{"id":"746e8da0-1950-4b2b-b5c3-44d7591db5e2","arxiv_id":"2509.00397","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SpliDT partitions decision trees into subtrees, processes flows in windows, and reuses switch registers via recirculation, supporting up to 5x more stateful features than NetBeacon and Leo with higher F1 at similar flow counts.","lead":"A new switch data-plane system, SpliDT, splits each network flow into windows and lets different parts of a decision tree use different features, reusing the same switch memory across windows. This lets in-switch machine learning models use up to 5x more stateful features than prior approaches without losing flow capacity or detection speed.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Window-boundary detection is assumed via Homa/NDP flow-size headers, but the evaluation never exercises it; for ordinary TCP the partitioned inference loop cannot trigger subtree transitions.","rationale":"I agree with the reader that the window-boundary assumption is the most load-bearing concern. The paper's own design text makes the architecture dependent on parsing flow-size information from packet headers, yet the evaluation never validates that this parsing and boundary detection actually works on the target hardware. The offline evaluation is performed on already-windowed dataset statistics, so it sidesteps the hardest systems problem: knowing, in the data path, when one window ends and the next subtree should be activated. If this fails for ordinary TCP, the entire partitioned inference loop cannot execute for the vast majority of real-world traffic, which would invalidate the generality of the headline claims. Other issues—BO selecting models on the test set, recirculation overhead being estimated rather than measured—are real but secondary; they affect the strength of the accuracy/overhead numbers, not whether the system can run at all. The reader already assigned CONDITIONAL, and my concern does not move the verdict; it reinforces that the revision must either implement/validate the boundary mechanism or explicitly scope the claims to transports like Homa/NDP.","tokens_in":25158,"tokens_out":10163,"duration_ms":125978,"concrete_test":"Run an end-to-end test on the Tofino testbed with MoonGen generating two traffic mixes: (a) packets carrying an explicit flow-size/length field in the style of Homa/NDP, and (b) standard TCP packets with no such field. Measure whether SpliDT triggers subtree transitions at the correct window boundaries and whether classification F1 matches the offline numbers. If the TCP arm cannot determine boundaries, the claim holds only for transports that expose flow size, not for general line-rate inference. As an additional analytical check, inspect the released P4 code for parser/action logic that computes window end from a flow-size header; if no such logic exists, the architecture as described is incomplete.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires a working mechanism to decide when a flow window ends and trigger the subtree transition. Section 1 states that modern transports (Homa, NDP) embed flow size in headers, which the switch parses to determine window boundaries; Section 3.1.3 says a recirculated packet is triggered after processing a flow window. However, no P4-level mechanism is specified for actually detecting that boundary, and the evaluation does not test the boundary-triggering path: the offline datasets are processed with CICFlowMeter, which provides ground-truth per-window statistics, effectively giving the model an oracle for flow length and window end. For ordinary TCP/IP traffic—the kind represented by the CIC datasets—no such header field exists, so the data plane cannot know where a window ends and cannot run the partitioned loop as described. Section 6 only flags spoofing of flow-size info, not its absence on general traffic. Unless SpliDT is explicitly scoped to Homa/NDP-style transports and that end-to-end path is demonstrated, the 'line-rate' and 'scaling to millions of flows' claims rest on an unvalidated assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents SpliDT, a partitioned decision-tree architecture for programmable data planes. Instead of computing a fixed top-k set of stateful features for the entire flow, SpliDT splits the DT into partitions and subtrees, assigns each subtree its own feature subset, collects features over sliding windows of packets, and uses packet recirculation as an in-band control channel to reuse registers and match keys across subtrees. A Bayesian-optimization-based design-space exploration framework jointly selects tree depth, partition sizes, and per-subtree feature counts. The paper evaluates SpliDT on seven public network datasets and compares against NetBeacon and Leo, reporting higher F1 scores, up to 5x more unique features, flows up to 1M, and recirculation overhead below 0.05%.","tokens_in":25420,"tokens_out":6855,"duration_ms":79042,"significance":"The core idea is timely and potentially significant: if validated, it decouples the number of stateful features used by an in-network DT from the per-flow register budget, and it offers a concrete way to time-share match-action resources. Strengths of the paper include the full P4 implementation compiled with BF-SDE for Tofino, the use of a real testbed, a custom training/DSE framework, and an explicit commitment to release artifacts. The main claims, however, rest on two evaluation choices that need to be corrected or scoped before the results can be taken at face value: using the test set to drive Bayesian optimization, and relying on an unvalidated window-boundary mechanism for the evaluated TCP-like workloads.","major_comments":[{"comment":"The BO loop is described as evaluating each proposed configuration 'on a test dataset' and feeding that F1 score back into the optimizer. Because the reported F1 values are the best over 500 BO iterations, they are subject to optimistic selection bias. This is load-bearing for the central 'higher accuracy than NetBeacon and Leo' claim: part or all of the gap may be an artifact of model selection on the test split. Please use a train/validation/test protocol: run BO on the validation split, then evaluate the final selected configuration once on a locked test set, and report both the validation-selected and locked-test F1 values.","section":"§3.2.1 (Figure 5), §5.2 (Table 3, Figure 6)"},{"comment":"The partitioned inference loop requires the data plane to know when a flow window ends and to trigger a recirculation with the next SID. The paper states in §1 that Homa/NDP embed flow-size information in headers, and §6 discusses only spoofing of that field. However, the evaluation is performed on offline datasets processed with CICFlowMeter, which provides ground-truth per-window statistics and thus an oracle for window boundaries. No P4-level mechanism for detecting window boundaries on ordinary TCP/IP traffic is specified, and no experiment exercises the header-parsing/triggering path. The end-to-end claims of line-rate, millions-of-flows operation are therefore not supported for the evaluated workloads. Please either scope SpliDT explicitly to transports with flow-size headers and demonstrate that path (including spoofing robustness), or implement and validate an alternative boundar","section":"§1, §3.1.3, §5.1, §6"},{"comment":"The recirculation-overhead results appear to be estimates rather than on-switch measurements; no testbed measurement of recirculated packet rate or its impact on throughput is presented. Additionally, the numbers are internally inconsistent: Table 5 lists a maximum of 60.0 Mbps for D7 in the Hadoop environment at 1M flows, which is 0.06% of a 100 Gbps link, while the abstract says '≤0.05%' and the introduction says 'just 50 Mbps (0.05%) in the worst case.' Please reconcile these values and clarify whether Figure 10's time-to-detection is measured or simulated, including how recirculation latency is accounted for.","section":"Table 5, §5.3, Abstract"},{"comment":"The claim of 'up to 5× more stateful features' compares SpliDT's total unique features across all subtrees with the baselines' fixed top-k set. This is a legitimate aggregate property, but it can be misleading: SpliDT's register budget is set only by the per-subtree value k (e.g., 4 features), so the unique features are not simultaneously 'supported' in the data-plane registers. Moreover, the F1 gains may come substantially from window-based training and per-subtree specialization rather than from a larger simultaneous feature set. A controlled ablation (same k and feature budget, with and without partitioning) would substantiate the claimed mechanism and make the comparison with NetBeacon/Leo fairer.","section":"Table 3, §1, §5.3"}],"minor_comments":[{"comment":"There is a duplicated/leftover abstract block beginning with 'FlowNetBeacon,Leo Feature Collection...' before Section 1; it should be removed or replaced with the actual paper abstract.","section":"Front matter"},{"comment":"Reference [22] is listed as 'Details omitted for double-blind review.' Since the paper commits to public artifact release, the reference should be resolved or the artifact linked.","section":"References"},{"comment":"The '#Features' column should clearly state that for SpliDT it denotes the total number of unique features across all subtrees, while for NetBeacon/Leo it denotes the fixed per-flow top-k value. Without this clarification, the reader may over-interpret the comparison.","section":"Table 3"},{"comment":"All datasets are multi-class, but the paper does not specify whether the reported F1 is macro-, micro-, or weighted. Please state the averaging method.","section":"§5.2"},{"comment":"The paper says the BO search runs 500 iterations, while Figure 7 shows convergence within 150 iterations. It would be helpful to state the stopping criterion or why 500 iterations were used.","section":"§3.2.1"}],"recommendation":"major_revision","confidential_remarks":"The architecture and prototyping effort are strong, and the paper could make a worthwhile contribution after revision. The main blockers are methodological: test-set-driven BO selection and the unvalidated window-boundary mechanism. Both are fixable: the first by a proper validation split, the second by scoping claims or adding a concrete boundary-trigger implementation. If the authors can also resolve the recirculation-bandwidth inconsistency, I would be supportive."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is the first in-network decision-tree design I know of that assigns different feature sets to different subtrees and reuses registers via recirculation. That is a real step past NetBeacon and Leo, which are locked into a fixed top-k feature set. The paper also does a lot of legwork: seven datasets, detailed Pareto comparisons, a P4 implementation compiled for Tofino1, and a concrete training/design-search pipeline. The core idea deserves serious attention.\n\nThe soft spots are in the evidence, not the idea. The evaluation is weakened by using the test set to drive Bayesian optimization. Section 3.2.1 says each configuration is evaluated on a test dataset and the feedback guides the search, so the reported F1 numbers are optimistic by selection. A validation split or nested CV is needed before comparing with baselines.\n\nThe bigger issue, which the stress-test note lands, is window-boundary detection. The entire partitioned loop depends on the switch knowing when a flow window ends. The paper cites Homa/NDP flow-size headers, but it never specifies or tests the P4 mechanism, and the offline evaluation uses CICFlowMeter to generate per-window statistics—effectively an oracle for window boundaries. For ordinary TCP traffic, which the CIC datasets actually represent, no such header field exists. Section 6 flags spoofing of flow-size info but not its absence on general traffic. Without a working boundary trigger, the 'line-rate partitioned inference' claim is not demonstrated. The paper should either be explicitly scoped to transports that carry flow-size information, or the mechanism needs to be implemented and measured.\n\nThe recirculation overhead numbers also appear to be estimates from flow-size distributions rather than testbed measurements, and a few table values don't reconcile. Those are fixable.\n\nNet: the architecture is plausible and the paper is clear about what it does, but the headline accuracy and line-rate claims currently outrun the evidence. I would send it to a serious referee and expect major revision, focusing first on the window-boundary question and the test-set-driven BO.","headline":"Genuinely novel partitioned-DT idea, but reported gains are undermined by test-set-driven model selection and an untested window-boundary mechanism.","tokens_in":25951,"tokens_out":3942,"would_cite":true,"duration_ms":41444,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SPLI DT splits decision trees into per-window subtrees and reuses switch resources, supporting up to 5x more stateful features at line rate with higher accuracy.","keywords":["in-network machine learning","programmable data planes","decision trees","stateful features","sliding window inference","packet recirculation","match-action tables","flow scalability"],"falsifier":"Run SpliDT on traffic where the flow-size header field is removed or randomized (for example, standard TCP without Homa or NDP) and compare F1 and flow capacity against the reported Pareto frontier; if accuracy falls to top-k levels or subtree transitions fail, the window-boundary assumption is the cause. Also instrument the actual switch to count recirculated control packets per flow at 1M flows under the Hadoop workload and verify that bandwidth stays at or below the reported <0.05% figure.","tokens_in":25062,"feed_emoji":"🌲","tokens_out":8838,"duration_ms":89929,"temperature":0.7,"pith_summary":"SPLI DT claims that the bottleneck for in-network decision trees is not switch hardware alone but the one-shot way trees are executed: every selected feature is computed up front and kept for the whole flow. By partitioning a tree into subtrees, giving each subtree its own feature set, and processing each flow in windows that trigger subtree transitions through packet recirculation, the same registers and match keys can be reused across the tree. On seven real-world traffic datasets, this yields up to 5x more unique stateful features than fixed top-k systems such as NetBeacon and Leo, with higher F1 scores at the same flow counts and support for millions of concurrent flows at line rate. The paper also contributes a Bayesian-optimization search that jointly picks tree depth, partition sizes, and per-subtree feature count to reach a chosen accuracy-versus-flows trade-off. If correct, it would remove the assumed conflict between feature richness and flow scalability in programmable data planes.","feed_headline":"Partitioned decision trees run 5x more features at line rate","feed_subtitle":"SpliDT splits trees into per-flow windows, reusing switch registers so accuracy and flow scale improve together.","key_machinery":"The partition: a group of consecutive decision-tree layers containing one or more subtrees, each with its own feature set of size k. Flows are processed one window per partition; a window boundary triggers a single recirculated control packet that updates the subtree ID, clears the dependency chain and the k feature registers, and starts the next partition. The Range Marking Algorithm maps each subtree's thresholds to compact ternary range marks so each leaf becomes one TCAM rule, and a Bayesian-optimization design search selects tree depth, partition sizes, and k to maximize F1 and supported flows under target hardware constraints.","core_discovery":"At the paper's center is a collect-and-predict abstraction: instead of computing a fixed global set of top-k features and traversing the whole decision tree in one pass, SpliDT splits the tree into partitions of subtrees, assigns each subtree its own subset of at most k features, and runs inference over sliding windows of packets. A flow enters at the root subtree, collects that subtree's features during the first window, predicts the next subtree ID, and recirculates one control packet to switch the active subtree and reset the feature registers. This time-sharing lets the data plane reuse the same k stateful register slots and match keys across the tree, so the total number of unique featu","pith_inferences":["The window-boundary mechanism depends on flow-size header fields from transports such as Homa and NDP; applying SpliDT to ordinary TCP would require an external way to estimate flow progress, which the paper leaves as future work.","The reported 5x feature scaling relies on feature sparsity across subtrees (roughly 6-10% of features needed per subtree in the evaluated datasets); models with dense per-subtree feature usage would gain less.","The same partition-and-recirculate strategy could extend to random forests or other stateful models, but the paper does not evaluate that setting.","Adaptive window sizing, listed as future work, could change the Pareto frontier for bursty traffic since fixed windows currently constrain both accuracy and resource efficiency."],"forward_implications":["Data-plane decision trees can use many more stateful features than the top-k limit, because only the active subtree's k features occupy registers at any given time.","Accuracy and flow scalability can improve together: SpliDT reports higher F1 at 100K, 500K, and 1M flows than fixed top-k models across all seven evaluated datasets.","Recirculation overhead stays bounded and small (<0.05% of bandwidth in the worst case), so the partitioned loop preserves line-rate operation and matches baseline time-to-detection.","Each leaf maps to a single TCAM rule via range marking, keeping rule count manageable even as the number of subtrees and unique features grows.","The design search yields a Pareto-optimal configuration per dataset and hardware target, letting operators choose where to sit on the accuracy-versus-flows curve."],"supporting_citations":[{"why":"NetBeacon is the main state-of-the-art baseline SpliDT must beat and supplies the Range Marking Algorithm used to encode subtree rules as TCAM entries.","marker":"[85]"},{"why":"Leo is the other state-of-the-art data-plane DT baseline with top-k stateful features that SpliDT compares against.","marker":"[43]"},{"why":"Homa provides the receiver-driven transport whose flow-size header fields SpliDT relies on to detect window boundaries.","marker":"[52]"},{"why":"NDP is the second modern transport cited for embedding flow size information in packet headers, enabling window termination in the data plane.","marker":"[37]"},{"why":"HyperMapper is the Bayesian optimization engine used to search the tree-depth, partition, and feature-allocation design space.","marker":"[53]"},{"why":"The Tofino switch defines the register, TCAM, and pipeline-stage constraints used in feasibility testing and flow-count estimation.","marker":"[41]"}],"fun_headline_variants":["Sliding-window trees give in-network ML 5x more features","SpliDT reuses registers to fit 5x more stateful features","Partitioned trees + recirculation = 5x feature scale","Decision trees that slide: 5x feature scale at line rate"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The load-bearing premise is that the switch can reliably determine where each flow's window ends from packet-header flow-size information; the paper assumes modern transports such as Homa and NDP expose this, and its own limitations section notes that if the field is absent or spoofed, window boundaries can be wrong and the partitioned inference loop can break.","fun_headline_variants_meta":{"raw":{"variants":["Sliding-window trees give in-network ML 5x more features","SpliDT reuses registers to fit 5x more stateful features","Partitioned trees + recirculation = 5x feature scale","Decision trees that slide: 5x feature scale at line rate"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000287,"raw_usage":{"total_tokens":1579,"prompt_tokens":857,"completion_tokens":722,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":601,"completion_tokens_details":{"reasoning_tokens":643}},"tokens_in":601,"tokens_out":722,"duration_ms":8362,"temperature":1.0,"reasoning_tokens":643,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T13:37:33.940288+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SpliDT on traffic where the flow-size header field is removed or randomized (for example, standard TCP without Homa or NDP) and compare F1 and flow capacity against the reported Pareto frontier; if accuracy falls to top-k levels or subtree transitions fail, the window-boundary assumption is the cause. Also instrument the actual switch to count recirculated control packets per flow at 1M flows under the Hadoop workload and verify that bandwidth stays at or below the reported <0.05% figure.","supporting_citations":[{"cited_title":"An Efficient Design of Intelligent Network Data Plane","cited_arxiv_id":null,"evidence_quote":"NetBeacon is the main state-of-the-art baseline SpliDT must beat and supplies the Range Marking Algorithm used to encode subtree rules as TCAM entries."},{"cited_title":"Leo: Online ML-based Traffic Classification at Multi-Terabit Line Rate","cited_arxiv_id":null,"evidence_quote":"Leo is the other state-of-the-art data-plane DT baseline with top-k stateful features that SpliDT compares against."},{"cited_title":"Homa: A Receiver-Driven Low-Latency Transport Protocol Using Network Priorities","cited_arxiv_id":null,"evidence_quote":"Homa provides the receiver-driven transport whose flow-size header fields SpliDT relies on to detect window boundaries."},{"cited_title":"Moore, Gianni Antichi, and Marcin Wój- cik","cited_arxiv_id":null,"evidence_quote":"NDP is the second modern transport cited for embedding flow size information in packet headers, enabling window termination in the data plane."},{"cited_title":"Algorithmic Performance- accuracy Trade-off in 3D Vision Applications using Hyper- mapper","cited_arxiv_id":null,"evidence_quote":"HyperMapper is the Bayesian optimization engine used to search the tree-depth, partition, and feature-allocation design space."},{"cited_title":"Tofino: P4-programmable Ethernet switch ASIC that delivers better performance at lower power","cited_arxiv_id":null,"evidence_quote":"The Tofino switch defines the register, TCAM, and pipeline-stage constraints used in feasibility testing and flow-count estimation."}],"review_version":1}