DFIR tooling still hands its telemetry to LLMs as one big JSON dump. At scale that is a context-exhaustion engine: latency climbs, the model starts hallucinating, and the analyst has to re-verify everything it said. Our new paper asks a narrow question: does the shape of the serialization matter mor
e than the model? We benchmarked Google's Open Knowledge Format (OKF v0.1) — a graph-native, selectively traversable format — against flat JSON, using 7,680 inference cycles across five open-source model architectures with escalating decoy densities (four difficulty tiers). Results, relative to JSON: Hallucination suppressed by 81.1% at the hardest tier Token overhead cut by 33.6% Noise-invariant recall sustained at 0.94–0.99 as decoys increased The useful part is not "OKF is better". It's the mechanism: when the model can traverse to the relevant subgraph instead of ingesting a monolithic dump, context stays small and grounded — so the failure mode that produces hallucination never gets loaded in the first place.
If your incident-response agent ingests JSON telemetry, this is a format decision you can test before you touch the model. Paper: https://sushantpoudel2028.com.np/publications/okf-dfir More writing, including the negative results: https://sushantpoudel2028.com.np/writing security # ai # dfir # llm
Key Takeaways #
- •We benchmarked Google's Open Knowledge Format (OKF v0.1) — a graph-native, selectively traversable format — against flat JSON, using 7,680 inference cycles across five open-source model architectures with escalating decoy densities (four difficulty tiers).
- •This story was reported by Dev.to , covering developments in thedev space.
- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.
📖 Continue reading the full article: