{
 "experiment": "large-scale-local-gpu",
 "hardware": {
  "gpus": "four NVIDIA H200 GPUs (150 GB each), 96 CPU cores"
 },
 "judge": {
  "decoding_fix": {
   "ab_control": "4 of 8",
   "ab_patched": "8 of 8",
   "after_failed": 8,
   "after_rate": 0.005780346820809248,
   "before_failed": 644,
   "before_rate": 0.4653179190751445,
   "records": 1384
  },
  "local": {
   "f1": 0.6418672501823487,
   "fpr": 0.18198529411764705,
   "n": 1376,
   "precision": 0.8163265306122449,
   "recall": 0.5288461538461539
  },
  "mantle": {
   "f1": 0.612,
   "fpr": 0.176,
   "precision": 0.815,
   "recall": 0.49
  }
 },
 "cascade": {
  "benign_skipped": 0.7074829931972789,
  "cascade": {
   "f1": 0.6259314456035767,
   "fpr": 0.11564625850340136,
   "n": 721,
   "precision": 0.860655737704918,
   "recall": 0.4918032786885246
  },
  "eval_n": 721,
  "judge_alone": {
   "f1": 0.6115007012622721,
   "fpr": 0.23129251700680273,
   "n": 721,
   "precision": 0.7622377622377622,
   "recall": 0.5105386416861827
  },
  "judge_calls": 0.6074895977808599,
  "screen": "prompt_injection",
  "select_n": 655,
  "threshold": 0.035,
  "selected_on_test_members": true
 },
 "deterministic": {
  "by_analyzer": [
   {
    "analyzer": "correlation",
    "harmless": 35,
    "malicious": 29,
    "ratio": 1.206896551724138
   },
   {
    "analyzer": "static",
    "harmless": 10,
    "malicious": 30,
    "ratio": 0.3333333333333333
   },
   {
    "analyzer": "pipeline",
    "harmless": 10,
    "malicious": 33,
    "ratio": 0.30303030303030304
   }
  ],
  "demotion": [
   {
    "f1": 0.13487881981032665,
    "fpr": 0.08440366972477065,
    "label": "Shipped, all rules",
    "precision": 0.5818181818181818,
    "recall": 0.07628128724672228
   },
   {
    "f1": 0.1328976034858388,
    "fpr": 0.03302752293577982,
    "label": "Demote CORRELATED_NETWORK_EXECUTION_FLOW",
    "precision": 0.7721518987341772,
    "recall": 0.07270560190703218
   },
   {
    "f1": 0.11504424778761063,
    "fpr": 0.023853211009174313,
    "label": "Also demote PIPELINE_TAINT_FLOW",
    "precision": 0.8,
    "recall": 0.06197854588796186
   }
  ],
  "fpr_high": 0.07706422018348624,
  "worst_rules": [
   {
    "analyzer": "correlation",
    "harmless": 31,
    "malicious": 7,
    "precision": 0.18421052631578946,
    "rule_id": "CORRELATED_NETWORK_EXECUTION_FLOW"
   },
   {
    "analyzer": "pipeline",
    "harmless": 10,
    "malicious": 9,
    "precision": 0.47368421052631576,
    "rule_id": "PIPELINE_TAINT_FLOW"
   },
   {
    "analyzer": "correlation",
    "harmless": 4,
    "malicious": 22,
    "precision": 0.8461538461538461,
    "rule_id": "CORRELATED_SENSITIVE_NETWORK_FLOW"
   },
   {
    "analyzer": "static",
    "harmless": 4,
    "malicious": 18,
    "precision": 0.8181818181818182,
    "rule_id": "ACTIVE_DYNAMIC_EXECUTION"
   },
   {
    "analyzer": "static",
    "harmless": 1,
    "malicious": 1,
    "precision": 0.5,
    "rule_id": "ACTIVE_REMOTE_ACQUIRE_EXECUTE"
   },
   {
    "analyzer": "static",
    "harmless": 1,
    "malicious": 0,
    "precision": 0.0,
    "rule_id": "FILE_MAGIC_MISMATCH"
   }
  ]
 },
 "full": {
  "agreement": {
   "static-base": {
    "both": 20645,
    "cohen_kappa": 0.07204408070868454,
    "det_flags_judge_agrees": {
     "ci95": [
      0.2602443505404491,
      0.26641013652809953
     ],
     "count": 20645,
     "of": 78404,
     "rate": 0.26331564716085915
    },
    "det_only": 57759,
    "either_flag_rate": 0.15776732405716642,
    "judge_flags_det_agrees": {
     "ci95": [
      0.08553146392917856,
      0.08779085454542258
     ],
     "count": 20645,
     "of": 238245,
     "rate": 0.08665449432307079
    },
    "judge_only": 217600,
    "neither": 1580202,
    "records": 1876206
   },
   "static-head": {
    "both": 16321,
    "cohen_kappa": 0.08368926160009121,
    "det_flags_judge_agrees": {
     "ci95": [
      0.4017052248407043,
      0.4113139110419257
     ],
     "count": 16321,
     "of": 40150,
     "rate": 0.40650062266500625
    },
    "det_only": 23829,
    "either_flag_rate": 0.13968295592275048,
    "judge_flags_det_agrees": {
     "ci95": [
      0.0674976833297555,
      0.06952645236283121
     ],
     "count": 16321,
     "of": 238245,
     "rate": 0.06850511028563033
    },
    "judge_only": 221924,
    "neither": 1614132,
    "records": 1876206
   },
   "static-tuned": {
    "both": 16893,
    "cohen_kappa": 0.0808926273497803,
    "det_flags_judge_agrees": {
     "ci95": [
      0.36145740674050636,
      0.3702437084924225
     ],
     "count": 16893,
     "of": 46176,
     "rate": 0.3658393970893971
    },
    "det_only": 29283,
    "either_flag_rate": 0.14258988618520568,
    "judge_flags_det_agrees": {
     "ci95": [
      0.06988224388507805,
      0.07194359406266877
     ],
     "count": 16893,
     "of": 238245,
     "rate": 0.0709060001259208
    },
    "judge_only": 221352,
    "neither": 1608678,
    "records": 1876206
   }
  },
  "blocking": false,
  "by_analyzer": {
   "static-base": [
    {
     "analyzer": "static",
     "findings": 114429,
     "medium_plus_records": 58328,
     "rate": 0.03108071671936662
    },
    {
     "analyzer": "pipeline",
     "findings": 29609,
     "medium_plus_records": 16525,
     "rate": 0.00880552811321378
    },
    {
     "analyzer": "correlation",
     "findings": 26559,
     "medium_plus_records": 14987,
     "rate": 0.007985987887003627
    }
   ],
   "static-head": [
    {
     "analyzer": "static",
     "findings": 67637,
     "medium_plus_records": 25292,
     "rate": 0.013477120547013794
    },
    {
     "analyzer": "correlation",
     "findings": 19530,
     "medium_plus_records": 11909,
     "rate": 0.006345841712572642
    },
    {
     "analyzer": "pipeline",
     "findings": 15024,
     "medium_plus_records": 8736,
     "rate": 0.0046550737426345285
    }
   ],
   "static-tuned": [
    {
     "analyzer": "static",
     "findings": 74331,
     "medium_plus_records": 29879,
     "rate": 0.015921353978500124
    },
    {
     "analyzer": "correlation",
     "findings": 23094,
     "medium_plus_records": 13382,
     "rate": 0.007130745973435813
    },
    {
     "analyzer": "pipeline",
     "findings": 21452,
     "medium_plus_records": 11990,
     "rate": 0.0063890034540050366
    }
   ]
  },
  "by_rule": {
   "static-base": [
    {
     "analyzer": "static",
     "est_removable_false_positives": 18209,
     "high_plus_records": 108,
     "judge_clears": 0.9481632653061225,
     "judge_clears_ci95": [
      0.9449707422354673,
      0.95118014280331
     ],
     "judged": 19600,
     "medium_plus_records": 19606,
     "rate": 0.01044727287066078,
     "rule_id": "FILE_MAGIC_MISMATCH",
     "sole_driver_judge_clears": 0.9513507864346554,
     "sole_driver_records": 19140
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 2968,
     "high_plus_records": 7835,
     "judge_clears": 0.5885862000397694,
     "judge_clears_ci95": [
      0.5789370414746595,
      0.5981677143783843
     ],
     "judged": 10058,
     "medium_plus_records": 10082,
     "rate": 0.005372304655819748,
     "rule_id": "PIPELINE_TAINT_FLOW",
     "sole_driver_judge_clears": 0.642175986129172,
     "sole_driver_records": 4622
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 1933,
     "high_plus_records": 9348,
     "judge_clears": 0.46135060522403903,
     "judge_clears_ci95": [
      0.45130035428787774,
      0.4714323734625018
     ],
     "judged": 9418,
     "medium_plus_records": 9425,
     "rate": 0.00502221497531255,
     "rule_id": "CORRELATED_NETWORK_EXECUTION_FLOW",
     "sole_driver_judge_clears": 0.43575293056807934,
     "sole_driver_records": 4437
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 4066,
     "high_plus_records": 7743,
     "judge_clears": 0.6613070539419087,
     "judge_clears_ci95": [
      0.6506663108792475,
      0.6717871723545191
     ],
     "judged": 7712,
     "medium_plus_records": 7743,
     "rate": 0.004125942764333695,
     "rule_id": "ACTIVE_DYNAMIC_EXECUTION",
     "sole_driver_judge_clears": 0.6774032042723631,
     "sole_driver_records": 6002
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 3328,
     "high_plus_records": 5721,
     "judge_clears": 0.6704028021015762,
     "judge_clears_ci95": [
      0.6580991577184883,
      0.6824773118847294
     ],
     "judged": 5710,
     "medium_plus_records": 5721,
     "rate": 0.0030484978115398512,
     "rule_id": "CORRELATED_SENSITIVE_NETWORK_FLOW",
     "sole_driver_judge_clears": 0.7230802697411355,
     "sole_driver_records": 4602
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 1113,
     "high_plus_records": 5621,
     "judge_clears": 0.8346092220046288,
     "judge_clears_ci95": [
      0.8246648562370433,
      0.8440962061632921
     ],
     "judged": 5617,
     "medium_plus_records": 5621,
     "rate": 0.0029952117110060308,
     "rule_id": "COMPOUND_FIND_EXEC",
     "sole_driver_judge_clears": 0.7597269624573378,
     "sole_driver_records": 1465
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 416,
     "high_plus_records": 4629,
     "judge_clears": 0.8561540125459658,
     "judge_clears_ci95": [
      0.8457419447911826,
      0.8659746611976631
     ],
     "judged": 4623,
     "medium_plus_records": 4629,
     "rate": 0.002466613593710535,
     "rule_id": "FIND_EXEC_PATTERN",
     "sole_driver_judge_clears": 0.8263473053892215,
     "sole_driver_records": 503
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 3452,
     "high_plus_records": 4,
     "judge_clears": 0.7951595159515952,
     "judge_clears_ci95": [
      0.7831791465311861,
      0.8066413475480098
     ],
     "judged": 4545,
     "medium_plus_records": 4546,
     "rate": 0.0024223861302674642,
     "rule_id": "SOCIAL_ENG_ANTHROPIC_IMPERSONATION",
     "sole_driver_judge_clears": 0.8110458284371328,
     "sole_driver_records": 4256
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 3095,
     "high_plus_records": 0,
     "judge_clears": 0.87066415703146,
     "judge_clears_ci95": [
      0.8594952619719018,
      0.8810680754529296
     ],
     "judged": 3719,
     "medium_plus_records": 3721,
     "rate": 0.001982775800863448,
     "rule_id": "SUPPLY_CHAIN_UNPINNED_DEPENDENCY",
     "sole_driver_judge_clears": 0.8867545871559633,
     "sole_driver_records": 3490
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 1435,
     "high_plus_records": 3450,
     "judge_clears": 0.5947674418604652,
     "judge_clears_ci95": [
      0.578264544847579,
      0.611058913002515
     ],
     "judged": 3440,
     "medium_plus_records": 3450,
     "rate": 0.0018383704684167953,
     "rule_id": "PROMPT_INJECTION_IGNORE_INSTRUCTIONS",
     "sole_driver_judge_clears": 0.6013428451531683,
     "sole_driver_records": 2387
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 1085,
     "high_plus_records": 2236,
     "judge_clears": 0.6835955056179776,
     "judge_clears_ci95": [
      0.6639684655984682,
      0.7025896603805157
     ],
     "judged": 2225,
     "medium_plus_records": 2236,
     "rate": 0.0011914772079362186,
     "rule_id": "ACTIVE_REMOTE_ACQUIRE_EXECUTE",
     "sole_driver_judge_clears": 0.6903390914907229,
     "sole_driver_records": 1571
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 1289,
     "high_plus_records": 0,
     "judge_clears": 0.868361581920904,
     "judge_clears_ci95": [
      0.8518095706251387,
      0.8833180754961385
     ],
     "judged": 1770,
     "medium_plus_records": 1771,
     "rate": 0.000943696840453955,
     "rule_id": "YARA_autonomy_abuse_generic",
     "sole_driver_judge_clears": 0.8586666666666667,
     "sole_driver_records": 1501
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 855,
     "high_plus_records": 1504,
     "judge_clears": 0.7161981258366801,
     "judge_clears_ci95": [
      0.6928047196902006,
      0.7384825405915274
     ],
     "judged": 1494,
     "medium_plus_records": 1504,
     "rate": 0.0008014229520286551,
     "rule_id": "YARA_jailbreak_generic",
     "sole_driver_judge_clears": 0.7484662576687117,
     "sole_driver_records": 1142
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 966,
     "high_plus_records": 1495,
     "judge_clears": 0.709979906229069,
     "judge_clears_ci95": [
      0.6864464695837771,
      0.7324355283510746
     ],
     "judged": 1493,
     "medium_plus_records": 1495,
     "rate": 0.0007966272029806113,
     "rule_id": "SECRET_CONNECTION_STRING",
     "sole_driver_judge_clears": 0.748062015503876,
     "sole_driver_records": 1292
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 862,
     "high_plus_records": 1433,
     "judge_clears": 0.652875175315568,
     "judge_clears_ci95": [
      0.6277852919726258,
      0.677143589660137
     ],
     "judged": 1426,
     "medium_plus_records": 1433,
     "rate": 0.0007635898206496428,
     "rule_id": "YARA_sql_injection_generic",
     "sole_driver_judge_clears": 0.67425431711146,
     "sole_driver_records": 1278
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 408,
     "high_plus_records": 1154,
     "judge_clears": 0.7504332755632582,
     "judge_clears_ci95": [
      0.7246608954577846,
      0.7745438316827845
     ],
     "judged": 1154,
     "medium_plus_records": 1154,
     "rate": 0.0006149216001602846,
     "rule_id": "PROMPT_INJECTION_CONCEALMENT",
     "sole_driver_judge_clears": 0.8209255533199196,
     "sole_driver_records": 497
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 176,
     "high_plus_records": 1030,
     "judge_clears": 0.5340466926070039,
     "judge_clears_ci95": [
      0.5034820735999462,
      0.5643577963956035
     ],
     "judged": 1028,
     "medium_plus_records": 1030,
     "rate": 0.0005488468354983476,
     "rule_id": "COMPOUND_FETCH_EXECUTE",
     "sole_driver_judge_clears": 0.5285285285285285,
     "sole_driver_records": 333
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 462,
     "high_plus_records": 1020,
     "judge_clears": 0.640117994100295,
     "judge_clears_ci95": [
      0.610142651901974,
      0.6690387607677292
     ],
     "judged": 1017,
     "medium_plus_records": 1020,
     "rate": 0.0005435182254449655,
     "rule_id": "ACTIVE_OS_PERSISTENCE_DIRECTIVE",
     "sole_driver_judge_clears": 0.6690856313497823,
     "sole_driver_records": 691
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 248,
     "high_plus_records": 0,
     "judge_clears": 0.41966173361522197,
     "judge_clears_ci95": [
      0.38860007559927207,
      0.45137324205706136
     ],
     "judged": 946,
     "medium_plus_records": 949,
     "rate": 0.0005056850940659532,
     "rule_id": "YARA_tool_chaining_abuse_generic",
     "sole_driver_judge_clears": 0.5210970464135021,
     "sole_driver_records": 475
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 107,
     "high_plus_records": 872,
     "judge_clears": 0.6055045871559632,
     "judge_clears_ci95": [
      0.5726699865199449,
      0.637413663308974
     ],
     "judged": 872,
     "medium_plus_records": 872,
     "rate": 0.00046465479665491174,
     "rule_id": "YARA_prompt_injection_generic",
     "sole_driver_judge_clears": 0.5783783783783784,
     "sole_driver_records": 185
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 207,
     "high_plus_records": 751,
     "judge_clears": 0.4623655913978495,
     "judge_clears_ci95": [
      0.4268239070156464,
      0.4982939254237365
     ],
     "judged": 744,
     "medium_plus_records": 751,
     "rate": 0.0004001786150089894,
     "rule_id": "YARA_command_injection_generic",
     "sole_driver_judge_clears": 0.4567627494456763,
     "sole_driver_records": 454
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 275,
     "high_plus_records": 684,
     "judge_clears": 0.5527859237536656,
     "judge_clears_ci95": [
      0.5152773052775856,
      0.5897032033413141
     ],
     "judged": 682,
     "medium_plus_records": 684,
     "rate": 0.00036447692765132985,
     "rule_id": "YARA_system_manipulation_generic",
     "sole_driver_judge_clears": 0.5741127348643006,
     "sole_driver_records": 479
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 305,
     "high_plus_records": 670,
     "judge_clears": 0.5849624060150376,
     "judge_clears_ci95": [
      0.5471288306061157,
      0.6218199907590625
     ],
     "judged": 665,
     "medium_plus_records": 670,
     "rate": 0.00035701687357659505,
     "rule_id": "YARA_credential_harvesting_generic",
     "sole_driver_judge_clears": 0.6031746031746031,
     "sole_driver_records": 505
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 441,
     "high_plus_records": 0,
     "judge_clears": 0.7752808988764045,
     "judge_clears_ci95": [
      0.740874481096635,
      0.8063131975768927
     ],
     "judged": 623,
     "medium_plus_records": 625,
     "rate": 0.000333038128336376,
     "rule_id": "YARA_capability_inflation_generic",
     "sole_driver_judge_clears": 0.857421875,
     "sole_driver_records": 514
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 28,
     "high_plus_records": 581,
     "judge_clears": 0.05163511187607572,
     "judge_clears_ci95": [
      0.03640521315903566,
      0.07275528431583617
     ],
     "judged": 581,
     "medium_plus_records": 581,
     "rate": 0.0003095922441014951,
     "rule_id": "MANDATORY_AUTOMATIC_HELPER_EXECUTION",
     "sole_driver_judge_clears": 0.051188299817184646,
     "sole_driver_records": 547
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 353,
     "high_plus_records": 571,
     "judge_clears": 0.6882661996497372,
     "judge_clears_ci95": [
      0.6491209053820018,
      0.7248951713946268
     ],
     "judged": 571,
     "medium_plus_records": 571,
     "rate": 0.0003042636340481131,
     "rule_id": "YARA_coercive_injection_generic",
     "sole_driver_judge_clears": 0.7003968253968254,
     "sole_driver_records": 504
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 91,
     "high_plus_records": 0,
     "judge_clears": 0.7974683544303798,
     "judge_clears_ci95": [
      0.758963193732255,
      0.8311905308492801
     ],
     "judged": 474,
     "medium_plus_records": 474,
     "rate": 0.00025257611653030755,
     "rule_id": "YARA_code_execution_generic",
     "sole_driver_judge_clears": 0.883495145631068,
     "sole_driver_records": 103
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 107,
     "high_plus_records": 387,
     "judge_clears": 0.46253229974160204,
     "judge_clears_ci95": [
      0.4134678011077404,
      0.5123333418616878
     ],
     "judged": 387,
     "medium_plus_records": 387,
     "rate": 0.000206217209065884,
     "rule_id": "COMPOUND_EXTRACT_EXECUTE",
     "sole_driver_judge_clears": 0.4349593495934959,
     "sole_driver_records": 246
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 7,
     "high_plus_records": 342,
     "judge_clears": 0.23668639053254437,
     "judge_clears_ci95": [
      0.19448941427548808,
      0.2848015789798676
     ],
     "judged": 338,
     "medium_plus_records": 342,
     "rate": 0.00018223846382566493,
     "rule_id": "YARA_SUSP_Lnx_EncodedShell_DecodeExec_Sep26",
     "sole_driver_judge_clears": 0.6363636363636364,
     "sole_driver_records": 11
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 93,
     "high_plus_records": 297,
     "judge_clears": 0.7337883959044369,
     "judge_clears_ci95": [
      0.680392162515804,
      0.781133445754735
     ],
     "judged": 293,
     "medium_plus_records": 297,
     "rate": 0.00015825971858544587,
     "rule_id": "PROMPT_INJECTION_UNRESTRICTED_MODE",
     "sole_driver_judge_clears": 0.7301587301587301,
     "sole_driver_records": 128
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 60,
     "high_plus_records": 248,
     "judge_clears": 0.38056680161943324,
     "judge_clears_ci95": [
      0.32228266531826305,
      0.44250913954982896
     ],
     "judged": 247,
     "medium_plus_records": 248,
     "rate": 0.00013214952932387398,
     "rule_id": "SECRET_JWT_TOKEN",
     "sole_driver_judge_clears": 0.30927835051546393,
     "sole_driver_records": 194
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 37,
     "high_plus_records": 0,
     "judge_clears": 0.5150214592274678,
     "judge_clears_ci95": [
      0.4511269627984378,
      0.5784286558091041
     ],
     "judged": 233,
     "medium_plus_records": 241,
     "rate": 0.00012841950228650658,
     "rule_id": "OBFUSCATION_BASE64_LARGE",
     "sole_driver_judge_clears": 0.72,
     "sole_driver_records": 51
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 59,
     "high_plus_records": 0,
     "judge_clears": 0.2887029288702929,
     "judge_clears_ci95": [
      0.23495141945806036,
      0.3491396094266117
     ],
     "judged": 239,
     "medium_plus_records": 239,
     "rate": 0.00012735378027583017,
     "rule_id": "YARA_prompt_injection_unicode_steganography",
     "sole_driver_judge_clears": 0.2796208530805687,
     "sole_driver_records": 211
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 139,
     "high_plus_records": 0,
     "judge_clears": 0.7217391304347827,
     "judge_clears_ci95": [
      0.660541360766336,
      0.7756513440389683
     ],
     "judged": 230,
     "medium_plus_records": 231,
     "rate": 0.00012309089223312456,
     "rule_id": "YARA_indirect_prompt_injection_generic",
     "sole_driver_judge_clears": 0.7666666666666667,
     "sole_driver_records": 181
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 4,
     "high_plus_records": 211,
     "judge_clears": 0.21739130434782605,
     "judge_clears_ci95": [
      0.16662649362844192,
      0.27845455299613314
     ],
     "judged": 207,
     "medium_plus_records": 211,
     "rate": 0.00011243367212636052,
     "rule_id": "CORRELATED_OBFUSCATION_EXECUTION_FLOW",
     "sole_driver_judge_clears": 0.8,
     "sole_driver_records": 5
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 47,
     "high_plus_records": 0,
     "judge_clears": 0.7956989247311828,
     "judge_clears_ci95": [
      0.7320490837201468,
      0.8473813467018472
     ],
     "judged": 186,
     "medium_plus_records": 187,
     "rate": 9.96450079982437e-05,
     "rule_id": "PROMPT_INJECTION_REVEAL_SYSTEM",
     "sole_driver_judge_clears": 0.7704918032786885,
     "sole_driver_records": 61
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 33,
     "high_plus_records": 169,
     "judge_clears": 0.20118343195266275,
     "judge_clears_ci95": [
      0.14769143614171756,
      0.26795849998477045
     ],
     "judged": 169,
     "medium_plus_records": 169,
     "rate": 9.005350990215606e-05,
     "rule_id": "ACTIVE_HIDDEN_HTML_INSTRUCTION",
     "sole_driver_judge_clears": 0.2894736842105263,
     "sole_driver_records": 114
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 29,
     "high_plus_records": 152,
     "judge_clears": 0.5197368421052632,
     "judge_clears_ci95": [
      0.4408073303743211,
      0.597693301036034
     ],
     "judged": 152,
     "medium_plus_records": 152,
     "rate": 8.099487281140664e-05,
     "rule_id": "YARA_script_injection_generic",
     "sole_driver_judge_clears": 0.4142857142857143,
     "sole_driver_records": 70
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 63,
     "high_plus_records": 0,
     "judge_clears": 0.7605633802816901,
     "judge_clears_ci95": [
      0.6841013156696377,
      0.823298493438326
     ],
     "judged": 142,
     "medium_plus_records": 142,
     "rate": 7.566626275802462e-05,
     "rule_id": "GLOB_HIDDEN_FILE_TARGETING",
     "sole_driver_judge_clears": 0.7159090909090909,
     "sole_driver_records": 88
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 31,
     "high_plus_records": 121,
     "judge_clears": 0.6446280991735538,
     "judge_clears_ci95": [
      0.5560997364560519,
      0.7242555297372681
     ],
     "judged": 121,
     "medium_plus_records": 121,
     "rate": 6.447618164592238e-05,
     "rule_id": "CORRELATED_NETWORK_FILE_WRITE_FLOW",
     "sole_driver_judge_clears": 0.6078431372549019,
     "sole_driver_records": 51
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 27,
     "high_plus_records": 65,
     "judge_clears": 0.6307692307692307,
     "judge_clears_ci95": [
      0.5092359303460251,
      0.7377077781093274
     ],
     "judged": 65,
     "medium_plus_records": 65,
     "rate": 3.46359653469831e-05,
     "rule_id": "SECRET_GITHUB_TOKEN",
     "sole_driver_judge_clears": 0.7714285714285715,
     "sole_driver_records": 35
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 20,
     "high_plus_records": 62,
     "judge_clears": 0.7833333333333333,
     "judge_clears_ci95": [
      0.6637973165265748,
      0.8687707895359299
     ],
     "judged": 60,
     "medium_plus_records": 62,
     "rate": 3.3037382330968496e-05,
     "rule_id": "SECRET_AWS_KEY",
     "sole_driver_judge_clears": 0.7916666666666666,
     "sole_driver_records": 25
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": null,
     "high_plus_records": 41,
     "judge_clears": 0.04878048780487809,
     "judge_clears_ci95": [
      0.013480662282573547,
      0.16139266962351367
     ],
     "judged": 41,
     "medium_plus_records": 41,
     "rate": 2.1847301218866262e-05,
     "rule_id": "YARA_SUSP_Multi_RawIP_DownloadExec_Sep26",
     "sole_driver_judge_clears": null,
     "sole_driver_records": 0
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 41,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.08567044886890744
     ],
     "judged": 41,
     "medium_plus_records": 41,
     "rate": 2.1847301218866262e-05,
     "rule_id": "YARA_SUSP_Multi_RemoteMiner_AcquireExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 25
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 10,
     "high_plus_records": 40,
     "judge_clears": 0.275,
     "judge_clears_ci95": [
      0.1610785343314309,
      0.4283525083312458
     ],
     "judged": 40,
     "medium_plus_records": 40,
     "rate": 2.131444021352806e-05,
     "rule_id": "SECRET_GOOGLE_API",
     "sole_driver_judge_clears": 0.30303030303030304,
     "sole_driver_records": 33
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 28,
     "high_plus_records": 36,
     "judge_clears": 0.8055555555555556,
     "judge_clears_ci95": [
      0.6497163793648479,
      0.9024702798054665
     ],
     "judged": 36,
     "medium_plus_records": 36,
     "rate": 1.9182996192175257e-05,
     "rule_id": "COMPOUND_LAUNDERING_CHAIN",
     "sole_driver_judge_clears": 0.8235294117647058,
     "sole_driver_records": 34
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 5,
     "high_plus_records": 35,
     "judge_clears": 0.48571428571428577,
     "judge_clears_ci95": [
      0.32993980391252736,
      0.6443146037328836
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "ACTIVE_SENSITIVE_EXFILTRATION",
     "sole_driver_judge_clears": 0.625,
     "sole_driver_records": 8
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 16,
     "high_plus_records": 35,
     "judge_clears": 0.6285714285714286,
     "judge_clears_ci95": [
      0.4633664048802107,
      0.7683439263110893
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "SECRET_STRIPE_KEY",
     "sole_driver_judge_clears": 0.7272727272727273,
     "sole_driver_records": 22
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 35,
     "judge_clears": 0.5142857142857142,
     "judge_clears_ci95": [
      0.35568539626711626,
      0.6700601960874725
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "YARA_SUSP_Multi_CredentialExfil_Chain_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 8,
     "high_plus_records": 32,
     "judge_clears": 0.7741935483870968,
     "judge_clears_ci95": [
      0.6018723994130262,
      0.886050084055012
     ],
     "judged": 31,
     "medium_plus_records": 32,
     "rate": 1.705155217082245e-05,
     "rule_id": "PROMPT_INJECTION_BYPASS_POLICY",
     "sole_driver_judge_clears": 0.7272727272727273,
     "sole_driver_records": 11
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 28,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.12064720365810762
     ],
     "judged": 28,
     "medium_plus_records": 28,
     "rate": 1.4920108149469643e-05,
     "rule_id": "YARA_SUSP_Multi_Cryptomining_ConfigExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 16
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 25,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.13798057582897535
     ],
     "judged": 24,
     "medium_plus_records": 25,
     "rate": 1.332152513345504e-05,
     "rule_id": "UNICODE_SMUGGLING_ACTIVE_INTENT",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 5
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": null,
     "high_plus_records": 18,
     "judge_clears": 0.2777777777777778,
     "judge_clears_ci95": [
      0.12499569146355476,
      0.5087307754619452
     ],
     "judged": 18,
     "medium_plus_records": 18,
     "rate": 9.591498096087628e-06,
     "rule_id": "ASCII_SMUGGLING_TAG_BLOCK",
     "sole_driver_judge_clears": null,
     "sole_driver_records": 0
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 5,
     "high_plus_records": 15,
     "judge_clears": 0.7142857142857143,
     "judge_clears_ci95": [
      0.4535045882751561,
      0.882788120898909
     ],
     "judged": 14,
     "medium_plus_records": 15,
     "rate": 7.992915080073023e-06,
     "rule_id": "SECRET_PRIVATE_KEY",
     "sole_driver_judge_clears": 0.625,
     "sole_driver_records": 8
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 9,
     "judge_clears": 0.4444444444444444,
     "judge_clears_ci95": [
      0.188775429471914,
      0.7333526542559703
     ],
     "judged": 9,
     "medium_plus_records": 9,
     "rate": 4.795749048043814e-06,
     "rule_id": "UNICODE_OBFUSCATED_INSTRUCTION",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 5,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      -3.139202815737979e-17,
      0.43449149475208104
     ],
     "judged": 5,
     "medium_plus_records": 5,
     "rate": 2.6643050266910076e-06,
     "rule_id": "YARA_SUSP_Multi_RemoteConfig_StageExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 4
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 5,
     "judge_clears": 0.19999999999999996,
     "judge_clears_ci95": [
      0.036223160969787456,
      0.6244717358814612
     ],
     "judged": 5,
     "medium_plus_records": 5,
     "rate": 2.6643050266910076e-06,
     "rule_id": "YARA_SUSP_Win_EncodedPowerShell_Exec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 1,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.7934567085261071
     ],
     "judged": 1,
     "medium_plus_records": 1,
     "rate": 5.328610053382015e-07,
     "rule_id": "YARA_SUSP_Multi_Cron_C2_Persistence_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 1
    }
   ],
   "static-head": [
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 1891,
     "high_plus_records": 6361,
     "judge_clears": 0.4356868459398596,
     "judge_clears_ci95": [
      0.4245367705473364,
      0.44690234450043564
     ],
     "judged": 7549,
     "medium_plus_records": 7556,
     "rate": 0.004026297756335451,
     "rule_id": "CORRELATED_NETWORK_EXECUTION_FLOW",
     "sole_driver_judge_clears": 0.4318337519981731,
     "sole_driver_records": 4380
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 3755,
     "high_plus_records": 6968,
     "judge_clears": 0.6381721205131902,
     "judge_clears_ci95": [
      0.6267904032052533,
      0.6494008874877947
     ],
     "judged": 6937,
     "medium_plus_records": 6968,
     "rate": 0.0037129754851965885,
     "rule_id": "ACTIVE_DYNAMIC_EXECUTION",
     "sole_driver_judge_clears": 0.654901275554779,
     "sole_driver_records": 5734
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 1398,
     "high_plus_records": 5320,
     "judge_clears": 0.5397968605724839,
     "judge_clears_ci95": [
      0.526497948488448,
      0.5530393459768489
     ],
     "judged": 5415,
     "medium_plus_records": 5438,
     "rate": 0.00289769814702914,
     "rule_id": "PIPELINE_TAINT_FLOW",
     "sole_driver_judge_clears": 0.6403307303628847,
     "sole_driver_records": 2184
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 2368,
     "high_plus_records": 4237,
     "judge_clears": 0.5974917179365831,
     "judge_clears_ci95": [
      0.5826238302542451,
      0.6121825189953344
     ],
     "judged": 4226,
     "medium_plus_records": 4237,
     "rate": 0.00225773207961796,
     "rule_id": "CORRELATED_SENSITIVE_NETWORK_FLOW",
     "sole_driver_judge_clears": 0.6595982142857143,
     "sole_driver_records": 3590
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 1051,
     "high_plus_records": 2327,
     "judge_clears": 0.7020636285468616,
     "judge_clears_ci95": [
      0.6831561397381924,
      0.720304765071817
     ],
     "judged": 2326,
     "medium_plus_records": 2327,
     "rate": 0.001239967559421995,
     "rule_id": "COMPOUND_FIND_EXEC",
     "sole_driver_judge_clears": 0.7501784439685939,
     "sole_driver_records": 1401
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 1190,
     "high_plus_records": 2236,
     "judge_clears": 0.6835955056179776,
     "judge_clears_ci95": [
      0.6639684655984682,
      0.7025896603805157
     ],
     "judged": 2225,
     "medium_plus_records": 2236,
     "rate": 0.0011914772079362186,
     "rule_id": "ACTIVE_REMOTE_ACQUIRE_EXECUTE",
     "sole_driver_judge_clears": 0.6936145284124194,
     "sole_driver_records": 1715
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 489,
     "high_plus_records": 2045,
     "judge_clears": 0.3974484789008832,
     "judge_clears_ci95": [
      0.3764138425824816,
      0.41886900403990074
     ],
     "judged": 2038,
     "medium_plus_records": 2045,
     "rate": 0.0010897007559166221,
     "rule_id": "PROMPT_INJECTION_IGNORE_INSTRUCTIONS",
     "sole_driver_judge_clears": 0.3705391040242976,
     "sole_driver_records": 1319
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 982,
     "high_plus_records": 1495,
     "judge_clears": 0.709979906229069,
     "judge_clears_ci95": [
      0.6864464695837771,
      0.7324355283510746
     ],
     "judged": 1493,
     "medium_plus_records": 1495,
     "rate": 0.0007966272029806113,
     "rule_id": "SECRET_CONNECTION_STRING",
     "sole_driver_judge_clears": 0.748854961832061,
     "sole_driver_records": 1312
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 387,
     "high_plus_records": 1395,
     "judge_clears": 0.687724335965542,
     "judge_clears_ci95": [
      0.6628996356570278,
      0.7115164756615353
     ],
     "judged": 1393,
     "medium_plus_records": 1395,
     "rate": 0.0007433411024467912,
     "rule_id": "FIND_EXEC_PATTERN",
     "sole_driver_judge_clears": 0.8160676532769556,
     "sole_driver_records": 474
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 777,
     "high_plus_records": 1365,
     "judge_clears": 0.7042772861356932,
     "judge_clears_ci95": [
      0.6794369459257171,
      0.72796344541398
     ],
     "judged": 1356,
     "medium_plus_records": 1365,
     "rate": 0.0007273552722866451,
     "rule_id": "YARA_jailbreak_generic",
     "sole_driver_judge_clears": 0.7418738049713193,
     "sole_driver_records": 1047
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 650,
     "high_plus_records": 1185,
     "judge_clears": 0.5967741935483871,
     "judge_clears_ci95": [
      0.568490231539282,
      0.6244290226145741
     ],
     "judged": 1178,
     "medium_plus_records": 1185,
     "rate": 0.0006314402913257689,
     "rule_id": "YARA_sql_injection_generic",
     "sole_driver_judge_clears": 0.6197318007662835,
     "sole_driver_records": 1049
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 213,
     "high_plus_records": 1030,
     "judge_clears": 0.5340466926070039,
     "judge_clears_ci95": [
      0.5034820735999462,
      0.5643577963956035
     ],
     "judged": 1028,
     "medium_plus_records": 1030,
     "rate": 0.0005488468354983476,
     "rule_id": "COMPOUND_FETCH_EXECUTE",
     "sole_driver_judge_clears": 0.5447570332480819,
     "sole_driver_records": 391
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 562,
     "high_plus_records": 1020,
     "judge_clears": 0.640117994100295,
     "judge_clears_ci95": [
      0.610142651901974,
      0.6690387607677292
     ],
     "judged": 1017,
     "medium_plus_records": 1020,
     "rate": 0.0005435182254449655,
     "rule_id": "ACTIVE_OS_PERSISTENCE_DIRECTIVE",
     "sole_driver_judge_clears": 0.69221260815822,
     "sole_driver_records": 812
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 283,
     "high_plus_records": 0,
     "judge_clears": 0.41966173361522197,
     "judge_clears_ci95": [
      0.38860007559927207,
      0.45137324205706136
     ],
     "judged": 946,
     "medium_plus_records": 949,
     "rate": 0.0005056850940659532,
     "rule_id": "YARA_tool_chaining_abuse_generic",
     "sole_driver_judge_clears": 0.5475728155339806,
     "sole_driver_records": 516
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 704,
     "high_plus_records": 0,
     "judge_clears": 0.8818474758324383,
     "judge_clears_ci95": [
      0.8595267812888836,
      0.9010298734427843
     ],
     "judged": 931,
     "medium_plus_records": 932,
     "rate": 0.0004966264569752039,
     "rule_id": "YARA_autonomy_abuse_generic",
     "sole_driver_judge_clears": 0.8711276332094176,
     "sole_driver_records": 808
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 258,
     "high_plus_records": 872,
     "judge_clears": 0.6055045871559632,
     "judge_clears_ci95": [
      0.5726699865199449,
      0.637413663308974
     ],
     "judged": 872,
     "medium_plus_records": 872,
     "rate": 0.00046465479665491174,
     "rule_id": "YARA_prompt_injection_generic",
     "sole_driver_judge_clears": 0.6807387862796834,
     "sole_driver_records": 379
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 329,
     "high_plus_records": 859,
     "judge_clears": 0.7322467986030268,
     "judge_clears_ci95": [
      0.7016495072871413,
      0.7607760410406167
     ],
     "judged": 859,
     "medium_plus_records": 859,
     "rate": 0.0004577276035855151,
     "rule_id": "PROMPT_INJECTION_CONCEALMENT",
     "sole_driver_judge_clears": 0.8103448275862069,
     "sole_driver_records": 406
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 217,
     "high_plus_records": 751,
     "judge_clears": 0.4623655913978495,
     "judge_clears_ci95": [
      0.4268239070156464,
      0.4982939254237365
     ],
     "judged": 744,
     "medium_plus_records": 751,
     "rate": 0.0004001786150089894,
     "rule_id": "YARA_command_injection_generic",
     "sole_driver_judge_clears": 0.4625267665952891,
     "sole_driver_records": 470
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 284,
     "high_plus_records": 684,
     "judge_clears": 0.5527859237536656,
     "judge_clears_ci95": [
      0.5152773052775856,
      0.5897032033413141
     ],
     "judged": 682,
     "medium_plus_records": 684,
     "rate": 0.00036447692765132985,
     "rule_id": "YARA_system_manipulation_generic",
     "sole_driver_judge_clears": 0.568,
     "sole_driver_records": 500
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 314,
     "high_plus_records": 670,
     "judge_clears": 0.5849624060150376,
     "judge_clears_ci95": [
      0.5471288306061157,
      0.6218199907590625
     ],
     "judged": 665,
     "medium_plus_records": 670,
     "rate": 0.00035701687357659505,
     "rule_id": "YARA_credential_harvesting_generic",
     "sole_driver_judge_clears": 0.603082851637765,
     "sole_driver_records": 520
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 29,
     "high_plus_records": 581,
     "judge_clears": 0.05163511187607572,
     "judge_clears_ci95": [
      0.03640521315903566,
      0.07275528431583617
     ],
     "judged": 581,
     "medium_plus_records": 581,
     "rate": 0.0003095922441014951,
     "rule_id": "MANDATORY_AUTOMATIC_HELPER_EXECUTION",
     "sole_driver_judge_clears": 0.05253623188405797,
     "sole_driver_records": 552
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 379,
     "high_plus_records": 571,
     "judge_clears": 0.6882661996497372,
     "judge_clears_ci95": [
      0.6491209053820018,
      0.7248951713946268
     ],
     "judged": 571,
     "medium_plus_records": 571,
     "rate": 0.0003042636340481131,
     "rule_id": "YARA_coercive_injection_generic",
     "sole_driver_judge_clears": 0.7097378277153558,
     "sole_driver_records": 534
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 94,
     "high_plus_records": 0,
     "judge_clears": 0.7974683544303798,
     "judge_clears_ci95": [
      0.758963193732255,
      0.8311905308492801
     ],
     "judged": 474,
     "medium_plus_records": 474,
     "rate": 0.00025257611653030755,
     "rule_id": "YARA_code_execution_generic",
     "sole_driver_judge_clears": 0.8545454545454545,
     "sole_driver_records": 110
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 128,
     "high_plus_records": 387,
     "judge_clears": 0.46253229974160204,
     "judge_clears_ci95": [
      0.4134678011077404,
      0.5123333418616878
     ],
     "judged": 387,
     "medium_plus_records": 387,
     "rate": 0.000206217209065884,
     "rule_id": "COMPOUND_EXTRACT_EXECUTE",
     "sole_driver_judge_clears": 0.4758364312267658,
     "sole_driver_records": 269
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 214,
     "high_plus_records": 0,
     "judge_clears": 0.7011173184357542,
     "judge_clears_ci95": [
      0.6517663249317383,
      0.7461978671346245
     ],
     "judged": 358,
     "medium_plus_records": 359,
     "rate": 0.00019129710091641435,
     "rule_id": "YARA_capability_inflation_generic",
     "sole_driver_judge_clears": 0.8287937743190662,
     "sole_driver_records": 258
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 28,
     "high_plus_records": 342,
     "judge_clears": 0.23668639053254437,
     "judge_clears_ci95": [
      0.19448941427548808,
      0.2848015789798676
     ],
     "judged": 338,
     "medium_plus_records": 342,
     "rate": 0.00018223846382566493,
     "rule_id": "YARA_SUSP_Lnx_EncodedShell_DecodeExec_Sep26",
     "sole_driver_judge_clears": 0.5283018867924528,
     "sole_driver_records": 53
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 115,
     "high_plus_records": 297,
     "judge_clears": 0.7337883959044369,
     "judge_clears_ci95": [
      0.680392162515804,
      0.781133445754735
     ],
     "judged": 293,
     "medium_plus_records": 297,
     "rate": 0.00015825971858544587,
     "rule_id": "PROMPT_INJECTION_UNRESTRICTED_MODE",
     "sole_driver_judge_clears": 0.7635135135135135,
     "sole_driver_records": 151
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 215,
     "high_plus_records": 4,
     "judge_clears": 0.8333333333333334,
     "judge_clears_ci95": [
      0.7836646083184229,
      0.873440187949222
     ],
     "judged": 264,
     "medium_plus_records": 264,
     "rate": 0.0001406753054092852,
     "rule_id": "SOCIAL_ENG_ANTHROPIC_IMPERSONATION",
     "sole_driver_judge_clears": 0.86,
     "sole_driver_records": 250
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 60,
     "high_plus_records": 248,
     "judge_clears": 0.38056680161943324,
     "judge_clears_ci95": [
      0.32228266531826305,
      0.44250913954982896
     ],
     "judged": 247,
     "medium_plus_records": 248,
     "rate": 0.00013214952932387398,
     "rule_id": "SECRET_JWT_TOKEN",
     "sole_driver_judge_clears": 0.30927835051546393,
     "sole_driver_records": 194
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 38,
     "high_plus_records": 0,
     "judge_clears": 0.5150214592274678,
     "judge_clears_ci95": [
      0.4511269627984378,
      0.5784286558091041
     ],
     "judged": 233,
     "medium_plus_records": 241,
     "rate": 0.00012841950228650658,
     "rule_id": "OBFUSCATION_BASE64_LARGE",
     "sole_driver_judge_clears": 0.38,
     "sole_driver_records": 101
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 59,
     "high_plus_records": 0,
     "judge_clears": 0.2887029288702929,
     "judge_clears_ci95": [
      0.23495141945806036,
      0.3491396094266117
     ],
     "judged": 239,
     "medium_plus_records": 239,
     "rate": 0.00012735378027583017,
     "rule_id": "YARA_prompt_injection_unicode_steganography",
     "sole_driver_judge_clears": 0.2796208530805687,
     "sole_driver_records": 211
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 141,
     "high_plus_records": 0,
     "judge_clears": 0.7217391304347827,
     "judge_clears_ci95": [
      0.660541360766336,
      0.7756513440389683
     ],
     "judged": 230,
     "medium_plus_records": 231,
     "rate": 0.00012309089223312456,
     "rule_id": "YARA_indirect_prompt_injection_generic",
     "sole_driver_judge_clears": 0.7608695652173914,
     "sole_driver_records": 185
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 64,
     "high_plus_records": 0,
     "judge_clears": 0.8031088082901554,
     "judge_clears_ci95": [
      0.741327422605713,
      0.8530591298303573
     ],
     "judged": 193,
     "medium_plus_records": 194,
     "rate": 0.0001033750350356111,
     "rule_id": "PROMPT_INJECTION_REVEAL_SYSTEM",
     "sole_driver_judge_clears": 0.810126582278481,
     "sole_driver_records": 79
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 4,
     "high_plus_records": 175,
     "judge_clears": 0.17543859649122806,
     "judge_clears_ci95": [
      0.12574284572144825,
      0.23939680067849317
     ],
     "judged": 171,
     "medium_plus_records": 175,
     "rate": 9.325067593418527e-05,
     "rule_id": "CORRELATED_OBFUSCATION_EXECUTION_FLOW",
     "sole_driver_judge_clears": 0.8,
     "sole_driver_records": 5
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 33,
     "high_plus_records": 169,
     "judge_clears": 0.20118343195266275,
     "judge_clears_ci95": [
      0.14769143614171756,
      0.26795849998477045
     ],
     "judged": 169,
     "medium_plus_records": 169,
     "rate": 9.005350990215606e-05,
     "rule_id": "ACTIVE_HIDDEN_HTML_INSTRUCTION",
     "sole_driver_judge_clears": 0.2894736842105263,
     "sole_driver_records": 114
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 31,
     "high_plus_records": 152,
     "judge_clears": 0.5197368421052632,
     "judge_clears_ci95": [
      0.4408073303743211,
      0.597693301036034
     ],
     "judged": 152,
     "medium_plus_records": 152,
     "rate": 8.099487281140664e-05,
     "rule_id": "YARA_script_injection_generic",
     "sole_driver_judge_clears": 0.4246575342465753,
     "sole_driver_records": 73
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 64,
     "high_plus_records": 0,
     "judge_clears": 0.7605633802816901,
     "judge_clears_ci95": [
      0.6841013156696377,
      0.823298493438326
     ],
     "judged": 142,
     "medium_plus_records": 142,
     "rate": 7.566626275802462e-05,
     "rule_id": "GLOB_HIDDEN_FILE_TARGETING",
     "sole_driver_judge_clears": 0.7111111111111111,
     "sole_driver_records": 90
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 32,
     "high_plus_records": 121,
     "judge_clears": 0.6446280991735538,
     "judge_clears_ci95": [
      0.5560997364560519,
      0.7242555297372681
     ],
     "judged": 121,
     "medium_plus_records": 121,
     "rate": 6.447618164592238e-05,
     "rule_id": "CORRELATED_NETWORK_FILE_WRITE_FLOW",
     "sole_driver_judge_clears": 0.6153846153846154,
     "sole_driver_records": 52
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 99,
     "high_plus_records": 108,
     "judge_clears": 0.9259259259259259,
     "judge_clears_ci95": [
      0.8606017449198994,
      0.9619902065543284
     ],
     "judged": 108,
     "medium_plus_records": 108,
     "rate": 5.754898857652577e-05,
     "rule_id": "FILE_MAGIC_MISMATCH",
     "sole_driver_judge_clears": 0.9252336448598131,
     "sole_driver_records": 107
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 28,
     "high_plus_records": 65,
     "judge_clears": 0.6307692307692307,
     "judge_clears_ci95": [
      0.5092359303460251,
      0.7377077781093274
     ],
     "judged": 65,
     "medium_plus_records": 65,
     "rate": 3.46359653469831e-05,
     "rule_id": "SECRET_GITHUB_TOKEN",
     "sole_driver_judge_clears": 0.7777777777777778,
     "sole_driver_records": 36
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 21,
     "high_plus_records": 62,
     "judge_clears": 0.7833333333333333,
     "judge_clears_ci95": [
      0.6637973165265748,
      0.8687707895359299
     ],
     "judged": 60,
     "medium_plus_records": 62,
     "rate": 3.3037382330968496e-05,
     "rule_id": "SECRET_AWS_KEY",
     "sole_driver_judge_clears": 0.8,
     "sole_driver_records": 26
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": null,
     "high_plus_records": 41,
     "judge_clears": 0.04878048780487809,
     "judge_clears_ci95": [
      0.013480662282573547,
      0.16139266962351367
     ],
     "judged": 41,
     "medium_plus_records": 41,
     "rate": 2.1847301218866262e-05,
     "rule_id": "YARA_SUSP_Multi_RawIP_DownloadExec_Sep26",
     "sole_driver_judge_clears": null,
     "sole_driver_records": 0
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 41,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.08567044886890744
     ],
     "judged": 41,
     "medium_plus_records": 41,
     "rate": 2.1847301218866262e-05,
     "rule_id": "YARA_SUSP_Multi_RemoteMiner_AcquireExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 25
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 10,
     "high_plus_records": 40,
     "judge_clears": 0.275,
     "judge_clears_ci95": [
      0.1610785343314309,
      0.4283525083312458
     ],
     "judged": 40,
     "medium_plus_records": 40,
     "rate": 2.131444021352806e-05,
     "rule_id": "SECRET_GOOGLE_API",
     "sole_driver_judge_clears": 0.30303030303030304,
     "sole_driver_records": 33
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 28,
     "high_plus_records": 36,
     "judge_clears": 0.8055555555555556,
     "judge_clears_ci95": [
      0.6497163793648479,
      0.9024702798054665
     ],
     "judged": 36,
     "medium_plus_records": 36,
     "rate": 1.9182996192175257e-05,
     "rule_id": "COMPOUND_LAUNDERING_CHAIN",
     "sole_driver_judge_clears": 0.8235294117647058,
     "sole_driver_records": 34
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 9,
     "high_plus_records": 35,
     "judge_clears": 0.48571428571428577,
     "judge_clears_ci95": [
      0.32993980391252736,
      0.6443146037328836
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "ACTIVE_SENSITIVE_EXFILTRATION",
     "sole_driver_judge_clears": 0.75,
     "sole_driver_records": 12
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 19,
     "high_plus_records": 35,
     "judge_clears": 0.6285714285714286,
     "judge_clears_ci95": [
      0.4633664048802107,
      0.7683439263110893
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "SECRET_STRIPE_KEY",
     "sole_driver_judge_clears": 0.76,
     "sole_driver_records": 25
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 35,
     "judge_clears": 0.5142857142857142,
     "judge_clears_ci95": [
      0.35568539626711626,
      0.6700601960874725
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "YARA_SUSP_Multi_CredentialExfil_Chain_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 9,
     "high_plus_records": 32,
     "judge_clears": 0.7741935483870968,
     "judge_clears_ci95": [
      0.6018723994130262,
      0.886050084055012
     ],
     "judged": 31,
     "medium_plus_records": 32,
     "rate": 1.705155217082245e-05,
     "rule_id": "PROMPT_INJECTION_BYPASS_POLICY",
     "sole_driver_judge_clears": 0.75,
     "sole_driver_records": 12
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 28,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.12064720365810762
     ],
     "judged": 28,
     "medium_plus_records": 28,
     "rate": 1.4920108149469643e-05,
     "rule_id": "YARA_SUSP_Multi_Cryptomining_ConfigExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 17
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 25,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.13798057582897535
     ],
     "judged": 24,
     "medium_plus_records": 25,
     "rate": 1.332152513345504e-05,
     "rule_id": "UNICODE_SMUGGLING_ACTIVE_INTENT",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 5
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": null,
     "high_plus_records": 18,
     "judge_clears": 0.2777777777777778,
     "judge_clears_ci95": [
      0.12499569146355476,
      0.5087307754619452
     ],
     "judged": 18,
     "medium_plus_records": 18,
     "rate": 9.591498096087628e-06,
     "rule_id": "ASCII_SMUGGLING_TAG_BLOCK",
     "sole_driver_judge_clears": null,
     "sole_driver_records": 0
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 6,
     "high_plus_records": 15,
     "judge_clears": 0.7142857142857143,
     "judge_clears_ci95": [
      0.4535045882751561,
      0.882788120898909
     ],
     "judged": 14,
     "medium_plus_records": 15,
     "rate": 7.992915080073023e-06,
     "rule_id": "SECRET_PRIVATE_KEY",
     "sole_driver_judge_clears": 0.6666666666666666,
     "sole_driver_records": 9
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 9,
     "judge_clears": 0.4444444444444444,
     "judge_clears_ci95": [
      0.188775429471914,
      0.7333526542559703
     ],
     "judged": 9,
     "medium_plus_records": 9,
     "rate": 4.795749048043814e-06,
     "rule_id": "UNICODE_OBFUSCATED_INSTRUCTION",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 5,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      -3.139202815737979e-17,
      0.43449149475208104
     ],
     "judged": 5,
     "medium_plus_records": 5,
     "rate": 2.6643050266910076e-06,
     "rule_id": "YARA_SUSP_Multi_RemoteConfig_StageExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 4
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 5,
     "judge_clears": 0.19999999999999996,
     "judge_clears_ci95": [
      0.036223160969787456,
      0.6244717358814612
     ],
     "judged": 5,
     "medium_plus_records": 5,
     "rate": 2.6643050266910076e-06,
     "rule_id": "YARA_SUSP_Win_EncodedPowerShell_Exec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 1,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.7934567085261071
     ],
     "judged": 1,
     "medium_plus_records": 1,
     "rate": 5.328610053382015e-07,
     "rule_id": "YARA_SUSP_Multi_Cron_C2_Persistence_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 1
    }
   ],
   "static-tuned": [
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 1886,
     "high_plus_records": 6361,
     "judge_clears": 0.4356868459398596,
     "judge_clears_ci95": [
      0.4245367705473364,
      0.44690234450043564
     ],
     "judged": 7549,
     "medium_plus_records": 7556,
     "rate": 0.004026297756335451,
     "rule_id": "CORRELATED_NETWORK_EXECUTION_FLOW",
     "sole_driver_judge_clears": 0.4317765567765568,
     "sole_driver_records": 4369
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 3872,
     "high_plus_records": 7150,
     "judge_clears": 0.6450344149459193,
     "judge_clears_ci95": [
      0.6338433606098003,
      0.6560690249190314
     ],
     "judged": 7119,
     "medium_plus_records": 7150,
     "rate": 0.003809956188168141,
     "rule_id": "ACTIVE_DYNAMIC_EXECUTION",
     "sole_driver_judge_clears": 0.6604579630895421,
     "sole_driver_records": 5862
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 3629,
     "high_plus_records": 5721,
     "judge_clears": 0.6704028021015762,
     "judge_clears_ci95": [
      0.6580991577184883,
      0.6824773118847294
     ],
     "judged": 5710,
     "medium_plus_records": 5721,
     "rate": 0.0030484978115398512,
     "rule_id": "CORRELATED_SENSITIVE_NETWORK_FLOW",
     "sole_driver_judge_clears": 0.7234085012971463,
     "sole_driver_records": 5017
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 1105,
     "high_plus_records": 5581,
     "judge_clears": 0.8346781423704501,
     "judge_clears_ci95": [
      0.8246989421505879,
      0.844196587871264
     ],
     "judged": 5577,
     "medium_plus_records": 5581,
     "rate": 0.0029738972707925027,
     "rule_id": "COMPOUND_FIND_EXEC",
     "sole_driver_judge_clears": 0.75840768702814,
     "sole_driver_records": 1457
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 1366,
     "high_plus_records": 5320,
     "judge_clears": 0.5397968605724839,
     "judge_clears_ci95": [
      0.526497948488448,
      0.5530393459768489
     ],
     "judged": 5415,
     "medium_plus_records": 5438,
     "rate": 0.00289769814702914,
     "rule_id": "PIPELINE_TAINT_FLOW",
     "sole_driver_judge_clears": 0.6358543417366946,
     "sole_driver_records": 2149
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 423,
     "high_plus_records": 4629,
     "judge_clears": 0.8561540125459658,
     "judge_clears_ci95": [
      0.8457419447911826,
      0.8659746611976631
     ],
     "judged": 4623,
     "medium_plus_records": 4629,
     "rate": 0.002466613593710535,
     "rule_id": "FIND_EXEC_PATTERN",
     "sole_driver_judge_clears": 0.8254901960784313,
     "sole_driver_records": 512
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 1465,
     "high_plus_records": 3450,
     "judge_clears": 0.5947674418604652,
     "judge_clears_ci95": [
      0.578264544847579,
      0.611058913002515
     ],
     "judged": 3440,
     "medium_plus_records": 3450,
     "rate": 0.0018383704684167953,
     "rule_id": "PROMPT_INJECTION_IGNORE_INSTRUCTIONS",
     "sole_driver_judge_clears": 0.6045454545454545,
     "sole_driver_records": 2424
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 1164,
     "high_plus_records": 2236,
     "judge_clears": 0.6835955056179776,
     "judge_clears_ci95": [
      0.6639684655984682,
      0.7025896603805157
     ],
     "judged": 2225,
     "medium_plus_records": 2236,
     "rate": 0.0011914772079362186,
     "rule_id": "ACTIVE_REMOTE_ACQUIRE_EXECUTE",
     "sole_driver_judge_clears": 0.6896962477665277,
     "sole_driver_records": 1687
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 869,
     "high_plus_records": 1504,
     "judge_clears": 0.7161981258366801,
     "judge_clears_ci95": [
      0.6928047196902006,
      0.7384825405915274
     ],
     "judged": 1494,
     "medium_plus_records": 1504,
     "rate": 0.0008014229520286551,
     "rule_id": "YARA_jailbreak_generic",
     "sole_driver_judge_clears": 0.7495682210708118,
     "sole_driver_records": 1159
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 970,
     "high_plus_records": 1495,
     "judge_clears": 0.709979906229069,
     "judge_clears_ci95": [
      0.6864464695837771,
      0.7324355283510746
     ],
     "judged": 1493,
     "medium_plus_records": 1495,
     "rate": 0.0007966272029806113,
     "rule_id": "SECRET_CONNECTION_STRING",
     "sole_driver_judge_clears": 0.7471087124132614,
     "sole_driver_records": 1299
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 648,
     "high_plus_records": 1185,
     "judge_clears": 0.5967741935483871,
     "judge_clears_ci95": [
      0.568490231539282,
      0.6244290226145741
     ],
     "judged": 1178,
     "medium_plus_records": 1185,
     "rate": 0.0006314402913257689,
     "rule_id": "YARA_sql_injection_generic",
     "sole_driver_judge_clears": 0.6190019193857965,
     "sole_driver_records": 1047
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 411,
     "high_plus_records": 1154,
     "judge_clears": 0.7504332755632582,
     "judge_clears_ci95": [
      0.7246608954577846,
      0.7745438316827845
     ],
     "judged": 1154,
     "medium_plus_records": 1154,
     "rate": 0.0006149216001602846,
     "rule_id": "PROMPT_INJECTION_CONCEALMENT",
     "sole_driver_judge_clears": 0.8138613861386138,
     "sole_driver_records": 505
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 213,
     "high_plus_records": 1030,
     "judge_clears": 0.5340466926070039,
     "judge_clears_ci95": [
      0.5034820735999462,
      0.5643577963956035
     ],
     "judged": 1028,
     "medium_plus_records": 1030,
     "rate": 0.0005488468354983476,
     "rule_id": "COMPOUND_FETCH_EXECUTE",
     "sole_driver_judge_clears": 0.5447570332480819,
     "sole_driver_records": 391
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 477,
     "high_plus_records": 1020,
     "judge_clears": 0.640117994100295,
     "judge_clears_ci95": [
      0.610142651901974,
      0.6690387607677292
     ],
     "judged": 1017,
     "medium_plus_records": 1020,
     "rate": 0.0005435182254449655,
     "rule_id": "ACTIVE_OS_PERSISTENCE_DIRECTIVE",
     "sole_driver_judge_clears": 0.6615598885793872,
     "sole_driver_records": 721
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 253,
     "high_plus_records": 0,
     "judge_clears": 0.41966173361522197,
     "judge_clears_ci95": [
      0.38860007559927207,
      0.45137324205706136
     ],
     "judged": 946,
     "medium_plus_records": 949,
     "rate": 0.0005056850940659532,
     "rule_id": "YARA_tool_chaining_abuse_generic",
     "sole_driver_judge_clears": 0.5228215767634855,
     "sole_driver_records": 483
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 700,
     "high_plus_records": 0,
     "judge_clears": 0.8818474758324383,
     "judge_clears_ci95": [
      0.8595267812888836,
      0.9010298734427843
     ],
     "judged": 931,
     "medium_plus_records": 932,
     "rate": 0.0004966264569752039,
     "rule_id": "YARA_autonomy_abuse_generic",
     "sole_driver_judge_clears": 0.871571072319202,
     "sole_driver_records": 803
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 111,
     "high_plus_records": 872,
     "judge_clears": 0.6055045871559632,
     "judge_clears_ci95": [
      0.5726699865199449,
      0.637413663308974
     ],
     "judged": 872,
     "medium_plus_records": 872,
     "rate": 0.00046465479665491174,
     "rule_id": "YARA_prompt_injection_generic",
     "sole_driver_judge_clears": 0.5842105263157895,
     "sole_driver_records": 190
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 212,
     "high_plus_records": 751,
     "judge_clears": 0.4623655913978495,
     "judge_clears_ci95": [
      0.4268239070156464,
      0.4982939254237365
     ],
     "judged": 744,
     "medium_plus_records": 751,
     "rate": 0.0004001786150089894,
     "rule_id": "YARA_command_injection_generic",
     "sole_driver_judge_clears": 0.45670995670995673,
     "sole_driver_records": 465
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 283,
     "high_plus_records": 684,
     "judge_clears": 0.5527859237536656,
     "judge_clears_ci95": [
      0.5152773052775856,
      0.5897032033413141
     ],
     "judged": 682,
     "medium_plus_records": 684,
     "rate": 0.00036447692765132985,
     "rule_id": "YARA_system_manipulation_generic",
     "sole_driver_judge_clears": 0.5694164989939637,
     "sole_driver_records": 497
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 309,
     "high_plus_records": 670,
     "judge_clears": 0.5849624060150376,
     "judge_clears_ci95": [
      0.5471288306061157,
      0.6218199907590625
     ],
     "judged": 665,
     "medium_plus_records": 670,
     "rate": 0.00035701687357659505,
     "rule_id": "YARA_credential_harvesting_generic",
     "sole_driver_judge_clears": 0.6015625,
     "sole_driver_records": 513
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 29,
     "high_plus_records": 581,
     "judge_clears": 0.05163511187607572,
     "judge_clears_ci95": [
      0.03640521315903566,
      0.07275528431583617
     ],
     "judged": 581,
     "medium_plus_records": 581,
     "rate": 0.0003095922441014951,
     "rule_id": "MANDATORY_AUTOMATIC_HELPER_EXECUTION",
     "sole_driver_judge_clears": 0.05253623188405797,
     "sole_driver_records": 552
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 377,
     "high_plus_records": 571,
     "judge_clears": 0.6882661996497372,
     "judge_clears_ci95": [
      0.6491209053820018,
      0.7248951713946268
     ],
     "judged": 571,
     "medium_plus_records": 571,
     "rate": 0.0003042636340481131,
     "rule_id": "YARA_coercive_injection_generic",
     "sole_driver_judge_clears": 0.7086466165413534,
     "sole_driver_records": 532
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 93,
     "high_plus_records": 0,
     "judge_clears": 0.7974683544303798,
     "judge_clears_ci95": [
      0.758963193732255,
      0.8311905308492801
     ],
     "judged": 474,
     "medium_plus_records": 474,
     "rate": 0.00025257611653030755,
     "rule_id": "YARA_code_execution_generic",
     "sole_driver_judge_clears": 0.8691588785046729,
     "sole_driver_records": 107
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 128,
     "high_plus_records": 387,
     "judge_clears": 0.46253229974160204,
     "judge_clears_ci95": [
      0.4134678011077404,
      0.5123333418616878
     ],
     "judged": 387,
     "medium_plus_records": 387,
     "rate": 0.000206217209065884,
     "rule_id": "COMPOUND_EXTRACT_EXECUTE",
     "sole_driver_judge_clears": 0.4758364312267658,
     "sole_driver_records": 269
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 214,
     "high_plus_records": 0,
     "judge_clears": 0.7011173184357542,
     "judge_clears_ci95": [
      0.6517663249317383,
      0.7461978671346245
     ],
     "judged": 358,
     "medium_plus_records": 359,
     "rate": 0.00019129710091641435,
     "rule_id": "YARA_capability_inflation_generic",
     "sole_driver_judge_clears": 0.8287937743190662,
     "sole_driver_records": 258
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 28,
     "high_plus_records": 342,
     "judge_clears": 0.23668639053254437,
     "judge_clears_ci95": [
      0.19448941427548808,
      0.2848015789798676
     ],
     "judged": 338,
     "medium_plus_records": 342,
     "rate": 0.00018223846382566493,
     "rule_id": "YARA_SUSP_Lnx_EncodedShell_DecodeExec_Sep26",
     "sole_driver_judge_clears": 0.5384615384615384,
     "sole_driver_records": 52
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 94,
     "high_plus_records": 297,
     "judge_clears": 0.7337883959044369,
     "judge_clears_ci95": [
      0.680392162515804,
      0.781133445754735
     ],
     "judged": 293,
     "medium_plus_records": 297,
     "rate": 0.00015825971858544587,
     "rule_id": "PROMPT_INJECTION_UNRESTRICTED_MODE",
     "sole_driver_judge_clears": 0.7322834645669292,
     "sole_driver_records": 129
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 215,
     "high_plus_records": 4,
     "judge_clears": 0.8333333333333334,
     "judge_clears_ci95": [
      0.7836646083184229,
      0.873440187949222
     ],
     "judged": 264,
     "medium_plus_records": 264,
     "rate": 0.0001406753054092852,
     "rule_id": "SOCIAL_ENG_ANTHROPIC_IMPERSONATION",
     "sole_driver_judge_clears": 0.86,
     "sole_driver_records": 250
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 60,
     "high_plus_records": 248,
     "judge_clears": 0.38056680161943324,
     "judge_clears_ci95": [
      0.32228266531826305,
      0.44250913954982896
     ],
     "judged": 247,
     "medium_plus_records": 248,
     "rate": 0.00013214952932387398,
     "rule_id": "SECRET_JWT_TOKEN",
     "sole_driver_judge_clears": 0.30927835051546393,
     "sole_driver_records": 194
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 37,
     "high_plus_records": 0,
     "judge_clears": 0.5150214592274678,
     "judge_clears_ci95": [
      0.4511269627984378,
      0.5784286558091041
     ],
     "judged": 233,
     "medium_plus_records": 241,
     "rate": 0.00012841950228650658,
     "rule_id": "OBFUSCATION_BASE64_LARGE",
     "sole_driver_judge_clears": 0.37373737373737376,
     "sole_driver_records": 100
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 59,
     "high_plus_records": 0,
     "judge_clears": 0.2887029288702929,
     "judge_clears_ci95": [
      0.23495141945806036,
      0.3491396094266117
     ],
     "judged": 239,
     "medium_plus_records": 239,
     "rate": 0.00012735378027583017,
     "rule_id": "YARA_prompt_injection_unicode_steganography",
     "sole_driver_judge_clears": 0.2796208530805687,
     "sole_driver_records": 211
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 140,
     "high_plus_records": 0,
     "judge_clears": 0.7217391304347827,
     "judge_clears_ci95": [
      0.660541360766336,
      0.7756513440389683
     ],
     "judged": 230,
     "medium_plus_records": 231,
     "rate": 0.00012309089223312456,
     "rule_id": "YARA_indirect_prompt_injection_generic",
     "sole_driver_judge_clears": 0.7595628415300546,
     "sole_driver_records": 184
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 49,
     "high_plus_records": 0,
     "judge_clears": 0.7956989247311828,
     "judge_clears_ci95": [
      0.7320490837201468,
      0.8473813467018472
     ],
     "judged": 186,
     "medium_plus_records": 187,
     "rate": 9.96450079982437e-05,
     "rule_id": "PROMPT_INJECTION_REVEAL_SYSTEM",
     "sole_driver_judge_clears": 0.7777777777777778,
     "sole_driver_records": 63
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 4,
     "high_plus_records": 175,
     "judge_clears": 0.17543859649122806,
     "judge_clears_ci95": [
      0.12574284572144825,
      0.23939680067849317
     ],
     "judged": 171,
     "medium_plus_records": 175,
     "rate": 9.325067593418527e-05,
     "rule_id": "CORRELATED_OBFUSCATION_EXECUTION_FLOW",
     "sole_driver_judge_clears": 0.8,
     "sole_driver_records": 5
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 33,
     "high_plus_records": 169,
     "judge_clears": 0.20118343195266275,
     "judge_clears_ci95": [
      0.14769143614171756,
      0.26795849998477045
     ],
     "judged": 169,
     "medium_plus_records": 169,
     "rate": 9.005350990215606e-05,
     "rule_id": "ACTIVE_HIDDEN_HTML_INSTRUCTION",
     "sole_driver_judge_clears": 0.2894736842105263,
     "sole_driver_records": 114
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 31,
     "high_plus_records": 152,
     "judge_clears": 0.5197368421052632,
     "judge_clears_ci95": [
      0.4408073303743211,
      0.597693301036034
     ],
     "judged": 152,
     "medium_plus_records": 152,
     "rate": 8.099487281140664e-05,
     "rule_id": "YARA_script_injection_generic",
     "sole_driver_judge_clears": 0.4246575342465753,
     "sole_driver_records": 73
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 64,
     "high_plus_records": 0,
     "judge_clears": 0.7605633802816901,
     "judge_clears_ci95": [
      0.6841013156696377,
      0.823298493438326
     ],
     "judged": 142,
     "medium_plus_records": 142,
     "rate": 7.566626275802462e-05,
     "rule_id": "GLOB_HIDDEN_FILE_TARGETING",
     "sole_driver_judge_clears": 0.7111111111111111,
     "sole_driver_records": 90
    },
    {
     "analyzer": "correlation",
     "est_removable_false_positives": 31,
     "high_plus_records": 121,
     "judge_clears": 0.6446280991735538,
     "judge_clears_ci95": [
      0.5560997364560519,
      0.7242555297372681
     ],
     "judged": 121,
     "medium_plus_records": 121,
     "rate": 6.447618164592238e-05,
     "rule_id": "CORRELATED_NETWORK_FILE_WRITE_FLOW",
     "sole_driver_judge_clears": 0.6078431372549019,
     "sole_driver_records": 51
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 78,
     "high_plus_records": 108,
     "judge_clears": 0.9259259259259259,
     "judge_clears_ci95": [
      0.8606017449198994,
      0.9619902065543284
     ],
     "judged": 108,
     "medium_plus_records": 108,
     "rate": 5.754898857652577e-05,
     "rule_id": "FILE_MAGIC_MISMATCH",
     "sole_driver_judge_clears": 0.9069767441860465,
     "sole_driver_records": 86
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 28,
     "high_plus_records": 65,
     "judge_clears": 0.6307692307692307,
     "judge_clears_ci95": [
      0.5092359303460251,
      0.7377077781093274
     ],
     "judged": 65,
     "medium_plus_records": 65,
     "rate": 3.46359653469831e-05,
     "rule_id": "SECRET_GITHUB_TOKEN",
     "sole_driver_judge_clears": 0.7777777777777778,
     "sole_driver_records": 36
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 21,
     "high_plus_records": 62,
     "judge_clears": 0.7833333333333333,
     "judge_clears_ci95": [
      0.6637973165265748,
      0.8687707895359299
     ],
     "judged": 60,
     "medium_plus_records": 62,
     "rate": 3.3037382330968496e-05,
     "rule_id": "SECRET_AWS_KEY",
     "sole_driver_judge_clears": 0.8,
     "sole_driver_records": 26
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": null,
     "high_plus_records": 41,
     "judge_clears": 0.04878048780487809,
     "judge_clears_ci95": [
      0.013480662282573547,
      0.16139266962351367
     ],
     "judged": 41,
     "medium_plus_records": 41,
     "rate": 2.1847301218866262e-05,
     "rule_id": "YARA_SUSP_Multi_RawIP_DownloadExec_Sep26",
     "sole_driver_judge_clears": null,
     "sole_driver_records": 0
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 41,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.08567044886890744
     ],
     "judged": 41,
     "medium_plus_records": 41,
     "rate": 2.1847301218866262e-05,
     "rule_id": "YARA_SUSP_Multi_RemoteMiner_AcquireExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 25
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 10,
     "high_plus_records": 40,
     "judge_clears": 0.275,
     "judge_clears_ci95": [
      0.1610785343314309,
      0.4283525083312458
     ],
     "judged": 40,
     "medium_plus_records": 40,
     "rate": 2.131444021352806e-05,
     "rule_id": "SECRET_GOOGLE_API",
     "sole_driver_judge_clears": 0.30303030303030304,
     "sole_driver_records": 33
    },
    {
     "analyzer": "pipeline",
     "est_removable_false_positives": 28,
     "high_plus_records": 36,
     "judge_clears": 0.8055555555555556,
     "judge_clears_ci95": [
      0.6497163793648479,
      0.9024702798054665
     ],
     "judged": 36,
     "medium_plus_records": 36,
     "rate": 1.9182996192175257e-05,
     "rule_id": "COMPOUND_LAUNDERING_CHAIN",
     "sole_driver_judge_clears": 0.8235294117647058,
     "sole_driver_records": 34
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 5,
     "high_plus_records": 35,
     "judge_clears": 0.48571428571428577,
     "judge_clears_ci95": [
      0.32993980391252736,
      0.6443146037328836
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "ACTIVE_SENSITIVE_EXFILTRATION",
     "sole_driver_judge_clears": 0.625,
     "sole_driver_records": 8
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 19,
     "high_plus_records": 35,
     "judge_clears": 0.6285714285714286,
     "judge_clears_ci95": [
      0.4633664048802107,
      0.7683439263110893
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "SECRET_STRIPE_KEY",
     "sole_driver_judge_clears": 0.76,
     "sole_driver_records": 25
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 35,
     "judge_clears": 0.5142857142857142,
     "judge_clears_ci95": [
      0.35568539626711626,
      0.6700601960874725
     ],
     "judged": 35,
     "medium_plus_records": 35,
     "rate": 1.8650135186837056e-05,
     "rule_id": "YARA_SUSP_Multi_CredentialExfil_Chain_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 8,
     "high_plus_records": 32,
     "judge_clears": 0.7741935483870968,
     "judge_clears_ci95": [
      0.6018723994130262,
      0.886050084055012
     ],
     "judged": 31,
     "medium_plus_records": 32,
     "rate": 1.705155217082245e-05,
     "rule_id": "PROMPT_INJECTION_BYPASS_POLICY",
     "sole_driver_judge_clears": 0.7272727272727273,
     "sole_driver_records": 11
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 28,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.12064720365810762
     ],
     "judged": 28,
     "medium_plus_records": 28,
     "rate": 1.4920108149469643e-05,
     "rule_id": "YARA_SUSP_Multi_Cryptomining_ConfigExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 17
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 25,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.13798057582897535
     ],
     "judged": 24,
     "medium_plus_records": 25,
     "rate": 1.332152513345504e-05,
     "rule_id": "UNICODE_SMUGGLING_ACTIVE_INTENT",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 5
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": null,
     "high_plus_records": 18,
     "judge_clears": 0.2777777777777778,
     "judge_clears_ci95": [
      0.12499569146355476,
      0.5087307754619452
     ],
     "judged": 18,
     "medium_plus_records": 18,
     "rate": 9.591498096087628e-06,
     "rule_id": "ASCII_SMUGGLING_TAG_BLOCK",
     "sole_driver_judge_clears": null,
     "sole_driver_records": 0
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 6,
     "high_plus_records": 15,
     "judge_clears": 0.7142857142857143,
     "judge_clears_ci95": [
      0.4535045882751561,
      0.882788120898909
     ],
     "judged": 14,
     "medium_plus_records": 15,
     "rate": 7.992915080073023e-06,
     "rule_id": "SECRET_PRIVATE_KEY",
     "sole_driver_judge_clears": 0.6666666666666666,
     "sole_driver_records": 9
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 9,
     "judge_clears": 0.4444444444444444,
     "judge_clears_ci95": [
      0.188775429471914,
      0.7333526542559703
     ],
     "judged": 9,
     "medium_plus_records": 9,
     "rate": 4.795749048043814e-06,
     "rule_id": "UNICODE_OBFUSCATED_INSTRUCTION",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 5,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      -3.139202815737979e-17,
      0.43449149475208104
     ],
     "judged": 5,
     "medium_plus_records": 5,
     "rate": 2.6643050266910076e-06,
     "rule_id": "YARA_SUSP_Multi_RemoteConfig_StageExec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 4
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 5,
     "judge_clears": 0.19999999999999996,
     "judge_clears_ci95": [
      0.036223160969787456,
      0.6244717358814612
     ],
     "judged": 5,
     "medium_plus_records": 5,
     "rate": 2.6643050266910076e-06,
     "rule_id": "YARA_SUSP_Win_EncodedPowerShell_Exec_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 2
    },
    {
     "analyzer": "static",
     "est_removable_false_positives": 0,
     "high_plus_records": 1,
     "judge_clears": 0.0,
     "judge_clears_ci95": [
      0.0,
      0.7934567085261071
     ],
     "judged": 1,
     "medium_plus_records": 1,
     "rate": 5.328610053382015e-07,
     "rule_id": "YARA_SUSP_Multi_Cron_C2_Persistence_Sep26",
     "sole_driver_judge_clears": 0.0,
     "sole_driver_records": 1
    }
   ]
  },
  "cascade": {
   "at_threshold": {
    "cascade_flag_rate": 0.034044236080686234,
    "cascade_flag_rate_ci95": [
     0.03378570128026287,
     0.03430467899993829
    ],
    "judge_calls": 0.07821369295269283,
    "judge_flag_rate": 0.1269823249685802,
    "judge_flags_retained": 0.26810216373900814,
    "records": 1876206,
    "threshold": 0.0609
   },
   "sweep": [
    {
     "cascade_flag_rate": 0.09000450909974704,
     "cascade_flag_rate_ci95": [
      0.08959583525814505,
      0.09041486189925971
     ],
     "judge_calls": 0.34623916563533,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.7087955675879871,
     "records": 1876206,
     "threshold": 0.005
    },
    {
     "cascade_flag_rate": 0.072004353466517,
     "cascade_flag_rate_ci95": [
      0.07163534291681749,
      0.07237511668592246
     ],
     "judge_calls": 0.2316024999387061,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.5670423303741946,
     "records": 1876206,
     "threshold": 0.01
    },
    {
     "cascade_flag_rate": 0.0550222097147115,
     "cascade_flag_rate_ci95": [
      0.05469683599723354,
      0.05534940564486659
     ],
     "judge_calls": 0.1537688292223775,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.43330605049423915,
     "records": 1876206,
     "threshold": 0.02
    },
    {
     "cascade_flag_rate": 0.04364499420639312,
     "cascade_flag_rate_ci95": [
      0.04335358448155295,
      0.043938272734339825
     ],
     "judge_calls": 0.11106243131084753,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.3437092069088543,
     "records": 1876206,
     "threshold": 0.035
    },
    {
     "cascade_flag_rate": 0.03802514222851862,
     "cascade_flag_rate_ci95": [
      0.03775241306245871,
      0.038299763211340446
     ],
     "judge_calls": 0.09103904368710046,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.2994522445381855,
     "records": 1876206,
     "threshold": 0.0484
    },
    {
     "cascade_flag_rate": 0.034044236080686234,
     "cascade_flag_rate_ci95": [
      0.03378570128026287,
      0.03430467899993829
     ],
     "judge_calls": 0.07821369295269283,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.26810216373900814,
     "records": 1876206,
     "threshold": 0.0609
    },
    {
     "cascade_flag_rate": 0.026205011603203487,
     "cascade_flag_rate_ci95": [
      0.025977398031978762,
      0.02643456539538545
     ],
     "judge_calls": 0.05525512656925732,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.20636739490860248,
     "records": 1876206,
     "threshold": 0.1
    },
    {
     "cascade_flag_rate": 0.016851561075915972,
     "cascade_flag_rate_ci95": [
      0.016668366614911386,
      0.017036734060859426
     ],
     "judge_calls": 0.03196290812416121,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.13270792671409684,
     "records": 1876206,
     "threshold": 0.2
    },
    {
     "cascade_flag_rate": 0.010483390416617364,
     "cascade_flag_rate_ci95": [
      0.010338649598109302,
      0.010630135837132813
     ],
     "judge_calls": 0.016668745329670623,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.08255787109907868,
     "records": 1876206,
     "threshold": 0.35
    },
    {
     "cascade_flag_rate": 0.00733874638499184,
     "cascade_flag_rate_ci95": [
      0.0072176196979221565,
      0.007461890551588517
     ],
     "judge_calls": 0.010336818025312786,
     "judge_flag_rate": 0.1269823249685802,
     "judge_flags_retained": 0.057793447921257526,
     "records": 1876206,
     "threshold": 0.5
    }
   ],
   "threshold": 0.0609,
   "selection": "selected on MaliciousSkillBench train/validation for the prompt this corpus was judged with: keep at least 97% of the judge's recall at the lowest false-positive rate"
  },
  "caveat": "gitskills is unlabelled: flag rates bound FPR from above; the judge is not ground truth.",
  "combined": {
   "cascade": {
    "ci95": [
     0.03378570128026287,
     0.03430467899993829
    ],
    "count": 63874,
    "of": 1876206,
    "rate": 0.034044236080686234
   },
   "deterministic": {
    "ci95": [
     0.021193475140906668,
     0.021607623019583865
    ],
    "count": 40150,
    "of": 1876206,
    "rate": 0.021399569130468615
   },
   "deterministic_or_cascade": {
    "ci95": [
     0.05159195675094307,
     0.052226836478437885
    ],
    "count": 97391,
    "of": 1876206,
    "rate": 0.051908479132888395
   },
   "records": 1876206
  },
  "deterministic": {
   "medium_plus_relative_reduction": 0.48740972832524554,
   "overall": {
    "from": "static-base",
    "medium_plus_added": 7,
    "medium_plus_cleared": 38275,
    "to": "static-head"
   },
   "static-base": {
    "errors": 107,
    "records": 1876662,
    "tiers": {
     "CRITICAL": {
      "ci95": [
       0.00617303115938896,
       0.006399181259570219
      ],
      "count": 11795,
      "of": 1876662,
      "rate": 0.006285095557964087
     },
     "HIGH+": {
      "ci95": [
       0.024466411182444768,
       0.024910435534708154
      ],
      "count": 46330,
      "of": 1876662,
      "rate": 0.024687450377318877
     },
     "INFO+": {
      "ci95": [
       0.9032282743897276,
       0.9040726133955578
      ],
      "count": 1695848,
      "of": 1876662,
      "rate": 0.9036512701807784
     },
     "LOW+": {
      "ci95": [
       0.05181426286392835,
       0.05245035221169779
      ],
      "count": 97833,
      "of": 1876662,
      "rate": 0.052131390735252275
     },
     "MEDIUM+": {
      "ci95": [
       0.04155099497759952,
       0.04212391299968861
      ],
      "count": 78513,
      "of": 1876662,
      "rate": 0.04183651611211822
     }
    }
   },
   "static-head": {
    "errors": 107,
    "records": 1876662,
    "tiers": {
     "CRITICAL": {
      "ci95": [
       0.004157505706775257,
       0.004343656964997007
      ],
      "count": 7975,
      "of": 1876662,
      "rate": 0.004249566517572158
     },
     "HIGH+": {
      "ci95": [
       0.019671699750654522,
       0.02007103971137544
      ],
      "count": 37290,
      "of": 1876662,
      "rate": 0.019870386889061536
     },
     "INFO+": {
      "ci95": [
       0.895720376554528,
       0.8965932932740325
      ],
      "count": 1681785,
      "of": 1876662,
      "rate": 0.8961576458627073
     },
     "LOW+": {
      "ci95": [
       0.03424628272163916,
       0.034768583286459646
      ],
      "count": 64757,
      "of": 1876662,
      "rate": 0.034506480122685916
     },
     "MEDIUM+": {
      "ci95": [
       0.02123870719360327,
       0.021653234363436462
      ],
      "count": 40245,
      "of": 1876662,
      "rate": 0.021444991159835922
     }
    }
   },
   "static-tuned": {
    "errors": 107,
    "records": 1876662,
    "tiers": {
     "CRITICAL": {
      "ci95": [
       0.00587363389010182,
       0.006094315385753961
      ],
      "count": 11228,
      "of": 1876662,
      "rate": 0.005982963367937327
     },
     "HIGH+": {
      "ci95": [
       0.022909442248985876,
       0.023339516769739402
      ],
      "count": 43395,
      "of": 1876662,
      "rate": 0.023123503326651255
     },
     "INFO+": {
      "ci95": [
       0.895952601634216,
       0.8968246563200059
      ],
      "count": 1682220,
      "of": 1876662,
      "rate": 0.8963894404000294
     },
     "LOW+": {
      "ci95": [
       0.037432064377396164,
       0.03797712060534179
      ],
      "count": 70757,
      "of": 1876662,
      "rate": 0.03770364615471513
     },
     "MEDIUM+": {
      "ci95": [
       0.02443829341551728,
       0.024882070150692995
      ],
      "count": 46277,
      "of": 1876662,
      "rate": 0.024659208744035953
     }
    }
   },
   "waterfall": [
    {
     "from": "static-base",
     "medium_plus_added": 7,
     "medium_plus_cleared": 32243,
     "medium_plus_rate_delta": -0.01717730736808227,
     "records_moved_down": 32717,
     "records_moved_up": 7,
     "to": "static-tuned"
    },
    {
     "from": "static-tuned",
     "medium_plus_added": 0,
     "medium_plus_cleared": 6032,
     "medium_plus_rate_delta": -0.0032142175842000305,
     "records_moved_down": 6297,
     "records_moved_up": 0,
     "to": "static-head"
    }
   ]
  },
  "experiment": "full-corpus-analysis",
  "jev": {
   "auc_vs_judge_flag": 0.7778648740679548,
   "genuine": 1876769,
   "paired_with_judge": 1876206,
   "quantiles": {
    "p10": 0.0006719999999999999,
    "p25": 0.00116,
    "p50": 0.002457,
    "p75": 0.008423,
    "p90": 0.0411453999999999,
    "p99": 0.5146362400000005
   },
   "rows": 1876769,
   "truncated": 67234
  },
  "judge": {
   "failed": 563,
   "failure_kinds": [
    [
     "capability",
     490
    ],
    [
     "SkillLoadError: SKILL.md contains null bytes (binary content is not allowed)",
     73
    ]
   ],
   "genuine": 1876206,
   "medium_plus_full_coverage_only": {
    "ci95": [
     0.13143521536212252,
     0.13242962600426686
    ],
    "count": 234797,
    "of": 1779687,
    "rate": 0.13193162617921017
   },
   "partial_coverage": 96519,
   "rows": 1876769,
   "tiers": {
    "CRITICAL": {
     "ci95": [
      0.0005573153749255207,
      0.000626902696388534
     ],
     "count": 1109,
     "of": 1876206,
     "rate": 0.0005910864798428318
    },
    "HIGH+": {
     "ci95": [
      0.02583569470382981,
      0.026291652371908926
     ],
     "count": 48899,
     "of": 1876206,
     "rate": 0.026062703136009585
    },
    "LOW+": {
     "ci95": [
      0.1920218364761276,
      0.19315034713406196
     ],
     "count": 361330,
     "of": 1876206,
     "rate": 0.19258546236394083
    },
    "MEDIUM+": {
     "ci95": [
      0.12650665875668543,
      0.12745951871185085
     ],
     "count": 238245,
     "of": 1876206,
     "rate": 0.1269823249685802
    }
   },
   "tokens": {
    "input": 7091251022,
    "output": 158942308
   },
   "top_rules": [
    [
     "LLM_UNAUTHORIZED_TOOL_USE",
     70404
    ],
    [
     "LLM_DATA_EXFILTRATION",
     42888
    ],
    [
     "LLM_COMMAND_INJECTION",
     42463
    ],
    [
     "LLM_SUPPLY_CHAIN_ATTACK",
     21324
    ],
    [
     "LLM_POLICY_VIOLATION",
     11747
    ],
    [
     "LLM_PROMPT_INJECTION",
     10545
    ],
    [
     "LLM_SKILL_DISCOVERY_ABUSE",
     9266
    ],
    [
     "LLM_MALWARE",
     8061
    ],
    [
     "LLM_AUTONOMY_ABUSE",
     7310
    ],
    [
     "LLM_HARDCODED_SECRETS",
     5951
    ],
    [
     "LLM_HARMFUL_CONTENT",
     4770
    ],
    [
     "LLM_RESOURCE_ABUSE",
     3139
    ],
    [
     "LLM_OBFUSCATION",
     1042
    ],
    [
     "LLM_SOCIAL_ENGINEERING",
     898
    ],
    [
     "LLM_TRANSITIVE_TRUST_ABUSE",
     540
    ],
    [
     "LLM_TOOL_CHAINING_ABUSE",
     301
    ],
    [
     "LLM_UNICODE_STEGANOGRAPHY",
     1
    ]
   ],
   "verdicts": {
    "counts": {
     "MALICIOUS": 36840,
     "SAFE": 1514859,
     "SUSPICIOUS": 324507
    },
    "crosstab": {
     "MALICIOUS": {
      "CRITICAL": 1108,
      "HIGH": 35392,
      "LOW": 4,
      "MEDIUM": 333,
      "NONE": 3
     },
     "SAFE": {
      "NONE": 1514859
     },
     "SUSPICIOUS": {
      "CRITICAL": 1,
      "HIGH": 12398,
      "LOW": 123081,
      "MEDIUM": 189013,
      "NONE": 14
     }
    },
    "non_safe_rate": {
     "ci95": [
      0.19203088718897485,
      0.19315941806158043
     ],
     "count": 361347,
     "of": 1876206,
     "rate": 0.19259452320267603
    },
    "rates": {
     "MALICIOUS": 0.019635370529675313,
     "SAFE": 0.807405476797324,
     "SUSPICIOUS": 0.17295915267300072
    },
    "safe_with_medium_plus_finding": 0,
    "unsafe_without_medium_plus_finding": 123102
   }
  },
  "next_candidates": [
   {
    "analyzer": "static",
    "est_removable_false_positives": 3755,
    "high_plus_records": 6968,
    "judge_clears": 0.6381721205131902,
    "judge_clears_ci95": [
     0.6267904032052533,
     0.6494008874877947
    ],
    "judged": 6937,
    "medium_plus_records": 6968,
    "rate": 0.0037129754851965885,
    "rule_id": "ACTIVE_DYNAMIC_EXECUTION",
    "sole_driver_judge_clears": 0.654901275554779,
    "sole_driver_records": 5734
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 1190,
    "high_plus_records": 2236,
    "judge_clears": 0.6835955056179776,
    "judge_clears_ci95": [
     0.6639684655984682,
     0.7025896603805157
    ],
    "judged": 2225,
    "medium_plus_records": 2236,
    "rate": 0.0011914772079362186,
    "rule_id": "ACTIVE_REMOTE_ACQUIRE_EXECUTE",
    "sole_driver_judge_clears": 0.6936145284124194,
    "sole_driver_records": 1715
   },
   {
    "analyzer": "pipeline",
    "est_removable_false_positives": 1051,
    "high_plus_records": 2327,
    "judge_clears": 0.7020636285468616,
    "judge_clears_ci95": [
     0.6831561397381924,
     0.720304765071817
    ],
    "judged": 2326,
    "medium_plus_records": 2327,
    "rate": 0.001239967559421995,
    "rule_id": "COMPOUND_FIND_EXEC",
    "sole_driver_judge_clears": 0.7501784439685939,
    "sole_driver_records": 1401
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 982,
    "high_plus_records": 1495,
    "judge_clears": 0.709979906229069,
    "judge_clears_ci95": [
     0.6864464695837771,
     0.7324355283510746
    ],
    "judged": 1493,
    "medium_plus_records": 1495,
    "rate": 0.0007966272029806113,
    "rule_id": "SECRET_CONNECTION_STRING",
    "sole_driver_judge_clears": 0.748854961832061,
    "sole_driver_records": 1312
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 777,
    "high_plus_records": 1365,
    "judge_clears": 0.7042772861356932,
    "judge_clears_ci95": [
     0.6794369459257171,
     0.72796344541398
    ],
    "judged": 1356,
    "medium_plus_records": 1365,
    "rate": 0.0007273552722866451,
    "rule_id": "YARA_jailbreak_generic",
    "sole_driver_judge_clears": 0.7418738049713193,
    "sole_driver_records": 1047
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 704,
    "high_plus_records": 0,
    "judge_clears": 0.8818474758324383,
    "judge_clears_ci95": [
     0.8595267812888836,
     0.9010298734427843
    ],
    "judged": 931,
    "medium_plus_records": 932,
    "rate": 0.0004966264569752039,
    "rule_id": "YARA_autonomy_abuse_generic",
    "sole_driver_judge_clears": 0.8711276332094176,
    "sole_driver_records": 808
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 562,
    "high_plus_records": 1020,
    "judge_clears": 0.640117994100295,
    "judge_clears_ci95": [
     0.610142651901974,
     0.6690387607677292
    ],
    "judged": 1017,
    "medium_plus_records": 1020,
    "rate": 0.0005435182254449655,
    "rule_id": "ACTIVE_OS_PERSISTENCE_DIRECTIVE",
    "sole_driver_judge_clears": 0.69221260815822,
    "sole_driver_records": 812
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 387,
    "high_plus_records": 1395,
    "judge_clears": 0.687724335965542,
    "judge_clears_ci95": [
     0.6628996356570278,
     0.7115164756615353
    ],
    "judged": 1393,
    "medium_plus_records": 1395,
    "rate": 0.0007433411024467912,
    "rule_id": "FIND_EXEC_PATTERN",
    "sole_driver_judge_clears": 0.8160676532769556,
    "sole_driver_records": 474
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 379,
    "high_plus_records": 571,
    "judge_clears": 0.6882661996497372,
    "judge_clears_ci95": [
     0.6491209053820018,
     0.7248951713946268
    ],
    "judged": 571,
    "medium_plus_records": 571,
    "rate": 0.0003042636340481131,
    "rule_id": "YARA_coercive_injection_generic",
    "sole_driver_judge_clears": 0.7097378277153558,
    "sole_driver_records": 534
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 329,
    "high_plus_records": 859,
    "judge_clears": 0.7322467986030268,
    "judge_clears_ci95": [
     0.7016495072871413,
     0.7607760410406167
    ],
    "judged": 859,
    "medium_plus_records": 859,
    "rate": 0.0004577276035855151,
    "rule_id": "PROMPT_INJECTION_CONCEALMENT",
    "sole_driver_judge_clears": 0.8103448275862069,
    "sole_driver_records": 406
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 258,
    "high_plus_records": 872,
    "judge_clears": 0.6055045871559632,
    "judge_clears_ci95": [
     0.5726699865199449,
     0.637413663308974
    ],
    "judged": 872,
    "medium_plus_records": 872,
    "rate": 0.00046465479665491174,
    "rule_id": "YARA_prompt_injection_generic",
    "sole_driver_judge_clears": 0.6807387862796834,
    "sole_driver_records": 379
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 215,
    "high_plus_records": 4,
    "judge_clears": 0.8333333333333334,
    "judge_clears_ci95": [
     0.7836646083184229,
     0.873440187949222
    ],
    "judged": 264,
    "medium_plus_records": 264,
    "rate": 0.0001406753054092852,
    "rule_id": "SOCIAL_ENG_ANTHROPIC_IMPERSONATION",
    "sole_driver_judge_clears": 0.86,
    "sole_driver_records": 250
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 214,
    "high_plus_records": 0,
    "judge_clears": 0.7011173184357542,
    "judge_clears_ci95": [
     0.6517663249317383,
     0.7461978671346245
    ],
    "judged": 358,
    "medium_plus_records": 359,
    "rate": 0.00019129710091641435,
    "rule_id": "YARA_capability_inflation_generic",
    "sole_driver_judge_clears": 0.8287937743190662,
    "sole_driver_records": 258
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 141,
    "high_plus_records": 0,
    "judge_clears": 0.7217391304347827,
    "judge_clears_ci95": [
     0.660541360766336,
     0.7756513440389683
    ],
    "judged": 230,
    "medium_plus_records": 231,
    "rate": 0.00012309089223312456,
    "rule_id": "YARA_indirect_prompt_injection_generic",
    "sole_driver_judge_clears": 0.7608695652173914,
    "sole_driver_records": 185
   },
   {
    "analyzer": "static",
    "est_removable_false_positives": 115,
    "high_plus_records": 297,
    "judge_clears": 0.7337883959044369,
    "judge_clears_ci95": [
     0.680392162515804,
     0.781133445754735
    ],
    "judged": 293,
    "medium_plus_records": 297,
    "rate": 0.00015825971858544587,
    "rule_id": "PROMPT_INJECTION_UNRESTRICTED_MODE",
    "sole_driver_judge_clears": 0.7635135135135135,
    "sole_driver_records": 151
   }
  ],
  "packs": {
   "balanced": {
    "medium_plus": {
     "ci95": [
      0.02123870719360327,
      0.021653234363436462
     ],
     "count": 40245,
     "of": 1876662,
     "rate": 0.021444991159835922
    },
    "rules_demoted": []
   },
   "low-noise": {
    "medium_plus": {
     "ci95": [
      0.01910701883717858,
      0.019500729006852933
     ],
     "count": 36225,
     "of": 1876662,
     "rate": 0.01930288991837635
    },
    "rules_demoted": [
     "FILE_MAGIC_MISMATCH",
     "FIND_EXEC_PATTERN",
     "GLOB_HIDDEN_FILE_TARGETING",
     "PROMPT_INJECTION_CONCEALMENT",
     "PROMPT_INJECTION_REVEAL_SYSTEM",
     "PROMPT_INJECTION_UNRESTRICTED_MODE",
     "SECRET_CONNECTION_STRING",
     "YARA_autonomy_abuse_generic",
     "YARA_capability_inflation_generic",
     "YARA_code_execution_generic",
     "YARA_indirect_prompt_injection_generic"
    ]
   },
   "quiet": {
    "medium_plus": {
     "ci95": [
      0.013143657366783386,
      0.013471545240312436
     ],
     "count": 24972,
     "of": 1876662,
     "rate": 0.01330660502530557
    },
    "rules_demoted": [
     "COMPOUND_EXTRACT_EXECUTE",
     "COMPOUND_FIND_EXEC",
     "CORRELATED_SENSITIVE_NETWORK_FLOW",
     "FILE_MAGIC_MISMATCH",
     "FIND_EXEC_PATTERN",
     "GLOB_HIDDEN_FILE_TARGETING",
     "PIPELINE_TAINT_FLOW",
     "PROMPT_INJECTION_CONCEALMENT",
     "PROMPT_INJECTION_REVEAL_SYSTEM",
     "PROMPT_INJECTION_UNRESTRICTED_MODE",
     "SECRET_CONNECTION_STRING",
     "SOCIAL_ENG_ANTHROPIC_IMPERSONATION",
     "YARA_autonomy_abuse_generic",
     "YARA_capability_inflation_generic",
     "YARA_code_execution_generic",
     "YARA_coercive_injection_generic",
     "YARA_indirect_prompt_injection_generic",
     "YARA_jailbreak_generic",
     "YARA_sql_injection_generic"
    ]
   }
  },
  "labelled_ab": {
   "base_commit": "5b696a1",
   "final_commit": "9c08673",
   "arm": "static core",
   "corpora": {
    "msb-trainval": {
     "records": 6594,
     "role": "development split (rules were designed on it)",
     "medium_plus_base": {
      "positives": 5256,
      "tp": 1742,
      "negatives": 1338,
      "fp": 29,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "medium_plus_final": {
      "positives": 5256,
      "tp": 1653,
      "negatives": 1338,
      "fp": 14,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_base": {
      "positives": 5256,
      "tp": 1652,
      "negatives": 1338,
      "fp": 14,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_final": {
      "positives": 5256,
      "tp": 1638,
      "negatives": 1338,
      "fp": 11,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     }
    },
    "msb-source-disjoint": {
     "records": 1384,
     "role": "frozen test split (held out)",
     "medium_plus_base": {
      "positives": 839,
      "tp": 67,
      "negatives": 545,
      "fp": 46,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "medium_plus_final": {
      "positives": 839,
      "tp": 67,
      "negatives": 545,
      "fp": 23,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_base": {
      "positives": 839,
      "tp": 65,
      "negatives": 545,
      "fp": 42,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_final": {
      "positives": 839,
      "tp": 65,
      "negatives": 545,
      "fp": 22,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     }
    },
    "msb-balanced-800": {
     "records": 800,
     "role": "overlaps the test split (137 records)",
     "medium_plus_base": {
      "positives": 400,
      "tp": 132,
      "negatives": 400,
      "fp": 8,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "medium_plus_final": {
      "positives": 400,
      "tp": 124,
      "negatives": 400,
      "fp": 5,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_base": {
      "positives": 400,
      "tp": 125,
      "negatives": 400,
      "fp": 6,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_final": {
      "positives": 400,
      "tp": 123,
      "negatives": 400,
      "fp": 5,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     }
    },
    "openskillrisk-corpus": {
     "records": 374,
     "role": null,
     "medium_plus_base": {
      "positives": 374,
      "tp": 118,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "medium_plus_final": {
      "positives": 374,
      "tp": 112,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_base": {
      "positives": 374,
      "tp": 98,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_final": {
      "positives": 374,
      "tp": 94,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     }
    },
    "mcp-tool-poisoning": {
     "records": 50,
     "role": null,
     "medium_plus_base": {
      "positives": 25,
      "tp": 10,
      "negatives": 25,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "medium_plus_final": {
      "positives": 25,
      "tp": 10,
      "negatives": 25,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_base": {
      "positives": 25,
      "tp": 5,
      "negatives": 25,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     },
     "high_plus_final": {
      "positives": 25,
      "tp": 5,
      "negatives": 25,
      "fp": 0,
      "unlabelled": 0,
      "flagged_unlabelled": 0
     }
    },
    "harmfulskillbench-corpus": {
     "records": 200,
     "role": "unlabelled for this purpose",
     "medium_plus_base": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 200,
      "flagged_unlabelled": 8
     },
     "medium_plus_final": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 200,
      "flagged_unlabelled": 7
     },
     "high_plus_base": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 200,
      "flagged_unlabelled": 7
     },
     "high_plus_final": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 200,
      "flagged_unlabelled": 7
     }
    },
    "real-world-skills": {
     "records": 12498,
     "role": null,
     "medium_plus_base": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 12498,
      "flagged_unlabelled": 470
     },
     "medium_plus_final": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 12498,
      "flagged_unlabelled": 311
     },
     "high_plus_base": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 12498,
      "flagged_unlabelled": 307
     },
     "high_plus_final": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 12498,
      "flagged_unlabelled": 280
     }
    },
    "gitskills-sample": {
     "records": 199998,
     "role": null,
     "medium_plus_base": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 199998,
      "flagged_unlabelled": 4455
     },
     "medium_plus_final": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 199998,
      "flagged_unlabelled": 1038
     },
     "high_plus_base": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 199998,
      "flagged_unlabelled": 1044
     },
     "high_plus_final": {
      "positives": 0,
      "tp": 0,
      "negatives": 0,
      "fp": 0,
      "unlabelled": 199998,
      "flagged_unlabelled": 987
     }
    }
   }
  },
  "recall_cost": {
   "records": 89,
   "carried_by": [
    [
     "SUPPLY_CHAIN_UNPINNED_DEPENDENCY",
     44
    ],
    [
     "SOCIAL_ENG_ANTHROPIC_IMPERSONATION",
     19
    ],
    [
     "PIPELINE_TAINT_FLOW",
     12
    ],
    [
     "FILE_MAGIC_MISMATCH",
     6
    ],
    [
     "CORRELATED_NETWORK_EXECUTION_FLOW + PIPELINE_TAINT_FLOW",
     4
    ],
    [
     "CORRELATED_SENSITIVE_NETWORK_FLOW",
     3
    ],
    [
     "PROMPT_INJECTION_IGNORE_INSTRUCTIONS",
     1
    ]
   ]
  },
  "packs_trainval": {
   "balanced": {
    "recall": 0.3144977168949772,
    "fpr": 0.01046337817638266,
    "tp": 1653,
    "positives": 5256,
    "fp": 14,
    "negatives": 1338
   },
   "low-noise": {
    "recall": 0.3135464231354642,
    "fpr": 0.01046337817638266,
    "tp": 1648,
    "positives": 5256,
    "fp": 14,
    "negatives": 1338
   },
   "quiet": {
    "recall": 0.2977549467275495,
    "fpr": 0.0014947683109118087,
    "tp": 1565,
    "positives": 5256,
    "fp": 2,
    "negatives": 1338
   }
  },
  "composition_check": {
   "composed_records": 1876662,
   "exact_records": 1876662,
   "composed_medium_plus": 40413,
   "exact_medium_plus": 40245,
   "composed_rate": 0.02153451180873274,
   "exact_rate": 0.021444991159835922,
   "both": 40245,
   "same_rule_set": 40235,
   "only_composed": 168,
   "only_exact": 0,
   "only_composed_by_rules": [
    [
     "YARA_jailbreak_generic",
     130
    ],
    [
     "FIND_EXEC_PATTERN",
     38
    ]
   ],
   "only_exact_by_rules": []
  }
 },
 "jev_screen": {
  "blocking": false,
  "complete": true,
  "experiment": "c4-openjev-screen",
  "logistic": {
   "c": 1.0,
   "class_weight": "balanced",
   "coef": [
    -0.3003,
    0.2057,
    1.04,
    0.4616,
    0.3108,
    -0.3015,
    0.0587,
    0.0266
   ],
   "features": [
    "logit(p_data_exfiltration)",
    "logit(p_destructive_command)",
    "logit(p_obfuscation)",
    "logit(p_prompt_injection)",
    "logit(p_remote_hidden_execution)",
    "logit(p_security_control_change)",
    "logit(p_sensitive_data_access)",
    "logit(p_supply_chain)"
   ],
   "intercept": 4.5155
  },
  "records": {
   "dev": 1938,
   "real": 2000,
   "test": 1379
  },
  "results": [
   {
    "cap": null,
    "dev": {
     "f1": 0.7331499312242091,
     "fp": 321,
     "fpr": 0.2399103139013453,
     "fpr_ci95": [
      0.2178,
      0.2635
     ],
     "judge_calls": 1.0,
     "precision": 0.6241217798594848,
     "recall": 0.8883333333333333,
     "recall_ci95": [
      0.8606,
      0.9111
     ],
     "records": 1938,
     "tp": 533
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.1045,
     "flag_rate_ci95": [
      0.0918,
      0.1187
     ],
     "judge_calls": 1.0,
     "records": 2000
    },
    "screen": null,
    "test": {
     "f1": 0.7558620689655172,
     "fp": 68,
     "fpr": 0.12477064220183487,
     "fpr_ci95": [
      0.0996,
      0.1552
     ],
     "judge_calls": 1.0,
     "precision": 0.8896103896103896,
     "recall": 0.657074340527578,
     "recall_ci95": [
      0.6242,
      0.6885
     ],
     "records": 1379,
     "tp": 548
    }
   },
   {
    "cap": null,
    "dev": {
     "f1": 0.8422764227642275,
     "fp": 112,
     "fpr": 0.08370702541106129,
     "fpr_ci95": [
      0.07,
      0.0998
     ],
     "judge_calls": 0.38596491228070173,
     "precision": 0.8222222222222222,
     "recall": 0.8633333333333333,
     "recall_ci95": [
      0.8335,
      0.8885
     ],
     "records": 1938,
     "tp": 518
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.0315,
     "flag_rate_ci95": [
      0.0247,
      0.0401
     ],
     "judge_calls": 0.079,
     "records": 2000
    },
    "screen": "prompt_injection",
    "test": {
     "f1": 0.7348148148148148,
     "fp": 20,
     "fpr": 0.03669724770642202,
     "fpr_ci95": [
      0.0239,
      0.056
     ],
     "judge_calls": 0.5997099347353154,
     "precision": 0.9612403100775194,
     "recall": 0.5947242206235012,
     "recall_ci95": [
      0.561,
      0.6275
     ],
     "records": 1379,
     "tp": 496
    },
    "threshold": -2.9796,
    "threshold_probability": 0.04835
   },
   {
    "cap": null,
    "dev": {
     "f1": 0.8713204373423044,
     "fp": 71,
     "fpr": 0.053064275037369206,
     "fpr_ci95": [
      0.0423,
      0.0664
     ],
     "judge_calls": 0.347781217750258,
     "precision": 0.8794567062818336,
     "recall": 0.8633333333333333,
     "recall_ci95": [
      0.8335,
      0.8885
     ],
     "records": 1938,
     "tp": 518
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.0175,
     "flag_rate_ci95": [
      0.0126,
      0.0242
     ],
     "judge_calls": 0.0315,
     "records": 2000
    },
    "screen": "logistic",
    "test": {
     "f1": 0.7525773195876289,
     "fp": 13,
     "fpr": 0.023853211009174313,
     "fpr_ci95": [
      0.014,
      0.0404
     ],
     "judge_calls": 0.5844815083393764,
     "precision": 0.9751908396946565,
     "recall": 0.6127098321342925,
     "recall_ci95": [
      0.5792,
      0.6452
     ],
     "records": 1379,
     "tp": 511
    },
    "threshold": -0.4536
   },
   {
    "cap": "low-confidence",
    "dev": {
     "f1": 0.7731343283582089,
     "fp": 222,
     "fpr": 0.16591928251121077,
     "fpr_ci95": [
      0.1469,
      0.1868
     ],
     "judge_calls": 1.0,
     "precision": 0.7,
     "recall": 0.8633333333333333,
     "recall_ci95": [
      0.8335,
      0.8885
     ],
     "records": 1938,
     "tp": 518
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.076,
     "flag_rate_ci95": [
      0.0652,
      0.0884
     ],
     "judge_calls": 1.0,
     "records": 2000
    },
    "screen": null,
    "test": {
     "f1": 0.7352732434350603,
     "fp": 57,
     "fpr": 0.10458715596330276,
     "fpr_ci95": [
      0.0816,
      0.1331
     ],
     "judge_calls": 1.0,
     "precision": 0.9008695652173913,
     "recall": 0.6211031175059952,
     "recall_ci95": [
      0.5877,
      0.6534
     ],
     "records": 1379,
     "tp": 518
    }
   },
   {
    "cap": "low-confidence",
    "dev": {
     "f1": 0.8568994889267462,
     "fp": 71,
     "fpr": 0.053064275037369206,
     "fpr_ci95": [
      0.0423,
      0.0664
     ],
     "judge_calls": 0.3498452012383901,
     "precision": 0.8763066202090593,
     "recall": 0.8383333333333334,
     "recall_ci95": [
      0.8067,
      0.8656
     ],
     "records": 1938,
     "tp": 503
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.0235,
     "flag_rate_ci95": [
      0.0177,
      0.0311
     ],
     "judge_calls": 0.0605,
     "records": 2000
    },
    "screen": "prompt_injection",
    "test": {
     "f1": 0.6943164362519202,
     "fp": 16,
     "fpr": 0.029357798165137616,
     "fpr_ci95": [
      0.0182,
      0.0472
     ],
     "judge_calls": 0.5576504713560552,
     "precision": 0.9658119658119658,
     "recall": 0.5419664268585132,
     "recall_ci95": [
      0.508,
      0.5755
     ],
     "records": 1379,
     "tp": 452
    },
    "threshold": -2.4651,
    "threshold_probability": 0.07834
   },
   {
    "cap": "low-confidence",
    "dev": {
     "f1": 0.8795811518324608,
     "fp": 42,
     "fpr": 0.03139013452914798,
     "fpr_ci95": [
      0.0233,
      0.0422
     ],
     "judge_calls": 0.3240454076367389,
     "precision": 0.9230769230769231,
     "recall": 0.84,
     "recall_ci95": [
      0.8085,
      0.8672
     ],
     "records": 1938,
     "tp": 504
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.0135,
     "flag_rate_ci95": [
      0.0093,
      0.0196
     ],
     "judge_calls": 0.0245,
     "records": 2000
    },
    "screen": "logistic",
    "test": {
     "f1": 0.7198177676537586,
     "fp": 9,
     "fpr": 0.01651376146788991,
     "fpr_ci95": [
      0.0087,
      0.0311
     ],
     "judge_calls": 0.5598259608411893,
     "precision": 0.9813664596273292,
     "recall": 0.5683453237410072,
     "recall_ci95": [
      0.5345,
      0.6016
     ],
     "records": 1379,
     "tp": 474
    },
    "threshold": 0.0929
   },
   {
    "cap": "contextual",
    "dev": {
     "f1": 0.8418410041841003,
     "fp": 92,
     "fpr": 0.0687593423019432,
     "fpr_ci95": [
      0.0564,
      0.0836
     ],
     "judge_calls": 1.0,
     "precision": 0.8453781512605042,
     "recall": 0.8383333333333334,
     "recall_ci95": [
      0.8067,
      0.8656
     ],
     "records": 1938,
     "tp": 503
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.03,
     "flag_rate_ci95": [
      0.0234,
      0.0384
     ],
     "judge_calls": 1.0,
     "records": 2000
    },
    "screen": null,
    "test": {
     "f1": 0.6482649842271293,
     "fp": 23,
     "fpr": 0.04220183486238532,
     "fpr_ci95": [
      0.0283,
      0.0625
     ],
     "judge_calls": 1.0,
     "precision": 0.9470046082949308,
     "recall": 0.49280575539568344,
     "recall_ci95": [
      0.459,
      0.5267
     ],
     "records": 1379,
     "tp": 411
    }
   },
   {
    "cap": "contextual",
    "dev": {
     "f1": 0.8683274021352313,
     "fp": 36,
     "fpr": 0.026905829596412557,
     "fpr_ci95": [
      0.0195,
      0.037
     ],
     "judge_calls": 0.33591331269349844,
     "precision": 0.9312977099236641,
     "recall": 0.8133333333333334,
     "recall_ci95": [
      0.7802,
      0.8425
     ],
     "records": 1938,
     "tp": 488
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.0175,
     "flag_rate_ci95": [
      0.0126,
      0.0242
     ],
     "judge_calls": 0.0505,
     "records": 2000
    },
    "screen": "prompt_injection",
    "test": {
     "f1": 0.6112026359143329,
     "fp": 9,
     "fpr": 0.01651376146788991,
     "fpr_ci95": [
      0.0087,
      0.0311
     ],
     "judge_calls": 0.5264684554024656,
     "precision": 0.9763157894736842,
     "recall": 0.4448441247002398,
     "recall_ci95": [
      0.4114,
      0.4787
     ],
     "records": 1379,
     "tp": 371
    },
    "threshold": -2.2326,
    "threshold_probability": 0.09686
   },
   {
    "cap": "contextual",
    "dev": {
     "f1": 0.8824593128390598,
     "fp": 18,
     "fpr": 0.013452914798206279,
     "fpr_ci95": [
      0.0085,
      0.0212
     ],
     "judge_calls": 0.30030959752321984,
     "precision": 0.9644268774703557,
     "recall": 0.8133333333333334,
     "recall_ci95": [
      0.7802,
      0.8425
     ],
     "records": 1938,
     "tp": 488
    },
    "prompt": "new",
    "real": {
     "flag_rate": 0.008,
     "flag_rate_ci95": [
      0.0049,
      0.013
     ],
     "judge_calls": 0.018,
     "records": 2000
    },
    "screen": "logistic",
    "test": {
     "f1": 0.601165695253955,
     "fp": 6,
     "fpr": 0.011009174311926606,
     "fpr_ci95": [
      0.0051,
      0.0238
     ],
     "judge_calls": 0.4873096446700508,
     "precision": 0.9836512261580381,
     "recall": 0.43285371702637887,
     "recall_ci95": [
      0.3996,
      0.4667
     ],
     "records": 1379,
     "tp": 361
    },
    "threshold": 0.8
   },
   {
    "cap": null,
    "dev": {
     "f1": 0.6921017402945113,
     "fp": 377,
     "fpr": 0.28176382660687593,
     "fpr_ci95": [
      0.2583,
      0.3065
     ],
     "judge_calls": 1.0,
     "precision": 0.5782997762863534,
     "recall": 0.8616666666666667,
     "recall_ci95": [
      0.8317,
      0.887
     ],
     "records": 1938,
     "tp": 517
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.128,
     "flag_rate_ci95": [
      0.1141,
      0.1434
     ],
     "judge_calls": 1.0,
     "records": 2000
    },
    "screen": null,
    "test": {
     "f1": 0.6340740740740741,
     "fp": 88,
     "fpr": 0.1614678899082569,
     "fpr_ci95": [
      0.133,
      0.1947
     ],
     "judge_calls": 1.0,
     "precision": 0.8294573643410853,
     "recall": 0.513189448441247,
     "recall_ci95": [
      0.4793,
      0.547
     ],
     "records": 1379,
     "tp": 428
    }
   },
   {
    "cap": null,
    "dev": {
     "f1": 0.8366666666666667,
     "fp": 98,
     "fpr": 0.07324364723467862,
     "fpr_ci95": [
      0.0605,
      0.0885
     ],
     "judge_calls": 0.36429308565531476,
     "precision": 0.8366666666666667,
     "recall": 0.8366666666666667,
     "recall_ci95": [
      0.805,
      0.8641
     ],
     "records": 1938,
     "tp": 502
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.026,
     "flag_rate_ci95": [
      0.0199,
      0.0339
     ],
     "judge_calls": 0.07,
     "records": 2000
    },
    "screen": "prompt_injection",
    "test": {
     "f1": 0.6389776357827476,
     "fp": 18,
     "fpr": 0.03302752293577982,
     "fpr_ci95": [
      0.021,
      0.0516
     ],
     "judge_calls": 0.5823060188542422,
     "precision": 0.9569377990430622,
     "recall": 0.47961630695443647,
     "recall_ci95": [
      0.4459,
      0.5135
     ],
     "records": 1379,
     "tp": 400
    },
    "threshold": -2.7354,
    "threshold_probability": 0.06092
   },
   {
    "cap": null,
    "dev": {
     "f1": 0.864027538726334,
     "fp": 60,
     "fpr": 0.04484304932735426,
     "fpr_ci95": [
      0.035,
      0.0573
     ],
     "judge_calls": 0.33126934984520123,
     "precision": 0.8932384341637011,
     "recall": 0.8366666666666667,
     "recall_ci95": [
      0.805,
      0.8641
     ],
     "records": 1938,
     "tp": 502
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.013,
     "flag_rate_ci95": [
      0.0089,
      0.019
     ],
     "judge_calls": 0.0255,
     "records": 2000
    },
    "screen": "logistic",
    "test": {
     "f1": 0.6501597444089458,
     "fp": 11,
     "fpr": 0.02018348623853211,
     "fpr_ci95": [
      0.0113,
      0.0358
     ],
     "judge_calls": 0.564902102973169,
     "precision": 0.9736842105263158,
     "recall": 0.4880095923261391,
     "recall_ci95": [
      0.4542,
      0.5219
     ],
     "records": 1379,
     "tp": 407
    },
    "threshold": -0.0264
   },
   {
    "cap": "low-confidence",
    "dev": {
     "f1": 0.7148231753197893,
     "fp": 254,
     "fpr": 0.1898355754857997,
     "fpr_ci95": [
      0.1697,
      0.2117
     ],
     "judge_calls": 1.0,
     "precision": 0.6515775034293553,
     "recall": 0.7916666666666666,
     "recall_ci95": [
      0.7574,
      0.8223
     ],
     "records": 1938,
     "tp": 475
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.092,
     "flag_rate_ci95": [
      0.0801,
      0.1055
     ],
     "judge_calls": 1.0,
     "records": 2000
    },
    "screen": null,
    "test": {
     "f1": 0.5327935222672066,
     "fp": 72,
     "fpr": 0.13211009174311927,
     "fpr_ci95": [
      0.1062,
      0.1631
     ],
     "judge_calls": 1.0,
     "precision": 0.8204488778054863,
     "recall": 0.39448441247002397,
     "recall_ci95": [
      0.3619,
      0.4281
     ],
     "records": 1379,
     "tp": 329
    }
   },
   {
    "cap": "low-confidence",
    "dev": {
     "f1": 0.8195555555555555,
     "fp": 64,
     "fpr": 0.04783258594917788,
     "fpr_ci95": [
      0.0376,
      0.0606
     ],
     "judge_calls": 0.34520123839009287,
     "precision": 0.878095238095238,
     "recall": 0.7683333333333333,
     "recall_ci95": [
      0.7329,
      0.8003
     ],
     "records": 1938,
     "tp": 461
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.0165,
     "flag_rate_ci95": [
      0.0118,
      0.0231
     ],
     "judge_calls": 0.0565,
     "records": 2000
    },
    "screen": "prompt_injection",
    "test": {
     "f1": 0.5404475043029259,
     "fp": 14,
     "fpr": 0.025688073394495414,
     "fpr_ci95": [
      0.0154,
      0.0427
     ],
     "judge_calls": 0.546047860768673,
     "precision": 0.9573170731707317,
     "recall": 0.3764988009592326,
     "recall_ci95": [
      0.3443,
      0.4099
     ],
     "records": 1379,
     "tp": 314
    },
    "threshold": -2.3681,
    "threshold_probability": 0.08563
   },
   {
    "cap": "low-confidence",
    "dev": {
     "f1": 0.8450962419798351,
     "fp": 30,
     "fpr": 0.02242152466367713,
     "fpr_ci95": [
      0.0158,
      0.0318
     ],
     "judge_calls": 0.30959752321981426,
     "precision": 0.9389002036659878,
     "recall": 0.7683333333333333,
     "recall_ci95": [
      0.7329,
      0.8003
     ],
     "records": 1938,
     "tp": 461
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.008,
     "flag_rate_ci95": [
      0.0049,
      0.013
     ],
     "judge_calls": 0.02,
     "records": 2000
    },
    "screen": "logistic",
    "test": {
     "f1": 0.5335658238884046,
     "fp": 7,
     "fpr": 0.012844036697247707,
     "fpr_ci95": [
      0.0062,
      0.0263
     ],
     "judge_calls": 0.5163161711385061,
     "precision": 0.9776357827476039,
     "recall": 0.3669064748201439,
     "recall_ci95": [
      0.3349,
      0.4002
     ],
     "records": 1379,
     "tp": 306
    },
    "threshold": 0.5455
   },
   {
    "cap": "contextual",
    "dev": {
     "f1": 0.7866786678667868,
     "fp": 74,
     "fpr": 0.05530642750373692,
     "fpr_ci95": [
      0.0443,
      0.0689
     ],
     "judge_calls": 1.0,
     "precision": 0.8551859099804305,
     "recall": 0.7283333333333334,
     "recall_ci95": [
      0.6914,
      0.7624
     ],
     "records": 1938,
     "tp": 437
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.0205,
     "flag_rate_ci95": [
      0.0151,
      0.0277
     ],
     "judge_calls": 1.0,
     "records": 2000
    },
    "screen": null,
    "test": {
     "f1": 0.4827586206896552,
     "fp": 24,
     "fpr": 0.044036697247706424,
     "fpr_ci95": [
      0.0298,
      0.0647
     ],
     "judge_calls": 1.0,
     "precision": 0.9191919191919192,
     "recall": 0.3273381294964029,
     "recall_ci95": [
      0.2963,
      0.3599
     ],
     "records": 1379,
     "tp": 273
    }
   },
   {
    "cap": "contextual",
    "dev": {
     "f1": 0.8099331423113658,
     "fp": 23,
     "fpr": 0.0171898355754858,
     "fpr_ci95": [
      0.0115,
      0.0257
     ],
     "judge_calls": 0.30701754385964913,
     "precision": 0.9485458612975392,
     "recall": 0.7066666666666667,
     "recall_ci95": [
      0.669,
      0.7417
     ],
     "records": 1938,
     "tp": 424
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.0055,
     "flag_rate_ci95": [
      0.0031,
      0.0098
     ],
     "judge_calls": 0.0305,
     "records": 2000
    },
    "screen": "prompt_injection",
    "test": {
     "f1": 0.45787545787545797,
     "fp": 8,
     "fpr": 0.014678899082568808,
     "fpr_ci95": [
      0.0075,
      0.0287
     ],
     "judge_calls": 0.43002175489485134,
     "precision": 0.9689922480620154,
     "recall": 0.2997601918465228,
     "recall_ci95": [
      0.2696,
      0.3317
     ],
     "records": 1379,
     "tp": 250
    },
    "threshold": -1.7243,
    "threshold_probability": 0.15132
   },
   {
    "cap": "contextual",
    "dev": {
     "f1": 0.821705426356589,
     "fp": 8,
     "fpr": 0.005979073243647235,
     "fpr_ci95": [
      0.003,
      0.0118
     ],
     "judge_calls": 0.2760577915376677,
     "precision": 0.9814814814814815,
     "recall": 0.7066666666666667,
     "recall_ci95": [
      0.669,
      0.7417
     ],
     "records": 1938,
     "tp": 424
    },
    "prompt": "shipped",
    "real": {
     "flag_rate": 0.004,
     "flag_rate_ci95": [
      0.002,
      0.0079
     ],
     "judge_calls": 0.012,
     "records": 2000
    },
    "screen": "logistic",
    "test": {
     "f1": 0.43177570093457945,
     "fp": 5,
     "fpr": 0.009174311926605505,
     "fpr_ci95": [
      0.0039,
      0.0213
     ],
     "judge_calls": 0.39158810732414795,
     "precision": 0.9788135593220338,
     "recall": 0.27697841726618705,
     "recall_ci95": [
      0.2477,
      0.3083
     ],
     "records": 1379,
     "tp": 231
    },
    "threshold": 1.3788
   }
  ],
  "selection": "train/validation; keep >= 97% of the judge's recall at minimum FPR",
  "standalone_auc": {
   "data_exfiltration": {
    "dev": 0.7924850523168909,
    "test": 0.6481365366422458
   },
   "destructive_command": {
    "dev": 0.8296225710014947,
    "test": 0.7906716828372164
   },
   "logistic": {
    "dev": 0.9733470353761834,
    "test": 0.9149759091809122
   },
   "obfuscation": {
    "dev": 0.9668784255107125,
    "test": 0.908244780322531
   },
   "prompt_injection": {
    "dev": 0.9588938714499252,
    "test": 0.8807394451411348
   },
   "remote_hidden_execution": {
    "dev": 0.8768080468360737,
    "test": 0.7261467889908257
   },
   "security_control_change": {
    "dev": 0.9351451170901843,
    "test": 0.8585219897476514
   },
   "sensitive_data_access": {
    "dev": 0.7335668908819133,
    "test": 0.5883682045189537
   },
   "supply_chain": {
    "dev": 0.8966230692575984,
    "test": 0.7931511671396827
   }
  }
 },
 "judge_prompt": {
  "experiment": "judge-prompt",
  "model": "Gemma 4 26B-A4B via Bedrock mantle",
  "verdict_repair": true,
  "blocking": false,
  "complete": true,
  "rows": [
   {
    "prompt": "shipped",
    "cap": null,
    "dev": {
     "records": 1938,
     "recall": 0.8616666666666667,
     "recall_ci95": [
      0.8317,
      0.887
     ],
     "fpr": 0.28176382660687593,
     "fpr_ci95": [
      0.2583,
      0.3065
     ],
     "precision": 0.5782997762863534,
     "f1": 0.6921017402945113,
     "failed": 0
    },
    "test": {
     "records": 1384,
     "recall": 0.5160905840286055,
     "recall_ci95": [
      0.4823,
      0.5498
     ],
     "fpr": 0.1614678899082569,
     "fpr_ci95": [
      0.133,
      0.1947
     ],
     "precision": 0.8310940499040307,
     "f1": 0.636764705882353,
     "failed": 0
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.128,
     "flag_rate_ci95": [
      0.1141,
      0.1434
     ],
     "failed": 0
    }
   },
   {
    "prompt": "shipped",
    "cap": "low-confidence",
    "dev": {
     "records": 1938,
     "recall": 0.7916666666666666,
     "recall_ci95": [
      0.7574,
      0.8223
     ],
     "fpr": 0.1898355754857997,
     "fpr_ci95": [
      0.1697,
      0.2117
     ],
     "precision": 0.6515775034293553,
     "f1": 0.7148231753197893,
     "failed": 0
    },
    "test": {
     "records": 1384,
     "recall": 0.39809296781883197,
     "recall_ci95": [
      0.3655,
      0.4316
     ],
     "fpr": 0.13211009174311927,
     "fpr_ci95": [
      0.1062,
      0.1631
     ],
     "precision": 0.8226600985221675,
     "f1": 0.5365461847389559,
     "failed": 0
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.092,
     "flag_rate_ci95": [
      0.0801,
      0.1055
     ],
     "failed": 0
    }
   },
   {
    "prompt": "shipped",
    "cap": "contextual",
    "dev": {
     "records": 1938,
     "recall": 0.7283333333333334,
     "recall_ci95": [
      0.6914,
      0.7624
     ],
     "fpr": 0.05530642750373692,
     "fpr_ci95": [
      0.0443,
      0.0689
     ],
     "precision": 0.8551859099804305,
     "f1": 0.7866786678667868,
     "failed": 0
    },
    "test": {
     "records": 1384,
     "recall": 0.33134684147794996,
     "recall_ci95": [
      0.3003,
      0.3639
     ],
     "fpr": 0.044036697247706424,
     "fpr_ci95": [
      0.0298,
      0.0647
     ],
     "precision": 0.9205298013245033,
     "f1": 0.4872918492550395,
     "failed": 0
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.0205,
     "flag_rate_ci95": [
      0.0151,
      0.0277
     ],
     "failed": 0
    }
   },
   {
    "prompt": "new",
    "cap": null,
    "dev": {
     "records": 1938,
     "recall": 0.8883333333333333,
     "recall_ci95": [
      0.8606,
      0.9111
     ],
     "fpr": 0.2399103139013453,
     "fpr_ci95": [
      0.2178,
      0.2635
     ],
     "precision": 0.6241217798594848,
     "f1": 0.7331499312242091,
     "failed": 0
    },
    "test": {
     "records": 1384,
     "recall": 0.6591179976162098,
     "recall_ci95": [
      0.6264,
      0.6904
     ],
     "fpr": 0.12477064220183487,
     "fpr_ci95": [
      0.0996,
      0.1552
     ],
     "precision": 0.8904991948470209,
     "f1": 0.7575342465753425,
     "failed": 0
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.1045,
     "flag_rate_ci95": [
      0.0918,
      0.1187
     ],
     "failed": 0
    }
   },
   {
    "prompt": "new",
    "cap": "low-confidence",
    "dev": {
     "records": 1938,
     "recall": 0.8633333333333333,
     "recall_ci95": [
      0.8335,
      0.8885
     ],
     "fpr": 0.16591928251121077,
     "fpr_ci95": [
      0.1469,
      0.1868
     ],
     "precision": 0.7,
     "f1": 0.7731343283582089,
     "failed": 0
    },
    "test": {
     "records": 1384,
     "recall": 0.6233611442193087,
     "recall_ci95": [
      0.5901,
      0.6555
     ],
     "fpr": 0.10458715596330276,
     "fpr_ci95": [
      0.0816,
      0.1331
     ],
     "precision": 0.9017241379310345,
     "f1": 0.7371388301620859,
     "failed": 0
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.076,
     "flag_rate_ci95": [
      0.0652,
      0.0884
     ],
     "failed": 0
    }
   },
   {
    "prompt": "new",
    "cap": "contextual",
    "dev": {
     "records": 1938,
     "recall": 0.8383333333333334,
     "recall_ci95": [
      0.8067,
      0.8656
     ],
     "fpr": 0.0687593423019432,
     "fpr_ci95": [
      0.0564,
      0.0836
     ],
     "precision": 0.8453781512605042,
     "f1": 0.8418410041841003,
     "failed": 0
    },
    "test": {
     "records": 1384,
     "recall": 0.4958283671036949,
     "recall_ci95": [
      0.4621,
      0.5296
     ],
     "fpr": 0.04220183486238532,
     "fpr_ci95": [
      0.0283,
      0.0625
     ],
     "precision": 0.9476082004555809,
     "f1": 0.6510172143974962,
     "failed": 0
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.03,
     "flag_rate_ci95": [
      0.0234,
      0.0384
     ],
     "failed": 0
    }
   }
  ]
 },
 "profiles": [
  {
   "preset": "balanced",
   "judge": false,
   "rules_demoted": 0,
   "caps": [],
   "medium_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.2966666666666667,
     "recall_ci95": [
      0.2615,
      0.3344
     ],
     "fpr": 0.01046337817638266,
     "fpr_ci95": [
      0.0062,
      0.0175
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.07985697258641239,
     "recall_ci95": [
      0.0634,
      0.1002
     ],
     "fpr": 0.04220183486238532,
     "fpr_ci95": [
      0.0283,
      0.0625
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.02,
     "flag_rate_ci95": [
      0.0147,
      0.0271
     ]
    }
   },
   "high_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.295,
     "recall_ci95": [
      0.2599,
      0.3327
     ],
     "fpr": 0.008221225710014948,
     "fpr_ci95": [
      0.0046,
      0.0147
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.07747318235995232,
     "recall_ci95": [
      0.0612,
      0.0975
     ],
     "fpr": 0.04036697247706422,
     "fpr_ci95": [
      0.0268,
      0.0604
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.0185,
     "flag_rate_ci95": [
      0.0135,
      0.0254
     ]
    }
   }
  },
  {
   "preset": "balanced",
   "judge": true,
   "rules_demoted": 0,
   "caps": [],
   "medium_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.905,
     "recall_ci95": [
      0.8789,
      0.926
     ],
     "fpr": 0.24588938714499253,
     "fpr_ci95": [
      0.2236,
      0.2697
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.6674612634088201,
     "recall_ci95": [
      0.6349,
      0.6985
     ],
     "fpr": 0.15412844036697249,
     "fpr_ci95": [
      0.1262,
      0.1869
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.1165,
     "flag_rate_ci95": [
      0.1032,
      0.1313
     ]
    }
   },
   "high_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.75,
     "recall_ci95": [
      0.7138,
      0.783
     ],
     "fpr": 0.04708520179372197,
     "fpr_ci95": [
      0.037,
      0.0598
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.33730631704410013,
     "recall_ci95": [
      0.3061,
      0.37
     ],
     "fpr": 0.06422018348623854,
     "fpr_ci95": [
      0.0465,
      0.088
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.038,
     "flag_rate_ci95": [
      0.0305,
      0.0473
     ]
    }
   }
  },
  {
   "preset": "low-noise",
   "judge": false,
   "rules_demoted": 11,
   "caps": [
    "low-confidence"
   ],
   "medium_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.2966666666666667,
     "recall_ci95": [
      0.2615,
      0.3344
     ],
     "fpr": 0.01046337817638266,
     "fpr_ci95": [
      0.0062,
      0.0175
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.07866507747318235,
     "recall_ci95": [
      0.0623,
      0.0989
     ],
     "fpr": 0.04220183486238532,
     "fpr_ci95": [
      0.0283,
      0.0625
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.0165,
     "flag_rate_ci95": [
      0.0118,
      0.0231
     ]
    }
   },
   "high_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.295,
     "recall_ci95": [
      0.2599,
      0.3327
     ],
     "fpr": 0.008221225710014948,
     "fpr_ci95": [
      0.0046,
      0.0147
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.07747318235995232,
     "recall_ci95": [
      0.0612,
      0.0975
     ],
     "fpr": 0.04036697247706422,
     "fpr_ci95": [
      0.0268,
      0.0604
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.0165,
     "flag_rate_ci95": [
      0.0118,
      0.0231
     ]
    }
   }
  },
  {
   "preset": "low-noise",
   "judge": true,
   "rules_demoted": 11,
   "caps": [
    "low-confidence"
   ],
   "medium_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.88,
     "recall_ci95": [
      0.8516,
      0.9036
     ],
     "fpr": 0.17339312406576982,
     "fpr_ci95": [
      0.1541,
      0.1946
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.6317044100119189,
     "recall_ci95": [
      0.5985,
      0.6637
     ],
     "fpr": 0.13394495412844037,
     "fpr_ci95": [
      0.1079,
      0.1651
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.0865,
     "flag_rate_ci95": [
      0.075,
      0.0996
     ]
    }
   },
   "high_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.75,
     "recall_ci95": [
      0.7138,
      0.783
     ],
     "fpr": 0.04708520179372197,
     "fpr_ci95": [
      0.037,
      0.0598
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.33730631704410013,
     "recall_ci95": [
      0.3061,
      0.37
     ],
     "fpr": 0.06422018348623854,
     "fpr_ci95": [
      0.0465,
      0.088
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.036,
     "flag_rate_ci95": [
      0.0287,
      0.0451
     ]
    }
   }
  },
  {
   "preset": "quiet",
   "judge": false,
   "rules_demoted": 19,
   "caps": [
    "low-confidence",
    "contextual"
   ],
   "medium_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.2816666666666667,
     "recall_ci95": [
      0.2472,
      0.319
     ],
     "fpr": 0.0014947683109118087,
     "fpr_ci95": [
      0.0004,
      0.0054
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.041716328963051254,
     "recall_ci95": [
      0.0301,
      0.0575
     ],
     "fpr": 0.03669724770642202,
     "fpr_ci95": [
      0.0239,
      0.056
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.011,
     "flag_rate_ci95": [
      0.0073,
      0.0166
     ]
    }
   },
   "high_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.2816666666666667,
     "recall_ci95": [
      0.2472,
      0.319
     ],
     "fpr": 0.0014947683109118087,
     "fpr_ci95": [
      0.0004,
      0.0054
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.03694874851013111,
     "recall_ci95": [
      0.0262,
      0.052
     ],
     "fpr": 0.03302752293577982,
     "fpr_ci95": [
      0.021,
      0.0516
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.01,
     "flag_rate_ci95": [
      0.0065,
      0.0154
     ]
    }
   }
  },
  {
   "preset": "quiet",
   "judge": true,
   "rules_demoted": 19,
   "caps": [
    "low-confidence",
    "contextual"
   ],
   "medium_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.855,
     "recall_ci95": [
      0.8246,
      0.8809
     ],
     "fpr": 0.07025411061285501,
     "fpr_ci95": [
      0.0578,
      0.0852
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.5029797377830751,
     "recall_ci95": [
      0.4692,
      0.5367
     ],
     "fpr": 0.07155963302752294,
     "fpr_ci95": [
      0.0528,
      0.0963
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.0385,
     "flag_rate_ci95": [
      0.0309,
      0.0479
     ]
    }
   },
   "high_plus": {
    "dev": {
     "records": 1938,
     "recall": 0.745,
     "recall_ci95": [
      0.7086,
      0.7782
     ],
     "fpr": 0.03587443946188341,
     "fpr_ci95": [
      0.0272,
      0.0472
     ]
    },
    "test": {
     "records": 1384,
     "recall": 0.33134684147794996,
     "recall_ci95": [
      0.3003,
      0.3639
     ],
     "fpr": 0.05504587155963303,
     "fpr_ci95": [
      0.0388,
      0.0775
     ]
    },
    "real": {
     "records": 2000,
     "flag_rate": 0.029,
     "flag_rate_ci95": [
      0.0225,
      0.0373
     ]
    }
   }
  }
 ],
 "notes": [
  "Judge figures on the labelled splits are single pass, core rules, meta-analyzer off, detection at MEDIUM or above.",
  "The first cascade threshold was selected on half of the frozen test split; it is re-selected on train/validation, and those figures supersede it.",
  "The deterministic rules and the judge prompt were designed on MaliciousSkillBench train/validation and real skills; the frozen test split was scored once and used to design nothing in the later passes.",
  "Unlabelled populations give flag rates, which bound the false-positive rate from above.",
  "An early deterministic run read 100% false-positive rate because copying the corpus from macOS added an AppleDouble '._SKILL.md' to every record, which the scanner correctly flagged; the sidecars were removed.",
  "Endpoint protection quarantined malicious SKILL.md files from local copies of the benchmark, silently turning malicious records into empty ones; every figure here was produced on a Linux analysis host."
 ],
 "provenance": {
  "scanner_commits": {
   "shipped": "5b696a1",
   "first_pass": "f3a42f3",
   "final": "9c08673"
  },
  "report_builder_commit": "5807c36de84b028a912624ed46fab0d0c67d49d0",
  "published_as": "results/large-scale.json"
 },
 "published_as": "results/large-scale.json",
 "digests_file": "results/SHA256SUMS",
 "blocking": false,
 "complete": true
}