The Cognitive Fingerprint: LLM-Resistant Cross-Domain Threat Actor Attribution via Temporal-Syntactic Fusion

[TechRxiv] Manish Tripathy released a preprint on March 5 proposing a cross-domain threat actor attribution framework that bypasses the "LLM wall." The paper states that existing attribution methods based on semantic features such as BERT and RoBERTa approach random accuracy under adversarial style transfer. The framework instead uses behavioral signal processing: Logical Time Difference of Arrival (L-TDoA) draws on the mathematics of electronic warfare signal propagation to measure "cognitive delay," while SynGNN learns identity based on deep syntactic embeddings such as dependency tree structure and part-of-speech transitions rather than lexical content. The author reports that under fully structurally stripped conditions, SynGNN recovers 78.6% (95% CI: 75.4-81.8%) of identities, while BERT-type models drop to 12.4%; in a controlled adversarial scenario with 200 candidate suspects, the fused simulation achieves an overall precision of 91.7% (95% CI: 88.3-94.1%). The study is positioned as a TRL 3 foundational framework.