The Specificity Floor: Dual-Use Detection Is an Information Problem, Not a Model Problem

Living-off-the-land / dual-use activity is the hard core of intrusion detection: a benign administrator and an attacker run the same tools, and on host telemetry their events can be shaped identically. We show that separating them is an information problem, not a model problem — the distinguishing signal is not present in host telemetry. We define a specificity floor and test whether a reproduced state-of-the-art provenance-graph detector (FLASH)'s residual dual-use false positives can be cut by host-derived context at matched true-positive rate, on two independent external datasets (DARPA OpTC and DARPA TC E3 Cadets). A pre-registered acceptance gate returns moved:false on both. We show, as a proof-of-mechanism only, that an out-of-band change-approval signal moves the floor on a live fleet — but its effect size is unmeasured, because no public dataset carries the out-of-band signal. The code, data pointers, and a full self-audit that shrank an over-claim and then re-strengthened it are in the linked repository. The paper cites state-of-the-art detection, vuln-discovery, and repair engines as integrated baselines it does not beat.