HuggingFace Daily Papers·· 1 天前
VX-One：面向实时边界流量分诊的类型化校准决策头实证研究
VX-One: Typed, Calibrated Decision Heads for Real-Time Perimeter Triage - An empirical study of unknown-attack honesty, cascade gray zones, and calibration under drift
AI 导读
VX-One 是一个 100K-10M 参数的小型多头网络，输出校准门控、含显式 unknown 选项的闭集选择与序数分数三类类型化决策原语，CPU 上 p50 约 0.7-1.7 ms。
正文 · 原文
Abstract:Perimeter triage faces a latency/semantics trade-off: signature engines are fast and format-safe but blind to unseen attacks, while generative models are semantic but slow and produce unparseable output. In late 2026 a class of commercial System One decision models (TypeSafe Jev; Microsoft-Decision-1) began selling typed decision primitives - binary gates, closed-set choices, ordinal scores - as product APIs, with no academic treatment. We present VX-One: a small multi-head network (100K-10M parameters) whose outputs are these primitives - a calibrated gate, a choice over a closed candidate set that always includes an explicit unknown option, and an ordinal score, trained multi-task, temperature-calibrated per head (~0.7-1.7 ms p50 on CPU). We evaluate it on UNSW-NB15, CIC-IDS2017, EMBER2024 against calibrated XGBoost, Random-Forest, MLP, Kitsune, and measure a two-phase cascade (Suricata with 52,674 Emerging-Threats rules -> VX-One) over five days of CIC-IDS2017. Findings: (i) VX-One wins detection (AUROC/FPR@95%TPR) on UNSW-NB15 and under temporal drift on CIC-IDS2017 (0.711 vs 0.637), but XGBoost wins multi-class attribution on all three benchmarks; (ii) leave-one-family-out gate detects never-seen families on 9/9 UNSW folds yet drops below chance on CIC recon family, and abstention threshold transfers poorly across benchmarks; (iii) on payload-less reconstructions signature engines resolve ~0.1% of flows - gray zone ~99.9% of traffic, recovered by Phase 2 (combined recall >=0.978); (iv) calibration collapses under temporal drift (ECE 0.04->0.40) for every method while ranking partially survives. We provide a measured account of where typed calibrated decisions help perimeter triage, and where they fail.
| Comments: | 11 pages, 7 tables, 1 figure |
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG); Networking and Internet Architecture (cs.NI) |
| Cite as: | arXiv:2610.30090 [cs.CR] |
| (or arXiv:2610.30090v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.30090 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Juan Salas [view email]
[v1]
Wed, 21 Oct 2026 17:39:12 UTC (46 KB)
来源：HuggingFace Daily Papers · arxiv.org