Why one model is a bet you keep losing

In 2017, building a network detection product around a single, well-trained ML model was a reasonable bet. In 2026, it is a fragile one — because the attacker can now target the model itself.

Gradient-based evasion is no longer research. A deployed model is a fixed target: given enough queries or a transferable surrogate trained on public data, its blind spots can be found and used, often without the attacker ever seeing your detection logic.

A commodity attack surface

The tooling to attack a model is now as accessible as the tooling to build one. What used to require a research team is a weekend project:

• FGSM and PGD perturbations, packaged in ART, CleverHans and Foolbox.
• Transfer attacks, where an adversarial example crafted on a surrogate carries over to your model.
• Model extraction, rebuilding a usable copy of a detector from its outputs.
• Label poisoning, nudging the training set so the blind spot is baked in from the start.

Three seeds is not three judges

The instinct is to ensemble. It helps — it raises the attacker's cost — but it does not solve the problem when the models are too similar. Three seeds of the same architecture share the same features, the same training data and the same inductive bias, so a perturbation that fools one usually transfers to all three. Cross-model transfer rates above 60% are common. Redundancy is not robustness.

Ward³ uses judges that are architecturally orthogonal: a sequence model over packet windows, a graph model over host topology, and a deterministic rule engine that is not differentiable at all. A perturbation crafted against the sequence judge has no gradient to follow into the rule engine, and no reason to keep the graph topology plausible.

The real question is what catches it next

A single model gives you a score and nothing else. When it is fooled, it fails silently. Orthogonal judges give you a score and a shape of agreement — and a stealthy attacker who fools one of them usually leaves the others inconsistent.

That inconsistency is not noise to be smoothed away. It is the signal, and it is the thing a single-model NDR structurally cannot produce. The bet was never that your model is perfect; it was that it never has a bad day. That is the bet you keep losing.