Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination

Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination

Speakers: Kim Hammar

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=TGuNgPEFnwk

Overview

This talk presents a novel method for automated incident response planning that uses a fine-tuned lightweight LLM combined with look-ahead optimization to generate response plans with theoretical performance guarantees and reduced hallucination risk. Unlike existing LLM-based incident response systems that rely on external providers like OpenAI or Google (requiring sensitive incident data to be shared externally), this method runs on a 14-billion parameter DeepSeek R1 model fine-tuned on a commodity GPU in about 8 hours.

The key innovation is a planning algorithm that generates n candidate response actions at each stage, evaluates each through look-ahead simulation, and selects the action leading to fastest recovery. The authors prove that by increasing the number of candidate actions, the hallucination risk can be mathematically bounded using Chernoff bounds, and that the method can filter out hallucinated actions under regularity conditions. Evaluated against four public incident datasets, the method outperforms frontier models (DeepSeek R1, Gemini 2.5, and OpenAI o3) across all metrics -- recovery time, percentage of ineffective actions, and percentage of failed recoveries -- while running on dramatically less expensive hardware.

Background

▶ Watch: Incident response as a control problem (0:00)

Incident response in enterprise environments is currently managed through Security Operations Centers (SOCs) where human operators analyze security alerts around the clock and prescribe response actions. While effective when staffed with skilled operators, this approach is extremely costly, and the global shortage of security operators continues to worsen. There is intense demand for decision support systems that can reduce operator workload.

In the past year, all major IT vendors have released LLM-based incident response systems that work by prompting a language model with incident details and generating response recommendations. These systems often outperform traditional incident response playbooks in practice. However, they have two fundamental limitations: they require sending potentially sensitive incident information to external LLM providers, and they provide no theoretical reliability guarantees -- they are inherently prone to hallucination, especially since they use general-purpose models not specialized for incident response.

The speaker frames incident response as a control problem: given an internal system state describing the nature of the incident, the goal is to select a sequence of actions that drives the system to a secure and operational state as quickly as possible. This formalization connects the problem to stochastic shortest path problems and Markov decision processes, enabling the theoretical analysis that distinguishes this work.

Key Findings

▶ Watch: Fine-tuning on 68,000-incident dataset in 8 hours (4:00)

Lightweight models can outperform frontier models: A fine-tuned 14B parameter DeepSeek R1 model, running on a single commodity GPU, outperformed GPT o3, Gemini 2.5, and the full DeepSeek R1 across all evaluation metrics on four public incident datasets. This demonstrates that domain-specific fine-tuning combined with structured planning can compensate for raw model scale.

Hallucination risk is mathematically boundable: By generating n candidate actions and evaluating each through look-ahead optimization, the probability that all candidates are hallucinated decreases exponentially with n. Even models with high individual hallucination rates can produce reliable plans given sufficient candidate generation.

Fine-tuning and planning are the main performance drivers: An ablation study showed that removing information retrieval (RAG) had minimal impact on performance, while removing fine-tuning or the planning algorithm caused significant degradation. The information retrieval's low impact is attributed to the evaluation datasets using well-known attack techniques likely covered during pre-training -- the authors speculate RAG would be more impactful for zero-day or very recent vulnerabilities.

First public incident response fine-tuning dataset: The team assembled a dataset of 68,000 incidents covering a broad range of system types and attacker tactics, published on Hugging Face. This is described as the first publicly available dataset for fine-tuning incident response models.

Cheap and accessible fine-tuning: The model was fine-tuned in approximately 8 hours on a commodity GPU, making this approach accessible to any organization without requiring data center-scale compute.

Technical Deep Dive

▶ Watch: Chernoff bound on hallucination probability (8:00)

The method consists of three stages:

Stage 1 -- Fine-tuning: The 14B parameter DeepSeek R1 model is fine-tuned using supervised instruction tuning on the 68,000-incident dataset. For each incident, the model receives incident details, uses chain-of-thought prompting to reason about the response, generates a response action, and the output is compared against ground truth using cross-entropy loss. Gradients are backpropagated to update weights via standard gradient descent. The convergence plot shows reliable loss reduction over the 8-hour training period.

Stage 2 -- Information Retrieval: Before planning, relevant external information is retrieved from sources like open threat intelligence APIs to bridge the gap between fine-tuning time and planning time. This information is incorporated into the model's context. While the ablation study showed minimal impact on the evaluation datasets (well-known attacks), this step is designed for real-world scenarios involving recent or unknown vulnerabilities.

Stage 3 -- Look-ahead Planning: At each planning stage, the model generates n candidate response actions (n is configurable). For each candidate, a look-ahead evaluation assesses the expected impact on system service availability and progress toward recovery. The action predicted to lead to the shortest recovery path is selected.

The hallucination control mechanism works through two theoretical results:

1. Chernoff Bound on Hallucination: Given an empirically estimated per-action hallucination probability p, the probability that all n candidates are hallucinated is bounded by p^n. This decreases exponentially with n -- even with p = 0.5, generating 20 candidates makes the probability of all being hallucinated less than 10^-6.

1. Filtering Guarantee: Under regularity conditions, if at least one candidate action is non-hallucinated (makes progress toward recovery), the look-ahead evaluation can identify and select it. The proof formulates the problem as a stochastic shortest path problem and bounds the difference between the true underlying Markov decision process and the model's look-ahead approximation.

A hallucination is formally defined as an action that makes no progress toward recovery -- for example, patching a vulnerability that does not exist in the system. This is more precisely measurable than general-purpose hallucination definitions.

The method is horizontally scalable: candidate action evaluation can be parallelized across multiple GPUs, with the number of evaluations scaling linearly with n but executable in constant time given sufficient hardware.

Demo / Proof of Concept

▶ Watch: Results: outperforming o3 and Gemini 2.5 on all metrics (10:00)

No live demo was performed. The evaluation used four public datasets consisting of pcap files and security alerts related to different incidents. Raw pcap files were preprocessed through Snort to generate alerts, which were then passed to the model (typically under 20K tokens, well within the 128K context window). The generated response plans were compared against ground truth, with metrics including recovery time, percentage of ineffective actions, and percentage of failed recoveries.

The response plan format is textual, similar to incident response playbooks but more concrete -- actions include specific system commands, are classified according to MITRE tactics, and cover six action types: containment, eviction, assessment, restoration, hardening, and calling in forensics teams. During Q&A, the speaker noted that organizational-level decision-making (compliance notifications, non-technical response actions) is not fully covered in the current dataset but is planned for future work.

Defensive Implications

▶ Watch: Q&A: response plan format and MITRE tactic classification (18:00)

This work has immediate practical value for security operations:

SOC augmentation without data exposure: Organizations can run this method entirely on-premises using commodity hardware, eliminating the need to send sensitive incident details to external LLM providers. For organizations in regulated industries or with strict data sovereignty requirements, this is a significant advantage.

Decision support with quantified risk: The theoretical hallucination bounds give operators an actual metric for system reliability, rather than the "trust the model" approach of current LLM-based tools. Operators can configure the number of candidate actions based on their risk tolerance.

Scalability validation: The Q&A exchange with a Walmart security operations representative confirmed the speaker's claim that the method generalizes well across incident types without requiring per-incident fine-tuning. The single dataset covers a broad enough range of tactics for practical deployment.

Gap: organizational integration: The current system focuses on technical response actions. Production deployment would need to incorporate organizational policies, compliance requirements (breach notification), and non-technical decision-making. The speaker acknowledged this limitation and described ongoing work on formal constraint verification with feedback loops.

Gap: human evaluation: No comparison against human analyst performance was conducted, though this was identified as the top priority for future work and a key concern raised by reviewers.

Key Takeaways

• A fine-tuned 14B parameter DeepSeek R1 model outperforms frontier models (o3, Gemini 2.5) on incident response planning while running on a single commodity GPU
• Hallucination risk is mathematically bounded: generating n candidate actions with look-ahead evaluation provides exponentially decreasing hallucination probability
• The 68,000-incident fine-tuning dataset is publicly available on Hugging Face -- the first public dataset for incident response model fine-tuning
• Fine-tuning takes approximately 8 hours on commodity hardware, making this accessible to any organization
• Fine-tuning and look-ahead planning drive performance; information retrieval (RAG) had minimal impact on evaluation datasets with well-known attack patterns
• Response plans include specific system commands classified by MITRE tactics, going beyond generic playbook recommendations
• The method is horizontally scalable -- candidate evaluation parallelizes across GPUs

About the Speaker(s)

Kim Hammar is a researcher with a background in electrical engineering, reinforcement learning, and decision theory applied to cybersecurity. This work was conducted jointly with collaborators Tanu and EML. Hammar has extensive prior experience applying reinforcement learning to incident response, and frames the LLM-based approach as addressing the scalability limitations of his previous RL-based methods. The Q&A session demonstrated broad interest from industry (Walmart, Microsoft, Virginia Commonwealth University) and academia (Georgia Tech, CISPA, Euro Research Institute), indicating strong practical relevance.