Sleuth: Multi-Domain Investigative Systems

• Sleuth is a cross-domain term that denotes techniques and systems designed to recover latent structure from incomplete, noisy, or disorganized evidence.
• Applications range from no-code text classification and multimodal QA to collider anomaly searches, urban growth simulation, forensic reconstruction, and slitless spectroscopy analysis.
• These methods employ structured inference strategies, such as active learning, hierarchical evidence refinement, and taint analysis, to produce actionable insights.

“Sleuth” and “SLEUTH” are recurrent names in contemporary research for systems, algorithms, and investigative frameworks concerned with recovering latent structure from incomplete, noisy, or weakly organized evidence. In the literature represented here, the term spans no-code text classification, multimodal long-document question answering, misinformation fact-checking, smart-contract fraud detection, collider anomaly search, cellular-automata urban growth simulation, host- and web-forensics, slitless-spectroscopy analysis, and historical or literary discussions of investigative method (Shnarch et al., 2022, Liu et al., 28 Nov 2025, Renkel, 2011, Nahavandya et al., 2017, Hossain et al., 2018, Estrada-Carpenter et al., 1 Aug 2025, Olson et al., 2012, Lima et al., 12 May 2025). The shared name does not denote a single technical lineage; rather, it marks a family of practices organized around search, evidence reduction, provenance, and reconstruction.

1. Polysemy and named systems

The research uses of the name are diverse enough that “Sleuth” functions more as a cross-domain label than as a single method. In some cases it is an acronym; in others it is a metaphor for disciplined detection or inference (Liu et al., 28 Nov 2025, Nahavandya et al., 2017).

Name	Domain	Core role
Label Sleuth	NLP	No-code binary text-classifier creation
SLEUTH	Long-document understanding	Multi-agent context engineering
Truth Sleuth	Misinformation analysis	YouTube claim extraction and fact-checking
PonziSleuth	Smart-contract security	LLM-based Ponzi-contract detection
SLEUTH	Collider physics	High-$p_T$ tail anomaly search
SLEUTH	Urban modeling	Cellular-automata urban growth simulation
SLEUTH	Host security	Real-time attack reconstruction from audit logs
Sleuth	Slitless spectroscopy	Spatially resolved grism forward modeling
CyberSleuth	Blue-team forensics	Autonomous web-attack investigation

Two expansions are explicit in the source material. In long-document understanding, SLEUTH stands for Sequential Long-document Evidence Uncovering through mulTi-agent Hierarchical refinement (Liu et al., 28 Nov 2025). In urban growth modeling, SLEUTH stands for Slope, Land cover, Exclusion, Urban, Transportation, Hillshade (Nahavandya et al., 2017). Elsewhere, the name is descriptive rather than acronymic, as in “Label Sleuth,” “Truth Sleuth,” and the historical phrase “sleuth of the skies” for Caroline Herschel (Shnarch et al., 2022, Olson et al., 2012).

2. No-code and agentic language analysis

In NLP, Label Sleuth is a no-code, open-source system for turning an unlabeled text collection into a usable binary text classifier in a few hours. Its intended user is the domain expert rather than the data scientist, and its workflow integrates annotation, model training, active learning, model inspection, error analysis, and lightweight evaluation in a single interface. The default policy begins training after $20$ positively labeled examples, retrains after every $20$ additional labels, supplements the training set with weak negatives to maintain a $2{:}1$ negative-to-positive ratio when negatives are scarce, uses uncertainty sampling for active learning, and estimates precision by labeling $50$ predicted-positive examples. The default classifier is an ensemble of two SVMs, one over Bag-of-Words features and one over GloVe representations (Shnarch et al., 2022).

The same paper presents the system as deliberately narrow in scope. Each classifier is binary, the task assumes pre-segmented text elements, and the weak-negative heuristic should be disabled when the positive prior is not low. These constraints are part of the design logic: the system hides most ML decisions behind defaults so that lawyers, psychologists, analysts, editors, researchers, and other subject-matter experts can move from cold start to a workable classifier without building a bespoke ML stack (Shnarch et al., 2022).

A distinct later use of the name appears in long-document multimodal QA. The 2025 SLEUTH framework is a training-free, plug-and-play multi-agent system for long-document understanding in which evidence is sparse, scattered across pages, and distributed across modalities such as text, tables, charts, figures, and layout cues. It combines a coarse-grained visual retriever based on ColPali with four collaborative agents: a Clue Discovery Agent, a Page Screening Agent, a Difficulty Assessment Agent, and a Core Decision Agent. The system constructs what the paper calls a denoised, evidence-dense multimodal context before final answer generation, rather than asking a VLM to reason directly over the raw retrieved pages (Liu et al., 28 Nov 2025).

Its reported results are benchmark-level rather than anecdotal. On MMLongBench-Doc, SLEUTH reaches 52.77% average accuracy; on LongDocURL, 59.96 average; on PaperTab, 43.09; and on FetaTab, 70.46. The paper attributes these gains to hierarchical evidence refinement and also notes an important limitation: the framework is retrieval-dependent, so if the initial retriever misses a critical page, downstream agents cannot recover it (Liu et al., 28 Nov 2025).

3. Verification, misinformation, and code semantics

In misinformation research, Truth Sleuth is the fact-checking component of a two-agent YouTube intervention system completed by Trend Bender. Truth Sleuth retrieves video title, channel information, and raw audio captions via the YouTube API; reformats captions; extracts claims; rewrites them as fact-checkable questions; queries Wikipedia, Google Search, and Google FactCheck ClaimReview; and assigns one of five verdicts: True, Partly True, Partly False, False, or Unsure. The final product is both a raw-text report for downstream use and a human-facing Markdown report with video thumbnail and color-coded verdict indicators; claims labeled Unsure are excluded from the final report shown to users (Cécile et al., 11 Jul 2025).

That system is evaluated on a 105-claim subset of FEVER and AVeriTeC. The paper reports 81% overall accuracy on the combined subset and 93% accuracy when Unsure cases are excluded. Trend Bender then uses the fact-check report, a theme-specific article corpus, and a seven-criterion self-evaluation loop to produce either a general comment or a targeted reply in the YouTube comment section (Cécile et al., 11 Jul 2025).

In blockchain security, Semantic Sleuth, implemented as PonziSleuth, applies the sleuthing metaphor to smart-contract semantics rather than discourse. It is presented as the first LLM-driven approach for Ponzi-contract detection that requires no labeled training data. The pipeline compiles Solidity source with Solc, parses it with Slither, seeds taint analysis from msg.sender and msg.value, constructs a taint propagation graph, slices functions interacting with tainted data, and then runs a two-step zero-shot chain-of-thought procedure: first analyze contract logic, then decide whether it satisfies a formal Ponzi definition. On the benchmark dataset, the reported balanced accuracy is 96.06% with GPT-3.5-turbo, 93.91% with LLAMA3, and 94.27% with Mistral. On 4,597 Etherscan-verified contracts from March 2024, the system reports 15 new Ponzi schemes, FNR = 0%, and FPR = 0.29% (Wu et al., 2024).

The paper is explicit that this system depends on source-code availability and that its static taint stage is intentionally approximate: over-tainting, infeasible branches, and overly persistent taint are acknowledged limitations. The purpose of taint analysis is not formal proof, but focused semantic prompting (Wu et al., 2024).

4. Physical search, simulation, and inverse reasoning

In collider physics, SLEUTH is the D0 collaboration’s quasi-model-independent algorithm for searching for excesses in the high-$p_T$ tails of event distributions. The global D0 search partitions data into 117 exclusive final states and examines 5543 distributions. SLEUTH uses a scalar variable described as the sum of the absolute values of object transverse momenta plus missing transverse energy,

$\sum_i |p_{T,i}| + \not\!\!E_T,$

then scans lower cuts on that variable to find the tail region with the smallest consistency probability $\tilde P$. After accounting for trials factors, a final state is treated as discrepant if the post-trials probability is below $10^{-3}$. In the reported analysis of $1~\mathrm{fb}^{-1}$, no evidence of new physics was found; the leading discrepancies were traced to detector-modeling issues (Renkel, 2011).

In urban science, the name denotes a much older and entirely different framework. The SLEUTH urban growth model is a modified cellular automata model built on a regular lattice, discrete time, and a $20$0 Moore neighborhood. The Tehran study uses Landsat TM and ETM imagery from 1988, 1992, 1998, 2001, and 2010, calibrates the model by staged brute-force search with 100 Monte Carlo iterations per phase, and compares three policy scenarios encoded through the exclusion layer. The reported result is that the historical-trend scenario produces the greatest growth rate, while the third, polycentric scenario is judged more suitable for Tehran because it could avoid undesirable effects such as congestion and pollution and was more in accordance with the conditions of Tehran city (Nahavandya et al., 2017).

The name also appears in a satirical but conceptually serious inverse-problems paper, which treats the detective’s task as reconstruction of hidden causes from measurements and a dynamical model. There the “sleuth” is explicitly framed as an optimizer navigating model space under uncertainty. The paper’s point is that culprit identification is fragile whenever measurements are insufficient or the model is incomplete, because multiple degenerate solutions may fit the evidence equally well (Armstrong, 2023).

5. Cybersecurity and forensic reconstruction

In host security, SLEUTH is a real-time system for reconstructing attack scenarios from commercial off-the-shelf audit logs on Windows, Linux, and FreeBSD. Its core abstraction is a compact, platform-neutral, main-memory dependency graph over subjects and objects, combined with provenance-derived trustworthiness and confidentiality tags. A key engineering choice is the use of split trustworthiness tags for subject code and subject data, which the paper reports reduces alarms by factors including 45.39x for untrusted execution and 517x for modification alarms. In DARPA Transparent Computing evaluation data spanning 358 hours and about 73 million events, the system reports 174 correctly identified entities, 0 incorrectly identified entities, and 2 missed entities. The same paper reports that 38M events were stored in 329 MB, and that 79 hours of FreeBSD audit data were processed in 14 seconds using 84 MB (Hossain et al., 2018).

In web-attack forensics, CyberSleuth applies the term to an autonomous blue-team LLM agent that analyzes packet traces and, optionally, application logs. Its task is to identify the targeted service, determine the exact exploited CVE, assess whether the service was vulnerable and whether the attack succeeded, and generate a structured forensic report. The paper compares four architectures and six LLM backends over 20 benchmark incidents and a separate set of 10 incidents from 2025. The best architecture is a Flow Reporter Agent, in which a flow-summarization sub-agent distills each connection before a main agent performs higher-level reasoning and focused web search. On the 2025 incidents, the system reports 80% exact CVE identification. A human study with 22 experts rates the reports 4.33 for completeness, 4.23 for usefulness, and 4.31 for logical coherence, with a slight preference for DeepSeek R1 (Fumero et al., 28 Aug 2025).

A more operational, platform-aware perspective appears in the 2026 forensics paper that discusses Autopsy/Sleuth Kit as the disk-analysis component of a broader workflow rather than as the main subject of evaluation. There Autopsy 4.21.0 is used to analyze Windows and Linux disk images acquired with FTK Imager or dd, while Volatility 3 handles RAM. The paper reports that Autopsy requires an average of 2–3 hours to process a disk dump, that Linux ransomware cases show an approximately 8–15% increase in suspicious activity relative to trojan cases, and that incorrect Linux device-path selection can prevent accurate downstream processing (Jain et al., 29 Jan 2026).

6. Astronomical observation and slitless spectroscopy

The historical astronomical use is literal rather than acronymic. Caroline Herschel is described as a “sleuth of the skies” because her comet work combined systematic searching, repeated observation, record-keeping, sketching, and rapid reporting. The paper calls her “the first female comet-hunter” and “the first salaried female astronomer,” credits her with at least eight comet discoveries, and emphasizes the procedural character of her practice: she swept the sky with dedicated instruments, recorded suspicious objects, verified motion on subsequent nights, and communicated discoveries to scientific authorities (Olson et al., 2012).

A modern technical use appears in JWST slitless spectroscopy. In the 2025 galaxy-evolution study, Sleuth is an advanced grism analysis code that “forward models and infers spatially resolved physical properties from grism data,” including current JWST NIRISS/NIRCam observations and future Roman grism data. The system segments galaxies into small regions grown from the brightest pixel until a target SNR = 50 in F150W is achieved, forward-models regional spectral templates including emission lines, and fits those templates to observed grism spectra. Applied to 20 galaxies at $20$1, the resulting emission-line maps support the claim that star-forming clumps are lower in metallicity by approximately 0.1 dex, corresponding to 20% metallicity dilution (Estrada-Carpenter et al., 1 Aug 2025).

The same methodological line is used again in the 2025 study of HCM 6A at $20$2. There SLEUTH is applied to the NIRISS WFSS spectrum with the F090WN filter to derive a high-quality Ly$20$3 emission-line map. The paper states that the pipeline segments the galaxy into small regions grown from the brightest pixel until a target S/N of 20 is achieved, yielding roughly 30 regions across the source, and that the integrated observed Ly$20$4 flux is

$20$5

The mapped Ly$20$6 emission is concentrated in clump C3, corresponding to slit region S3, and is interpreted as evidence that Ly$20$7 escape is regulated by a feedback-shaped multiphase ISM rather than by average dust content alone (Markov et al., 15 Dec 2025).

7. Sleuthing as investigative style

The name also persists as an explicit object of literary and epistemic analysis. A 2025 computational narratology study treats the sleuth not as a genre label but as a profile of distinctive investigative traits: reasoning style, evidentiary preference, social tactics, psychological orientation, moral stance, and characteristic truth-extraction methods. Using a five-phase workflow across 15 LLMs and 7 detectives—Hercule Poirot, Sherlock Holmes, William Murdoch, Columbo, Father Brown, Miss Marple, and Auguste Dupin—the paper synthesizes trait profiles and validates them through reverse identification. The reported overall reverse-identification accuracy is 91.43% $20$8, with the major confusion concentrated in Auguste Dupin being misclassified as Sherlock Holmes (Lima et al., 12 May 2025).

Across the technical systems surveyed above, a common pattern is visible, although it should be treated as an interpretation rather than a formal taxonomy. This suggests that “sleuth” is repeatedly used for pipelines that begin from evidence sparsity, ambiguity, or overload and then impose a guided reduction strategy: search for likely positives in Label Sleuth, evidence distillation in long-document SLEUTH, tail-region scanning in D0 SLEUTH, provenance-guided graph reduction in host-security SLEUTH, or region-based forward modeling in astronomical Sleuth (Shnarch et al., 2022, Liu et al., 28 Nov 2025, Renkel, 2011, Hossain et al., 2018, Estrada-Carpenter et al., 1 Aug 2025).

A second recurring pattern is explicit scope control. Label Sleuth is limited to binary classification over pre-segmented text and assumes low prevalence for its weak-negative heuristic; long-document SLEUTH is retrieval-dependent; D0 SLEUTH is only quasi-model independent because it assumes new physics will appear as a high-$20$9 excess; the urban SLEUTH study treats the model as a scenario-support tool rather than a literal predictor; and host-security SLEUTH assumes trustworthy kernels and audit subsystems (Shnarch et al., 2022, Liu et al., 28 Nov 2025, Renkel, 2011, Nahavandya et al., 2017, Hossain et al., 2018). In that sense, “sleuthing” in research is rarely unrestricted discovery. It is usually structured inference under carefully chosen assumptions.