Attribution-Driven Explainable Intrusion Detection with Encoder-Based Large Language Models

ArXi:2604.06266v1 Announce Type: cross Software-Defined Networking (SDN) improves network flexibility but also increases the need for reliable and interpretable intrusion detection. Large Language Models (LLMs) have recently been explored for cybersecurity tasks due to their strong representation learning capabilities; however, their lack of transparency limits their practical adoption in security-critical environments. Understanding how LLMs make decisions is therefore essential.