Betthauser, Leo, Liu, Yingqi, Shah, Uday, Wei, Jishang, Galhotra, Sainyam, Gou, Liang, Dharnidharka, Vedant, Yang, Hao · Oct 28, 2026
arXiv cs.AI paper: Lev-3B argues a two-stage training recipe helps compact models analyze logs
Markdown · JSON · Original source
The authors of Lev-3B present a 3-billion-parameter model for log-analysis decisions, such as detecting anomalous sessions or identifying attack techniques. Their central claim is about the training recipe: teach the model to make bounded decisions before exposing it to logs, then mix target tasks with general log data. They report that this two-stage approach transfers better than training on log data alone, and that general log data improves results on sources excluded from training. On anomaly detection, Lev-3B outperforms prompted , including on an excluded logging system, at a fraction of their serving cost. But it trails those models on attack-technique classification, and its probabilities, though on familiar sources, confidently miss anomalies on the excluded system. The contrast matters: lower serving cost and strong results on one task do not mean dependable performance across unfamiliar systems or tasks. The authors release the checkpoint, recipe, data manifests and prediction-level artifacts, making their approach available for inspection. How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection?
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Oct 28, 2026 (2026-10-28).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-11T08:38:39.260Z. First observed: 2026-10-30T06:45:32.828Z. Retrieved: 2026-10-31T11:31:40.793Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The evidence is the abstract; it does not provide detailed evaluation results or explain the scope of the tested tasks and systems. The abstract reports a result on an excluded logging system but does not establish how performance or calibration will generalize to other unfamiliar systems.
Open question
How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection?
Source-stated
The authors present Lev-3B, a 3-billion-parameter decision model, and study a training recipe that first teaches bounded natural-language decisions without log data, then trains on target tasks mixed with general log data.
The recipe has two key parts. First, training follows a curriculum: the model learns bounded natural-language decisions, using no log data, before it sees any logs.
Source-stated
The authors report that the two-stage recipe transfers better than training on log data alone, and that general log data improves performance on excluded sources.
The two-stage recipe transfers substantially better than training on log data alone. Adding general log data improves performance on excluded sources.
Source-stated
The authors report that Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, at a fraction of their serving cost; it trails them on attack-technique classification.
At a fraction of their serving cost, Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, but trails them on attack-technique classification.
Source-stated
The authors report good calibration on familiar sources but say Lev-3B confidently misses anomalies on the excluded logging system.
Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies.
Source-stated
The authors say they release the checkpoint, recipe, data manifests and prediction-level artifacts.
We release the checkpoint, recipe, data manifests, and prediction-level artifacts.
Source and contributor context
Betthauser, Leo, Liu, Yingqi, Shah, Uday, Wei, Jishang, Galhotra, Sainyam, Gou, Liang, Dharnidharka, Vedant, Yang, Hao · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Frontier model
One of the most capable AI models available at a given time; the set shifts as models improve.
Model calibration
Whether a model's stated confidence matches how often it turns out to be right.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: ecedcafd-830d-43ac-84a5-006114876bd1.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-11T08:38:39.260Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: d617c83758146f71bddd17653e3f730c9483f04c969023d2f652628f731599b2. Source text hash: fcf3ad78715359db28d45ed9673bceb0b955db8c5ce02e9bd5de7aca3828b7b2.
Revision and source-check history
Version 1 · 2026-11-11T08:38:39.260Z
arXiv cs.AI paper: Lev-3B argues a two-stage training recipe helps compact models analyze logs
The authors of Lev-3B present a 3-billion-parameter model for log-analysis decisions, such as detecting anomalous sessions or identifying attack techniques. Their central claim is about the training recipe: teach the model to make bounded decisions before exposing it to logs, then mix target tasks with general log data. They report that this two-stage approach transfers better than training on log data alone, and that general log data improves results on sources excluded from training. On anomaly detection, Lev-3B outperforms prompted , including on an excluded logging system, at a fraction of their serving cost. But it trails those models on attack-technique classification, and its probabilities, though on familiar sources, confidently miss anomalies on the excluded system. The contrast matters: lower serving cost and strong results on one task do not mean dependable performance across unfamiliar systems or tasks. The authors release the checkpoint, recipe, data manifests and prediction-level artifacts, making their approach available for inspection. How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection?
Original source
cs.AI · Article
Source details
Original source date: Oct 28, 2026 (2026-10-28).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-11T08:38:39.260Z. First observed: 2026-10-30T06:45:32.828Z. Retrieved: 2026-10-31T11:31:40.793Z.
Limits
The evidence is the abstract; it does not provide detailed evaluation results or explain the scope of the tested tasks and systems. The abstract reports a result on an excluded logging system but does not establish how performance or calibration will generalize to other unfamiliar systems.
Open question
How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection?
Source-stated
The authors present Lev-3B, a 3-billion-parameter decision model, and study a training recipe that first teaches bounded natural-language decisions without log data, then trains on target tasks mixed with general log data.
The recipe has two key parts. First, training follows a curriculum: the model learns bounded natural-language decisions, using no log data, before it sees any logs.
Source-stated
The authors report that the two-stage recipe transfers better than training on log data alone, and that general log data improves performance on excluded sources.
The two-stage recipe transfers substantially better than training on log data alone. Adding general log data improves performance on excluded sources.
Source-stated
The authors report that Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, at a fraction of their serving cost; it trails them on attack-technique classification.
At a fraction of their serving cost, Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, but trails them on attack-technique classification.
Source-stated
The authors report good calibration on familiar sources but say Lev-3B confidently misses anomalies on the excluded logging system.
Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies.
Source-stated
The authors say they release the checkpoint, recipe, data manifests and prediction-level artifacts.
We release the checkpoint, recipe, data manifests, and prediction-level artifacts.
Source and contributor context
Betthauser, Leo, Liu, Yingqi, Shah, Uday, Wei, Jishang, Galhotra, Sainyam, Gou, Liang, Dharnidharka, Vedant, Yang, Hao · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Frontier model
One of the most capable AI models available at a given time; the set shifts as models improve.
Model calibration
Whether a model's stated confidence matches how often it turns out to be right.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: ecedcafd-830d-43ac-84a5-006114876bd1.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-11T08:38:39.260Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: d617c83758146f71bddd17653e3f730c9483f04c969023d2f652628f731599b2. Source text hash: fcf3ad78715359db28d45ed9673bceb0b955db8c5ce02e9bd5de7aca3828b7b2.
passed · 2026-11-11T08:38:39.260Z · anthropic/claude-opus-5.5
Publication: ecedcafd-830d-43ac-84a5-006114876bd1
attribution — pass: The claims are consistently attributed to the paper's authors, and the arXiv source is identified. The paper's primary category is cs.LG and it is cross-listed in cs.AI; the 'arXiv cs.AI' label matches the publisher metadata and is not misleading.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI)
summary — pass: The reading faithfully conveys the two-stage recipe, the transfer results, the cost advantage, the anomaly-detection win, the attack-classification shortfall, the calibration failure on the excluded system and the release. Small fidelity repairs would help: restore 'substantially' in 'transfers substantially better', and keep the exact term 'bounded natural-language decisions' rather than shortening it. Terms such as calibrated and serving cost should be covered by term-library tooltips. The question is substantive and follows from the evidence.
The two-stage recipe transfers substantially better than training on log data alone.
date — pass: The originalPublished date of 2026-10-28 matches the v1 submission date shown on the arXiv page.
[Submitted on 28 Oct 2026]
support — pass: Every claim's excerpt appears verbatim in the source. The interpretive line saying strong results on one task do not mean dependable performance on unfamiliar systems is grounded in the source's own reported trade-offs. The limitations accurately note that the evidence is only the abstract.
Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies.
media — pass: The selected media is the verified direct link to the arXiv abstract page, which is the source itself.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
One of the most capable AI models available at a given time; the set shifts as models improve.
Definition referenceWhether a model's stated confidence matches how often it turns out to be right.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivOne of the most capable AI models available at a given time; the set shifts as models improve.
Definition referenceWhether a model's stated confidence matches how often it turns out to be right.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv