Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Linux Tipps & HardeningSecurity: Ausführen beliebiger Kommandos in evolution-ews (Fedora)(24.09.2026 um 07:47 Uhr)
Linux Tipps & HardeningSecurity: Mehrere Probleme in mingw-pcre2 (Fedora)(24.09.2026 um 07:47 Uhr)
Linux Tipps & HardeningSecurity: Denial of Service in nginx-mod-js-challenge (Fedora)(24.09.2026 um 07:47 Uhr)
Unix & Linux ServerSecurity: Mehrere Probleme in ipa (Red Hat)(24.09.2026 um 07:48 Uhr)
Sichere ProgrammierungWhy easing makes animation feel alive(24.09.2026 um 06:27 Uhr)
Sichere ProgrammierungMCP tool poisoning: Defending Against Metadata Manipulation in 2026(24.09.2026 um 06:32 Uhr)
Sicherheitslücken (CVE)What is a Software Bill of Materials (SBOM) and why your team needs one(24.09.2026 um 06:39 Uhr)
Linux Tipps & HardeningSecurity: Ausführen beliebiger Kommandos in evolution-ews (Fedora)(24.09.2026 um 07:47 Uhr)
Linux Tipps & HardeningSecurity: Mehrere Probleme in mingw-pcre2 (Fedora)(24.09.2026 um 07:47 Uhr)
Linux Tipps & HardeningSecurity: Denial of Service in nginx-mod-js-challenge (Fedora)(24.09.2026 um 07:47 Uhr)
Unix & Linux ServerSecurity: Mehrere Probleme in ipa (Red Hat)(24.09.2026 um 07:48 Uhr)
Sichere ProgrammierungWhy easing makes animation feel alive(24.09.2026 um 06:27 Uhr)
Sichere ProgrammierungMCP tool poisoning: Defending Against Metadata Manipulation in 2026(24.09.2026 um 06:32 Uhr)
Sicherheitslücken (CVE)What is a Software Bill of Materials (SBOM) and why your team needs one(24.09.2026 um 06:39 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

More Context Made My Classifier Worse: Building a Machine-Maintained Failure Taxonomy

You ran an eval. The dashboard says 80% accuracy. Now what? For most teams, the answer is surprisingly manual. Someone exports failures, copies a few examples into a document, writes some notes, maybe creates a ticket or two, and then…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

You ran an eval. The dashboard says 80% accuracy. Now what?



For most teams, the answer is surprisingly manual. Someone exports failures, copies a few examples into a document, writes some notes, maybe creates a ticket or two, and then moves on. By the next eval run, those notes are already stale. The failures have changed, new ones have appeared, and nobody remembers whether a particular issue is actually new or something that has been showing up for weeks.



The bottleneck is not running the eval. It is closing the feedback loop.




Without a structured path from failure → diagnosis → prompt improvement, evals become scoreboards rather than engineering tools.




Recently I ran into exactly this problem while working on a local MLX-based classifier that maps developer work sessions to Jira tickets.



The classifier is evaluated against a golden dataset of 40 hand-authored developer sessions. Each session targets a specific failure mode: hard decoys, overhead work, untracked activity, ambiguous evidence, and other edge cases that show up in real engineering environments.



After a few iterations, I had run the eval three times. I also had 62 failures.



What I did not have was a reliable way to answer basic questions:




  • Which failures keep showing up?

  • Which prompt changes helped?

  • Are the failures random, or manifestations of the same underlying issue?

  • What is the highest-leverage thing to fix next?



The traditional approach — maintaining notes manually — breaks down almost immediately. Notes become outdated after the second run. There is no consistent structure. Nobody tracks recurrence. And reviewing dozens of failures turns into a forensic exercise every time.






The key insight



The eval was already producing everything I needed. Every failure had structured evidence: a trace, a span, the model's prediction, the expected answer, the classifier's reasoning. The problem was not interpretation. The problem was extraction and organisation.



That is where I started using a Claude Code skill. A Claude Code skill is essentially a markdown file containing a repeatable workflow: some frontmatter, a procedure, and a set of allowed tools. In my case, the skill is invoked manually with:




/eval-feedback






It is not an autonomous agent and it does not run continuously. It is simply a repeatable post-eval analysis workflow — a perfect fit for evaluating classifier failures.






The data structure



The most important design decision was not the skill itself. It was the data structure it writes to: a machine-maintained file called FEEDBACK.json.



Machine-maintained is the important part. Humans are terrible at keeping failure logs up to date. Structured JSON does not have that problem. It can be queried, diffed, aggregated, and analysed across runs without anyone manually curating it.



The file contains three top-level arrays:




{
"runs": [],
"observations": [],
"failure_classes": []
}






runs stores evaluation-level metadata and metrics. observations stores individual failure evidence. failure_classes stores named patterns that persist across multiple runs.






Three design decisions



First: a lean-read pattern. Instead of loading the entire file into context every time, the skill pulls only targeted slices using jq — recent runs, open failure classes, matching observations, summary statistics. This lets the file grow indefinitely without consuming large amounts of context. Based on current usage, roughly 20 KB of additional data per run.



Second: updates through a small Python append workflow — load → mutate → write. The skill never edits JSON directly.



Third, and most valuable: every observation contains a failure_class_id. That single field links individual failures to a persistent failure pattern. When the same pattern appears again, its occurrence count increases automatically. Recurring problems rise to the top without any manual prioritisation.






What the taxonomy revealed



After three runs, the system identified 10 named failure classes across 62 observations. One class dominated everything else. I called it optimism-bias. It appeared 27 times across all three runs.



The pattern was consistent: whenever the classifier encountered any adjacent signal — a mention in a document, a related article, a matching keyword, or a topically similar file path — it tended to classify the session as belonging to the target task with high confidence.



Even more interesting was what happened during a context experiment. I removed a 2,500-character OCR truncation limit, expecting additional context to improve accuracy. The opposite happened. Performance got worse. The classifier became more confident in incorrect predictions because the additional context provided more opportunities to find loosely related evidence.



Without the structured cross-run view, I probably would have concluded the model needed more data. Instead, the evidence pointed somewhere else entirely: the issue was not data volume. It was prompt design.






The broader lesson



AI systems are often very good at analysing the failures of other AI systems. The classifier's reasoning output turned out to be the richest signal in the entire pipeline. It exposed exactly which evidence the model was over-weighting and why a prediction seemed reasonable from the model's perspective.



Reading the reasoning traces and clustering them into recurring failure modes is precisely the kind of task an LLM excels at. Once those patterns are captured in a structured format, the same system can generate prompt changes targeted at specific failure classes.






How to replicate this



You do not need much:




  • An eval that emits structured traces (OpenTelemetry or similar)

  • A golden dataset with expected outputs

  • A place to persist observations across runs



The skill itself is only a couple hundred lines of markdown describing the workflow, schema, and guardrails. The underlying idea generalises well beyond classifiers. Any system where you are running repeated experiments can benefit from a persistent failure taxonomy that accumulates evidence over time.



Because the loop does not close when you hit 95% accuracy.



The loop closes when the failure taxonomy starts driving the next prompt revision.






Key findings




  1. 10 named failure classes across 62 observations


  2. optimism-bias accounted for 27 of them

  3. More context made accuracy worse, not better

  4. The fix was prompt design, not more data

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Vulnerability Remediation & Verification
title: Detect Exploitation - More Context Made My Classifier Worse: Building a Machine-Maintained Failure Taxonomy
id: ee6f1f8a-92ab-4939-81e5-9cdb631de48d
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "More Context Made My Classifie" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich More Context Made My Classifier Worse: B.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten More Context Made My Classifier Worse: Building a Machine-Maintained Failure Taxonomy

Thematisch verwandte Begriffe: More, Context, Made, Classifier · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-96676 | A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impa…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick