Tiered Detection Cascade
Definition
A detection architecture that orders stages by cost so that a cheap, high-recall pre-filter handles most events and gates a more expensive, high-precision stage that runs only on what the pre-filter flags. The economic premise is that running the most accurate detector (typically an LLM reasoning pass) on every event is unaffordable at agent-traffic volume, while running only a cheap detector misses sophisticated attacks. Cascading the two recovers most of the accuracy at a fraction of the cost.
Why it appears now
Agentic traffic is both high-volume and heavily skewed toward benign activity, and the accurate detector is an LLM whose per-event cost is non-trivial. Those two facts make blanket LLM inspection economically impossible: production systems report tens of thousands of sessions daily and millions of prompts. The cascade is the standard response, spending almost nothing on the common case and real money only on the suspicious minority.
The pattern
| Stage | Goal | Typical implementation | Tuned for |
|---|---|---|---|
| Pre-filter / triage | Catch everything suspicious cheaply | Regex, entropy, embeddings, or a small/cheap LLM | High recall, low cost |
| Deep stage | Decide precisely on flagged events | Reasoning LLM with context (source code, policy, threat intel) | High precision |
The design discipline is to keep the pre-filter conservative, escalating whenever in doubt, so that false negatives stay low and the precision burden moves to the deep stage. The cost lever is the escalation rate: the fraction of traffic the pre-filter passes upward sets both the spend and the precision/recall trade-off.
Where it appears (3+ independent sources)
- ADR (Uber, MLSys 2026). Tier 1 is a high-recall LLM triage screen; Tier 2 is a Claude Sonnet 4 reasoning agent that queries MCP context. Triage resolves 40.7% of tasks at $0.017 each; the reasoning path costs $0.029. Removing the triage layer raises recall but adds false positives and increases cost 29% and latency 52% — quantifying the cascade’s value directly.1
- SYARA (Palo Alto, Unprompted 2026). Four matchers (string, similarity, classifier, LLM) execute in cost order, so a cheap pre-filter gates the expensive LLM call, reported as order-of-magnitude cost and latency reductions over an LLM-only approach.
- Agentforce telemetry (Salesforce, Unprompted 2026). A three-level ensemble of behavioral anomaly detection reduces 1.8M daily prompts to ≤30 actionable alerts, a cascade tuned to collapse volume before human review.
Relationship to adjacent patterns
The cascade is an economic axis, distinct from the layered defense in Prompt Injection Containment (network → input-detection → execution-containment), which is organized by where enforcement sits rather than by cost order. A system can be both: ADR’s Tier 1/Tier 2 is a cost cascade, while its sensor-plus-inline-hooks split is a containment layering. The deep stage frequently uses an LLM-as-a-judge, inheriting that pattern’s recursive-injection exposure.
Escalation policy is the unsolved knob
Each system sets the pre-filter’s escalation threshold by hand, and the right operating point differs by enterprise (cost tolerance, class imbalance, miss cost). There is no shared methodology for choosing it; ADR notes only that it uses a precision-first setting to keep alert volume manageable under extreme class imbalance.
See Also
- ADR — Agentic Detection for Enterprise AI — the two-tier production instance
- SYARA — cost-ordered matchers
- Agent Observability — the telemetry the cascade consumes
- Evaluating AI SOC Agents — cost-per-outcome as a buyer criterion
Sources
Footnotes
-
§3.2 and §5.2–5.3, arXiv:2605.17380: Tier 1 triage / Tier 2 reasoning, 40.7% of tasks at $0.017 vs $0.029 for the reasoning path, and the w/o-Triage ablation (recall and F1 rise; precision falls; cost +29%, latency +52%).
↩