AuditBench - Lab Attack Classification: leaderboard

AuditBench (2026) evaluates LLMs on security investigations over system audit logs read in 400-line chunks. This board is the F1 score (0 to 100) for classifying provenance-graph log chunks as malicious or benign on the Lab data (Linux and Windows audit logs recorded by the benchmark authors), with 5 attack and 5 benign scenarios. Higher is better.

Metric: F1 (0-100) for attack classification (is a log chunk malicious or benign) on the Lab data (Linux and Windows audit logs recorded by the authors) (5 attack and 5 benign scenarios): the model reads the scenario's edge-representation (provenance-graph edges, 400-line chunks) audit logs in chunks with prompt v2 and flags malicious log chunks; recall counts the attack scenarios found and precision counts false-positive chunks out of 21; temperature 0 where available (GPT-5 models at the default medium reasoning effort); higher is better. Source: arxiv.org. Saturation forecast: Estimated already saturated. 5 models tracked.

Top models

No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.

Interactive version: theaggregate.ai/benchmark?slug=auditbench-lab-attack-classification · How It Works · Data refreshed daily, snapshot 2026-11-13.