{
  "feature_names": [
    "timestep",
    "perturbation_magnitude",
    "feature_delta_l2_norm",
    "feature_delta_linf_norm",
    "query_count_cumulative",
    "trust_level",
    "detection_coverage",
    "feature_space_dim",
    "alert_threshold",
    "retraining_cadence_days",
    "ensemble_size",
    "detection_strength",
    "adversarial_robustness",
    "progress_frac",
    "log_queries",
    "perturb_intensity",
    "defender_weakness",
    "query_rate",
    "attacker_capability_tier_advanced_persistent_threat",
    "attacker_capability_tier_opportunistic",
    "attacker_capability_tier_script_kiddie",
    "segment_type_cloud_workload",
    "segment_type_corporate_lan",
    "segment_type_data_exfiltration_target",
    "segment_type_dmz_perimeter",
    "segment_type_endpoint_fleet",
    "segment_type_ot_ics_control_network",
    "segment_type_soc_management_plane",
    "segment_type_zero_trust_segment",
    "defender_architecture_autoencoder_anomaly",
    "defender_architecture_ensemble_stacked",
    "defender_architecture_gradient_boosted_tree",
    "defender_architecture_isolation_forest",
    "defender_architecture_lstm_behavioural",
    "defender_architecture_neural_network_dense",
    "defender_architecture_rule_based_threshold",
    "defender_architecture_transformer_sequence"
  ],
  "numeric_features": [
    "timestep",
    "perturbation_magnitude",
    "feature_delta_l2_norm",
    "feature_delta_linf_norm",
    "query_count_cumulative",
    "trust_level",
    "detection_coverage",
    "feature_space_dim",
    "alert_threshold",
    "retraining_cadence_days",
    "ensemble_size",
    "detection_strength",
    "adversarial_robustness",
    "progress_frac",
    "log_queries",
    "perturb_intensity",
    "defender_weakness",
    "query_rate"
  ],
  "categorical_levels": {
    "attacker_capability_tier": [
      "advanced_persistent_threat",
      "opportunistic",
      "script_kiddie"
    ],
    "segment_type": [
      "cloud_workload",
      "corporate_lan",
      "data_exfiltration_target",
      "dmz_perimeter",
      "endpoint_fleet",
      "ot_ics_control_network",
      "soc_management_plane",
      "zero_trust_segment"
    ],
    "defender_architecture": [
      "autoencoder_anomaly",
      "ensemble_stacked",
      "gradient_boosted_tree",
      "isolation_forest",
      "lstm_behavioural",
      "neural_network_dense",
      "rule_based_threshold",
      "transformer_sequence"
    ]
  },
  "label_to_int": {
    "reconnaissance": 0,
    "feature_space_probe": 1,
    "perturbation_craft": 2,
    "evasion_attempt": 3,
    "feedback_adaptation": 4,
    "campaign_consolidation": 5,
    "idle_dwell": 6
  },
  "int_to_label": {
    "0": "reconnaissance",
    "1": "feature_space_probe",
    "2": "perturbation_craft",
    "3": "evasion_attempt",
    "4": "feedback_adaptation",
    "5": "campaign_consolidation",
    "6": "idle_dwell"
  },
  "oracle_excluded": [
    "detection_outcome",
    "detector_confidence_score",
    "evasion_budget_consumed"
  ]
}