Evaluating Google's Open Knowledge Format (OKF v0.1) for Multi-Agent Threat Intelligence: A Proof-of-Concept in Digital Forensics

Large Language Models (LLMs) are reshaping Digital Forensics and Incident Response (DFIR), but the unstructured JSON telemetry these systems still rely on has become a critical bottleneck for autonomous multiagent threat intelligence pipelines. In highnoise forensic environments, ingesting monolithic data dumps drives context exhaustion, inflates latency, and triggers hallucination rates severe enough to undermine operational integrity. This paper evaluates Google’s Open Knowledge Format (OKF v0.1) as a selectively traversable, graphnative alternative to flat serialization. Through a controlled benchmark of 7,680 inference cycles spanning five open-source model architectures and escalating decoy densities, we show that OKF Selective sustains noiseinvariant recall (0.94–0.99), cuts token overhead by 33.6%, and suppresses hallucination by 81.1% at the hardest of four difficulty tiers relative to a JSON baseline, which itself degrades from 33% to 92% error across those tiers. These results establish that semantic knowledge representation is not simply an engineering optimization — it is an architectural prerequisite for trustworthy autonomous cyber defense.

No artifact released. This paper reports measurements, but its code, corpus and raw outputs are not public, so the numbers above cannot be independently checked. Treat the results as unreproduced.

@misc{poudel2026evaluatingdfir,
  title  = {Evaluating Google's Open Knowledge Format (OKF v0.1) for Multi-Agent Threat Intelligence: A Proof-of-Concept in Digital Forensics},
  author = {Sushant Poudel and Rakhee Pandey},
  year   = {2026},
  note   = {IC-AICSE 2026 — Everest Engineering College, Nepal; 7 October 2026},
  url    = {https://sushantpoudel2028.com.np/papers/okf-dfir.pdf}
}

Claims about his own work that the ledger covers are re-checked weekly against their public source by sushant-me/reputation — 27 claims today, 19 checked live. Coverage is stated rather than implied: it does not yet extend to every manuscript listed here. The reproducibility note above is part of that record: where no artifact exists, the page says so instead of implying one.