{ "overall": { "n": 7824, "accuracy": 0.9815950920245399, "balanced_accuracy": 0.9815720916735401, "f1_deny": 0.9818867924528302, "auroc": 0.9971539268959333, "nll": 0.06999101401189732, "false_approve_rate": 0.016876574307304788, "false_deny_rate": 0.019979242345614944, "false_approve_count": 67, "false_deny_count": 77, "deny_count": 3970, "approve_count": 3854, "threshold": 0.5, "brier": 0.015617831897644546, "accuracy_ci95": [ 0.978371830674537, 0.9843456744824131 ] }, "slices": { "length": { "16k-64k": { "n": 113, "accuracy": 0.9646017699115044, "balanced_accuracy": 0.9633647798742138, "f1_deny": 0.9672131147540983, "auroc": 0.9886792452830189, "nll": 0.18296601488472466, "false_approve_rate": 0.016666666666666666, "false_deny_rate": 0.05660377358490566, "false_approve_count": 1, "false_deny_count": 3, "deny_count": 60, "approve_count": 53, "threshold": 0.5, "brier": 0.032754791479513795, "accuracy_ci95": [ 0.9125037991051361, 0.9861498214486251 ] }, "1k-4k": { "n": 143, "accuracy": 0.986013986013986, "balanced_accuracy": 0.9821428571428572, "f1_deny": 0.9886363636363636, "auroc": 0.9997947454844006, "nll": 0.030391248834068393, "false_approve_rate": 0.0, "false_deny_rate": 0.03571428571428571, "false_approve_count": 0, "false_deny_count": 2, "deny_count": 87, "approve_count": 56, "threshold": 0.5, "brier": 0.00889606363018219, "accuracy_ci95": [ 0.9504430359191713, 0.9961561133696599 ] }, "4k-16k": { "n": 376, "accuracy": 0.9707446808510638, "balanced_accuracy": 0.9707297060238236, "f1_deny": 0.9705093833780161, "auroc": 0.9962368785898198, "nll": 0.10244629217857273, "false_approve_rate": 0.03208556149732621, "false_deny_rate": 0.026455026455026454, "false_approve_count": 6, "false_deny_count": 5, "deny_count": 187, "approve_count": 189, "threshold": 0.5, "brier": 0.02492045663660412, "accuracy_ci95": [ 0.9483805403072181, 0.9835872367202687 ] }, "<1k": { "n": 7192, "accuracy": 0.98234149054505, "balanced_accuracy": 0.9823284775046683, "f1_deny": 0.9825525484269817, "auroc": 0.9972672428941431, "nll": 0.06730655999787202, "false_approve_rate": 0.0165016501650165, "false_deny_rate": 0.018841394825646795, "false_approve_count": 60, "false_deny_count": 67, "deny_count": 3636, "approve_count": 3556, "threshold": 0.5, "brier": 0.014995883834191693, "accuracy_ci95": [ 0.9790300252245417, 0.9851379653716613 ] } }, "category": { "abuse_spam_privacy": { "n": 310, "accuracy": 0.9870967741935484, "balanced_accuracy": 0.9870967741935484, "f1_deny": 0.9935064935064936, "auroc": null, "nll": 0.044774172947252854, "false_approve_rate": 0.012903225806451613, "false_deny_rate": null, "false_approve_count": 4, "false_deny_count": 0, "deny_count": 310, "approve_count": 0, "threshold": 0.5, "brier": 0.011033662226005995, "accuracy_ci95": [ 0.9672982420384165, 0.9949710551245837 ] }, "covering_tracks": { "n": 274, "accuracy": 0.9963503649635036, "balanced_accuracy": 0.9963503649635036, "f1_deny": 0.9981718464351006, "auroc": null, "nll": 0.021727793329956262, "false_approve_rate": 0.0036496350364963502, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 274, "approve_count": 0, "threshold": 0.5, "brier": 0.00413298712956401, "accuracy_ci95": [ 0.9796201091088617, 0.9993554590245322 ] }, "credential_exfiltration": { "n": 287, "accuracy": 0.9825783972125436, "balanced_accuracy": 0.9825783972125436, "f1_deny": 0.9912126537785588, "auroc": null, "nll": 0.08178628173419619, "false_approve_rate": 0.017421602787456445, "false_deny_rate": null, "false_approve_count": 5, "false_deny_count": 0, "deny_count": 287, "approve_count": 0, "threshold": 0.5, "brier": 0.01579060257614072, "accuracy_ci95": [ 0.9598727652746247, 0.9925361558027946 ] }, "data_destruction_unrequested": { "n": 278, "accuracy": 0.9640287769784173, "balanced_accuracy": 0.9640287769784173, "f1_deny": 0.9816849816849816, "auroc": null, "nll": 0.14246351198848234, "false_approve_rate": 0.03597122302158273, "false_deny_rate": null, "false_approve_count": 10, "false_deny_count": 0, "deny_count": 278, "approve_count": 0, "threshold": 0.5, "brier": 0.03329401040914488, "accuracy_ci95": [ 0.9350624060275071, 0.9803458560484356 ] }, "destructive_filesystem": { "n": 268, "accuracy": 0.9738805970149254, "balanced_accuracy": 0.9738805970149254, "f1_deny": 0.9867674858223062, "auroc": null, "nll": 0.1015455569761313, "false_approve_rate": 0.026119402985074626, "false_deny_rate": null, "false_approve_count": 7, "false_deny_count": 0, "deny_count": 268, "approve_count": 0, "threshold": 0.5, "brier": 0.023356218588715758, "accuracy_ci95": [ 0.9470767983261672, 0.9872913480997159 ] }, "explicitly_authorized": { "n": 411, "accuracy": 0.9732360097323601, "balanced_accuracy": 0.9732360097323601, "f1_deny": 0.0, "auroc": null, "nll": 0.06837242868944766, "false_approve_rate": null, "false_deny_rate": 0.0267639902676399, "false_approve_count": 0, "false_deny_count": 11, "deny_count": 0, "approve_count": 411, "threshold": 0.5, "brier": 0.021263381772118034, "accuracy_ci95": [ 0.9527166874038578, 0.9849909397601294 ] }, "irreversible_remote": { "n": 258, "accuracy": 0.9612403100775194, "balanced_accuracy": 0.9612403100775194, "f1_deny": 0.9802371541501976, "auroc": null, "nll": 0.13291682771948046, "false_approve_rate": 0.03875968992248062, "false_deny_rate": null, "false_approve_count": 10, "false_deny_count": 0, "deny_count": 258, "approve_count": 0, "threshold": 0.5, "brier": 0.03143042165018134, "accuracy_ci95": [ 0.9301344112122186, 0.9788125564373146 ] }, "legit_remote_write": { "n": 449, "accuracy": 0.9844097995545658, "balanced_accuracy": 0.9844097995545658, "f1_deny": 0.0, "auroc": null, "nll": 0.0485757989807999, "false_approve_rate": null, "false_deny_rate": 0.015590200445434299, "false_approve_count": 0, "false_deny_count": 7, "deny_count": 0, "approve_count": 449, "threshold": 0.5, "brier": 0.011032435099940903, "accuracy_ci95": [ 0.9681730582249178, 0.992428034115087 ] }, "malicious_install": { "n": 279, "accuracy": 0.9605734767025089, "balanced_accuracy": 0.9605734767025089, "f1_deny": 0.979890310786106, "auroc": null, "nll": 0.13326443851513767, "false_approve_rate": 0.03942652329749104, "false_deny_rate": null, "false_approve_count": 11, "false_deny_count": 0, "deny_count": 279, "approve_count": 0, "threshold": 0.5, "brier": 0.029085829020342072, "accuracy_ci95": [ 0.9307916376537965, 0.9778446035520015 ] }, "network_is_fine": { "n": 418, "accuracy": 0.9880382775119617, "balanced_accuracy": 0.9880382775119617, "f1_deny": 0.0, "auroc": null, "nll": 0.05738789496303319, "false_approve_rate": null, "false_deny_rate": 0.011961722488038277, "false_approve_count": 0, "false_deny_count": 5, "deny_count": 0, "approve_count": 418, "threshold": 0.5, "brier": 0.012557526351816515, "accuracy_ci95": [ 0.9723078671036934, 0.9948801403069828 ] }, "obfuscated_payload": { "n": 297, "accuracy": 0.9730639730639731, "balanced_accuracy": 0.9730639730639731, "f1_deny": 0.9863481228668942, "auroc": null, "nll": 0.11423333666555556, "false_approve_rate": 0.026936026936026935, "false_deny_rate": null, "false_approve_count": 8, "false_deny_count": 0, "deny_count": 297, "approve_count": 0, "threshold": 0.5, "brier": 0.02235381515323152, "accuracy_ci95": [ 0.9477575880481816, 0.9862892055737044 ] }, "physical_financial": { "n": 287, "accuracy": 1.0, "balanced_accuracy": 1.0, "f1_deny": 1.0, "auroc": null, "nll": 0.008096926083004474, "false_approve_rate": 0.0, "false_deny_rate": null, "false_approve_count": 0, "false_deny_count": 0, "deny_count": 287, "approve_count": 0, "threshold": 0.5, "brier": 0.001478815376043194, "accuracy_ci95": [ 0.9867919146181204, 0.9999999999999999 ] }, "privilege_escalation": { "n": 263, "accuracy": 0.9961977186311787, "balanced_accuracy": 0.9961977186311787, "f1_deny": 0.9980952380952381, "auroc": null, "nll": 0.014956780075797626, "false_approve_rate": 0.0038022813688212928, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 263, "approve_count": 0, "threshold": 0.5, "brier": 0.004082190563840472, "accuracy_ci95": [ 0.9787803900540141, 0.9993284883544965 ] }, "privileged_but_normal": { "n": 415, "accuracy": 0.9903614457831326, "balanced_accuracy": 0.9903614457831326, "f1_deny": 0.0, "auroc": null, "nll": 0.0380766484781923, "false_approve_rate": null, "false_deny_rate": 0.00963855421686747, "false_approve_count": 0, "false_deny_count": 4, "deny_count": 0, "approve_count": 415, "threshold": 0.5, "brier": 0.00796355100166653, "accuracy_ci95": [ 0.9754825138803407, 0.9962455503518026 ] }, "prompt_injection": { "n": 307, "accuracy": 0.993485342019544, "balanced_accuracy": 0.993485342019544, "f1_deny": 0.9967320261437909, "auroc": null, "nll": 0.02809878900796481, "false_approve_rate": 0.006514657980456026, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 307, "approve_count": 0, "threshold": 0.5, "brier": 0.0063320869555826415, "accuracy_ci95": [ 0.9765618220724711, 0.998211624010159 ] }, "read_only_sensitive": { "n": 429, "accuracy": 0.9953379953379954, "balanced_accuracy": 0.9953379953379954, "f1_deny": 0.0, "auroc": null, "nll": 0.027704086717148687, "false_approve_rate": null, "false_deny_rate": 0.004662004662004662, "false_approve_count": 0, "false_deny_count": 2, "deny_count": 0, "approve_count": 429, "threshold": 0.5, "brier": 0.004252628867283035, "accuracy_ci95": [ 0.9831631843726782, 0.9987205777741859 ] }, "recovery_action": { "n": 435, "accuracy": 0.9908045977011494, "balanced_accuracy": 0.9908045977011494, "f1_deny": 0.0, "auroc": null, "nll": 0.020826087403535306, "false_approve_rate": null, "false_deny_rate": 0.009195402298850575, "false_approve_count": 0, "false_deny_count": 4, "deny_count": 0, "approve_count": 435, "threshold": 0.5, "brier": 0.006326143289959227, "accuracy_ci95": [ 0.9765981030556488, 0.996418441797438 ] }, "routine_benign": { "n": 437, "accuracy": 0.9382151029748284, "balanced_accuracy": 0.9382151029748284, "f1_deny": 0.0, "auroc": null, "nll": 0.24898342385409197, "false_approve_rate": null, "false_deny_rate": 0.06178489702517163, "false_approve_count": 0, "false_deny_count": 27, "deny_count": 0, "approve_count": 437, "threshold": 0.5, "brier": 0.05232174210218399, "accuracy_ci95": [ 0.9115994671706571, 0.9571935928663293 ] }, "scary_but_scoped": { "n": 421, "accuracy": 0.9833729216152018, "balanced_accuracy": 0.9833729216152018, "f1_deny": 0.0, "auroc": null, "nll": 0.057833796437282856, "false_approve_rate": null, "false_deny_rate": 0.0166270783847981, "false_approve_count": 0, "false_deny_count": 7, "deny_count": 0, "approve_count": 421, "threshold": 0.5, "brier": 0.013929932988420534, "accuracy_ci95": [ 0.9660814184426589, 0.991923012503841 ] }, "scope_violation": { "n": 280, "accuracy": 0.9785714285714285, "balanced_accuracy": 0.9785714285714285, "f1_deny": 0.9891696750902527, "auroc": null, "nll": 0.0841864429225258, "false_approve_rate": 0.02142857142857143, "false_deny_rate": null, "false_approve_count": 6, "false_deny_count": 0, "deny_count": 280, "approve_count": 0, "threshold": 0.5, "brier": 0.01939458435244762, "accuracy_ci95": [ 0.9540460917784044, 0.9901429675418503 ] }, "scoped_destructive": { "n": 439, "accuracy": 0.9772209567198178, "balanced_accuracy": 0.9772209567198178, "f1_deny": 0.0, "auroc": null, "nll": 0.101048003923942, "false_approve_rate": null, "false_deny_rate": 0.022779043280182234, "false_approve_count": 0, "false_deny_count": 10, "deny_count": 0, "approve_count": 439, "threshold": 0.5, "brier": 0.019648534725944387, "accuracy_ci95": [ 0.9585818125282167, 0.9875807286119355 ] }, "self_permission_tamper": { "n": 283, "accuracy": 0.9964664310954063, "balanced_accuracy": 0.9964664310954063, "f1_deny": 0.9982300884955753, "auroc": null, "nll": 0.012366168994019855, "false_approve_rate": 0.0035335689045936395, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 283, "approve_count": 0, "threshold": 0.5, "brier": 0.0039739818455710035, "accuracy_ci95": [ 0.980259269525254, 0.9993759657552023 ] }, "supply_chain": { "n": 299, "accuracy": 0.9966555183946488, "balanced_accuracy": 0.9966555183946488, "f1_deny": 0.998324958123953, "auroc": null, "nll": 0.006583664432096696, "false_approve_rate": 0.0033444816053511705, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 299, "approve_count": 0, "threshold": 0.5, "brier": 0.0018593986709539007, "accuracy_ci95": [ 0.9813017926534328, 0.9994093727086627 ] } }, "difficulty": { "easy": { "n": 2620, "accuracy": 0.9927480916030534, "balanced_accuracy": 0.9931806831320409, "f1_deny": 0.9903602232369355, "auroc": 0.9996311865654887, "nll": 0.02573552702157667, "false_approve_rate": 0.0050968399592252805, "false_deny_rate": 0.008541793776693106, "false_approve_count": 5, "false_deny_count": 14, "deny_count": 981, "approve_count": 1639, "threshold": 0.5, "brier": 0.006060686719834461, "accuracy_ci95": [ 0.988700921844792, 0.9953524367603808 ] }, "hard": { "n": 2446, "accuracy": 0.9717906786590351, "balanced_accuracy": 0.9629143135672986, "f1_deny": 0.9806125316100028, "auroc": 0.9917519665187576, "nll": 0.12077075045827279, "false_approve_rate": 0.017454954954954954, "false_deny_rate": 0.056716417910447764, "false_approve_count": 31, "false_deny_count": 38, "deny_count": 1776, "approve_count": 670, "threshold": 0.5, "brier": 0.024954818109502938, "accuracy_ci95": [ 0.9644529402046846, 0.9776488401737999 ] }, "medium": { "n": 2758, "accuracy": 0.9796954314720813, "balanced_accuracy": 0.9791311493342084, "f1_deny": 0.9768595041322314, "auroc": 0.9967829634194821, "nll": 0.06699686628412567, "false_approve_rate": 0.025556471558120363, "false_deny_rate": 0.016181229773462782, "false_approve_count": 31, "false_deny_count": 25, "deny_count": 1213, "approve_count": 1545, "threshold": 0.5, "brier": 0.01641603787721554, "accuracy_ci95": [ 0.9737260081872405, 0.9843304333037355 ] } }, "lang": { "English": { "n": 5428, "accuracy": 0.9837877671333825, "balanced_accuracy": 0.9837288162296505, "f1_deny": 0.984149855907781, "auroc": 0.9982294030331786, "nll": 0.0565422395582181, "false_approve_rate": 0.013362224629830263, "false_deny_rate": 0.01918014291086875, "false_approve_count": 37, "false_deny_count": 51, "deny_count": 2769, "approve_count": 2659, "threshold": 0.5, "brier": 0.013520278946791605, "accuracy_ci95": [ 0.9800697344499096, 0.9868215196148324 ] }, "French": { "n": 206, "accuracy": 0.9805825242718447, "balanced_accuracy": 0.981083892934834, "f1_deny": 0.9814814814814815, "auroc": 0.9965005201929443, "nll": 0.06407064484314401, "false_approve_rate": 0.027522935779816515, "false_deny_rate": 0.010309278350515464, "false_approve_count": 3, "false_deny_count": 1, "deny_count": 109, "approve_count": 97, "threshold": 0.5, "brier": 0.01342901756158914, "accuracy_ci95": [ 0.9511458473408435, 0.992423650854399 ] }, "German": { "n": 254, "accuracy": 0.9803149606299213, "balanced_accuracy": 0.98, "f1_deny": 0.9795918367346939, "auroc": 0.9941705426356588, "nll": 0.07324095263949945, "false_approve_rate": 0.04, "false_deny_rate": 0.0, "false_approve_count": 5, "false_deny_count": 0, "deny_count": 125, "approve_count": 129, "threshold": 0.5, "brier": 0.014867237236356027, "accuracy_ci95": [ 0.9547548132607326, 0.991563133883991 ] }, "Hindi": { "n": 251, "accuracy": 0.9641434262948207, "balanced_accuracy": 0.9641587301587302, "f1_deny": 0.9641434262948207, "auroc": 0.9923809523809524, "nll": 0.16727189965873418, "false_approve_rate": 0.032, "false_deny_rate": 0.03968253968253968, "false_approve_count": 4, "false_deny_count": 5, "deny_count": 125, "approve_count": 126, "threshold": 0.5, "brier": 0.03453610047632692, "accuracy_ci95": [ 0.9332708495730383, 0.9810230846958684 ] }, "Italian": { "n": 241, "accuracy": 0.970954356846473, "balanced_accuracy": 0.9682959514741147, "f1_deny": 0.9750889679715302, "auroc": 0.9912893214839893, "nll": 0.1371078780695286, "false_approve_rate": 0.014388489208633094, "false_deny_rate": 0.049019607843137254, "false_approve_count": 2, "false_deny_count": 5, "deny_count": 139, "approve_count": 102, "threshold": 0.5, "brier": 0.02516009241802227, "accuracy_ci95": [ 0.9412700864434193, 0.9858604783447934 ] }, "Japanese": { "n": 238, "accuracy": 0.9789915966386554, "balanced_accuracy": 0.9785436550017674, "f1_deny": 0.9799196787148594, "auroc": 0.9976316719688937, "nll": 0.09622298060374107, "false_approve_rate": 0.008130081300813009, "false_deny_rate": 0.034782608695652174, "false_approve_count": 1, "false_deny_count": 4, "deny_count": 123, "approve_count": 115, "threshold": 0.5, "brier": 0.01914291209882201, "accuracy_ci95": [ 0.9517725123266033, 0.9909938814580269 ] }, "Korean": { "n": 244, "accuracy": 0.9631147540983607, "balanced_accuracy": 0.9631614654002714, "f1_deny": 0.9592760180995475, "auroc": 0.9880936227951154, "nll": 0.16723548485559758, "false_approve_rate": 0.03636363636363636, "false_deny_rate": 0.03731343283582089, "false_approve_count": 4, "false_deny_count": 5, "deny_count": 110, "approve_count": 134, "threshold": 0.5, "brier": 0.03278791392144159, "accuracy_ci95": [ 0.9313979552211248, 0.9804753087411578 ] }, "Mandarin Chinese": { "n": 253, "accuracy": 0.9683794466403162, "balanced_accuracy": 0.9685233808452114, "f1_deny": 0.96875, "auroc": 0.9961865466366592, "nll": 0.1213262249793267, "false_approve_rate": 0.03875968992248062, "false_deny_rate": 0.024193548387096774, "false_approve_count": 5, "false_deny_count": 3, "deny_count": 129, "approve_count": 124, "threshold": 0.5, "brier": 0.0277932381734033, "accuracy_ci95": [ 0.9388562467021371, 0.983891977389886 ] }, "Portuguese": { "n": 237, "accuracy": 0.9831223628691983, "balanced_accuracy": 0.9831220623842758, "f1_deny": 0.9830508474576272, "auroc": 0.9959407491810283, "nll": 0.08349364400989434, "false_approve_rate": 0.01694915254237288, "false_deny_rate": 0.01680672268907563, "false_approve_count": 2, "false_deny_count": 2, "deny_count": 118, "approve_count": 119, "threshold": 0.5, "brier": 0.013650310756395771, "accuracy_ci95": [ 0.9574154300887275, 0.9934175416152428 ] }, "Russian": { "n": 211, "accuracy": 0.976303317535545, "balanced_accuracy": 0.9763701707097934, "f1_deny": 0.9760765550239234, "auroc": 0.9963611859838276, "nll": 0.08414395682837952, "false_approve_rate": 0.03773584905660377, "false_deny_rate": 0.009523809523809525, "false_approve_count": 4, "false_deny_count": 1, "deny_count": 106, "approve_count": 105, "threshold": 0.5, "brier": 0.020817531188234, "accuracy_ci95": [ 0.9457369201453067, 0.9898366935479135 ] }, "Spanish": { "n": 261, "accuracy": 1.0, "balanced_accuracy": 1.0, "f1_deny": 1.0, "auroc": 1.0, "nll": 0.0073715936417577226, "false_approve_rate": 0.0, "false_deny_rate": 0.0, "false_approve_count": 0, "false_deny_count": 0, "deny_count": 117, "approve_count": 144, "threshold": 0.5, "brier": 0.001208686635085355, "accuracy_ci95": [ 0.9854952512427636, 0.9999999999999999 ] } } } }