Findings

The same model, the same flows. Tested the usual way it looks nearly perfect; tested on attacks from days it never trained on, F1 falls by more than half. Results reported on random splits measure recognition, not detection.

A model squeezed to fit a lean serverless function is not the model in the paper, so its design was trained and tested on the same held-out attackers. It was weaker; fused with a small classifier it beat the full model. Then it was tried on real questions before shipping: it misread a defence question about ransomware on file shares, so that answer still comes from retrieval, and a test pins it.

The harness never counted the normal points a detector correctly left alone. Fixed, every affected result was re-run, the detection decision was re-made on the corrected numbers, and the history was kept rather than rewritten.