Anomaly Radar
2. Anomaly Radar
The Anomaly Radar is a two-dimensional scatter plot visualization of all events where the L3 engine was triggered. It allows operators to visually identify clusters of high-risk behavioral anomalies.
2.1 Scatter Plot
Each point on the chart represents a single L3-escalated event. The axes are:
- X-axis — Semantic Shift (L1) % — How far the interaction drifted semantically from the guard's baseline policy (0–100%)
- Y-axis — Syntactic Drift (L2 Proxy) % — A derived metric representing syntactic/structural deviation from expected output patterns (0–100%)
Color Coding by Severity
| Color | Severity | Threshold |
|---|---|---|
| Red | Critical | L1 > 80% AND L2 proxy > 80% |
| Orange | High | L1 > 70% OR L2 proxy > 70% |
| Copper | Medium | L1 > 40% OR L2 proxy > 40% |
| Gray | Low | Below all thresholds |
2.2 Tooltip
Hovering over any scatter point shows a tooltip with: - Anomaly ID - Severity badge - Guard name - Semantic Shift (L1) % - Syntactic Drift (L2 Proxy) % - Detection time (UTC)
2.3 Filtering
The Anomaly Radar supports filtering by: - Guard — Show only anomalies from a specific guard kernel - Severity — Filter by critical, high, medium, or low - Search by Anomaly ID — Locate a specific event in the scatter plot
2.4 Empty State
If no L3-triggered anomalies exist in the current filter set, the chart displays an empty state message confirming that the system is healthy and no anomalies are currently detected.