Skip to content
NewA calmer, faster ZeroHour
StoryResearchinfo

VX-One study finds detection gains but calibration collapse under drift

2 sources · 2 articlesFirst reported Updated ()
What's new

October 21: arXiv adds that abstention thresholds transfer poorly and that ranking partly survives when calibration collapses.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A small multi-head triage model leads some IDS detection tests, but calibration fails under drift for every method.

A paper evaluates VX-One, a 100K–10M-parameter multi-head network that emits a calibrated gate, a closed-set choice including unknown, and an ordinal score, with about 0.7–1.7 ms p50 latency on CPU. On UNSW-NB15, CIC-IDS2017, and EMBER2024 it beats listed baselines on some detection metrics, including 0.711 versus 0.637 under temporal drift on CIC-IDS2017, while XGBoost wins multi-class attribution on all three. A Suricata cascade using 52,674 Emerging-Threats rules resolves about 0.1% of payload-less flows and leaves a gray zone of about 99.9%; combined cascade recall is at least 0.978. Calibration error rises from 0.04 to 0.40 under drift for every method tested. Leave-one-family-out detection holds on 9 of 9 UNSW folds, but the gate falls below chance on the CIC reconnaissance family.

Key facts
  • VX-One has 100K–10M parameters and about 0.7–1.7 ms p50 CPU latency.
  • CIC-IDS2017 drift detection is 0.711 for VX-One versus 0.637.
  • XGBoost wins multi-class attribution on all three benchmarks.
  • Suricata cascade uses 52,674 Emerging-Threats rules; gray zone is about 99.9%.
  • ECE rises from 0.04 to 0.40 under drift for every method.
  • Leave-one-family-out succeeds on 9 of 9 UNSW folds.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Hugging Face lists the VX-One empirical triage study. · Hugging Face daily papers
  2. Oct 21, 2026arXiv cs.CR posts the same VX-One study. · arXiv cs.CR

What each outlet adds

beyond the shared facts
  • Hugging Face daily papersGate below chance on CIC recon; Kitsune and five-day cascade.
  • arXiv cs.CRAbstention thresholds transfer poorly; ranking partly survives calibration collapse.
Vendors
Microsoft
Products
SuricataXGBoostKitsuneTypeSafe Jev
AI models
VX-OneMicrosoft-Decision-1TypeSafe Jev

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Hugging Face daily papersFirst report

    VX-One study tests typed heads for real-time perimeter triage

    Under CIC-IDS2017 drift VX-One leads detection, but calibration error rises from 0.04 to 0.40 for every method.

  2. · 4d ago arXiv cs.CR

    VX-One study tests typed decision heads for perimeter triage

    A 100K–10M-parameter model is measured against XGBoost and a Suricata cascade on public IDS sets.