{"id":"d6b79bc9-23fd-43dc-9edd-7d8cee23ad81","arxiv_id":"2608.11291","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A dueling DQN trained as a label-reward classifier on CIC-IDS2018 reports 99.68% average accuracy, but without a held-out test set the accuracy is an in-sample score.","lead":"This paper applies a dueling deep Q-learning network to classify network attacks in the CIC-IDS2018 dataset, reporting 99.68% average accuracy. The result is weakened because the model was evaluated on the same environment it was trained in, and the web attack class was excluded.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 99.68% accuracy is computed in-sample: Section V admits the model was trained and evaluated in the same environment, so the reported number cannot support the claimed generalization to unseen traffic.","rationale":"The reader's weakest_assumption identified exactly the load-bearing concern: no held-out test set, with the paper itself admitting same-environment evaluation. My reading confirms this from multiple textual locations: Section V's limitation statement, Table V's full-dataset sample counts, and the absence of any split in the methodology. The 99.68% number is the basis for the abstract, the conclusion, and Table IV's comparison, so the central claim as a statement about intrusion detection performance on unseen traffic is unsupported. I also note that the reward function uses ground-truth labels, making this effectively a supervised classifier, but the in-sample evaluation alone is sufficient to keep the reader's REJECT verdict. No change to the verdict is needed.","tokens_in":7463,"tokens_out":3035,"duration_ms":29659,"concrete_test":"Re-run the experiment with a strict temporal split: sort CIC-IDS2018 flows by timestamp, train on the first 80% of each day and test on the last 20% (or hold out whole days), retrain the dueling DQN with the same architecture, hyperparameters, and reward function, and report weighted accuracy and per-class F1 on the held-out partition. Include a random forest trained on the same training split as a supervised baseline. If the held-out accuracy is materially below 99.68%, or if the DQN is not competitive with the supervised baseline, the central generalization claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is an average accuracy of 99.68% across attack classes (Abstract; Section IV.A). The load-bearing condition is that this number measures classification performance on unseen traffic, as implied by the Table IV comparison to prior work. That condition is not met anywhere in the manuscript. Section V states: \"This model was trained and evaluated in the same environment it was rained in [sic].\" No train/test split, cross-validation, or temporal partition is described in Section III or Section IV. Table V reports sample counts equal to the full dataset sizes from Table I, and the weighted accuracy of 0.99684 matches the in-sample prediction accuracy. The Web attack class is excluded post-hoc (Section IV.A), changing the reported class set after seeing results. Additionally, the reward function in Section III.B depends on the true label l_t in both correct and incorrect branches, so the \"reinforcement learning\" report is effectively measuring a supervised classifier scored on the same flows used for training. Without a held-out evaluation protocol, the 99.68% number is an in-sample fit, and every comparison in Table IV inherits that defect.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a dueling deep Q-network (Dueling DQN) for network intrusion detection, trained on the CIC-IDS2018 dataset, and reports an average accuracy of 99.68% across multiple attack types. The authors also integrate SHAP for explainability. The main claim is that this reward-based, dueling Q-learning approach outperforms prior RL-based IDS methods. However, the evaluation is performed in the same environment used for training, as acknowledged in Section V, and no held-out test set or cross-validation is described. The Web attack class is excluded post hoc after showing zero performance, and the reward function is based on the true class label, making the approach functionally similar to supervised classification.","tokens_in":7700,"tokens_out":4082,"duration_ms":38125,"significance":"If the claimed performance were supported by a rigorous evaluation, the paper could make a useful contribution to RL-based intrusion detection by demonstrating the dueling architecture's effectiveness on a modern benchmark. The SHAP analysis also provides interpretability, which is valuable. However, the central accuracy claim is currently unsupported because the evaluation is in-sample. The paper ships no code and reports no error bars, and the comparison to prior work is confounded by differing datasets and protocols. As presented, the manuscript does not establish its main contribution.","major_comments":[{"comment":"The paper explicitly states that the model was trained and evaluated in the same environment, and no train/test split, temporal partition, or cross-validation is described anywhere in Sections III or IV. The 99.68% accuracy reported in Table V and the Abstract is therefore an in-sample fit, and the comparisons in Table IV are not valid evidence of generalization. This is load-bearing because every performance claim rests on this number. The authors must re-run the experiments with a held-out test set (ideally a temporal split, given the sequential nature of the data) and report error bars or confidence intervals.","section":"Section V, 'Deployment in Real-World Scenarios'"},{"comment":"The Web attack class is excluded from the reported average after observing its performance, which is exactly zero (precision, recall, and F1-score are 0.0000). This post-hoc exclusion changes the class set and inflates the reported average accuracy. The authors should either include the Web attack class with appropriate class-balancing techniques or report results for all classes without selective removal, and justify any exclusion a priori.","section":"Section IV.A, Table V"},{"comment":"The reward function depends directly on the true label l_t in both the correct and incorrect branches. Consequently, the learning signal is the ground-truth class label, and the agent is effectively performing supervised classification with a shaped reward rather than learning from environment feedback. This undercuts the paper's framing as a reinforcement learning approach that can adapt to new attack types. The authors should clarify how this differs from a standard classifier and provide evidence of adaptation to unseen attacks, such as evaluating on attack types not seen during training.","section":"Section III.B, Reward Calculation"},{"comment":"The comparison with prior work is not meaningful because the studies use different datasets (e.g., NSL-KDD vs. CIC-IDS2018), different class sets, and likely different evaluation protocols. Table IV cannot support the claim of state-of-the-art performance. The authors should compare on the same benchmark with identical train/test partitions, or explicitly discuss the limitations of cross-study comparisons.","section":"Table IV"}],"minor_comments":[{"comment":"The sentence 'This model was trained and evaluated in the same environment it was rained in' contains a typo: 'rained' should be 'trained'.","section":"Section V"},{"comment":"The caption reads 'Explainability resutls for DQN Decision Making'; 'resutls' should be 'results'.","section":"Figure 5 caption"},{"comment":"The paper mentions that there are over 80 features, but Table III lists only seven. Please clarify the full feature set used by the model and whether feature selection was applied.","section":"Table III"},{"comment":"The diagram in Algorithm 1 contains labels '1' and '5' that are ambiguous; please provide a clear legend or textual description of the architecture dimensions.","section":"Algorithm 1"},{"comment":"Reference [9] appears to have an incomplete or incorrectly formatted DOI (10.1109/ICCS.2023.983451); please verify and correct the citation details.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to be a lightly revised version of a conference paper (IEEE SoutheastCon 2025). For a journal submission, the evaluation standards are much higher, and the present in-sample evaluation is a fundamental shortcoming. I would consider the paper only after a proper held-out evaluation is added, the Web attack class is handled transparently, and the comparison to prior work is made on a compatible basis. If the authors cannot provide such evidence, the paper should not be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper is a competent combination of dueling DQN and SHAP on CIC-IDS2018, and the authors are refreshingly honest about their limitations — but that honesty reveals that the 99.68% accuracy is measured on the training environment. That number should not be compared to held-out results in prior work.\n\nWhat's new: combining dueling Q-networks with a label-based reward on this dataset is a legitimate extension, not a conceptual advance. The architecture is clearly described, the dataset is standard, and the SHAP analysis is a nice touch. The comparison to Alavizadeh et al. [8] is interesting but flawed because it uses a different dataset and an in-sample number.\n\nSoft spots: the evaluation protocol is the load-bearing issue. Section V says the model was trained and evaluated in the same environment; no test split, cross-validation, or temporal split is mentioned. Table V's sample counts match Table I, so the reported accuracy is an in-sample fit. The web attack class (173 samples) scores 0.0 and is excluded post-hoc; that is cherry-picking, even if the sample size is small. The reward function uses the true label in both branches, so this is a supervised classifier trained with a DQN wrapper; calling it reinforcement learning is a stretch. The SHAP analysis is mostly qualitative — no quantitative validation that the features are causal or align with known attack patterns.\n\nThe citation pattern is fine; the related work is relevant and the prior claims are fairly represented. The writing is clear and the limitations are stated openly, which is more than many papers do.\n\nBottom line: the paper is not ready as a claim about IDS performance. With a proper held-out evaluation it could be a solid workshop paper. As it stands, the abstract overstates what the data supports. I'd recommend a serious referee, but with a strong request for a real train/test split and a pre-registered class-inclusion policy.","headline":"A cleanly-written engineering paper whose headline accuracy is in-sample; the evaluation protocol undercuts the main claim.","tokens_in":8276,"tokens_out":1919,"would_cite":false,"duration_ms":18003,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A dueling deep Q-network trained with reward-based learning reports 99.68% average accuracy in classifying CIC-IDS2018 network attacks, above earlier DQN-based intrusion detection systems.","keywords":["intrusion detection","reinforcement learning","dueling deep Q-network","CIC-IDS2018","SHAP","cybersecurity","threat hunting","multiclass classification"],"falsifier":"Retrain the model on a proper training split of CIC-IDS2018 and evaluate on a held-out split, such as a different week of traffic, then compare that accuracy with the reported 99.68%; also recompute the average with the 173 web attack samples included, since the reported number excludes the one class where the model scores zero.","tokens_in":7296,"feed_emoji":"🛡️","tokens_out":13026,"duration_ms":104031,"temperature":0.7,"pith_summary":"This paper argues that a reward-based dueling deep Q-network can serve as an intrusion detection classifier, and reports that it reaches 99.68% average accuracy across the attack types in the CIC-IDS2018 dataset. The authors frame this as an improvement over prior Q-learning-based intrusion detection work, which reached about 88% accuracy, and as competitive with supervised models such as random forest. The paper also integrates SHAP to identify which flow features drive the model's decisions. The authors explicitly note that the model was trained and evaluated in the same environment, so the 99.68% figure is an in-sample report; the claimed adaptability to new attack types is not tested in the experiments described.","feed_headline":"Dueling Q-network hits 99.68% accuracy on attack detection","feed_subtitle":"A reward-based AI model matches top supervised detectors on a standard traffic benchmark, if that in-sample accuracy holds.","key_machinery":"The load-bearing object is the dueling deep Q-network, which decomposes the action-value function as $$Q(s,a)=V(s)+\\left(A(s,a)-\\frac{1}{|A|}\\sum_{a'}A(s,a')\\right)$$ so that one stream learns the value of a state $V(s)$ and another learns the relative advantage $A(s,a)$ of each action. The two streams share two hidden layers of 128 and 64 units with batch normalization and ReLU activations, then split into a value head and an advantage head. The environment treats each network flow as a state, and the reward is $r_t=+1\\cdot S_l\\cdot C_a+\\min(0.5\\log(\\text{streak}),2.0)$ for a correct action and $-1\\cdot S_l\\cdot C_a$ for an incorrect one, where $S_l$ is a severity weight and $C_a=0.5+\\text{confidence}/2$ scales with the network's confidence. The dueling decomposition is what the paper credits for stable and efficient learning; the shaped reward is what turns classification into a Q-learning problem.","core_discovery":"The paper's central claim is that a dueling deep Q-network, trained with a reward function built from true labels, classifies network flows in the CIC-IDS2018 dataset with a weighted average accuracy of 99.68%, with per-class F1 scores above 0.99 for the five classes with enough samples; the web attack class, with only 173 samples, is excluded from the main analysis. The authors attribute the improvement over earlier DQN-based IDS work to the dueling architecture's separate value and advantage streams and to the larger training set of 2,177,804 samples. SHAP analysis shows that decisions rest on features such as RST flag count, PSH flag count, backward packet length, initial window bytes, ACK flag count, and byte and packet rates.","pith_inferences":["Because the paper reports no held-out test set, the 99.68% figure is best interpreted as training-environment accuracy; any statement about detecting unseen traffic needs a separate evaluation split.","The reward is assigned from the true label of each flow, so the model is functionally a supervised classifier with a shaped reward; the paper's claimed advantage in adapting to novel attacks is not demonstrated by the reported experiments.","The streak bonus in the reward encourages the agent to keep outputting its current prediction, which could inflate accuracy on long contiguous runs of similar traffic; shuffled or stream-based evaluation would reveal how much this mechanism contributes.","A direct ablation comparing dueling DQN with plain DQN and with a supervised MLP on identical data would isolate whether the dueling structure or the larger sample count explains the jump from the 88% baseline."],"forward_implications":["A reward-based dueling DQN can match the accuracy of the best supervised models on CIC-IDS2018, making reinforcement learning a viable alternative for multiclass intrusion detection.","Because the reward uses per-class severity weights, the same architecture can be tuned to penalize missed high-severity attacks more heavily without changing the network structure.","The SHAP feature attributions provide a feature-level account of each classification, which could make RL-based detections more auditable when deployed.","Training on 2.18 million samples shows the approach scales to large datasets, though the authors acknowledge added computational cost over supervised classifiers."],"supporting_citations":[{"why":"Reports 88% accuracy for a DQN-based intrusion detection system, the earlier RL baseline the paper claims to outperform.","marker":"[8]"},{"why":"Achieves 99% accuracy with a random forest classifier on CIC-IDS2018, the supervised baseline showing the proposed result is comparable.","marker":"[10]"},{"why":"Introduces the deep Q-network algorithm with experience replay and target networks, the foundation of the agent's learning procedure.","marker":"[11]"},{"why":"Proposes the dueling architecture that separates value and advantage streams, the core mechanism under test.","marker":"[12]"},{"why":"Created the CIC-IDS2018 dataset used for all training and evaluation.","marker":"[13]"},{"why":"Achieves 98.36% accuracy with tree-based ensemble classifiers on CIC-IDS2018, another supervised baseline the paper compares against.","marker":"[14]"},{"why":"Supplies the SHAP-based explainability method used to attribute the agent's decisions to input features.","marker":"[16]"}],"fun_headline_variants":["Reward-based dueling Q-net detects attacks at 99.68% accuracy","Dueling Q-learning matches top IDS accuracy at 99.68%","Explainable AI sheds light on dueling Q-network's attack detection","Dueling DQN with SHAP explains intrusion detection decisions","99.68% accuracy: dueling deep Q-network for intrusion detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that accuracy measured in the same environment used for training is a valid report of detection performance; the paper states this was the setup and no held-out evaluation is described.","fun_headline_variants_meta":{"raw":{"variants":["Reward-based dueling Q-net detects attacks at 99.68% accuracy","Dueling Q-learning matches top IDS accuracy at 99.68%","Explainable AI sheds light on dueling Q-network's attack detection","Dueling DQN with SHAP explains intrusion detection decisions","99.68% accuracy: dueling deep Q-network for intrusion detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000722,"raw_usage":{"total_tokens":3200,"prompt_tokens":865,"completion_tokens":2335,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":481,"completion_tokens_details":{"reasoning_tokens":2237}},"tokens_in":481,"tokens_out":2335,"duration_ms":17634,"temperature":1.0,"reasoning_tokens":2237,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:12:26.984541+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Retrain the model on a proper training split of CIC-IDS2018 and evaluate on a held-out split, such as a different week of traffic, then compare that accuracy with the reported 99.68%; also recompute the average with the 173 web attack samples included, since the reported number excludes the one class where the model scores zero.","supporting_citations":[{"cited_title":"Op- timizing intrusion detection systems in three phases on the cse-cic- ids-2018 dataset.MDPI Computers, 12(12):245, 2023","cited_arxiv_id":null,"evidence_quote":"Achieves 99% accuracy with a random forest classifier on CIC-IDS2018, the supervised baseline showing the proposed result is comparable."},{"cited_title":"Human-level control through deep reinforcement learning.Nature, 518(7540):529–533, 2015","cited_arxiv_id":null,"evidence_quote":"Introduces the deep Q-network algorithm with experience replay and target networks, the foundation of the agent's learning procedure."},{"cited_title":"Sharafaldin, A","cited_arxiv_id":null,"evidence_quote":"Created the CIC-IDS2018 dataset used for all training and evaluation."},{"cited_title":"Intrusion detection system development using tree-based machine learning algorithms.International Journal of Computer Networks & Communications, 15(4):73–85, 2023","cited_arxiv_id":null,"evidence_quote":"Achieves 98.36% accuracy with tree-based ensemble classifiers on CIC-IDS2018, another supervised baseline the paper compares against."},{"cited_title":"Beechey, T","cited_arxiv_id":null,"evidence_quote":"Supplies the SHAP-based explainability method used to attribute the agent's decisions to input features."}],"review_version":1}