Learning a baseline: AI-driven anomaly detection on one Mac

Every anomaly detector needs a definition of normal. In a large network, normal is learned from thousands of machines. On a single Mac, normal is personal: the apps one person uses, the services they reach, the hours they work. A model that learns this baseline can answer the routine questions itself and save the person’s attention for what is genuinely new.

Where the baseline comes from

There are two broad ways to learn what is normal. The first is to observe: record which destinations each app contacts, from which countries, at what times, and treat departures as signals. The second is to learn from decisions: every time the person allows or blocks a connection, the model learns what they consider acceptable. The second is more direct, because it learns the person’s intent rather than guessing it from traffic, but it depends on the quality of those decisions.

Why baselines are fragile

• Drift: normal changes. A new job, a new app or a trip abroad makes yesterday’s baseline wrong.
• Poisoning: if something harmful is allowed during learning, it becomes part of normal. NIST’s AI Risk Management Framework lists the integrity of training data among the risks to manage.
• Self-reinforcement: a model that learns from its own past decisions can drift further and further from what the person actually wanted.
• Overconfidence: a model that acts silently on uncertain cases turns a small error into an invisible one.

How FireAI’s Autopilot handles this

Autopilot is one of FireAI’s operating modes, next to Alert, Silent – allow and Silent – deny. It uses FireAI’s own built-in decision model, which runs on the Mac and needs no download. It is a different system from the optional language model used by Ask FireAI: it never writes text, it only decides allow, deny or ask for a connection.

It starts from cautious, hand-set defaults and adjusts from your own answers and corrections over time. FireAI also keeps each app’s history, such as destinations and countries it usually contacts, and a first connection to a new place counts as one of the signals in its risk score (lesson 3). Several safeguards address the fragility listed above:

• It only answers on your behalf when it is confident; anything less still shows you a prompt, with its suggestion.
• It never learns from its own decisions, only from yours, which prevents self-reinforcement.
• It never auto-allows an unsigned app because it resembles another one, and a broken code signature always goes to the full check instead of a shortcut.
• Every confident decision becomes a visible rule in an “Autopilot” group, with a confidence value and a short reason in Suggestions.
• Undo removes the rule and teaches the opposite; “Forget What FireAI Learned” resets what it has learned from your corrections and habits.

The principle: automation you can audit

The safest automated defence is not the one that decides the most, but the one whose decisions are visible and reversible. A baseline model earns trust by being right on the boring cases, being honest about uncertainty, and leaving a trail you can inspect. When you design or evaluate any AI-driven security tool, ask three questions: what does it learn from, what happens when it is unsure, and how do I undo what it did?

Applied to FireAI, those questions have concrete answers you can check yourself. Open Suggestions during the first days and read the Autopilot group: each rule shows its confidence and a reason. If a decision is wrong, click Undo; the rule disappears and Autopilot learns the opposite. If you believe its learned habits are no longer right, for example after lending the Mac to someone or changing jobs, “Forget What FireAI Learned” clears what it learned from your corrections and habits, after asking you to confirm. A baseline you can inspect, correct and reset is one you can trust with the boring decisions. The same test applies to any product you evaluate, from a spam filter to an enterprise detection platform: if you cannot see what it learned, correct it, or wipe it and start again, you are trusting a model you have no way to audit, and a quiet mistake in its baseline can last for months.