VX-One: Calibrated decision heads deliver sub-2ms perimeter attack triage against zero-day drift

Juan S. Santillana · hf · 2026-10-22

Independent researcher Juan S. Santillana published a paper on VX-One, tackling the latency/semantics trade-off in perimeter triage: signature engines (Snort, Suricata, YARA) are fast but structurally blind to zero-day and low-and-slow attacks, while security LLMs (e.g. SecureBERT) are semantic but slow with fragile output formats.

VX-One is a small multi-head network (100K–10M params) emitting typed, temperature-calibrated decision primitives — a calibrated gate with an explicit unknown option, a closed-set choice, and an ordinal score — at 0.7–1.7ms single-event CPU latency (p50).

• Evaluated on UNSW-NB15, CIC-IDS2017 and EMBER2024 against calibrated XGBoost, RandomForest, MLP and Kitsuune baselines
• Two-phase cascade: a Suricata engine with 52,674 rules as stage one, VX-One for the gray zone
• Focus on unknown-attack honesty, cascade gray zones, and calibration under drift
• The paper also flags the common bidirectional-encoder-vs-decoder confusion in security LLMs and XGBoost's confident misattributions on unseen attack families

Original post →

More from Safety

• Compromised eMudhra intermediate CAs could mint valid fake certificates for any domain — i_dg23 · 2026-10-22
• Treasury Secretary Bessent shrugs off 'systemic' AI risks at private investor event — nordicinst · 2026-10-22
• Lawyer: AI-hacked bank accounts are covered, but AI scams are on you — sebkrier · 2026-10-22
• Researcher: Stop confusing vulnerability disclosures with active exploitation — sebkrier · 2026-10-22
• Four cyber events in 24 hours: GitLab CVSS 10 RCE, Railway secrets exposure, HTTP/3 DoS flaws — josh_bickett · 2026-10-22
• Security incidents will 100x demand for open source models, argues dev — zack_overflow · 2026-10-22

Safety channel →