The BIPIA row is the wrong headline. A 24/7 layer lives on the NotInject row.

BIPIA training contexts and Deepset training data are both in the tuning corpus, split by context and by source row. So 99.83% and 78.33% are in-family recall, and Deepset still misses 13 of 60.

NotInject is the row that moved the other way. 98.82% benign accuracy on the parent, 87.61% here. That is 42 of 339 hard benign prompts flagged where AutoJev flagged 4, with hard benigns in the tuning corpus. The card says this plainly as an operating-point tradeoff, which I appreciate.

That is also what makes the fixed 0.70 threshold hard to read across the three columns. Security-One ships its own fitted temperature (0.145). AutoJev at 28% BIPIA recall with zero false positives may just sit far from its best cut, not fail to separate the classes. Recall at a matched false positive rate, or AUROC on the 800 BIPIA rows, would say whether the tune learned a better ranking or moved the threshold. If evals/comparison.json already has that, I could not read it. The repo is gated and I only have the card.

It matters at always-on volume. At 1 attack per 1,000 events and the 0.5% BIPIA false positive rate (1 row of 200), about 5 of every 6 escalations are benign. If benign traffic looked like NotInject, it would be over 99 in 100.

Were the temperature and the 0.70 cut fit on a calibration split that had NotInject-style hard benigns in it, or without them?