HIDBench - DARPA E3 THEIA: leaderboard
Metric: Matthews correlation coefficient of malicious-event detection times 100 (-100 to 100), from the HIDBench pipeline (attack-centric windows of host provenance-graph events serialized for the LLM, high-confidence evidence identification, k-hop context expansion, then attack narrative and indicator-of-compromise output) on the DARPA Engagement 3 THEIA host logs (121,263 events, 64 malicious); higher is better. Source: arxiv.org. Saturation forecast: Around May 2028. 9 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Claude Opus 4.6 | 28.3 |
| 2 | GPT-5.2 | 25.5 |
| 3 | Claude Sonnet 4.5 | 25 |
| 4 | GPT-4.1 | 25 |
| 5 | Claude Sonnet 4 | 22.4 |
| 6 | DeepSeek V3.2 | 22.1 |
| 7 | GPT-OSS-120B | 21.6 |
| 8 | Qwen 3.6 Plus | 18.7 |
| 9 | Gemini 2.5 Flash | 17.7 |
Interactive version: theaggregate.ai/benchmark?slug=hidbench-darpa-e3-theia · How It Works · Data refreshed daily, snapshot 2026-10-07.