Imagine you're a customs officer at an airport with three stamps: PASS, REJECT, and I DON'T KNOW. Most AI security tools only carry the first two — they classify traffic into known buckets and silently pass anything they've never seen. VX-One adds the third stamp as a first-class output, and the paper is really about measuring when that stamp works and when it doesn't. The core claim is architectural, not performance-chasing: take a small multi-head network (100K–10M parameters), give each head a typed output primitive — a binary gate, a closed-set classifier with an explicit 'unknown' option, and an ordinal severity score — train them multi-task with per-head temperature calibration, and you get a decision layer that runs at 0.7–1.7ms p50 on CPU. This sits behind Suricata's 52,674 signature rules in a two-phase cascade. The paper positions this against a late-2026 wave of commercial 'System One decision models' (TypeSafe Jev, Microsoft-Decision-1) that sell typed decision primitives as APIs without any published evaluation. The results are genuinely mixed, and the paper is better for admitting it. VX-One wins detection (AUROC, FPR@95%TPR) on UNSW-NB15 and under temporal drift on CIC-IDS2017 (FPR@95TPR of 0.711 vs XGBoost's 0.637 — lower is better here, so neither is great). But XGBoost wins multi-class attribution on all three benchmarks including EMBER2024. The leave-one-family-out gate experiment detects all 9 unseen UNSW families, then drops below chance on CIC's reconnaissance family. Abstention thresholds that work on one benchmark fail on another. This is not a victory lap — it's a field report. The cascade architecture reveals a striking structural finding: Suricata's signature engine resolves roughly 0.1% of payload-less reconstructed flows, meaning ~99.9% of traffic lands in a gray zone that Phase 2 must handle. Combined recall hits ≥0.978, but the paper is clear that Phase 1 contributes almost nothing when packet payloads are absent. This is an honest measurement of how much work signature engines actually do in modern encrypted-traffic environments. The calibration story is the paper's sharpest contribution. Every method tested — VX-One, XGBoost, Random Forest, MLP, Kitsune — sees expected calibration error (ECE) collapse under temporal drift, jumping from 0.04 to 0.40. Calibration promises ('this alert is 90% likely to be real') become meaningless within days. Ranking partially survives: the model still roughly orders threats by severity even when the absolute probabilities are garbage. This is a genuine finding about the limits of calibrated confidence in non-stationary environments. The paper's honest accounting of failure modes is its strongest quality and its weakest marketing move. It demonstrates that typed decision heads are a viable architectural pattern for perimeter triage — fast, parseable, explicitly handling unknowns — while simultaneously showing that the problems everyone hoped calibration would solve (drift, cross-benchmark transfer, abstention tuning) remain unsolved. The commercial products selling these primitives without published evaluations now have a public benchmark to answer to.
