mlsanityData to 7 Oct 2026

Attribution-Driven Explainable Intrusion Detection with Encoder-Based Large Language Models

arXiv 2604.06266 ↗First posted 7 Apr 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Software-Defined Networking (SDN) improves network flexibility but also increases the need for reliable and interpretable intrusion detection. Large Language Models (LLMs) have recently been explored for cybersecurity tasks due to their strong representation learning capabilities; however, their lack of transparency limits their practical adoption in security-critical environments. Understanding how LLMs make decisions is therefore essential. This paper presents an attribution-driven analysis of encoder-based LLMs for network intrusion detection using flow-level traffic features. Attribution analysis demonstrates that model decisions are driven by meaningful traffic behavior patterns, improving transparency and trust in transformer-based SDN intrusion detection. These patterns align with established intrusion detection principles, indicating that LLMs learn attack behavior from traffic dynamics. This work demonstrates the value of attribution methods for validating and trusting LLM-based security analysis.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 19 of its 43 references that are in the map. First posted on arXiv 7 Apr 2026.

Builds on

19 of 43 references.

References · 19

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  5. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  6. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
  7. 2017Axiomatic Attribution for Deep Networkscited by 3,350
  8. 2020DeBERTa: Decoding-enhanced BERT with Disentangled Attentioncited by 2,157
  9. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  10. 2023A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directionscited by 101
  11. 2023Temporal Data Meets LLM -- Explainable Financial Time Series Forecastingcited by 77
  12. 2024Large Language Models for Cyber Security: A Systematic Literature Reviewcited by 65
7 more
  1. 2023A Perspective on Explainable Artificial Intelligence Methods: SHAP and LIMEcited by 42
  2. 2025LLMs for Explainable AI: A Comprehensive Surveycited by 42
  3. 2024Large Language Models in Wireless Application Design: In-Context Learning-enhanced Automatic Network Intrusion Detectioncited by 16
  4. 2024DALD: Improving Logits-based Detector without Logits from Black-box LLMscited by 12
  5. 2024Efficient Federated Intrusion Detection in 5G ecosystem using optimized BERT-based modelcited by 8
  6. 2025eX-NIDS: A Framework for Explainable Network Intrusion Detection Leveraging Large Language Modelscited by 5
  7. 2025Large Language Models for Network Intrusion Detection Systems: Foundations, Implementations, and Future Directionscited by 4

Built on by

Not cited yet.