What DGA Detectors Actually Compute: An Effective-Operator Analysis of Hybrid and Quantum-Inspired Architectures

Abstract—Architectural labels (“quantum-inspired,” “graph-convolutional,” “diffusion-conditioned”) do not guarantee a correspondingly rich effective computation. We introduce a code-faithful effective-operator framework that determines what an implemented component actually computes, how many of its parameters are functionally effective, and what information it discards. Applied to four character-level Domain Generation Algorithm (DGA) detectors, it yields exact characterizations: the quantum-inspired phase layer is a gain-scaled ReLU (ηeff = 0.985); the 128-node chain graph-convolutional network (GCN) is a frozen, singular three-tap filter; and the simulated variational quantum circuit (VQC) is a closed-form polynomial with effective dimension 525 of 1,594 (ηeff = 0.329); all three characterizations are confirmed by independent numerical computation. A decision-theoretic analysis covers excess risk, calibration, prior shift, and cost-sensitive operation. On a balanced held-out set of 48,000 domains, accuracy is 94.7–96.3%, yet at prevalence 10−3 fewer than 3% of alerts are genuine. These numbers come from a single seed and are provisional; a multi-seed validation protocol is specified but not executed. Results concern the specific implementations studied; the simulated VQC provides no evidence of quantum advantage. Index Terms—domain generation algorithm, effective operator, graph convolution, null space, prior shift, statistical decision theory, variational quantum circuit