Non-Degenerate Risk Certification for Automated Security Decisions: A Decision-Contract Theory with ATT\&CK-Aligned Triage as a Worked Instance
Decision-contract theory combines CRC, capacity κ, and actionability; 90.3% of configurations met risk targets with 83.4% correct automation.
Key Findings
Methodology
The paper defines a decision contract C=(g,E), where g selects acted-on inputs and E specifies when an output is semantically correct. A CRC wrapper uses s(x,t)=1−f_t(x)/Σ_{j≠Normal}f_j(x), calibrates a split-conformal threshold, and acts only when the prediction set is a singleton. The theory adds error conservation, label-free singleton capacity κ, risk-feasible capacity κ_α, and an (α,ρ)-actionability certificate.
Key Results
- Across 3 IDS datasets, 6 LLMs sized 7B–32B, and 4 error targets, empirical false-attribution risk was at or below target in 90.3% of configurations, with 83.4% mean correct automation.
- At deployment floor ρ=0.5, all 18 LLM configurations avoided the structural-incapacity condition κ<ρ. κ_α classified the three lowest-utility cases as two risk-constrained failures and one recoverable threshold misalignment.
- A 20-seed stability rerun found no confirmed structural-incapacity instance. Fine-grained subtype labels validated R_ϕ=R_fine−M_ϕ under a genuine many-to-one map, with small but non-zero masking mass.
Significance
The work shows that low certified risk does not imply useful automation: R≤α is satisfied by g≡0 and can also improve through semantic coarsening. This matters for SOCs and other high-stakes selective systems. The proposed audit asks not only whether automation is safe, but how much it does, how often acted-on predictions are conditionally wrong, and how much error is hidden by the reporting semantics.
Technical Contribution
The central identity is B(h)=R(C)+D(C)+M(C): base-classifier error is reassigned to harmful automation, human deferral, or semantic masking. For singleton prediction, κ(f)=supτ[F_{−2}(τ)−F_{−1}(τ)] upper-bounds action achievable by any global threshold; a DKW bound gives an unlabeled finite-sample certificate. κ_α restricts the supremum to thresholds satisfying R(τ)≤α, separating structural incapacity, risk-constrained incapacity, and threshold misalignment.
Novelty
Unlike conventional CRC, which controls risk under a fixed correctness relation, this work treats both selection and semantics as a decision contract. It gives abstention and semantic coarsening one accounting framework, introduces a label-free deployment-capacity limit, and then refines it with a labeled risk-feasible capacity. The conceptual advance is diagnosing why low utility occurs, not merely reporting a low risk number.
Limitations
- The benchmark labels come from a coarse deterministic bijection between four attack categories and four ATT&CK techniques, not independently annotated full ATT&CK ground truth; conclusions therefore do not cover the complete hierarchy.
- CRC provides a marginal, exchangeability-based guarantee, not a guarantee for every realized split or a direct bound on conditional error among automated predictions.
- The study does not fully test distribution shift, complete ATT&CK coverage, analyst workflow costs, or end-to-end SOC outcomes.
Future Work
Future studies should use genuinely fine-grained, many-to-one ATT&CK labels across organizations and time, quantify masking M_ϕ, and evaluate online calibration under drift. Promising extensions include class-conditional or local risk control, dynamic and multi-level thresholds, cost-sensitive human–machine routing, and larger retraining-stability studies to determine whether structural incapacity emerges for particular models or domains.
AI Executive Summary
Security operations centres process thousands of IDS alerts, yet an incorrect ATT&CK attribution can trigger the wrong containment action or conceal a genuine threat. Conformal Risk Control (CRC) offers a distribution-free bound on wrong automated attribution, but the paper identifies a structural loophole: a system that abstains on every alert has zero unconditional risk without automating anything. Thus a low risk number alone is not evidence of competence.
Li proposes decision-contract theory, representing an automated policy as a selector g and a correctness relation E. The resulting error-conservation law states B(h)=R+D+M: base-model error is either harmful automation, human deferral, or semantic masking after labels are coarsened. For singleton conformal prediction, the label-free capacity κ measures the maximum action rate any global threshold can reach. The risk-feasible capacity κ_α asks the stronger question: how much can be automated while still meeting R≤α? An (α,ρ)-actionability certificate adds a minimum action-rate floor.
The worked ATT&CK-aligned triage study spans 3 IDS datasets, 6 LLMs from 7B to 32B, and 4 risk targets. Empirical FAR met its target in 90.3% of configurations, while mean correct automation reached 83.4%. At ρ=0.5, all 18 LLM configurations avoided structural incapacity; κ_α separated three low-utility cases into two risk-constrained cases and one recoverable threshold mismatch. A 20-seed rerun found no confirmed structural-incapacity case. The broader message is operational: trustworthy certification must report safety and useful work together, while explicitly auditing semantic masking.
Deep Analysis
Background
SOC triage maps network-flow alerts to MITRE ATT&CK techniques. Conventional ML systems such as LightGBM and XGBoost, and newer LLM-IDS pipelines, can produce confident errors. Conformal Prediction and CRC add calibration-based abstention, while selective-classification research emphasizes risk–coverage trade-offs. However, most formulations fix the correctness semantics and do not expose how abstention or coarser reporting can make risk appear smaller.
Core Problem
The target is FAR=P(g=1,h≠Y)≤α with meaningful automation. An unconditional bound permits g≡0; even A≤α can coexist with conditional error Q=1. Coarsening labels creates a second loophole: a fine-grained mistake may become correct under a broader relation. The challenge is therefore to certify safety, action volume, and semantic fidelity simultaneously.
Innovation
- ��Decision contracts unify selection and correctness.
- ��Theorem 3 proves B=R+D+M.
- ��Theorems 4–5 establish exact fine-to-coarse transfer and reverse impossibility.
- ��κ provides a label-free geometric action ceiling.
- ��κ_α distinguishes risk-constrained incapacity from threshold misalignment.
- ��Actionability combines R≤α with A≥ρ, eliminating all-abstain certification.
Methodology
- ��Input: network-flow vector x and operational attack label mapped to ATT&CK by ϕ.
- ��Base model: any LLM or ML classifier f outputs f_k(x).
- ��Score: s(x,t)=1−f_t(x)/Σ_{j≠Normal}f_j(x), reducing dependence on benign-class probability.
- ��Calibration: choose q̂ via the split-conformal quantile; form Γ_q={t:s≤q̂}; act only if |Γ_q|=1.
- ��Geometry: with p_(1) and p_(2), action occurs when p_(2)<τ≤p_(1); κ=supτ[F_{−2}(τ)−F_{−1}(τ)].
- ��Risk feasibility: κ_α=sup{A(τ):R(τ)≤α}.
- ��Statistics: DKW bounds |κ̂−κ| by 2√[log(4/δ)/(2m)]; Hoeffding supplies a lower confidence bound for realized action rate.
Experiments
The evaluation uses 3 IDS benchmark datasets, 6 LLMs (7B–32B), and 4 α values, with ρ=0.5 as the representative deployment floor. CRC and an ML+CRC baseline are assessed using empirical FAR, action rate, correct automation, and conditional error. Additional analyses cover κ and κ_α for all 18 LLM configurations, a 20-seed retraining stability rerun, and fine-grained subtype labels for many-to-one coarsening.
Results
Overall, 90.3% of configurations satisfied empirical FAR targets and mean correct automation was 83.4%. Every one of the 18 LLM configurations had κ≥0.5, ruling out geometric structural incapacity. Among three lowest-utility cases, κ_α identified two as risk-constrained and one as threshold misalignment, for which an alternative threshold demonstrated recoverability. Fine-grained evaluation produced small but non-zero M_ϕ, empirically supporting the transfer identity.
Applications
A SOC can place the CRC wrapper after an existing LLM-IDS model: singleton outputs are automated, ambiguous alerts go to analysts. Before deployment, unlabeled traffic estimates κ and screens out impossible action-rate goals. After calibration, κ_α and the action-rate confidence bound test whether safety and throughput are jointly satisfied, rather than accepting zero automation as success.
Limitations & Outlook
The four-class ATT&CK mapping is intentionally coarse and does not represent the full many-to-one technique–tactic structure. Exchangeability may fail under organization changes, evolving attacks, and temporal drift. Marginal FAR does not directly control conditional automated error. The study also leaves prompt sensitivity, inference cost, analyst burden, and end-to-end containment outcomes underexplored. Future work should combine richer labels, drift-aware calibration, local risk control, and cost-sensitive routing.
Plain Language Accessible to non-experts
Imagine a school security guard who must decide whether to let students through. The school wants very few dangerous items to be missed. The easiest way to achieve that is to let nobody enter: the number of mistakes is zero, but the guard has done no useful work. Another shortcut is to record both a knife and a suspicious tool simply as “something risky”; the report looks more accurate while hiding important mistakes.
The paper therefore asks two questions at once: how often is the guard wrong, and how many people does the guard actually process? It separates the decision into “act or send to a human” and “what counts as correct.” A model’s mistakes never vanish. They become wrong automatic decisions, cases passed to people, or errors hidden because the categories were made broader.
The authors test every possible strictness level, then keep only levels that are both safe and productive. In the security experiments, the system correctly automated 83.4% on average, and 90.3% of settings met their risk targets. The lesson is simple: a safe machine must not merely avoid mistakes; it must also do a substantial, measurable share of the job.
ELI14 Explained like you're 14
Suppose you are playing a game where a computer must identify which kind of monster is attacking. It can answer confidently, or say, “I’m not sure—ask an expert.” If it always chooses the second option, it never gives a wrong answer, but that does not mean it understands the game. It is like handing in a blank test and celebrating zero wrong answers!
This paper builds a safety switch for the computer. It lists the answers that seem plausible. The computer acts only when exactly one answer survives; otherwise a human checks the alert. A calibration step chooses how strict this switch should be, and a number called α limits the chance of a wrong automatic label.
Then comes the clever part: can the computer actually do enough work? The authors look at the gap between its most likely and second-most-likely answers. That gap tells them how much automation any single cutoff could possibly produce. They also check whether that amount remains possible while staying under the safety limit. So they can tell apart “the model cannot separate cases,” “safety rules force it to be cautious,” and “the cutoff was simply chosen badly.”
Across 3 datasets, 6 language models, and 4 safety targets, 90.3% of settings passed the risk target and average correct automation was 83.4%. The big takeaway: a good safety score should come with proof that the system is genuinely helping—not just refusing everything!
Glossary
Conformal Risk Control
A calibration method that controls a chosen risk under exchangeability. It can decide when to abstain, but by itself does not guarantee useful coverage.
The paper uses CRC to bound wrong automated ATT&CK attribution.
False Automated Attribution Risk
The probability that the system acts and assigns the wrong technique: P(g=1,h≠Y). It is unconditional over all alerts.
This is the formal risk target.
Decision Contract
A pair C=(g,E): g says where the system acts, while E defines semantic correctness. It makes both abstention and label coarsening explicit.
The paper’s central theoretical object.
Singleton Capacity κ
The largest action rate achievable by any single global threshold when exactly one label must remain plausible. It can be estimated without labels.
Used to certify geometric deployability limits.
Actionability
A two-sided requirement combining risk control R≤α with an action-rate floor A≥ρ. It prevents the all-abstain policy from passing.
The proposed non-degenerate deployment certificate.
Semantic Masking
A fine-label error that becomes acceptable after labels are merged into a coarser category. Its probability mass is M_ϕ.
Used to quantify risk reduction caused by semantic coarsening.
Open Questions Unanswered questions from this research
- 1 The amount of masking in the full ATT&CK hierarchy remains unknown; it requires independently labeled, fine-grained attack techniques across organizations.
- 2 It is unclear whether CRC and κ remain reliable under temporal drift and broken exchangeability; online monitoring and adaptive calibration are needed.
- 3 The operational optimum among automated errors, analyst workload, and containment cost is not yet quantified.
Applications
Immediate Applications
SOC alert routing
Security teams can wrap CRC around an existing LLM or LightGBM IDS, automate only singleton ATT&CK outputs, and send ambiguous alerts to analysts. Unlabeled traffic estimates κ before deployment; κ_α and action-rate bounds audit live operation.
Model acceptance testing
Deployment contracts can require FAR≤α and action rate≥ρ, while also reporting conditional error, correct automation, and masking mass. This prevents a model from achieving nominal compliance by abstaining on everything.
Long-term Vision
Risk-aware human–machine SOCs
Future systems could use severity-aware, multi-level thresholds that jointly optimize attack risk, analyst capacity, and response cost. Such routing would replace one global cutoff with calibrated escalation policies.
Abstract
An unconditional risk bound on automated decisions can be satisfied without automating anything, since a selector that never acts drives the bound to zero. We show this is structural: any risk certificate is defined over a decision contract, the inputs a system acts on plus the semantic relation under which an output counts correct, and weakening either hides base-classifier error. We develop a decision-contract theory: an error-conservation law showing error is only reassigned among harmful automation, human deferral, and semantic masking; a label-free singleton capacity certifying structural incapacity, with a risk-feasible refinement separating recoverable threshold misalignment from risk-constrained incapacity; and a non-degenerate actionability certificate excluding all-abstain solutions by construction. We instantiate this on ATT\&CK-aligned alert triage for LLM-based intrusion detection, the setting that exposed the vacuity failure. Across 3 IDS datasets, 6 LLMs, and 4 error-rate thresholds, empirical false-attribution risk stays at or below target in 90.3% of configurations, with 83.4% mean correct automation. The capacity diagnostic explains every low-utility configuration; its refinement separates genuine misalignment from risk-constrained incapacity, confirmed by an exhibited alternative threshold; a training-stability re-run finds no confirmed structural-incapacity instance; and real fine-grained attack-subtype labels confirm the coarsening-transfer identity under a genuine many-to-one map, with small but non-zero masking mass.