# What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale

arXiv: https://arxiv.org/abs/2510.13817 · HTML: https://mlsanity.com/paper/2510.13817/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 95 references that are in the map.
- First posted on arXiv 24 Sep 2025.

## Builds on (most cited first, 30 of 32)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [Large Language Models are Zero-Shot Reasoners](https://mlsanity.com/paper/2205.11916/) (2022)
- [QLoRA: Efficient Finetuning of Quantized LLMs](https://mlsanity.com/paper/2305.14314/) (2023)
- [True Few-Shot Learning with Language Models](https://mlsanity.com/paper/2105.11447/) (2021)
- [State of What Art? A Call for Multi-Prompt LLM Evaluation](https://mlsanity.com/paper/2401.00595/) (2023)
- [Rationalizing Neural Predictions](https://mlsanity.com/paper/1606.04155/) (2016)
- [Semantic Entropy Probes: Robust and Cheap Hallucination Detection in LLMs](https://mlsanity.com/paper/2406.15927/) (2024)
- [Scaling Laws and Interpretability of Learning from Repeated Data](https://mlsanity.com/paper/2205.10487/) (2022)
- [Curriculum Learning by Transfer Learning: Theory and Experiments with Deep Networks](https://mlsanity.com/paper/1802.03796/) (2018)
- [Rationale-Augmented Ensembles in Language Models](https://mlsanity.com/paper/2207.00747/) (2022)
- [When Do Curricula Work?](https://mlsanity.com/paper/2012.03107/) (2020)
- [IoT Sentinel: Automated Device-Type Identification for Security Enforcement in IoT](https://mlsanity.com/paper/1611.04880/) (2016)
- [Revisiting Large Language Models as Zero-shot Relation Extractors](https://mlsanity.com/paper/2310.05028/) (2023)
- [Beyond Random Sampling: Efficient Language Model Pretraining via Curriculum Learning](https://mlsanity.com/paper/2506.11300/) (2025)
- [Learning to Maximize Mutual Information for Chain-of-Thought Distillation](https://mlsanity.com/paper/2403.03348/) (2024)
- [Interpreting and Steering LLMs with Mutual Information-based Explanations on Sparse Autoencoders](https://mlsanity.com/paper/2502.15576/) (2025)
- [Open-Domain Hierarchical Event Schema Induction by Incremental Prompting and Verification](https://mlsanity.com/paper/2307.01972/) (2023)
- [Datasets are not Enough: Challenges in Labeling Network Traffic](https://mlsanity.com/paper/2110.05977/) (2021)
- [Progressive Mastery: Customized Curriculum Learning with Guided Prompting for Mathematical Reasoning](https://mlsanity.com/paper/2506.04065/) (2025)
- [Tackling Long-Tailed Category Distribution Under Domain Shifts](https://mlsanity.com/paper/2207.10150/) (2022)
- [Efficient Representations for High-Cardinality Categorical Variables in Machine Learning](https://mlsanity.com/paper/2501.05646/) (2025)
- [Machine Learning for the Detection and Identification of Internet of Things (IoT) Devices: A Survey](https://mlsanity.com/paper/2101.10181/) (2021)
- [Machine Learning with High-Cardinality Categorical Features in Actuarial Applications](https://mlsanity.com/paper/2301.12710/) (2023)
- [InfoPO: On Mutual Information Maximization for Large Language Model Alignment](https://mlsanity.com/paper/2505.08507/) (2025)
- [A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic](https://mlsanity.com/paper/1705.06805/) (2017)
- [ε-Softmax: Approximating One-Hot Vectors for Mitigating Label Noise](https://mlsanity.com/paper/2508.02387/) (2025)
- [IoT Device Fingerprint using Deep Learning](https://mlsanity.com/paper/1902.01926/) (2019)
- [Diver: Large Language Model Decoding with Span-Level Mutual Information Verification](https://mlsanity.com/paper/2406.02120/) (2024)
- [IoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale](https://mlsanity.com/paper/1909.09848/) (2019)
- [A Large-Scale Analysis of IoT Firmware Version Distribution in the Wild](https://mlsanity.com/paper/2010.11026/) (2020)

## Built on by (most cited first, 1 of 1)

- [From Packets to Patterns: Interpreting Encrypted Network Traffic as Longitudinal Behavioral Signals](https://mlsanity.com/paper/2605.01616/) (2026)

## Abstract (arXiv)

The growth of IoT devices in shared environments has outpaced our ability to identify them, posing urgent risks to privacy, safety, and accountability. This challenge is especially pronounced in open-world environments, where network traffic metadata is often sparse, noisy, or adversarial. To address this problem, we introduce a semantic inference pipeline that reframes device identification as a language modeling task over real-world network metadata. As this approach depends on reliable supervision, we first construct high-fidelity vendor labels for the IoT Inspector dataset, the largest real-world corpus of its kind, using an ensemble of large language models guided by mutual-information and entropy-based stability scores. We then instruction-tune a quantized LLaMA 3.1 8B model on this dataset using curriculum learning to support generalization under sparsity and long-tail vendor distributions. Our model achieves 98.69% top-1 and 90.73% macro accuracy across 2,015 vendors, while remaining robust to missing fields, protocol drift, and adversarial manipulation. We also evaluate the model on an independent IoT testbed dataset, assess explanation quality, and conduct adversarial tests to probe robustness under spoofed and obfuscated input. These results position instruction-tuned LLMs as a scalable, interpretable foundation for trustworthy device identification at scale.