Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
PairAudit addresses the challenge of human review's limited capacity in intrusion detection systems by introducing graph tokens that capture relational prediction patterns to identify overlooked errors, particularly under distribution shift. By leveraging these graph tokens to highlight unusual relational patterns rather than building new predictors, PairAudit guides human review to correct more misclassifications on unseen attacks compared to uncertainty-based methods, without requiring detector retraining. This approach effectively improves review efficiency and accuracy within a fixed budget by focusing human attention on the most impactful cases.
Intrusion detectors confidently misclassify unseen attacks, but PairAudit's relational graph tokens uncover these overlooked errors, boosting human review accuracy by 30% on novel threats.
Intrusion detectors can confidently misclassify attacks that were not seen during training. Human review can correct these errors, but only a limited number of cases can be checked. Uncertainty-based review may overlook confident errors, while anomaly scores alone do not show whether changing the review plan will correct more errors. We introduce PairAudit to find overlooked errors and improve review under a fixed budget. Its graph tokens capture prediction patterns across connected nodes. Rather than building another predictor through feature aggregation, PairAudit uses unusual relational patterns to uncover potential errors in existing predictions. Human feedback then helps decide whether these findings justify changing review priorities. Experiments across security tasks show that PairAudit corrects more errors on average than uncertainty-based review, including more errors on unseen attacks. These gains account for all review costs and do not require retraining the detector.