具备抗幻觉能力的安全规划与大语言模型
Hallucination-Resistant Security Planning with a Large Language Model
AI总结：
本文提出了一种抗幻觉的安全规划框架，通过迭代循环和上下文学习优化LLM决策，减少恢复时间30%。
摘要：
大语言模型（LLMs）在支持安全管理工作任务如事件响应规划方面具有潜力。然而，其不可靠性和容易产生幻觉仍然是重大挑战。在本文中，我们通过引入一个原则性的框架来利用LLM作为安全管理工作中的决策支持工具来解决这些挑战。我们的框架将LLM整合到一个迭代循环中，其中它生成候选行动，这些行动会被检查以确保与系统约束和前瞻预测一致。当一致性较低时，我们放弃生成的行动，转而收集外部反馈，例如通过在数字双胞胎中评估行动。此反馈随后通过上下文学习（ICL）来优化候选行动。我们证明了这种设计通过调整一致性阈值可以控制幻觉风险。此外，我们建立了在某些假设下的ICL遗憾界。为了评估我们的框架，我们将其应用于一个事件响应用例，目标是根据系统日志生成响应和恢复计划。在四个公开数据集上的实验表明，我们的框架将恢复时间减少了高达30%，与前沿LLM相比。
英文摘要：
Large language models (LLMs) are promising tools for supporting security management tasks, such as incident response planning. However, their unreliability and tendency to hallucinate remain significant challenges. In this paper, we address these challenges by introducing a principled framework for using an LLM as decision support in security management. Our framework integrates the LLM in an iterative loop where it generates candidate actions that are checked for consistency with system constraints and lookahead predictions. When consistency is low, we abstain from the generated actions and instead collect external feedback, e.g., by evaluating actions in a digital twin. This feedback is then used to refine the candidate actions through in-context learning (ICL). We prove that this design allows to control the hallucination risk by tuning the consistency threshold. Moreover, we establish a bound on the regret of ICL under certain assumptions. To evaluate our framework, we apply it to an incident response use case where the goal is to generate a response and recovery plan based on system logs. Experiments on four public datasets show that our framework reduces recovery times by up to 30% compared to frontier LLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
