Novel Attacks Arrive Diffuse: Rethinking Few-Shot Open-Set Enrollment for ROS Intrusion Detection

The paper’s central contribution is showing that single-prototype enrollment in few-shot open-set recognition has a geometric ceiling that more labels cannot lift — novel-class F1 actually declines with support size, and an oracle prototype built from all 4,326 novel flows matches the 100-shot result exactly, ruling out sampling error. The diagnosis generalizes beyond ROS: because the episodic loss never shapes the unseen class, it arrives 2–4× more diffuse than trained classes and its mean falls inside a rival class basin. The fix is cheap and follows directly — enrolling three k-means sub-prototypes instead of one raises mean novel-class F1 from 0.694 to 0.862 with no retraining.