# arXiv cs.AI paper: Lev-3B argues a two-stage training recipe helps compact models analyze logs [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-paper-lev-3b-argues-a-two-stage-training-recipe-ded92384) The authors of Lev-3B present a 3-billion-parameter model for log-analysis decisions, such as detecting anomalous sessions or identifying attack techniques. Their central claim is about the training recipe: teach the model to make bounded decisions before exposing it to logs, then mix target tasks with general log data. They report that this two-stage approach transfers better than training on log data alone, and that general log data improves results on sources excluded from training. On anomaly detection, Lev-3B outperforms prompted frontier models, including on an excluded logging system, at a fraction of their serving cost. But it trails those models on attack-technique classification, and its probabilities, though well calibrated on familiar sources, confidently miss anomalies on the excluded system. The contrast matters: lower serving cost and strong results on one task do not mean dependable performance across unfamiliar systems or tasks. The authors release the checkpoint, recipe, data manifests and prediction-level artifacts, making their approach available for inspection. How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection? Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Oct 28, 2026 (2026-10-28). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-11T08:38:39.260Z. First observed: 2026-10-30T06:45:32.828Z. Retrieved: 2026-10-31T11:31:40.793Z. - [Lev-3B: A Data Recipe for Compact Probabilistic Log Decision Models](https://arxiv.org/abs/2610.38915) ## Limits The evidence is the arXiv abstract; it does not provide detailed evaluation results or explain the scope of the tested tasks and systems. The abstract reports a result on an excluded logging system but does not establish how performance or calibration will generalize to other unfamiliar systems. ## Open question How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection? ## Source-stated The authors present Lev-3B, a 3-billion-parameter decision model, and study a training recipe that first teaches bounded natural-language decisions without log data, then trains on target tasks mixed with general log data. > The recipe has two key parts. First, training follows a curriculum: the model learns bounded natural-language decisions, using no log data, before it sees any logs. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors report that the two-stage recipe transfers better than training on log data alone, and that general log data improves performance on excluded sources. > The two-stage recipe transfers substantially better than training on log data alone. Adding general log data improves performance on excluded sources. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors report that Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, at a fraction of their serving cost; it trails them on attack-technique classification. > At a fraction of their serving cost, Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, but trails them on attack-technique classification. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors report good calibration on familiar sources but say Lev-3B confidently misses anomalies on the excluded logging system. > Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors say they release the checkpoint, recipe, data manifests and prediction-level artifacts. > We release the checkpoint, recipe, data manifests, and prediction-level artifacts. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source and contributor context Betthauser, Leo, Liu, Yingqi, Shah, Uday, Wei, Jishang, Galhotra, Sainyam, Gou, Liang, Dharnidharka, Vedant, Yang, Hao · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Frontier model One of the most capable AI models available at a given time; the set shifts as models improve. - [Definition reference](https://www.gov.uk/government/publications/frontier-ai-capabilities-and-risks-discussion-paper) ## Model calibration Whether a model's stated confidence matches how often it turns out to be right. - [Definition reference](https://en.wikipedia.org/wiki/Calibration_%28statistics%29) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: ecedcafd-830d-43ac-84a5-006114876bd1. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-11T08:38:39.260Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: d617c83758146f71bddd17653e3f730c9483f04c969023d2f652628f731599b2. Source text hash: fcf3ad78715359db28d45ed9673bceb0b955db8c5ce02e9bd5de7aca3828b7b2. ## Revision and source-check history ### Version 1 — 2026-11-11T08:38:39.260Z The authors of Lev-3B present a 3-billion-parameter model for log-analysis decisions, such as detecting anomalous sessions or identifying attack techniques. Their central claim is about the training recipe: teach the model to make bounded decisions before exposing it to logs, then mix target tasks with general log data. They report that this two-stage approach transfers better than training on log data alone, and that general log data improves results on sources excluded from training. On anomaly detection, Lev-3B outperforms prompted frontier models, including on an excluded logging system, at a fraction of their serving cost. But it trails those models on attack-technique classification, and its probabilities, though well calibrated on familiar sources, confidently miss anomalies on the excluded system. The contrast matters: lower serving cost and strong results on one task do not mean dependable performance across unfamiliar systems or tasks. The authors release the checkpoint, recipe, data manifests and prediction-level artifacts, making their approach available for inspection. How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection? ## Original source arXiv cs.AI · Article Original source date: Oct 28, 2026 (2026-10-28). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-11T08:38:39.260Z. First observed: 2026-10-30T06:45:32.828Z. Retrieved: 2026-10-31T11:31:40.793Z. - [Lev-3B: A Data Recipe for Compact Probabilistic Log Decision Models](https://arxiv.org/abs/2610.38915) ## Limits The evidence is the arXiv abstract; it does not provide detailed evaluation results or explain the scope of the tested tasks and systems. The abstract reports a result on an excluded logging system but does not establish how performance or calibration will generalize to other unfamiliar systems. ## Open question How well would the reported performance and calibration hold across additional logging systems not used for training, calibration or model selection? ## Source-stated The authors present Lev-3B, a 3-billion-parameter decision model, and study a training recipe that first teaches bounded natural-language decisions without log data, then trains on target tasks mixed with general log data. > The recipe has two key parts. First, training follows a curriculum: the model learns bounded natural-language decisions, using no log data, before it sees any logs. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors report that the two-stage recipe transfers better than training on log data alone, and that general log data improves performance on excluded sources. > The two-stage recipe transfers substantially better than training on log data alone. Adding general log data improves performance on excluded sources. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors report that Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, at a fraction of their serving cost; it trails them on attack-technique classification. > At a fraction of their serving cost, Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, but trails them on attack-technique classification. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors report good calibration on familiar sources but say Lev-3B confidently misses anomalies on the excluded logging system. > Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source-stated The authors say they release the checkpoint, recipe, data manifests and prediction-level artifacts. > We release the checkpoint, recipe, data manifests, and prediction-level artifacts. - [Supporting source](https://arxiv.org/abs/2610.38915) ## Source and contributor context Betthauser, Leo, Liu, Yingqi, Shah, Uday, Wei, Jishang, Galhotra, Sainyam, Gou, Liang, Dharnidharka, Vedant, Yang, Hao · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Frontier model One of the most capable AI models available at a given time; the set shifts as models improve. - [Definition reference](https://www.gov.uk/government/publications/frontier-ai-capabilities-and-risks-discussion-paper) ## Model calibration Whether a model's stated confidence matches how often it turns out to be right. - [Definition reference](https://en.wikipedia.org/wiki/Calibration_%28statistics%29) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: ecedcafd-830d-43ac-84a5-006114876bd1. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-11T08:38:39.260Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: d617c83758146f71bddd17653e3f730c9483f04c969023d2f652628f731599b2. Source text hash: fcf3ad78715359db28d45ed9673bceb0b955db8c5ce02e9bd5de7aca3828b7b2. ### passed — 2026-11-11T08:38:39.260Z — anthropic/claude-opus-5.5 Publication: ecedcafd-830d-43ac-84a5-006114876bd1 attribution — pass: The claims are consistently attributed to the paper's authors, and the arXiv source is identified. The paper's primary category is cs.LG and it is cross-listed in cs.AI; the 'arXiv cs.AI' label matches the publisher metadata and is not misleading. > Machine Learning (cs.LG); Artificial Intelligence (cs.AI) summary — pass: The reading faithfully conveys the two-stage recipe, the transfer results, the cost advantage, the anomaly-detection win, the attack-classification shortfall, the calibration failure on the excluded system and the release. Small fidelity repairs would help: restore 'substantially' in 'transfers substantially better', and keep the exact term 'bounded natural-language decisions' rather than shortening it. Terms such as calibrated and serving cost should be covered by term-library tooltips. The question is substantive and follows from the evidence. > The two-stage recipe transfers substantially better than training on log data alone. date — pass: The originalPublished date of 2026-10-28 matches the v1 submission date shown on the arXiv page. > \[Submitted on 28 Oct 2026\] support — pass: Every claim's excerpt appears verbatim in the source. The interpretive line saying strong results on one task do not mean dependable performance on unfamiliar systems is grounded in the source's own reported trade-offs. The limitations accurately note that the evidence is only the abstract. > Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies. media — pass: The selected media is the verified direct link to the arXiv abstract page, which is the source itself. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/ded92384cf77b9565748865ef262a97fc046d5ba13c4272c10d2b2e7bfca97e6/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-paper-lev-3b-argues-a-two-stage-training-recipe-ded92384.json)