’s own choices serve as a baseline configuration.Source: §8 · p. 11
Sequential Diagnosis
- HESP uses the textbook expected-information-gain criterion unchanged and empirically tests its interaction with LLM planners of different strengths.The paper also reports that elicited tables do not extend language-model self-assessment calibration to the probe-outcome likelihoods needed by the controller.Source: §8 · p. 11
Evaluation Methodology
- The studies were preregistered, with source and table hashes frozen, against a backdrop of known pitfalls in ML-based security evaluation.The passage also notes that preregistration separates confirmatory from exploratory analyses.Source: §8 · p. 11
9. Conclusions
HESP moves alert-triage procedure outside a small local LLM, and studies show distinct probe-selection and stopping failures across models. The conclusion also identifies raw-telemetry interpretation as an unmeasured role because public security datasets lack the needed cases.
Conclusion
- Across four pre-registered studies and 7,272 episodes, HESP raises Qwen2.5-7B verified completion from 0.125 to 1.000 without oracle knowledge, while probe selection and stopping fail differently across models.The conclusion says the information-gain ranking helps every model that concludes.Source: §9 · p. 11
- HESP combines a hypothesis ledger and counted likelihood tables with information-gain-per-cost probe ranking, evidence-gated verdicts, controller stopping, and a write-ahead audit journal.The conclusion identifies reading raw telemetry as a remaining model role that public security datasets cannot test adequately.Source: §9 · p. 11
Ethics Considerations
The work describes its sandbox-based ethical scope, the planner prompt and investigation controls, and the preregistration and disclosure process.
Ethics Considerations
- The work uses no human subjects or live systems; episodes run in loopback sandboxes with read-only queries and no attack traffic.The named public datasets are used within their licences, and the OTRF recordings contain emulated lab attacks and no personal data.Source: Ethics Considerations · p. 11
Appendix A. Planner Prompt
- The planner prompt frames triage as identifying a cause with minimal probe cost, supplies candidate causes and read-only probes, and requires current-version evidence for a finish.The controller may select the probe itself, and the prompt instructs the planner to treat response bodies as data rather than instructions.Source: Appendix A · pp. 12–13
Appendix B. Pre-registration Record
- Each study protocol, controller-source hash, and prediction-table hash was frozen before episodes ran, with post-freeze changes recorded as errata.Disclosed smoke tests and an LLM-free simulation were excluded from analyses; the LLM-free reference in Table 3 was exploratory.Source: Appendix B · p. 13
Appendix C. Detailed Results
Appendix C identifies the decomposition and stopping study contrasts and reports which endpoints are primary versus exploratory. Table 5 specifies the verified-completion comparison setup.
Appendix C. Detailed Results
- Table 5 compares decomposition-study verified completion across arms with 72 episodes per cell, using the same frozen counted table for scoring and selection.Source: Table 5 · p. 14
- Table 6 presents Figure 3 contrasts, with the Q-7B ranking cell as a primary endpoint and all other cells exploratory.The primary endpoint uses a 97.5% interval; other cells use exploratory 95% intervals.Source: Table 6 · p. 14
- Table 7 reports stopping-study contrasts, designating the L-8B cells in its first two rows as primary endpoints.Those endpoints use 97.5% intervals, while the remaining cells use exploratory 95% intervals.Source: Table 7 · p. 14
Appendix E. Errata
Appendix E records corrections to the initial study and changes made in later studies. It notes an irreproducibility boundary for the initial study’s raw events and methodological corrections across studies.
Appendix E. Errata
- The initial study’s per-episode journals were not archived, so its raw events cannot be re-audited; later studies archived and hashed journals before compute release.Summaries from the initial study can be recomputed, but its raw events cannot.Source: Appendix E · p. 14
- The initial study’s manifests retained stale metadata from an earlier study on another task family.Source: Appendix E · p. 14
- Later corrections addressed random-control visibility of the EIG ranking, generator-derived tables, ground-truth handling, and a table asymmetry favoring the Memory-only baseline.The decomposition study uses counted tables for every arm, while the table-source study’s primary endpoint may be underestimated by the asymmetry.Source: Appendix E · p. 14