Plausible Is Not Faithful: Auditing LLM-Generated Explanations of Network Intrusion Alerts Against the Detector They Describe

Large language models (LLMs) are used to explain the alerts of machine-learning intrusion detectors to analysts. Such explanations are evaluated for plausibility or for agreement with a supplied attribution table, which does not test their central claim: that the detector flagged the flow because of the stated features. We audit that claim on the detector. Three open-weight LLMs of at most 8B parameters explain 1,111 alerts of gradient-boosted detectors trained on CIC-IDS2017, CSE-CIC-IDS2018 and UNSW-NB15, including two with a planted shortcut feature and one under dataset shift. Cited features are removed from, or isolated in, the flow, and the change in detector log-odds is compared with size-matched random and TreeSHAP references. Flow-only explanations are near the random reference on the CIC detectors (normalised comprehensiveness −0.08 to 0.10), disclose a planted shortcut in at most 10% of alerts and judge 3,332 of 3,333 alerts, every false positive included, to be real attacks. Given a ranked top-5 attribution the LLMs cite the right features, but only because of the ranking: with the same attribution unsorted, normalised comprehensiveness is −0.03 to 0.77 across models. Even with the ranked list, features that pushed the detector toward benign are described as pushing toward malicious in 57%, 23% and 0.1% of cases, and two of the three models endorse 79–100% of the false alerts caused solely by the shortcut. A deterministic verifier removes the direction errors but does not correct the judgement. For local models of this size, a plausible alert explanation is not thereby faithful.