Logit ROCs: Monitor TPR is linear in FPR in logit space

Research question

How should monitor performance be estimated at very small audit budgets?

Design & assumptions

Fits a logit relationship between detection and false-positive rates across control settings.

Findings

Parametric fitting improves estimates when benign-tail data are sparse.

A naive estimate can be better when sufficient tail observations exist.

Limits & counterevidence

Detection uses attack trajectories while false positives use benign actions; varied attackers can violate the fitted relationship.

Source evidence

No structured numerical extraction is available in this reading package.