Xuan Tian

Yidong Chai, Yanguang Liu, Xuan Tian et al.

We study investor learning and information acquisition in private markets using a large dataset of expert network calls. We develop a sequential Large Language Model (LLM)-Bayesian framework that treats expert interactions as sequential signals and recovers time-varying beliefs about firm success and associated uncertainty from unstructured conversations, providing a measurement system for how qualitative information is aggregated into investment expectations. We show that expert network calls contain decision-relevant information: a single call increases subsequent investment probability by 6.9 to 9.0 percentage points, while positive sentiment raises deal likelihood by 3.9 to 4.1 percentage points. Informativeness varies across topics and environments: discussions of technology adoption and customer acquisition increase deal probability by up to 14.7 percentage points, particularly in high-uncertainty settings. Information is asymmetric across horizons, with positive signals predicting short-term investment decisions and negative signals more informative about long-run firm performance. Consistent with a belief-based mechanism, investment decisions respond to inferred beliefs rather than raw signals. A one standard deviation increase in success belief raises deal probability by approximately 11 percentage points, while reductions in uncertainty further increase investment likelihood. Our framework improves capital allocation, increasing portfolio returns by 15.26% and F1 by 6.69%, with gains concentrated in the upper tail. Attention and ablation analyses show that conversational cues are particularly informative for technologically complex startups, young firms, diverse founding teams, and firms with low public visibility, where information frictions are severe.

Jiaren Peng, Zeqin Li, Chang You et al.

The rapid advancement of Large Language Models (LLMs) has created new opportunities for Automated Penetration Testing (AutoPT), spawning numerous frameworks aimed at achieving end-to-end autonomous attacks. However, despite the proliferation of related studies, existing research generally lacks systematic architectural analysis and large-scale empirical comparisons under a unified benchmark. Therefore, this paper presents the first Systematization of Knowledge (SoK) focusing on the architectural design and comprehensive empirical evaluation of current LLM-based AutoPT frameworks. At systematization level, we comprehensively review existing framework designs across six dimensions: agent architecture, agent plan, agent memory, agent execution, external knowledge, and benchmarks. At empirical level, we conduct large-scale experiments on 13 representative open-source AutoPT frameworks and 2 baseline frameworks utilizing a unified benchmark. The experiments consumed over 10 billion tokens in total and generated more than 1,500 execution logs, which were manually reviewed and analyzed over four months by a panel of more than 15 researchers with expertise in cybersecurity. By investigating the latest progress in this rapidly developing field, we provide researchers with a structured taxonomy to understand existing LLM-based AutoPT frameworks and a large-scale empirical benchmark, along with promising directions for future research.

Jiaren Peng, Hongda Sun, Xuan Tian et al.

The automation of Cyber Threat Intelligence (CTI) relies heavily on Named Entity Recognition (NER) to extract critical entities from unstructured text. Currently, Large Language Models (LLMs) primarily address this task through retrieval-based In-Context Learning (ICL). This paper analyzes this mainstream paradigm, revealing a fundamental flaw: its success stems not from global semantic similarity but largely from the incidental overlap of entity types within retrieved examples. This exposes the limitations of relying on unreliable implicit induction. To address this, we propose TTPrompt, a framework shifting from implicit induction to explicit instruction. TTPrompt maps the core concepts of CTI's Tactics, Techniques, and Procedures (TTPs) into an instruction hierarchy: formulating task definitions as Tactics, guiding strategies as Techniques, and annotation guidelines as Procedures. Furthermore, to handle the adaptability challenge of static guidelines, we introduce Feedback-driven Instruction Refinement (FIR). FIR enables LLMs to self-refine guidelines by learning from errors on minimal labeled data, adapting to distinct annotation dialects. Experiments on five CTI NER benchmarks demonstrate that TTPrompt consistently surpasses retrieval-based baselines. Notably, with refinement on just 1% of training data, it rivals models fine-tuned on the full dataset. For instance, on LADDER, its Micro F1 of 71.96% approaches the fine-tuned baseline, and on the complex CTINexus, its Macro F1 exceeds the fine-tuned ACLM model by 10.91%.