DiagChain: leaderboard
DiagChain (Tsinghua University, 2026) tests LLM agents that reconstruct ordered attack chains from multi-system security telemetry with an evidence-retrieval scaffold, over 69 cases built from open-source logs in clean, noisy and raw evidence profiles. The score is the percentage of the 849 coverable reference steps reconstructed with no failure at any stage (evidence observed, used, fully attributed and correctly ordered); higher is better.
Metric: Correctly reconstructed reference steps (%; share of the 849 coverable reference steps of MAIN-69's 69 cases, pooled over the clean, noisy and raw evidence profiles; attack-chain reconstruction from heterogeneous telemetry with the ECRAG evidence-retrieval scaffold; a step counts when its evidence is observed, used, fully attributed and correctly ordered, with no earlier failure; temperature 0). Source: arxiv.org. Saturation forecast: Around June 2027. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5.5 | 39.58 | #49 |
| 2 | GLM-5.2 (High) | 28.15 | #138 (GLM-5.2) |
| 3 | GLM-5.2 (Non-reasoning) | 25.32 | #138 (GLM-5.2) |
| 4 | DeepSeek V4 Pro (Non-reasoning) | 20.26 | #188 (DeepSeek V4 Pro) |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=diagchain · How It Works · Data refreshed daily, snapshot 2026-11-13.