Three judges.
One verdict. Zero blind spots.
Ward³ is the first reference implementation of Adversarial Neural Mediation — three architecturally orthogonal AI judges that mediate every flow, with divergence treated as a first-class security signal. Built for the era of adversarial AI.
Single-model NDR is no longer enough.
Vectra. Darktrace. ExtraHop. They all assumed one ML model could catch sophisticated attacks. That assumption was reasonable in 2017. It is not reasonable in 2026.
Open-source adversarial frameworks — ART, CleverHans, Foolbox — now put gradient-based evasion in commodity attackers' hands. Any single deployed model can be fooled.
Three judges. Architecturally orthogonal.
Adversarial perturbations transfer across models that share inductive bias. They do not transfer across models that encode the world in fundamentally different ways. Ward³ runs three.
- Bidirectional neural encoder
- Attention pooling
- Per-flow windowed inference
- Adversarial-robust training
- Multi-layer graph encoder
- Sliding src→dst windows
- Cross-flow context
- Adversarial-robust training
- Hand-curated invariants
- Max packets · entropy · rate
- Immune to gradient attacks
- Inspectable, by construction
Divergence is a first-class security signal.
A stealth attacker who fools one judge produces high divergence with the others. The mediator fails closed under disagreement and emits XAI_DIVERGENCE_HIGH — a signal no single-model NDR can produce, by definition.
Three judges. Three latencies. Three surfaces.
Edge in microseconds. Tenant in milliseconds. Platform-wide correlation in tens of milliseconds. Network and endpoint, unified under one mediator — the Ward³ trinity, executed end to end.
- Rule judge (pure Rust)
- Threat-intel cache hits
- TLS fingerprint match
- eBPF preprocessing & tagging
- Local endpoint enforce
- Sequence judge
- Relational judge
- Endpoint process & file judges
- Mediator + divergence
- Adversarial-robust scoring
- Async enrichment (no hot-path block)
- Endpoint correlation
- Long-horizon baselines
- Kill-chain reconstruction
- Federated threat intel
- IPv4 + IPv6
- Retransmits, TTL var.
- Per-flow runtime vector
- Line-rate
- Sequence judge
- Relational judge
- Rule judge
- Cryptographically signed
- Pairwise spread
- Fail-closed on disagree
- Consensus on align
- XAI_DIVERGENCE_HIGH
- NetworkPolicy injection
- nftables Block/Quarantine
- War mode 4-eyes
- Rate-limit / principal
- Hash-chained log
- Post-quantum signed
- Tamper-evident
- Replayable
Both ML judges trained against gradient-based attacks. Documented threat model, hyperparameters, and reproducible runs.
Inference artifacts cryptographically signed at build, verified at load. Append-only registry with full provenance.
Every decision — per-judge scores, divergence, applied rules — replayable to validate reasoning end to end.
+30 to +60 pts of detection under adversarial pressure.
Evaluated on held-out traffic and on out-of-distribution networks (log formats, attack families, and IoT botnets never seen during training). Adversarial robustness measured under gradient-based evasion.
~2× inference latency vs single-model — still <10ms p99 per flow on commodity hardware.
| Metric | Single-judge | Ward³ 3-judge | Δ |
|---|---|---|---|
| F1 (clean) | 0.66 | 0.97 | +0.31 |
| AUC-ROC (clean) | 0.89 | 0.998 | +0.108 |
| Detection · PGD ε=0.02 | 23.7% | 94.1% | +70.4 pts |
| Detection · transfer | 31.4% | 89.6% | +58.2 pts |
| Metric | Single-judge | Ward³ 3-judge | Δ |
|---|---|---|---|
| AUC-ROC | 0.71 | 0.87 | +0.16 |
Five criteria for category membership.
A product belongs to the ANM category if and only if it implements all five. Ward³ is the first reference implementation — proof the category is achievable, not a marketing slogan.
Read the full whitepaper- 01At least three judges, architecturally distinct
Not three random seeds. Not three window sizes. Three different inductive biases — sequence, graph, rule.
- 02Explicit divergence detection
Real-time disagreement measure between judges, treated as a security signal — not just a confidence score.
- 03Adversarial training of ML judges
Gradient-based attack training. Documented threat model. Untrained judges are easy to fool individually.
- 04Model integrity & watermarking
Cryptographic signing, verified at load. Append-only registry with provenance. Without it, mediation is meaningless.
- 05Auditable decision trail
Per-judge scores, divergence, applied consequences — persisted in a tamper-evident log. Robustness has to be provable.
ANM coexists with EDR, NDR & XDR — it doesn't replace them.
ANM owns the network layer when adversarial-grade attackers come for your ML. The rest of your stack stays where it is.
| Capability | EDR | NDR | XDR | MDR | ANM (Ward³) |
|---|---|---|---|---|---|
| Endpoint visibility | yes | no | yes | depends | yes |
| Network visibility | no | yes | yes | depends | yes |
| ML-based detection | yes | yes | yes | varies | yes |
| Architecturally orthogonal judges | no | no | no | no | yes |
| Divergence as a security signal | no | no | no | no | yes |
| Adversarial training documented | rare | rare | rare | no | yes |
| Model integrity verification | partial | partial | partial | no | yes |
| Tamper-evident audit ledger | no | no | no | no | yes |
Built for SOCs that already have an opinion.
Ward³ exposes the surfaces your team already speaks. eBPF on the wire, Kubernetes at the edge, Prometheus on the wall, Sigstore on the build.
Line-rate flow capture on Linux. IPv4 + IPv6, retransmits, TTL variance, per-flow runtime vector. Mock probe for non-Linux dev.
Verdicts translated into K8s NetworkPolicies — or Linux nftables sets (Block / Quarantine), or dry-run.
NIST-aligned post-quantum primitives for quorum and ledger. Shamir secret sharing. Argon2id + JWT RS256 + mTLS.
Hash-chained, post-quantum signed audit log. Tip-hash sealable. Replayable for forensics, retraining, regulator review.
High-impact line-rate blocks require two human admins to approve. Designed for ops teams that need to prove restraint.
Active deception — attacker burns time on instrumented decoys while the mediator collects high-confidence labels.
Offline auto-labeling pipeline + retrain trigger. Continuous improvement without trusting production verdicts blindly.
Prometheus metrics + reference Grafana dashboards + OpenTelemetry tracing. Plus Sigstore attestation for artifacts.
Defend with three judges.
Or be fooled by one.
Ward³ ships today as the reference ANM implementation. Banks, telcos, defense contractors, critical infrastructure: that's who this is for. If that's you, let's talk.