Hisham Tariq

What Does a Missing Exclusion Clause Cost? Measuring the False-Positive Burden of LLM-Generated Detection Rules

Large language models now write detection rules, and the work evaluating them asks whether the rules catch attacks. It does not ask what they cost on a quiet day. That cost sits in the exclusion clause the "alert when X, except when Y" half of a rule, which encodes local knowledge of what is benign here. Prior work rep...