Dual-Threshold Conformal Deferral for Trustworthy Security Alert Triage
A model-agnostic dual-threshold conformal deferral architecture that needs no retraining and closes an automatic zone rather than certifying what the calibration data cannot support is presented, and severe cross-dataset degradation appears not as a silent error but as sharply reduced certifiable automation.