aiqbench analysis
This research proposes a novel runtime monitoring framework for stochastic systems by integrating information geometry with sequential inference to detect regime shifts while minimizing false alarms. The study demonstrates high detection accuracy on cybersecurity datasets like NSL-KDD and UNSW-NB15, validating the approach against standard benchmarks without claiming universal superiority.
Information-Geometric First-Passage Monitoring of Distributional Stability in Stochastic Systems
arXiv:2604.24083v2 Announce Type: replace-cross Abstract: Runtime monitoring of stochastic systems must distinguish nominal distributional relaxation from regime departure while controlling repeated-test false alarms under explicit validity assumptions. This paper links relative-entropy dissipation, information geometry, and sequential inference in a bounded first-passage monitoring architecture. For reversible Fokker--Planck dynamics, relative entropy to an invariant density is non-increasing; under exogenous forcing, its derivative decomposes into nominal dissipation and an information-space forcing term. The runtime layer uses Gaussian window surrogates, nominal-relative covariance shrinkage, a coordinate-consistent relative precision diagnostic, and randomized conformal ranks aggregated by a mixture power-martingale process. Analytical Ornstein--Uhlenbeck validation gives zero positive nominal Kullback--Leibler increments, forcing-identity residuals below 3.31 x 10^-6, and coordinate-invariance errors at numerical roundoff. On NSL-KDD, the monitor yields 0/100 alarms on internal nominal streams but 63/100 on official test-normal streams; post-change detection is 99.0% for seen and 98.53% for test-only attack types with median one-window delay. On UNSW-NB15, internal-null alarms are 0/100, whereas official test-normal alarms rise to 90/100; post-change detection is 81.33%, with 18.67% pre-change alarms. In these evaluations, calibration transport emerges as a major deployment constraint. No universal benchmark superiority, causal inference, or physical-work interpretation is claimed.
Abstract:Runtime monitoring of stochastic systems must distinguish nominal distributional relaxation from regime departure while controlling repeated-test false alarms under explicit validity assumptions. This paper links relative-entropy dissipation, information geometry, and sequential inference in a bounded first-passage monitoring architecture. For reversible Fokker--Planck dynamics, relative entropy to an invariant density is non-increasing; under exogenous forcing, its derivative decomposes into nominal dissipation and an information-space forcing term. The runtime layer uses Gaussian window surrogates, nominal-relative covariance shrinkage, a coordinate-consistent relative precision diagnostic, and randomized conformal ranks aggregated by a mixture power-martingale process. Analytical Ornstein--Uhlenbeck validation gives zero positive nominal Kullback--Leibler increments, forcing-identity residuals below 3.31 x 10^-6, and coordinate-invariance errors at numerical roundoff. On NSL-KDD, the monitor yields 0/100 alarms on internal nominal streams but 63/100 on official test-normal streams; post-change detection is 99.0% for seen and 98.53% for test-only attack types with median one-window delay. On UNSW-NB15, internal-null alarms are 0/100, whereas official test-normal alarms rise to 90/100; post-change detection is 81.33%, with 18.67% pre-change alarms. In these evaluations, calibration transport emerges as a major deployment constraint. No universal benchmark superiority, causal inference, or physical-work interpretation is claimed.
Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2604.24083 [cs.AI]
(or arXiv:2604.24083v2 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2604.24083 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 289 words
Related coverage

PIRAMID: Progress and Plans
LessWrong · Jul 27, 2026

The Entangled Dimensions of Decision Theory
LessWrong · Jul 30, 2026
Restart and first detection in a lackadaisical quantum walk with flat-band localization
arXiv · Sep 9, 2026

Research Note: Filtering Subversion-Relevant Information From Pretraining Data Is Feasible
LessWrong · Oct 5, 2026