{"slug": "google-s-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not", "title": "Google's OKF cut LLM hallucination 81% on DFIR telemetry — because the format, not the model, was the problem", "summary": "A benchmark of Google's Open Knowledge Format (OKF v0.1) against flat JSON cut LLM hallucination by 81.1% at the hardest difficulty tier on DFIR telemetry, according to a paper reported by Dev.to. The study ran 7,680 inference cycles across five open-source model architectures with escalating decoy densities over four difficulty tiers, and also measured a 33.6% reduction in token overhead and noise-invariant recall sustained at 0.94–0.99 as decoys increased. The author attributes the gain to the format rather than the model: selectively traversing a graph-native subgraph keeps context small and grounded, so the failure mode that produces hallucination never gets loaded.", "body_md": "# Google's OKF cut LLM hallucination 81% on DFIR telemetry — because the format, not the model, was the problem\n\nDFIR tooling still hands its telemetry to LLMs as one big JSON dump. At scale that is a context-exhaustion engine: latency climbs, the model starts hallucinating, and the analyst has to re-verify everything it said. Our new paper asks a narrow question: does the shape of the serialization matter mor\n\ne than the model? We benchmarked Google's Open Knowledge Format (OKF v0.1) — a graph-native, selectively traversable format — against flat JSON, using 7,680 inference cycles across five open-source model architectures with escalating decoy densities (four difficulty tiers). Results, relative to JSON: Hallucination suppressed by 81.1% at the hardest tier Token overhead cut by 33.6% Noise-invariant recall sustained at 0.94–0.99 as decoys increased The useful part is not \"OKF is better\". It's the mechanism: when the model can traverse to the relevant subgraph instead of ingesting a monolithic dump, context stays small and grounded — so the failure mode that produces hallucination never gets loaded in the first place.\n\nIf your incident-response agent ingests JSON telemetry, this is a format decision you can test before you touch the model. Paper: https://sushantpoudel2028.com.np/publications/okf-dfir More writing, including the negative results: https://sushantpoudel2028.com.np/writing security # ai # dfir # llm\n\n## Key Takeaways\n\n- •We benchmarked Google's Open Knowledge Format (OKF v0.1) — a graph-native, selectively traversable format — against flat JSON, using 7,680 inference cycles across five open-source model architectures with escalating decoy densities (four difficulty tiers).\n- •This story was reported by **Dev.to** , covering developments in the**dev** space.\n- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.\n\n📖 Continue reading the full article:\n\n[Read Full Article on Dev.to →](https://dev.to/sushant-me/googles-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not-the-model-was-5cpf)", "url": "https://wpnews.pro/news/google-s-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not", "canonical_source": "https://ainexusdaily.vercel.app/article/2026-11-13-googles-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not-th", "published_at": "2026-11-13 14:00:59+00:00", "updated_at": "2026-11-13 14:24:55.687346+00:00", "lang": "en", "topics": ["large-language-models", "ai-safety", "ai-research", "ai-agents"], "entities": ["Google", "Open Knowledge Format", "Dev.to", "Sushant Poudel"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/google-s-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not", "markdown": "https://wpnews.pro/news/google-s-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not.md", "text": "https://wpnews.pro/news/google-s-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not.txt", "jsonld": "https://wpnews.pro/news/google-s-okf-cut-llm-hallucination-81-on-dfir-telemetry-because-the-format-not.jsonld"}}