VX-One
A small multi-head neural network for boundary traffic classification whose outputs are constrained to three typed decision primitives: binary gates, closed-set selection, and ordinal scoring. It uses multi-task training and per-head temperature calibration, emphasizing interpretability and low-latency deployment.
Timeline (last 90 days)
VX-One is a small multi-head network with 100K–10M parameters whose outputs are constrained to three parseable primitives—binary gates, closed-set choices, and ordinal scores—trained in a multi-task manner with per-head temperature calibration, achieving a p50 latency of about 0.7–1.7 ms on CPU.
VX-One's second head selects among closed-set candidates, and the candidate set always includes an explicit unknown option, giving the model a legitimate exit for "declining to commit."
On the three benchmarks UNSW-NB15, CIC-IDS2017, and EMBER2024, the paper compares against calibrated XGBoost, Random-Forest, MLP, and Kitsune, and measures a two-stage cascade of "Suricata (52,674 Emerging-Threats rules) → VX-One" running over five days on CIC-IDS2017.
VX-One wins on the detection metrics (AUROC, FPR@95%TPR) on UNSW-NB15, and also leads under the temporal drift conditions of CIC-IDS2017 (0.711 vs 0.637).
On the multi-class attribution task, XGBoost wins on all three benchmarks UNSW-NB15, CIC-IDS2017, and EMBER2024.
In the leave-one-family-out test, the VX-One gate successfully detected never-before-seen attack families on all 9 folds of UNSW (9/9), but on the CIC recon family its detection rate fell below random level.
An abstention threshold tuned on one benchmark performs poorly after switching to another benchmark, and the threshold needs to be recalibrated for the target environment.
The combined recall of the Suricata→VX-One two-stage cascade reaches ≥0.978.
Under temporal drift, calibration collapses for all methods, with ECE deteriorating from 0.04 to 0.40, while ranking ability only partially survives.
All Facts (9)
VX-One is a small multi-head network with 100K–10M parameters whose outputs are constrained to three parseable primitives—binary gates, closed-set choices, and ordinal scores—trained in a multi-task manner with per-head temperature calibration, achieving a p50 latency of about 0.7–1.7 ms on CPU.
50%UnverifiedVX-One's second head selects among closed-set candidates, and the candidate set always includes an explicit unknown option, giving the model a legitimate exit for "declining to commit."
50%UnverifiedOn the three benchmarks UNSW-NB15, CIC-IDS2017, and EMBER2024, the paper compares against calibrated XGBoost, Random-Forest, MLP, and Kitsune, and measures a two-stage cascade of "Suricata (52,674 Emerging-Threats rules) → VX-One" running over five days on CIC-IDS2017.
50%UnverifiedVX-One wins on the detection metrics (AUROC, FPR@95%TPR) on UNSW-NB15, and also leads under the temporal drift conditions of CIC-IDS2017 (0.711 vs 0.637).
50%UnverifiedOn the multi-class attribution task, XGBoost wins on all three benchmarks UNSW-NB15, CIC-IDS2017, and EMBER2024.
50%UnverifiedIn the leave-one-family-out test, the VX-One gate successfully detected never-before-seen attack families on all 9 folds of UNSW (9/9), but on the CIC recon family its detection rate fell below random level.
50%UnverifiedAn abstention threshold tuned on one benchmark performs poorly after switching to another benchmark, and the threshold needs to be recalibrated for the target environment.
50%UnverifiedThe combined recall of the Suricata→VX-One two-stage cascade reaches ≥0.978.
50%UnverifiedUnder temporal drift, calibration collapses for all methods, with ECE deteriorating from 0.04 to 0.40, while ranking ability only partially survives.
50%