# Bridging High-Level Intent and Network Execution: Detecting Violations and Intent Drift Through Low-Level Traffic Analysis

arXiv: https://arxiv.org/abs/2606.05076 · HTML: https://mlsanity.com/paper/2606.05076/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Jun 2026.

## Built on by (most cited first, 2 of 2)

- [Engineering Trustworthy Agentic AI for Critical Systems](https://mlsanity.com/paper/2607.18548/) (2026)
- [SoK: Semantic Decision Engines in Network Control Loops](https://mlsanity.com/paper/2610.06425/) (2026)

## Abstract (arXiv)

Intent-Based Networking (IBN) structures a core management pillar for autonomous 6G networks by translating high-level administrative goals into autonomous configurations, yet a critical validation gap persists between declarative intent and data-plane execution. This paper investigates this gap by formalizing low-level flow headers into standardized 7-tuple vectors, establishing an Internal Low-Level Intent (ILI) telemetry interface. Leveraging an empirical dataset of 100.91 million flow records from a distributed honeynet, we evaluate three administrative policy regimes (Strict, Balanced, and Permissive) across two metrics: Policy Violations (V) and Intent Drift (D). Our results expose a distinct Compliance Paradox where widening policy permissiveness systematically suppresses violation counts, yet underlying operational intent drift remains mostly invariant. This demonstrates that conventional, violation-centric tracking are unreliable. Furthermore, an empirical case study show that ILI metrics structural violations can inform closed-loop orchestrators to dynamically recalculate and enforce low-level rules that maintain high-level operational intent.