Paper artifact

Reproduce the TGCM experiments

The artifact follows the current figure and table numbering used in the manuscript. Selected reviewer-ready notebooks are available now, while the remaining executable materials are being prepared for release.

Browse experiments

Experiment index

Paper-to-artifact mapping

Reviewer-ready notebooks are enabled for the Figure 4 LLM baseline, kill-chain coverage, zero-shot performance, DARPA robustness, unknown-K sensitivity, and embedding sensitivity. Main-paper and appendix table numbers below follow the current manuscript. Each enabled notebook starts with its environment and required evaluation assets and can be run independently of the other notebooks.

Figure 4

Blind unknown-K comparison

TGCM, DANet, MossFormer2, DECOMPOSE, OpenAI, and Gemini across K=2 through K=6.

READMEFull notebookDownload LLM notebook Download LLM prompt

Table III

Kill-chain coverage

Unique-technique ATT&CK tactic coverage for ATLAS, NODLINK, ProvCon, DARPA TC-E3, DARPA TC-E5, and CAPTure.

README Download notebook Zero-shot mapping CAPTure coverage

Table IV · Appendix Table XIII

Zero-shot performance

Five-seed TGCM and DANet evaluation on ATLAS, NODLINK, ProvCon, DARPA TC-E3, and naturally interleaved DARPA TC-E5.

README Download notebook

Table VI · Appendix Table XXIII

DARPA robustness

Missing, confusion, and insertion perturbations over the complete DARPA TC-E5 evaluation grid.

README Download notebook

Table VII · Appendix Table XXI

CAPTure evaluation

Pooled single-host and multi-host evaluation using SFM, Zoomer, and TREC outputs.

READMENotebook

Appendix Table XXII

Unknown-K sensitivity

Known-K versus Up-to-6 decoding from identical TGCM forward outputs.

README Download notebook

Appendix Table XXV

Embedding sensitivity

Seven topic-encoder families, five seeds, and mixture levels K=2 through K=6 under fixed-slot evaluation.

README Download notebook

Environment

Quick setup

conda env create -f environment.yml
conda env create -f 01_Figure04_Blind_Unknown_K/environment_decompose.yml
conda activate tgcm-review
python -m ipykernel install --user --name tgcm-review --display-name "TGCM reviewer"
jupyter lab

Large data and model assets: the full 822.44 GiB CAPture CSV snapshot is not required by the currently enabled notebooks. Each notebook lists exactly which compact evaluation assets/checkpoints it needs at the top.