PairAudit: Guiding Human Review with Graph Tokens under Distribution Shift
PairAudit uses graph tokens to surface overlooked intrusion-detector mistakes and improve fixed-budget review of unseen attacks.
Intrusion detectors can confidently misclassify attacks absent from training, and uncertainty-based review can miss those errors. PairAudit encodes prediction patterns across connected nodes as graph tokens and flags unusual relational patterns instead of training another predictor. Human feedback then decides whether those findings should change review priorities under a fixed budget. Experiments show it corrects more errors on average than uncertainty-based review, including unseen attacks, without retraining the detector.
- Graph tokens capture prediction patterns across connected nodes
- Flags confident errors that uncertainty-based review can miss
- Corrects more errors on unseen attacks under a fixed budget
- Accounts for review costs and does not retrain the detector
From the original article
1 min read at arxiv.orgIntrusion detectors can confidently misclassify attacks that were not seen during training. Human review can correct these errors, but only a limited number of cases can be checked. Uncertainty-based review may overlook confident errors, while anomaly scores alone do not show whether changing the review plan will correct more errors.
By Jiran Tao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.