In our earlier Dynamic AI Safety weblog and the underlying CAMLIS 2025 paper, we described a launch platform constructed to maneuver new protections into manufacturing with out disrupting buyer workflows. Such a platform is a requirement for safety methods as a result of the fixed evolution and adaptation of adversaries require the same response loop from distributors like Cisco.
Speedy detection-model churn creates potential downstream disruptions for patrons, who all of a sudden, and with out understanding it, begin utilizing a more moderen model of the mannequin that behaves otherwise from the earlier iteration. One main variable between deployments is mannequin aggression: the newer mannequin is healthier however can be deployed extra aggressively, breaking workflows that appeared superb just a few hours in the past.
Preserving the aggression degree between releases is one thing we give attention to throughout each mannequin replace. If a buyer chooses a blocking tier that flags about 1 in 1,000 requests, a mannequin retrain mustn’t silently flip that into 1 in 200 or 1 in 20,000. The detector could enhance beneath, however the buyer’s false-positive funds ought to stay the identical.
Totally different downstream customers additionally function at completely different factors on that tradeoff. A SOC operating aggressive blocking sits removed from a device that solely enriches logs, so it isn’t sufficient to protect one threshold throughout releases. The entire vary of working factors, from very aggressive to very conservative, has to hold the identical which means from one mannequin model to the subsequent.
This can be a frequent downside for anybody deploying detection fashions, so we’re open-sourcing our answer for FPR calibration that may be utilized earlier than a mannequin is launched to attenuate the possibility of buyer disruption. The tactic works offline on benign scores and ships a bounded sklearn artifact together with the mannequin. The code is at github.com/cisco-ai-defense/fpr-model-calibration, and the paper describing the technical particulars might be downloaded right here.
Why false-positive fee is the fitting contract
False-positive fee (FPR) is the fraction of benign site visitors that will be flagged at a threshold. For a mannequin rating threshold, FPR estimates how a lot reputable exercise the brink will interrupt in manufacturing.
FPR calibration differs from chance calibration, which estimates Pr(assault | rating). For a lot of safety fashions, that chance relies on an assault distribution that’s uncommon, adversarial, and quickly shifting. Attackers change techniques when detectors enhance. The optimistic class a mannequin sees throughout coaching is subsequently a file of previous assaults, not a steady pattern of future assaults.
FPR calibration relies upon solely on benign site visitors. In lots of manufacturing safety settings, benign site visitors is extra plentiful, simpler to measure, and tied on to false-positive hurt. If the calibrated rating says a request is a 1-in-1,000 benign occasion, the product group can motive about alert quantity while not having to know tomorrow’s assault prevalence.
What a calibrated rating means
The calibrator maps uncooked mannequin scores onto a hard and fast rating contract. The calibrated rating contract maps frequent working tiers to focus on FPRs:
The size is logarithmic as a result of manufacturing FPR choices are logarithmic. Shifting from 1% to 0.1% and from 0.1% to 0.01% are each tenfold reductions in benign alerts. A linear rating axis would compress the low-FPR area coated by the 0.50, 0.70, and 0.85 working tiers.
With the rating contract in place, coverage thresholds keep steady throughout mannequin releases. A coverage can block at 0.50, alert at 0.30, and enrich logs at 0.10. When the mannequin group ships a brand new detector model, it ships a brand new calibrator with it. The coverage thresholds maintain their FPR which means though the uncooked mannequin scores beneath modified.
How a lot knowledge is sufficient?
One frequent gotcha when estimating the efficiency of detection fashions is simply how a lot knowledge you truly have to correctly calibrate, and even measure, a mannequin. Whereas assaults can appear to be in all places in public take a look at units, in observe they’re very uncommon, often under 0.1% of site visitors. At these charges, the mannequin needs to be extraordinarily correct to maintain the false-positive fee sensible, and calibrating it requires much more benign knowledge than one would count on.
A standard-approximation rule of thumb offers about 16 / p benign samples for plus-or-minus 50% relative precision at 95% confidence, the place p is the goal FPR. For frequent working factors, the tough pattern counts are:
Pattern dimension dominates low-FPR error in observe, and extra benign knowledge is the one path to tighter estimates.
Validation on a public benchmark
We validated the strategy on the general public Credit score Card Fraud Detection benchmark (284,807 transactions, 492 fraud instances), becoming the calibrator on a held-out benign subset:
The takeaway is straightforward: so long as the benign distribution stays pretty fixed between calibration and manufacturing, a mannequin might be calibrated very precisely.
What modifications for product groups
An FPR-calibrated launch contains the detector, the calibrator, and both calibrated-score serving or uncooked thresholds derived from the calibrator. Coverage thresholds maintain their FPR which means, prospects maintain their false-positive funds, and the mannequin can enhance beneath.
The identical contract additionally makes detector scores simpler to check throughout classes. If a prompt-injection detector and a data-leakage detector each emit calibrated rating 0.50, every rating means the identical factor about benign rarity. Compound insurance policies nonetheless want their very own FPR measurement, however their inputs not combine unrelated uncooked rating scales.
Getting began
Match the calibrator with fit_calibration_pipeline:
from fpr_model_calibration import fit_calibration_pipeline
import joblib
pipeline = fit_calibration_pipeline(benign_scores, n_knots=10000)
joblib.dump(pipeline, “calibration.pkl”)
Manufacturing inference calls the serialized sklearn pipeline:
pipeline = joblib.load(“calibration.pkl”)
calibrated = pipeline.predict(raw_scores.reshape(-1, 1))
FPR calibration offers mannequin releases a steady rating contract with out changing contemporary benign knowledge, drift monitoring, or detection-quality analysis. For safety methods that retrain underneath adversarial stress, that contract lets detectors enhance whereas coverage thresholds maintain their FPR which means.
Hyperlink to the open supply GitHub repo might be discovered right here:
https://github.com/cisco-ai-defense/fpr-model-calibration
and the preprint:
https://arxiv.org/abs/2607.05481
