The five criteria for real ANM

The Ward³ whitepaper makes a narrow, testable claim: once the machine-learning model becomes an attack surface, network detection built on a single model is a liability, and the fix is not another model of the same kind. It is arbitration between judges that are genuinely different, with disagreement treated as a signal.

That is easy to say and easy to fake. So the whitepaper pins the term down with five criteria that have to hold together. This post walks through them; the whitepaper argues each one in full, with the threat model and the numbers behind it.

The threat model moved — the defense didn't

Classical IDS made the attacker change payloads until they stopped matching a rule. NDR moved detection to learned models, which changed the attacker's job: not to dodge a signature, but to make a model choose the wrong answer. Gradient-based evasion, transfer attacks, model extraction and label poisoning are now available in open-source frameworks.

Most NDR products still answer that with one model behind the branding. The whitepaper's Part 2 reproduces the failure mode empirically: a typical autoencoder NDR, perturbed at roughly 2% of each feature vector, drops from 86–99% detection to 12–41%. The attack barely changes; the features the model sees about it do.

The five criteria

To talk seriously about ANM, all five have to be present at once — not three of them on a good day.

• 01 — At least three judges, architecturally distinct. Not three seeds and not three window sizes: three different ways to read traffic, so one perturbation cannot fool everyone for the same reason.
• 02 — Explicit divergence detection. Disagreement between judges is measured in real time and treated as a security signal, not folded into an ordinary confidence score.
• 03 — Adversarial training of the ML judges, with a documented threat model. An untrained judge stays easy to fool alone.
• 04 — Model integrity and watermarking. Every model signed and verified at load, tied to append-only provenance from build to runtime.
• 05 — Auditable decision trail. Per-judge scores, divergence and action taken kept in a tamper-evident log — robustness you can replay.

Which ones get skipped

Criteria 1 and 5 are the marketable ones — “multiple models” and “full logging” both sound reassuring. The three in the middle are where products quietly fall short.

Homogeneous ensembles fail criterion 1 (their perturbations transfer, often above 60%). Treating disagreement as mere uncertainty fails criterion 2. Shipping a model that was never adversarially trained, or one whose provenance stops at the artifact, fails 3 and 4. The whitepaper's point is that the guarantee is the conjunction: drop any one criterion and the mediation stops meaning anything.

Ward³ as the reference implementation

Ward³ exists to show the five criteria are buildable, not just slide-worthy: three orthogonal judges (a sequence model, a graph model, a non-differentiable rule engine), a mediator that fails closed on divergence, adversarial training with a documented procedure, signed-and-verified artifacts with append-only provenance, and a hash-chained, post-quantum-signed ledger for every decision.

The whitepaper is the full argument — threat model, empirical evidence, the tiered architecture, performance under evasion, and how it compares to EDR, NDR and XDR. If this post is the map, that is the territory.