A Deployment-Oriented Framework for Explainable AI-Assisted eBPF/XDP Mitigation at the IoT Edge

AI performance in labs doesn't guarantee real-world safety: The authors emphasize that "offline artificial intelligence benchmark performance alone does not establish operational deployability," highlighting a critical gap between how AI systems perform in controlled testing and how they function when protecting actual IoT devices in production environments.

Explainability is essential for deployment trust: The framework requires "event-level explainability" alongside AI risk scoring, recognizing that security teams need to understand why the system made decisions (not just that it did) before trusting it to protect critical infrastructure—a key principle for responsible AI in high-stakes settings.

Safety guardrails must protect critical devices: The system includes "critical-device safeguards" and applies only "reversible, time-limited actions," meaning the AI cannot permanently disable devices and must be able to undo its decisions. This prevents a malfunctioning AI from causing irreversible harm to essential IoT equipment.

Resource constraints demand practical AI design: Rather than deploying complex AI models directly on weak devices, the architecture "separates complex reasoning and policy control in user space from concise packet-handling decisions in the kernel," ensuring AI-assisted security doesn't overwhelm the limited computing power of IoT devices.

Comprehensive evaluation requires more than accuracy metrics: The authors call for evaluation covering "detection quality, resource cost, response timing, rollback behaviour, and legitimate-traffic preservation"—acknowledging that responsible deployment demands testing beyond just whether the system catches threats, including whether it maintains system performance and doesn't block legitimate users.