The Hiremath Early Detection (HED) Score: A Measure-Theoretic Evaluation Standard for Temporal Intelligence

This paper introduces the Hiremath Early Detection (HED) Score, a measure-theoretic evaluation standard that overcomes the temporal agnosticism of traditional metrics like ROC/AUC by quantifying the time-value of information through an exponentially decaying kernel, and validates its superiority via the PARD-SSM model on the NSL-KDD benchmark.

The Gist

The Big Idea: Why "When" Matters More Than "What"

Imagine you are a security guard watching a bank vault.

• Scenario A: You see a thief pick the lock, and you hit the alarm immediately. The police arrive in 2 minutes. The thief is caught, and no money is stolen.
• Scenario B: You see the same thief pick the lock, but you hit the alarm 2 hours later. The thief has already emptied the vault and left. You still "detected" the thief, but the damage is done.

In the world of computer science and security, traditional scoring systems (like the famous ROC/AUC) treat Scenario A and Scenario B as identical. They just ask: "Did you eventually spot the bad guy?" If yes, you get a gold star.

The Problem: In the real world, time is money (and safety). A detection that happens 2 hours late is useless. The authors of this paper argue that our current way of grading AI detectors is broken because it ignores latency (how long you waited).

The Solution: The HED Score

The authors introduce the Hiremath Early Detection (HED) Score. Think of this as a new grading system for security alarms that rewards speed and punishes delays.

Here is how it works, broken down into three simple concepts:

1. The "Melting Ice Cream" Analogy (The Decay Kernel)

Imagine the value of an early warning is like a scoop of ice cream.

• The moment the danger starts (the "regime shift"), the ice cream is fresh, cold, and delicious (100% value).
• Every second you wait, the ice cream starts to melt.
• If you wait too long, it's just a puddle of water (0% value).

The HED Score uses a mathematical formula (an "exponential decay kernel") to calculate exactly how much "ice cream" is left when you finally sound the alarm.

• Fast alarm? You get a full scoop. High score.
• Slow alarm? You get a melted puddle. Low score.

2. The "Noise Floor" Filter (Baseline Neutrality)

Imagine a smoke detector that is so sensitive it goes off every time you toast bread. It's always "alerting," even when there is no fire.

• Traditional scores might think this is great because it catches every fire (even the tiny ones).
• The HED Score says: "Wait a minute. If you are always screaming 'Fire!', you aren't actually detecting anything new."

The HED Score subtracts the "background noise" (the times the detector was already worried before the real danger started). It only gives you credit for the extra alertness you show after the real danger begins. This stops "trigger-happy" detectors from cheating the system.

3. The "Half-Life" Rule (The Decay Constant)

Different jobs need different speeds.

• High-Frequency Trading: If you are trading stocks, a delay of 1 second costs millions. The "ice cream" melts in seconds.
• Earthquake Warning: If you are predicting earthquakes, you might have minutes or hours. The "ice cream" melts slower.

The HED Score has a "knob" called $\lambda_H$ (Lambda). You can turn this knob to match the job.

• For fast jobs, you set the knob so the score drops instantly if you are late.
• For slow jobs, you set the knob so you get credit for a longer window.

The New Tool: PARD-SSM

To prove their new scoring system works, the authors built a new type of AI detector called PARD-SSM.

• The Old Way (Random Forest): Imagine a detective who waits until they have gathered 50 clues before calling the police. By the time they call, the criminal is long gone.
• The New Way (PARD-SSM): This AI is like a detective with "super-senses." It notices tiny, subtle tremors in the data before the big event happens. It accumulates weak signals over time (like a snowball rolling down a hill) and triggers the alarm the moment the pattern shifts.

The Result: When they tested this new AI on a standard hacking dataset (NSL-KDD), it scored 388% higher than the old methods. It didn't just detect the attacks; it detected them much earlier, giving the system time to react.

Why the Name "Hiremath"?

The paper ends with a touching dedication. The author, Prakul Sunil Hiremath, names the score after his family lineage.

• In his culture, a "Hiremath" is a spiritual center or monastery that has historically acted as a protector and a guardian of knowledge during times of change.
• Just as those ancient guardians protected their communities from chaos, this new mathematical score is designed to protect modern systems (like power grids and computer networks) from digital chaos by ensuring we spot trouble early.

Summary in One Sentence

The HED Score is a new way to grade AI security systems that says: "It doesn't matter if you eventually catch the bad guy; it only matters how fast you catch them before the damage is done."

Technical Summary

1. Problem Statement

The paper addresses a critical flaw in existing evaluation paradigms for anomaly detection and regime switching in non-stationary stochastic processes.

• The Limitation of ROC/AUC: Traditional metrics like the Receiver Operating Characteristic (ROC) curve and Area Under the Curve (AUC) are temporally agnostic. They treat a detection made immediately after a regime shift ($t_{start} + 1$) identically to one made significantly later ($t_{start} + \tau$).
• The Consequence: In time-critical domains (e.g., cyber-physical security, epidemiology, algorithmic trading), the cost of delay is often superlinear. A delay in detection can lead to catastrophic system failures. Existing metrics fail to penalize latency or reward early detection, rendering them "epistemically incoherent" for these applications.
• The Goal: To develop a principled, measure-theoretic evaluation criterion that quantifies the time-value of information, explicitly rewarding earlier detections while accounting for pre-transition noise and false alarms.

2. Methodology

A. The Hiremath Early Detection (HED) Score

The core contribution is the HED Score, a functional that integrates the posterior probability of an anomalous regime over time, weighted by an exponential decay kernel.

• Mathematical Formulation:
  Let $P(t) = P(R_1 | \mathcal{F}_t)$ be the posterior probability of the anomalous regime $R_1$ at time $t$, and $t_{start}$ be the onset time of the regime shift.
  The HED Score is defined as:
  $$H[P, t_{start}; \lambda_H] := \frac{1}{T - t_{start}} \int_{t_{start}}^{T} \max(0, P(t) - \bar{P}_{base}) \cdot e^{-\lambda_H(t - t_{start})} dt$$
  Where:

  • Detection Lift: $\max(0, P(t) - \bar{P}_{base})$ measures the excess probability over the pre-onset noise floor ($\bar{P}_{base}$), preventing credit for chronically over-confident detectors.
  • Temporal Discount: $e^{-\lambda_H(t - t_{start})}$ applies an exponential penalty for delay. The parameter $\lambda_H$ is the Hiremath Decay Constant.
  • Information Half-Life: Defined as $\tau_{1/2} = \ln(2)/\lambda_H$, representing the time after which a detection's utility is halved. This constant is domain-specific (e.g., 0.50 for high-frequency trading, 0.01 for seismic warnings).

• Axiomatic Validation:
  The authors prove the HED Score satisfies three axioms:

  1. Temporal Monotonicity (A1): Earlier detections yield strictly higher scores than later ones.
  2. Invariance to Pre-Attack Bias (A2): Uniformly increasing the detector's output (e.g., lowering the threshold globally) does not increase the score, as the baseline $\bar{P}_{base}$ adjusts accordingly. This prevents "gaming" the metric.
  3. Sensitivity Decomposability (A3): The score is additive over non-overlapping time intervals, allowing for phase-resolved analysis.

B. The PARD-SSM Model

To demonstrate the utility of the HED Score, the authors introduce PARD-SSM (Probabilistic Anomaly and Regime Detection via Switching State-Space Models).

• Architecture:
  1. Fractional Stochastic Differential Equations (fSDEs): The latent state evolves using fSDEs with a Hurst exponent $H > 0.5$. This induces long-range dependence, allowing the model to accumulate weak, correlated anomaly signatures before the regime shift is fully confirmed.
  2. Switching Linear Dynamical System (S-LDS): Inferred from the latent state, this component switches between regimes.
• Mechanism for Maximizing HED: Unlike batch classifiers (e.g., Random Forest) or standard LSTMs that require sufficient post-onset data to build confidence, PARD-SSM leverages pre-onset memory to concentrate posterior probability near 1.0 immediately at $t_{start}$. This maximizes the integral under the exponential decay curve.

C. Statistical Evaluation

• Block Bootstrap: Due to the serial autocorrelation in the probability streams, standard i.i.d. bootstrapping is invalid. The authors use the Künsch moving block bootstrap to establish statistical significance.
• FAR-HED Pareto Frontier: A new visualization tool plotting False Alarm Rate (FAR) against HED Score across different thresholds, analogous to the ROC curve but optimized for temporal performance.

3. Key Contributions

1. HED Score Metric: A novel, mathematically rigorous evaluation standard that replaces the "time-blind" ROC/AUC for temporal detection tasks.
2. Theoretical Framework: Proof of three axioms ensuring the metric is robust against bias manipulation and sensitive to latency.
3. Hiremath Standard Table: A domain-indexed reference table for calibrating the decay constant $\lambda_H$ based on the specific response latency budget of different industries (e.g., trading vs. epidemiology).
4. PARD-SSM Model: A specific architectural implementation combining fSDEs and S-LDS designed to inherently maximize early detection capabilities.
5. Cultural Integration: The paper uniquely integrates the metric's naming and dedication with the author's ancestral lineage (the Hiremath tradition of scholarship and service), framing the metric as a modern form of Dasoha (selfless giving).

4. Empirical Results

The authors evaluated PARD-SSM against a Random Forest baseline on the NSL-KDD intrusion detection benchmark.

• Performance:
  • PARD-SSM: Achieved a HED Score of 0.0643.
  • Random Forest: Achieved a HED Score of 0.0132.
• Improvement: This represents a 388.8% improvement over the baseline.
• Significance: The result was statistically significant with $p < 0.001$ via block-bootstrap resampling.
• Interpretation: The results confirm that models capable of leveraging pre-onset temporal dependencies (via fSDEs) significantly outperform standard classifiers when evaluated on a metric that values time.

5. Significance and Future Directions

• Paradigm Shift: The paper argues that for any domain where "the moment of detection is as consequential as the fact of detection," the HED Score should become the successor standard to ROC/AUC.
• Applications: The framework is applicable to cyber-physical security, algorithmic surveillance, epidemiological monitoring, and seismic early warning.
• Future Extensions:
  • HED-Aware Loss Functions: Making the metric differentiable to train models directly for early detection.
  • Adaptive Scheduling: Allowing $\lambda_H$ to vary dynamically based on system state.
  • Multi-Regime Generalization: Extending the metric to handle transitions between more than two latent regimes.

In summary, the paper provides a rigorous mathematical foundation for evaluating when a system detects an anomaly, not just if it detects it, offering a superior standard for safety-critical and time-sensitive AI systems.