IoT Intrusion Detection Study Treats Explanation Generation as a Measured Cost, Not a Free Post-Processing Step

arXiv 2608.10349·low signalXBlueskyLinkedInCopy link

Most ML intrusion-detection research reports predictive accuracy while implicitly assuming explanations are computationally free. This study jointly evaluates predictive effectiveness, explanation cost, local explanation stability and selective explanation for binary IoT intrusion detection, built on a leakage-safe CICIoT2023 corpus constructed with exact 39-feature hashes, non-finite-value handling and exact-feature deduplication. The framing generalizes beyond IoT: any production system attaching SHAP-style explanations to high-volume inference decisions is paying a cost that benchmark papers rarely report.