DFIR tooling still hands its telemetry to LLMs as one big JSON dump. At scale that is a context-exhaustion engine: latency climbs, the model starts hallucinating, and the analyst has to re-verify everything it said.
Our new paper asks a narrow question: does the shape of the serialization matter more than the model?
We benchmarked Google's Open Knowledge Format (OKF v0.1) — a graph-native, selectively traversable format — against flat JSON, using 7,680 inference cycles across five open-source model architectures with escalating decoy densities (four difficulty tiers).
Results, relative to JSON:
- Hallucination suppressed by 81.1% at the hardest tier
- Token overhead cut by 33.6%
- Noise-invariant recall sustained at 0.94–0.99 as decoys increased
The useful part is not "OKF is better". It's the mechanism: when the model can traverse to the relevant subgraph instead of ingesting a monolithic dump, context stays small and grounded — so the failure mode that produces hallucination never gets loaded in the first place.
If your incident-response agent ingests JSON telemetry, this is a format decision you can test before you touch the model.
Paper: https://sushantpoudel2028.com.np/publications/okf-dfir
More writing, including the negative results: https://sushantpoudel2028.com.np/writing
