VX-One: Typed, Calibrated Decision Heads for Real-Time Perimeter Triage - An empirical study of unknown-attack honesty, cascade gray zones, and calibration under drift

VX-One is a small multi-head network with three typed outputs: a calibrated gate, a closed-set choice including an explicit unknown option, and an ordinal score. It is compared against calibrated XGBoost, Random-Forest, MLP, and Kitsune on UNSW-NB15, CIC-IDS2017, and EMBER2024, and evaluated in a Suricata-to-VX-One cascade. Reported findings: VX-One wins detection on UNSW-NB15 and under temporal drift on CIC-IDS2017 (0.711 vs 0.637), while XGBoost wins multi-class attribution on all three benchmarks. Calibration degrades under drift (ECE 0.04 to 0.40) for all methods. The cascade's second phase reaches combined recall of at least 0.978.

Why it matters

It offers a measured account of where typed, calibrated decision heads help perimeter triage and where they fail, including unknown-attack handling and calibration under drift.

Read with care

Source claims not independently checked; the text is an abstract and the 'System One' product references are unverified in the supplied text.