Enterprise Security in the Agentic AI Era

Tiered Detection Cascade

4 min read

Tiered Detection Cascade

Definition

A detection architecture that orders stages by cost so that a cheap, high-recall pre-filter handles most events and gates a more expensive, high-precision stage that runs only on what the pre-filter flags. The economic premise is that running the most accurate detector (typically an LLM reasoning pass) on every event is unaffordable at agent-traffic volume, while running only a cheap detector misses sophisticated attacks. Cascading the two recovers most of the accuracy at a fraction of the cost.

Timing of its emergence

Agentic traffic is both high-volume and heavily skewed toward benign activity, and the accurate detector is an LLM whose per-event cost is non-trivial. Those two facts make blanket LLM inspection economically impossible: production systems report tens of thousands of sessions daily and millions of prompts. The cascade is the standard response, spending almost nothing on the common case and real money only on the suspicious minority.

The pattern

StageGoalTypical implementationTuned for
Pre-filter / triageCatch everything suspicious cheaplyRegex, entropy, embeddings, or a small/cheap LLMHigh recall, low cost
Deep stageDecide precisely on flagged eventsReasoning LLM with context (source code, policy, threat intel)High precision

The design discipline is to keep the pre-filter conservative, escalating whenever in doubt, so that false negatives stay low and the precision burden moves to the deep stage. The cost lever is the escalation rate: the fraction of traffic the pre-filter passes upward sets both the spend and the precision/recall trade-off.

The discipline reaches a limit set by the pre-filter’s mechanism rather than by its threshold. The OWASP AI Exchange states that detection of statistically odd input is often ineffective against adversarial input, because such samples are designed to resemble normal input by definition, and it names embedding distance and cosine similarity among the measures such a detector uses.1 An embedding-similarity pre-filter therefore has recall bounded by construction against an adversary who knows it is there: escalating whenever in doubt requires doubt, and the attack is built to produce none. The bound applies to that detector class rather than to the cascade, since regex and small-LLM triage stages fail differently, and it changes what the escalation rate can be read as. A low escalation rate means a cheap common case where the adversary is not adapting to the pre-filter, and means very little where the adversary is. The Exchange also states the reverse case plainly: not all anomalous input is malicious, and not all malicious input is anomalous.1

Occurrences across independent sources

  • ADR (Uber, MLSys 2026). Tier 1 is a high-recall LLM triage screen; Tier 2 is a Claude Sonnet 4 reasoning agent that queries MCP context. Triage resolves 40.7% of tasks at $0.017 each; the reasoning path costs $0.029. Removing the triage layer raises recall but adds false positives and increases cost 29% and latency 52% — quantifying the cascade’s value directly.2
  • SYARA (Palo Alto, Unprompted 2026). Four matchers (string, similarity, classifier, LLM) execute in cost order, so a cheap pre-filter gates the expensive LLM call, reported as order-of-magnitude cost and latency reductions over an LLM-only approach.
  • Agentforce telemetry (Salesforce, Unprompted 2026). A three-level ensemble of behavioral anomaly detection reduces 1.8M daily prompts to ≤30 actionable alerts, a cascade tuned to collapse volume before human review.

Relationship to adjacent patterns

The cascade is an economic axis, distinct from the layered defense in Prompt Injection Containment (network → input-detection → execution-containment), which is organized by where enforcement sits rather than by cost order. A system can be both: ADR’s Tier 1/Tier 2 is a cost cascade, while its sensor-plus-inline-hooks split is a containment layering. The deep stage frequently uses an LLM-as-a-judge, inheriting that pattern’s recursive-injection exposure.

Escalation policy is the unsolved knob

Each system sets the pre-filter’s escalation threshold by hand, and the right operating point differs by enterprise (cost tolerance, class imbalance, miss cost). There is no shared methodology for choosing it; ADR notes only that it uses a precision-first setting to keep alert volume manageable under extreme class imbalance.

See Also

Sources

Footnotes

  1. OWASP AI Exchange — ANOMALOUS INPUT HANDLING, retrieved 2026-08-18. ↩ ↩2

  2. §3.2 and §5.2–5.3, arXiv:2605.17380: Tier 1 triage / Tier 2 reasoning, 40.7% of tasks at $0.017 vs $0.029 for the reasoning path, and the w/o-Triage ablation (recall and F1 rise; precision falls; cost +29%, latency +52%). ↩

Graph View

Backlinks