---
title: "ARBITRA: Robust Document-Level ATT&CK Extraction via Multi-Expert Argumentation"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2610.39433v1"
permalink: "https://feed.astralor.com/items/itm_92f623cc3eefaa240ac948e5"
published: "2026-10-29T06:09:41.000Z"
score: 54
channel: "tech"
tags: ["LLM","OpenAI","ARBITRA","Robust Document-Level ATT","Extraction","Multi-Expert Argumentation Cyber","CTI","MITRE ATT"]
---

# ARBITRA: Robust Document-Level ATT&CK Extraction via Multi-Expert Argumentation

## At a glance

Cyber threat intelligence (CTI) reports describe adversary behavior in natural language, but converting them into structured MITRE ATT&CK mappings remains difficult: existing methods decompose reports to sentence-level …

## Key points

- Cyber threat intelligence (CTI) reports describe adversary behavior in natural language, but converting them into structured MITRE ATT&CK mappings remains difficult: existing methods decompose reports to sentence-level …
- We present ARBITRA, which orchestrates multiple role-specialized LLM experts that propose candidate ATT&CK entities from the full report, which are then verified through a per-candidate quantitative bipolar argumentatio…
- We additionally construct reasoning-specialized corpora for fine-tuning so experts can act as effective participants during this verification process.

## Full text

Cyber threat intelligence (CTI) reports describe adversary behavior in natural language, but converting them into structured MITRE ATT&CK mappings remains difficult: existing methods decompose reports to sentence-level granularity for extraction, while modern LLMs can work with full reports in a single pass but with noticeable performance degradation. We present ARBITRA, which orchestrates multiple role-specialized LLM experts that propose candidate ATT&CK entities from the full report, which are then verified through a per-candidate quantitative bipolar argumentation framework (QBAF) grounded in document evidence and rationales. We additionally construct reasoning-specialized corpora for fine-tuning so experts can act as effective participants during this verification process. Across ATT&CK extraction benchmarks, ARBITRA reaches a stronger precision-oriented operating point than sentence-level pipelines, recent LLM-based extraction systems, and frontier models including GPT-5.5. Under adversarial perturbations simulating conflicting TTP statements, cross-report contamination, and semantic poisoning, ARBITRA limits mean precision degradation to roughly half that of frontier-model baselines for a more robust extraction.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_92f623cc3eefaa240ac948e5