A Computational Framework for Dark-Vessel Screening: Integrating SAR–AIS Fusion, OSINT, and Social Network Analysis

Abstract

Vessels disabling their Automatic Identification System (AIS) transponder evade AIS-based analytics. We present a framework for maritime dark-vessel screening—auditable candidate attributions for analyst review—coupling synthetic aperture radar (SAR) detection, AIS–SAR association, open-source intelligence (OSINT), and social network analysis (SNA). A Dynamic Kinematic Gate (DKG) grows its radius with speed and AIS staleness, up to 50 km, and demotes stale unmatched AIS to a low-confidence class. On 200 synthetic scenes, it raises true-match recall from 0.65 (capped static gate) to 0.88 and cuts spoofing alerts 4.1-fold via demotion; a fixed 10 km gate reaches 0.91 with fewer false confirmations, so the ceiling needs re-tuning. Re-benchmarked on five seeded SSDD folds with one evaluation code, YOLOv8s, YOLOv10s, and YOLOv11n reach a ship-class average precision (AP@0.50) of 0.940–0.955, on par with the deployed detector SLA-Net (Faster R-CNN with mask-attention and transformer modules; 0.938–0.941), whose two modules bring no significant gain. Without retraining, SLA-Net fails on inshore scenes of two other datasets (AP@0.50 $\le 0.19$). On a 12-day operational corpus the static-gate pipeline logs 3190 confirmed matches and 1606 dark detections; OSINT registry documents agree with the AIS-declared name for 90.1% and the flag for 71.8% of 2000 sampled vessels (consistency, not accuracy); a real one-month SNA graph shows no distinct bridge vessel. Attribution remains an analyst-adjudicated judgment.

1. Introduction

International regulations oblige vessels over 300 gross tons on international voyages to operate an Automatic Identification System (AIS) transponder that broadcasts identity and position without interruption [1]. Virtually every maritime domain awareness (MDA) analytic—from trajectory forecasting to behavioral anomaly detection—is built on the assumption that these cooperative broadcasts are present. Such methods, however, share a structural blind spot: they can only reason about vessels that are broadcasting. A vessel that switches its transponder off—whether through equipment failure or deliberate suppression to conceal position, cargo, or destination—disappears from every AIS-only analytic.

Non-cooperative sensing is therefore essential. Space-borne synthetic aperture radar (SAR) images vessels day or night and through cloud, independent of any transmission from the target. In a 12-day operational window over key Indo-Pacific and Middle Eastern corridors, the bidirectional fusion stage logged 3217 confirmed SAR–AIS matches and 1720 dark contacts, radar detections that had no AIS partner within the legacy static gate of that run (Section 4.2). These dark contacts, roughly one in three of the fusion-entered radar detections, are candidates for analyst review rather than confirmed non-broadcasting vessels, because a static gate can miss true AIS partners (Section Association Baselines and Gate Sensitivity). Detecting such a contact, however, is only the first step. Attribution—resolving who the vessel is, who owns it, and whether it belongs to a wider network of shell companies and shadow-fleet registries—is the harder and operationally decisive problem, and it cannot be solved from a radar echo alone.

Three obstacles stand between a SAR detection and an actionable dark-vessel alert. First, association: a SAR detection must be matched to the correct AIS track (or determined to have none). Prior AIS–SAR fusion relies on static distance gates of 2–5 km [2,3]; such a gate is simultaneously too small for fast vessels whose last AIS report is hours stale and too large in dense port approaches, where it merges unrelated contacts. The Dynamic Kinematic Gate proposed here therefore grows the acceptance radius with AIS staleness, but only up to a fixed ceiling $g_{\max }=50$ km, which a vessel at the assumed maximum surface speed $v_{\max }=30$ kn (15.43 m/s) reaches after about 0.9 h of AIS silence (Section 3.3). Longer gaps are not absorbed by enlarging the radius. Instead, an AIS broadcast left unmatched after assignment whose last report is more than 3 h older than the SAR pass is routed to a low-confidence temporal-sparsity class, rather than raised as a spoofing alert, whenever a SAR detection lies within the distance the vessel could have covered at $v_{\max }$ (Section 3.4). Association radius and alert triage are thus separate mechanisms: a vessel that may legitimately have moved several hundred kilometers during a multi-hour gap is neither force-matched within the gate nor reported as a spoof. In the controlled evaluation of Section Association Baselines and Gate Sensitivity, the alert reduction is produced by this triage rule, not by the enlarged radius, and wide gates carry a measurable cost in false confirmations. Second, identity: association to a track yields an MMSI, but AIS identity is self-declared and readily falsified. Third, operator overload: under a static gate, the operational run produced more than 105,000 spoof candidates. We attribute this flood mainly to the time gap between the SAR pass and the last AIS position available to the platform, rather than to spoofing; the attribution is consistent with the controlled evaluation of Section 4.3 but was not verified record by record. Such a flood buries the few genuine threats.

This paper addresses all three obstacles with a single, auditable pipeline (Figure 1) and makes the following contributions.

Figure 1. End-to-end dark-vessel screening pipeline. Numbered stages: (1) Sentinel-1 SAR acquisition; (2) AIS ingestion and kinematic interpolation; (3) SLA-Net detection; (4) bidirectional Hungarian matching with the Dynamic Kinematic Gate; (5) OSINT enrichment; (6) Social Network Analysis; (7) analyst dashboard with human-in-the-loop review. Stage labels reflect the deployed implementation.

• A deployed Sea–Land-Aware detector design (SLA-Net), evaluated. SLA-Net augments a Faster R-CNN backbone with per-level Hierarchical Mask Attention (HMA) and a Global Transformer Bridge (GTB) for scene context and is deployed in the operational pipeline. A seeded five-fold ablation of the two modules (Faster R-CNN, +HMA, +GTB, and +HMA+GTB), with per-fold results, precision–recall curves, operating points, and latency, finds no significant benefit from either module: the ship-class AP@0.50 lies between 0.938 and 0.941 for all four configurations, and no paired comparison is significant after Holm correction (Section 4.1.1). A unified re-benchmark of YOLOv8s, YOLOv10s, YOLOv11n, and RT-DETR-l on the same folds with the same evaluation code places the backbone on par with the three YOLO models, which reach a ship-class AP@0.50 of 0.940–0.955; Faster R-CNN leads only in the three-class mAP, through the two rare population classes (Section 4.1.2).
• A Dynamic Kinematic Gate (DKG) for bidirectional Hungarian AIS–SAR association whose acceptance radius scales with vessel speed and AIS staleness under a physically defensible ceiling, combined with a temporal-sparsity rule that demotes stale unmatched AIS broadcasts. In a controlled, reproducible evaluation on 200 synthetic scenes, the DKG improves true-match recall by 23 percentage points over the legacy capped static gate ($0.650\to 0.878$) and reduces spurious spoofing alerts $4.1$-fold ($3107\to 764$); the alert reduction is produced by the demotion rule, not by the enlarged radius. Against ten further association baselines and a one-at-a-time parameter sweep, a fixed 10 km gate attains higher recall (0.909) with fewer false confirmations (391 versus 893), identifying the 50 km ceiling as the parameter to re-tune (Section Association Baselines and Gate Sensitivity). Hungarian assignment outperforms greedy nearest-neighbor association in dense clustered scenes (0.853 versus 0.793), but not in the mixed synthetic scenes (0.878 versus 0.903).
• An OSINT attribution layer that resolves a flagged vessel through its IMO number to 1,244,050 typed registry documents (628,718 distinct after removing a duplicate ingestion), and a Social Network Analysis (SNA) layer over five edge types with Louvain community detection, both implemented in the deployed service and characterized here on the operational data. On 2000 sampled vessels, the registry documents agree with the AIS-declared name for 90.1% and with the flag for 71.8% of the vessels whose flags can be compared. The deployed service synchronizes the OFAC sanctions list but does not match vessels against it; two offline name-based screeners recover 51.4% and 67.0% of the listed vessels found by IMO number. Rebuilt with the deployed edge rules over one month of Persian Gulf traffic (27,991 nodes), the SNA graph is dominated by port hubs and contains no distinct bridge vessel, a negative finding that leaves the bridge-vessel signal a design hypothesis. These are consistency, screening, and graph-structure measures, not attribution accuracy (Section 4.7 and Section 4.8).
• An engineering analysis with reproducible controlled evaluations—asymptotic and measured complexity, seeded controlled ablations with per-fold results, error analysis, and operational and ethical safeguards—with a transparent separation of the operational results, which are reported as recorded and could not be re-run, from the controlled evaluations, which were run with fixed seeds and whose scripts are supplied as Supplementary Material.

The novelty is not any single component but their integration: the system implements the loop adaptive (non-static) gated fusion → identity resolution → network context → alert prioritization, with human-in-the-loop review and audit trails; the identity and network stages are characterized on the operational data but not validated against adjudicated outcomes. AIS behavioral classification, trajectory forecasting, and Robust-Z anomaly scoring are treated in the companion paper; this paper is confined to non-cooperative detection, fusion, and attribution.

The remainder of this paper is organized as follows. Section 2 (Related Work) reviews SAR ship detection, remote-sensing foundation models, and AIS–SAR fusion and graph analysis, and identifies the gap addressed here. Section 3 (Materials and Methods) describes the data sources, SLA-Net, kinematic interpolation and the Dynamic Kinematic Gate, bidirectional Hungarian assignment, the OSINT and SNA layers, and the complexity model. Section 4 (Results) reports the detector benchmark, an ablation of the SLA-Net modules, a re-benchmark of the compared detectors under one evaluation protocol, detector latency and a latency-weighted score, the operational fusion outcomes, the controlled evaluations of the gate and the matcher, the measured assignment complexity, the OSINT consistency and sanctions-screening measurements, and the SNA graph of real traffic. Section 5 (Discussion) addresses operational implications, error analysis, a cross-dataset robustness test of the detector, limitations, safeguards, and deployment, and Section 6 (Conclusions) summarizes the findings and future work.

2. Related Work

2.1. SAR Ship Detection and Transformer Detectors

Constant false alarm rate (CFAR) detectors were the production standard for decades, but deep learning now dominates the SSDD and HRSID benchmarks. Recent work refines convolutional detectors for the small-object, low-signal regime typical of Sentinel-1: lightweight YOLO variants for small SAR ships [4], precision-oriented redesigns [5], explicit multi-scale fusion [6], texture-aware convolution with balanced sampling for robustness to speckle and clutter [7], and near-real-time detectors validated on Gaofen-3 [8]. A parallel thread imports Vision Transformer inductive biases into SAR: local-perception-enhanced Swin backbones [9], DETR variants hardened with edge enhancement and dilated context [10], feature-enhancement transformers for oriented multi-category ships [11], and nested/flow-aligned transformers for very small ships [12]. SLA-Net contributes two maritime-specific modules absent from these detectors: a sea–land mask that attenuates land clutter inside the feature pyramid, and a transformer bridge that supplies scene-level context to a two-stage detection head, a design motivated by the expectation that precision, not raw recall, governs downstream fusion quality. Section 4.1.1 tests whether these modules improve detection, and Section 4.1.2 compares the two-stage detector with single-stage and transformer detectors under one evaluation, which does not support that expectation.

2.2. Foundation Models for Remote Sensing and SAR

Self-supervised pretraining increasingly supplies the representation backbone for MDA. Scale-aware masked autoencoding for multiscale geospatial imagery [13], spectral/EO foundation models [14], multimodal Earth-observation models [15,16], and SAR-native pretraining—a general SAR target-recognition model [17], radiometric/scale-aware SAR masked autoencoding [18], and an ocean-scene SAR foundation model [19]—all transfer well to SAR recognition with limited labels. These models improve where and what a ship is, but remain recognition- and detection-centric: none fuse SAR with AIS kinematics, reason about identity laundering, or provide the relational context needed for attribution.

2.3. AIS–SAR Fusion, Multimodal Maritime Intelligence, and Graph Analysis

Classical fusion associates AIS positions to SAR contacts with fixed distance thresholds and bipartite (Hungarian) assignment [2,20]. Recent multimodal work reports high cross-modal association accuracy—optical/SAR fusion surveys and systems [21,22], an improved multi-feature association method for dark-ship detection between remote-sensing images and AIS [3], graph-learning-driven multi-vessel association [23], and adaptive multimodal trajectory prediction [24]. Two recent systems target dark vessels directly. FusionDark [25] probabilistically fuses Sentinel-1 IW GRDH detections with AIS tracks over the North-East Atlantic, is evaluated on the MMDEC benchmark (230 scenes, 13,306 detections, 19.0 million AIS messages, and 25,130 vessels), ranks anomalies (dark vessels, AIS ghosts, and suspicious matches) with a FusionDark Score, analyzes them spatially against marine protected areas and cable infrastructure, and is validated against SECMAR operations. DarkVesselNet [26], available only as a preprint that has not been peer reviewed, combines Sentinel-1 SAR and Sentinel-2 optical imagery through geospatial foundation-model backbones with AIS trajectory and gap reasoning and an anomaly head. A distinct stream applies graph neural networks and complex-network analysis to AIS trajectories and shipping structures: hybrid GNNs for behavior recognition [27], temporal graph convolutional networks for congestion and prediction [28], community analysis of shipping networks [29,30], and route/pattern mining from massive AIS [31,32,33,34]. Surveys confirm multimodal fusion and anomaly detection as the field’s frontier [35,36].

Table 1 situates representative recent work along the dimensions that matter for dark-vessel attribution. Two gaps recur. First, image/AIS fusion terminates at detection or association: it answers “is there a vessel and which track is it,” not “who is it and what network does it belong to.” Second, the graph/network stream characterizes aggregate traffic or trade communities rather than resolving the identity of a specific suspicious hull. These two dark-vessel systems are the closest to the present work, yet neither performs identity attribution or network analysis: FusionDark scores SAR–AIS correspondences probabilistically rather than through an explicit gate that adapts to vessel speed and AIS staleness, and DarkVesselNet is detection-centric, with AIS used for trajectory and gap reasoning rather than for identity resolution. No prior system among those reviewed integrates adaptive gated fusion, OSINT-based identity attribution, and SNA network context end to end, through to auditable, alert-suppressed operator decisions. This work implements that integration; its identity and network stages are characterized but not validated against adjudicated outcomes.

Table 1. Representative recent work versus the capabilities required for end-to-end dark-vessel attribution. A check (✓) denotes explicit support; a dash (—) denotes not addressed. “Adaptive gate” denotes a non-static association gate.

Work	Year	SAR Det.	AIS Fusion	Adaptive Gate	Identity Attr.	Network/SNA	Alert Prior.
Niu et al. [4]	2024	✓	—	—	—	—	—
Yang et al. [9]	2024	✓	—	—	—	—	—
Li et al. (SARATR-X) [17]	2025	✓	—	—	—	—	—
Milios et al. [2]	2019	✓	✓	—	—	—	—
Li et al. (dark ship) [3]	2025	✓	✓	—	partial	—	—
Lu et al. (graph assoc.) [23]	2026	partial	✓	—	—	partial	—
Karagiannopoulos et al. (FusionDark) [25]	2026	✓	✓	—	—	—	partial
Sharma (DarkVesselNet, preprint) [26]	2026	✓	✓	—	—	—	partial
Huang et al. [29]	2024	—	—	—	—	✓	—
Ma et al. [27]	2025	—	—	—	—	✓	—
This work	2026	✓	✓	✓	✓ †	✓ †	✓

^† Implemented and deployed, and characterized on the operational data by identity-consistency, offline sanctions-screening, and graph-structure measures (Section 4.7 and Section 4.8), but without precision, recall, or adjudicated attribution accuracy; the real SNA graph contains no distinct bridge vessel. FusionDark ranks anomalies with a probabilistic score over SAR–AIS correspondences, and DarkVesselNet outputs an anomaly score; both are therefore marked “partial” for alert prioritization.

3. Materials and Methods

The end-to-end pipeline is shown in Figure 1 (Section 1). Two acquisition streams (SAR and AIS) feed non-cooperative detection (SLA-Net) and cooperative position estimation (kinematic interpolation); a Dynamic Kinematic Gate and Hungarian assignment fuse them into five outcome classes; flagged contacts pass to OSINT enrichment and Social Network Analysis; and results surface on an analyst dashboard with audit trails. All components run against a single PostgreSQL/PostGIS/TimescaleDB store.

3.1. Data Sources and Infrastructure

SAR. Sentinel-1 Ground Range Detected (GRD) imagery is acquired via EODAG from the Copernicus Data Space Ecosystem [37]. Acquisitions in VV polarization are converted to $512\times 512$-pixel tiles with a 100-pixel overlap (stride 412 pixels, that is, an overlap of about 20%). In the API service pipeline, a rasterized land–sea mask (1 = sea, 0 = land) is generated for each tile and passed to SLA-Net’s Hierarchical Mask Attention (Section 3.2), tiles whose land fraction exceeds 80% are skipped, and detections whose centroids fall on land are removed after inference. In the batch processing script and in the standalone inference module, by contrast, an all-ones mask is passed to the attention module, so no land suppression is applied inside the network on those paths; the service also falls back to an all-ones mask when the coastline data are not loaded. SAR detections are stored with geographic coordinates, confidence scores, and bounding-box dimensions; the operational run logged 4937 detections that entered bidirectional fusion (3217 confirmed matches and 1720 dark; Section 4). Which of the two code paths produced these detections was not logged.

AIS. AIS data come from a commercial aggregator in two forms. The operational fusion used the live polling tables collected over 5–17 March 2026, which hold 134,470,859 position snapshots of 1,921,466 MMSIs; a snapshot is the aggregator’s latest known position of a vessel at the time of a request, and a vessel is re-polled a median of every 3.8 h, so the last AIS position available at a SAR pass can be hours old. The SNA analysis of Section 4.8 uses the second form, a history backfill of per-vessel position histories (each record a request covering about one month) with positions from December 2025 to early March 2026 and a median of 30 min between consecutive positions; from it, all positions of February 2026 inside two regional boxes were extracted and de-duplicated (Table 18). A Kinematic Interpolator dead-reckons each vessel to its estimated position at the SAR capture time $t_{\mathrm{SAR}}$ using speed over ground (SOG) and course over ground (COG); the Circular Error Probable (CEP) of each estimate grows with SOG and elapsed time.

OSINT. A corpus of 1,244,050 typed documents is stored in a PostgreSQL JSONB table, keyed by the IMO number of the vessel (company records by company name or company IMO number); Table 2 lists the inventory by report type. The corpus holds nearly every document twice, from two ingestions on 4 and 17 March 2026 (618,593 and 625,457 rows), so 49.5% of the rows are duplicates and 628,718 payloads are distinct within their report type. The report types correspond to port-state-control, ownership, class, and casualty records of the kind published by registries such as Equasis [38], but the source registry of individual documents was not recorded. The service also downloads the public OFAC Specially Designated Nationals (SDN) list [39]; as Section 3.5 explains, it does not match vessels against it.

Table 2. OSINT corpus document inventory by report type. “Documents” counts corpus rows; “Distinct” counts distinct payloads within each report type, since nearly every document was ingested twice (4 and 17 March 2026).

Report Type	Documents	Distinct	Intended Registry
Inspections (PSC/ISM)	696,757	351,879	Equasis
Ownership records	238,736	120,573	Equasis, VesselFinder
Dry-dock dates	131,753	67,420	Baltic Shipping
Sales/purchase/demolitions	62,053	31,071	FleetMon
Casualty records	40,564	20,302	MarineTraffic
Company records	37,612	18,838	Equasis
Engine certificates	20,946	10,607	Class societies
Class-society reports	15,629	8028	Class societies
Total	1,244,050	628,718

“Intended registry” is the registry each report type was designed to hold. The source registry, URL, and retrieval time of individual documents were not recorded in the corpus, so provenance is available only at the level of report type. Company records were keyed by company name in the first ingestion and by company IMO number in the second.

3.2. SLA-Net: Sea–Land-Aware SAR Ship Detection

SLA-Net extends Faster R-CNN [40] with a ResNet-50 backbone and a Feature Pyramid Network (FPN) [41] producing maps $\{P_0,P_1,P_2,P_3\}$, augmented by two maritime-specific modules.

Hierarchical Mask Attention (HMA). A binary sea–land raster $\mathbf{M}$ (1 = sea, 0 = land) accompanies each tile. At FPN level l, with feature map $F_l$ of $C=256$ channels, $\mathbf{M}$ is resized to the spatial size of $F_l$ by nearest-neighbor interpolation, giving $M_l$. A per-image scalar gain ${\alpha }_l$ is predicted from the feature map itself: an adaptive $7\times 7$ average pool of $F_l$ is flattened and passed through a two-layer MLP, $\mathrm{Linear}(49C\to 256)$–GELU–$\mathrm{Linear}(256\to 1)$, followed by tanh,

$${\alpha }_l=\tanh \left(\mathrm{MLP}\left({\mathrm{AvgPool}}_{7\times 7}\left(F_l\right)\right)\right),$$

(1)

and the feature map is modulated element-wise as

$${\widehat{F}}_l=F_l\odot \left[M_l(1+\left|{\alpha }_l\right|)+(1-M_l)(1-\left|{\alpha }_l\right|)\right],$$

(2)

so that sea-region activations are scaled by $1+\left|{\alpha }_l\right|$ and land-region activations by $1-\left|{\alpha }_l\right|\le 1$ before the region proposal network. HMA is applied independently at the four FPN levels $P_0$–$P_3$, each with its own MLP. With an all-ones mask ($M_l\equiv 1$), Equation (2) reduces to a uniform gain $1+\left|{\alpha }_l\right|$ with no spatial land suppression. The original training script applies HMA only during training, whereas the deployed inference module applies it whenever a mask is supplied. The ablation of Section 4.1.1 applies HMA in both training and inference and, because SSDD provides no land raster, with an all-ones mask for every image.

Global Transformer Bridge (GTB). The coarsest level $P_3$ is flattened into a sequence of spatial tokens and passes through a single Transformer encoder layer [42] ($d_{\mathrm{model}}=256$, eight heads, feed-forward dimension 1024, GELU activation, dropout 0.1), whose output is reshaped and added back to $P_3$ as a residual, $P_3\leftarrow P_3+\mathrm{TEL}\left(P_3\right)$, injecting scene-level context—open-ocean clutter versus a vessel-dense port approach—into the per-proposal classifier. The detection head follows the standard region proposal network, ROI Align, and box predictor. Figure 2 shows the architecture.

Figure 2. SLA-Net architecture. At every FPN level ($P_0$–$P_3$), Hierarchical Mask Attention computes a scalar gain ${\alpha }_l$ from the feature map itself (7 × 7 average pooling, a two-layer MLP, and tanh) and modulates the feature map element-wise by the sea–land mask resized to that level (Equations (1) and (2)). The Global Transformer Bridge, a single Transformer encoder layer, is applied to $P_3$ only and added back as a residual, $P_3+\mathrm{GTB}\left(P_3\right)$, before the Faster R-CNN detection head.

3.3. Kinematic Interpolation and the Dynamic Kinematic Gate

Given a last reported position $({lat}_0,{lon}_0)$, SOG v, and COG $\theta$, the dead-reckoned position at $\Delta t=t_{\mathrm{SAR}}-t_{\mathrm{last}}$ is $lat={lat}_0+v\Delta t\cos \theta /R_E$ and $lon={lon}_0+v\Delta t\sin \theta /\left(R_E\cos {lat}_0\right)$ with $R_E=6371$ km. The acceptance gate for AIS vessel j is

$$g_j=\min \left(g_{\max },\max \left(g_0,2{\mathrm{CEP}}_j,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}}\right)+v_{\max }\Delta t_j\right),$$

(3)

where $\Delta t_j=t_{\mathrm{SAR}}-t_{\mathrm{last},j}$ is the AIS staleness of vessel j in seconds. All lengths in Equation (3) are in meters. Speeds are reported in knots (kn, the nautical unit of speed; 1 kn $=0.514444$ m/s), and $v_{\max }$ enters the staleness term converted to meters per second, $v_{\max }=30$ kn $=15.43$ m/s, so that $v_{\max }\Delta t_j$ is a distance in meters: one hour of AIS silence ($\Delta t_j=3600$ s) adds $15.43\times 3600\approx 55,600$ m to the radius before the ceiling applies. Table 3 lists every symbol with its value, unit, and implementing code constant. The reference speed $v_{\mathrm{ref}}=1$ kn makes the argument of the square root dimensionless, so that $\kappa \sqrt{1+v_j/v_{\mathrm{ref}}}$ is a length that absorbs speed-dependent position noise; the $2{\mathrm{CEP}}_j$ term absorbs dead-reckoning uncertainty. The floor $g_0=200$ m corresponds to about 20 pixels at the 10 m pixel spacing of Sentinel-1 IW GRD products; it is not a resolution limit but a minimum allowance for residual geolocation error, tile-stitching offsets, and short-horizon dead-reckoning error. The term $v_{\max }\Delta t_j$ grows the gate as fast as a surface vessel at the assumed maximum speed could travel, so that a genuine but stale track is not spuriously declared a spoof, and the fixed ceiling $g_{\max }=50$ km keeps the cost matrix sparse and the Hungarian assignment tractable. From the 200 m floor, the ceiling is reached when $v_{\max }\Delta t_j=49.8$ km, that is, after $\Delta t_j\approx 3227$ s (about 0.9 h). Staleness beyond that point is handled by alert triage rather than by the radius: an AIS broadcast left unmatched after assignment whose staleness exceeds the temporal-sparsity threshold of 3 h is demoted to the low-confidence temporal-sparsity class under the rule given in Section 3.4, instead of being raised as a spoof candidate. Equation (3) replaces the static 5 km threshold of prior work [2,3]. In the implementation, the legacy static configuration, used as the baseline in Section 4.3, is invoked when no SAR capture time is supplied; it evaluates $\min \left(5\mathrm{km},\max (g_0,2{\mathrm{CEP}}_j,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})\right)$, that is, the same floor terms capped at 5 km, with no staleness term and no temporal-sparsity demotion. Its radius therefore equals 5 km only when $2{\mathrm{CEP}}_j\ge 5$ km and is otherwise the floor term.

Table 3. Parameters of the Dynamic Kinematic Gate (Equation (3)) and of the temporal-sparsity rule, with units and the constants that implement them in api/services/sar_correlator.py. All lengths are in meters and all times in seconds; speeds are given in knots and are converted to m/s in the staleness term.

Symbol	Meaning	Value	Unit	Code Constant
$g_0$	Gate floor	200	m	MIN_GATE_M
$\kappa$	Speed-uncertainty coefficient	50	m	GATE_PER_KNOT_M
$v_{\mathrm{ref}}$	Reference speed normalizing $v_j$	1	kn	(implicit)
$v_j$	Reported speed over ground of AIS vessel j	per vessel	kn	sog
${\mathrm{CEP}}_j$	Circular Error Probable of the dead-reckoned position	per vessel	m	cep_meters
$v_{\max }$	Maximum surface-vessel speed	30 kn (15.43 m/s)	m/s	MAX_VESSEL_SPEED_KN
$\Delta t_j$	AIS staleness, $t_{\mathrm{SAR}}-t_{\mathrm{last},j}$	per vessel	s	—
$g_{\max }$	Hard ceiling of the dynamic gate	50,000 (50 km)	m	HARD_KINEMATIC_CEILING_M
—	Cap of the legacy static gate	5000 (5 km)	m	GATE_HARD_CAP_M
${\tau }_{\mathrm{sparse}}$	Temporal-sparsity threshold	10,800 (3 h)	s	TEMPORAL_SPARSITY_DT_S

3.4. Bidirectional Hungarian Assignment

For a scene with m SAR detections and n AIS interpolations, the cost matrix is $C_{ij}=d_{ij}/g_j$ if $d_{ij}\le g_j$ and ∞ otherwise, where $d_{ij}$ is the great-circle distance. The matrix is square-padded to $N=\max (m,n)$ and solved with the Jonker–Volgenant algorithm (scipy.optimize.linear_sum_assignment); pairs with $C_{ij}<1$ after assignment are confirmed. In the implementation, out-of-gate and padding cells carry the large finite cost ${10}^9$ rather than ∞; the solver therefore first maximizes the number of in-gate pairs and only then minimizes the summed normalized distance, which matters when gates are wide (Section Association Baselines and Gate Sensitivity). Every SAR detection and every unmatched AIS broadcast receives exactly one of five outcome labels (Figure 3):

Figure 3. (a) Illustrative $6\times 8$ cost matrix $C_{ij}=d_{ij}/g_j$ for a scene; cells outside the Dynamic Kinematic Gate are left blank, and the green outline marks the optimal assignment returned by scipy.optimize.linear_sum_assignment. (b) Gate radius $g_j$ versus AIS staleness $\Delta t$ for a vessel at SOG $=10$ kn with $\mathrm{CEP}=0$, computed with the production gate function (_gate_for in sar_correlator.py); the radius reaches the 50 km ceiling after about 54 min. The dashed red line is the 5 km cap of the legacy capped static gate, and the dashed vertical line marks the 3 h temporal-sparsity threshold beyond which unmatched AIS are demoted rather than alerted.

• Confirmed: SAR↔AIS matched within the gate.
• Dark: SAR detection with no AIS within the gate.
• Spoof candidate: AIS broadcast with no SAR echo that is not demoted under item 5 (in particular, every unmatched broadcast with $\Delta t_j\le 3$ h).
• Identity laundering: matched AIS declaring Pleasure/Fishing/Class-B while the SAR bounding box exceeds 50 m—a physical-truth override, since a declared small craft cannot be 180 m long.
• Low-confidence temporal sparsity: unmatched AIS with $\Delta t_j>3$ h for which at least one SAR detection in the scene lies within the uncapped reachable radius $v_{\max }\Delta t_j$ (or the scene contains no SAR detection)—demoted from the operator view as a satellite-cadence artifact rather than a threat.

3.5. OSINT Attribution and Social Network Analysis

Once flagged, a vessel is resolved in five steps, as implemented in the deployed service: (i) the IMO number is read from the vessel-static record of its MMSI; (ii) all corpus documents keyed on that IMO number are retrieved and grouped by report type; (iii) the OFAC SDN list [39] is downloaded and kept synchronized, but no step compares vessels with it, so sanctions status is not part of the dossier; (iv) maritime news is collected from RSS feeds for the analyst, without automatic linkage to the vessel; and (v) the documents, the vessel’s behavioral anomalies, its SAR correlations, and its watch-list status are aggregated into a dossier. The dossier returns the report type and payload of each document, but not its source registry or URL, which were not recorded, nor its ingestion time, which is stored but not returned; the evidence trail therefore reaches the report type, not the individual source.

The SNA graph is built over five edge types, whose deployed rules are as follows. Ship-to-ship (STS) transfer: two vessels with SOG $<3$ kn (a missing SOG counts as 0) whose latest positions in the same 5 min time bucket lie within 1 km, with at least 0.5 h between the first and the last shared bucket, which need not be consecutive; pairs whose mean position lies within 2 nautical miles of a port are excluded, and at least one vessel must have a cargo or tanker type, or the types of both must be unknown. Port call: a vessel–port edge when at least three positions of the vessel with SOG $<1$ kn lie within 3704 m (2 nautical miles) of a port with a UN/LOCODE; these are vessel–port edges, not vessel–vessel co-visits, and three such ports lack coordinates and cannot receive edges. Ownership: vessel–company and company–company edges extracted from the ownership and company documents after company names are canonicalized and merged by fuzzy string matching (token-sort ratio $\ge 92$), which can join distinct companies with similar names. Flag: vessel–flag edges seeded from a country_iso field of the vessel-static record, which no exported record carries, so the deployed code creates no flag edges on these data. Dark proximity: pairs of vessels with SAR correlations of confidence $\ge 0.6$ whose last AIS positions lie within about 50 nautical miles and 24 h of each other, which requires the SAR correlation tables. Ego-networks expand breadth-first from a seed MMSI over a default look-back window of 720 h (30 days); the default depth is two hops and the service accepts at most three. Graphs larger than the node cap (default 3000 nodes) are truncated to the highest-degree nodes, always retaining the seed. The HTTP endpoint omits flag edges unless they are requested. Louvain modularity optimization [43] (fixed random state 42, with connected components as a fallback partition) partitions the graph, and two centralities are computed with NetworkX [44]: degree centrality and betweenness centrality estimated from $k=\min (100,\max (2,\left|V\right|-1\left)\right)$ sampled source nodes with a fixed seed (42). Closeness and PageRank centralities are not computed by the deployed service. A bridge vessel—high betweenness linking otherwise disconnected communities—is the signal the layer was designed to surface; Section 4.8 tests whether such a vessel appears in real data.

3.6. Complexity and Cost Model

Table 4 gives the asymptotic cost of each stage. Detection scales linearly in the number of tiles; gating is quadratic in per-scene cardinality; Hungarian assignment is $O\left(N^3\right)$ in the worst case (empirically sub-cubic here, Section 4.5); OSINT is linear in the number of flagged contacts under indexed lookup; and SNA is dominated by sampled betweenness. Because scenes are small (N of order tens) and the ego-network is capped, the pipeline is dominated in practice by SAR inference, not by fusion or graph analysis.

Table 4. Per-stage computational cost. T = SAR tiles; $m,n$ = SAR detections and AIS interpolations per scene, $N=\max (m,n)$; F = flagged contacts; $V,E$ = SNA graph nodes and edges; k = betweenness sample size.

Stage	Dominant Operation	Cost
SLA-Net detection	Faster R-CNN forward pass per tile	$O\left(T\right)$
Kinematic interpolation	dead-reckon each AIS vessel	$O\left(n\right)$
DKG gating	pairwise great-circle distances per scene	$O\left(mn\right)$
Hungarian assignment	Jonker–Volgenant on padded matrix	$O\left(N^3\right)$ worst case
OSINT enrichment	indexed dossier lookup per flag	$O\left(F\right)$
SNA (Louvain)	modularity optimization	$\sim O\left(E\log V\right)$
SNA (betweenness)	k-sampled shortest paths	$O\left(kE\right)$

3.7. Reproducibility

The controlled experiments of Section 4 (complexity timing and the DKG and matcher ablations) were run with fixed random seed 42 using the deployed matching code (scripts/fusion_experiments.py), and their outputs are recorded as machine-readable tables. The analysis scripts, machine-readable tables, and per-fold results of all experiments run for this study are supplied as Supplementary Material with this submission, and the per-fold results of the detector experiments are also listed in Appendix A. The detector benchmark of Table 5 and the operational 12-day corpus results are reported from the project record, that is, from the original benchmark and operational runs, whose logs and checkpoints were not retained; their values are reported as recorded and are not re-measured here. The SLA-Net ablation, the detector latency measurements, and the detector failure analysis (Section 4.1.1, Section 4.1.3 and Section 5.2) were run for this revision with seed $42+f$ for fold f (scripts/slanet_ablation.py and scripts/slanet_failure_cases.py), and their per-fold results are kept as machine-readable tables. The re-benchmark of YOLOv8s, YOLOv10s, YOLOv11n, and RT-DETR-l (Section 4.1.2) was run on the same folds with the same seeds (scripts/detectors_kfold.py), and its per-fold results, precision–recall curves, and training settings are kept in the same way. The cross-dataset test of Section 5.3 applies the 20 checkpoints of that ablation in inference only (scripts/crossdataset_eval.py), and its per-fold results are kept in the same way. The OSINT and SNA analyses of Section 4.7 and Section 4.8 were run on a CPU over the exported operational data with the deployed graph-construction code imported unmodified, with fixed seeds for vessel sampling, Louvain partitioning, and betweenness sampling (all 42).

Table 5. SSDD five-fold SAR ship-detection benchmark (mean ± SD across folds). Best per column in bold. Values are from the project record and were not re-measured. Recall is the Ultralytics recall at IoU 0.50 for the YOLO and RT-DETR models but mAR@100, averaged over IoU 0.50–0.95, for Faster R-CNN and RetinaNet, so the column is not comparable across these groups (Section 4.1.2). YOLOv8s, YOLOv10s, YOLOv11n, and RT-DETR were re-trained and re-scored under the unified protocol of Section 4.1.2; RetinaNet was not re-run.

Model	Recall	mAP@0.50	mAP@[0.50:0.95]
Faster R-CNN	$0.631\pm 0.026$	$\mathbf{0}.\mathbf{821}\pm \mathbf{0}.\mathbf{067}$	$\mathbf{0}.\mathbf{553}\pm \mathbf{0}.\mathbf{034}$
YOLOv11n	$\mathbf{0}.\mathbf{790}\pm \mathbf{0}.\mathbf{097}$	$0.762\pm 0.083$	$0.432\pm 0.036$
YOLOv8s	$0.723\pm 0.088$	$0.752\pm 0.064$	$0.449\pm 0.040$
YOLOv10s	$0.609\pm 0.147$	$0.701\pm 0.091$	$0.352\pm 0.088$
RT-DETR	$0.575\pm 0.160$	$0.642\pm 0.132$	$0.286\pm 0.049$
RetinaNet	$0.241\pm 0.296$	$0.345\pm 0.424$	$0.195\pm 0.242$

4. Results

4.1. SLA-Net Detector

In the five-fold benchmark on SSDD [45] of the project record (Section 3.7), which was not re-run, a Faster R-CNN detector attains the highest mAP@0.50 ($0.821\pm 0.067$) and the highest strict-IoU score, mAP@[0.50:0.95] ($0.553\pm 0.034$), in the benchmark (Table 5), leading YOLOv8s by 10.4 and YOLOv11n by 12.1 percentage points on the strict multi-IoU metric. This Faster R-CNN detector is the backbone of the deployed SLA-Net (Section 3); its HMA and GTB modules are used operationally but are not isolated in this benchmark, so the reported figures reflect the backbone rather than the augmented model; the modules are ablated in Section 4.1.1. The Faster R-CNN choice was motivated by the expectation that the YOLO variants trade precision for recall and that precision governs downstream fusion quality, because a false SAR detection entered into the Hungarian matrix creates a spurious dark or spoof outcome. This expectation is not supported by the re-benchmark of Section 4.1.2: the recall column of Table 5 mixes two definitions, the benchmark recorded no precision for Faster R-CNN, and on the folds and with the evaluation code of this study the YOLO models are more precise than Faster R-CNN at a score threshold of 0.5 and within 0.028 of it in maximum F1. The values of Table 5 are kept as the project record. Reporting variance across folds is deliberate: RetinaNet’s collapse ($\mathrm{recall}=0.241\pm 0.296$) is invisible under the single-split reporting common in prior work.

4.1.1. Ablation of the HMA and GTB Modules

To isolate the contribution of the two SLA-Net modules, four configurations were trained and evaluated under one protocol: (A) Faster R-CNN with a ResNet-50 FPN backbone, (B) A with HMA, (C) A with GTB, and (D) A with both modules, which is the deployed SLA-Net architecture. The HMA and GTB classes were imported unmodified from the original SLA-Net training code. The 1160 SSDD images were pooled, sorted by file name, and split into five folds (shuffled with seed 42; 928 training and 232 validation images per fold), with the three classes of the benchmark (ship, small population, and large population; 2587, 136, and 21 boxes in total). Every run started from an ImageNet-initialized backbone and used the seed $42+f$ for fold f in all random-number generators, so that the four configurations saw the same data order within a fold. Training used stochastic gradient descent (learning rate 0.005, momentum 0.9, weight decay $5\times {10}^{-4}$, no learning-rate schedule, and no data augmentation), mixed precision (fp16), and batches of four images with two-step gradient accumulation, for at most 25 epochs. After each epoch the model was evaluated in inference mode, and the checkpoint with the highest validation mAP@0.50 was kept, with early stopping after six epochs without improvement.

The protocol deviates from that of the benchmark in Table 5 in ways that apply identically to all four configurations but make the absolute values incomparable with that table. Images were resized to $512\times 512$ pixels instead of the default $800/1333$ resize. Training was capped at 25 epochs instead of 150, and 11 of the 15 runs of configurations A–C reached the cap, with best epochs between 16 and 25, so these models were probably still improving. The fold membership differs from that of the benchmark, whose file order cannot be recovered. Unlike the original training script, the ablation applies HMA in inference as well as in training, as the deployed inference module does. The checkpoint was selected by validation mAP@0.50 on the same fold on which it is reported, instead of by the lowest training loss, so the values in Table 6 are optimistically biased; the last epoch, which had the lowest training loss in every run, gives lower mAP@0.50 values (A 0.703, B 0.731, C 0.741, and D 0.676). Finally, SSDD provides no land raster. An Otsu-threshold proxy mask was tested and rejected, because it labeled 518 of the 2587 ground-truth ship centers (20.0%) as land and marked open-sea scenes with a brightness gradient as land. An all-ones mask was therefore used for every configuration, under which Equation (2) reduces to a learned per-level gain $1+|{\alpha }_l|$: configurations B and D test that gain, not spatial land suppression.

Table 6. Five-fold ablation of the SLA-Net modules on SSDD (mean ± SD over five folds; seed $42+f$ for fold f; $512\times 512$ input; best-validation checkpoints; all-ones sea–land mask). mAP and mAR are averaged over the three classes; the ship columns refer to the ship class only; F1 is for the ship class at IoU 0.50 and a score threshold of 0.5. Configuration D is the deployed SLA-Net architecture. Because checkpoints were selected on the reporting fold and the protocol differs from that of Table 5, the values are not comparable with that table. No difference from A is significant after Holm correction.

Configuration	mAP@0.50	mAP@[0.50:0.95]	mAR@100	Ship AP@0.50	Ship AP@[0.50:0.95]	Ship F1 at 0.5
A: Faster R-CNN	$0.723\pm 0.069$	$0.419\pm 0.043$	$0.553\pm 0.025$	$0.938\pm 0.019$	$0.600\pm 0.036$	$0.901\pm 0.033$
B: +HMA	$0.820\pm 0.077$	$0.444\pm 0.045$	$0.557\pm 0.048$	$0.941\pm 0.017$	$0.619\pm 0.017$	$0.919\pm 0.016$
C: +GTB	$0.776\pm 0.101$	$0.428\pm 0.038$	$0.560\pm 0.025$	$0.938\pm 0.016$	$0.618\pm 0.025$	$0.905\pm 0.029$
D: +HMA+GTB	$0.761\pm 0.108$	$0.415\pm 0.086$	$0.552\pm 0.055$	$0.940\pm 0.021$	$0.595\pm 0.044$	$0.901\pm 0.026$

Table 6 and Figure 4 report the results, and Table A1 in Appendix A lists them per fold. On the ship class, which holds 2587 of the 2744 boxes, the four configurations are practically indistinguishable: AP@0.50 ranges from 0.938 (A) to 0.941 (B), and AP@[0.50:0.95] from 0.595 (D) to 0.619 (B). Paired with A over the five folds, the ship-class AP@0.50 changes by $+0.004$ with HMA ($p=0.24$, paired t-test), by $+0.001$ with GTB ($p=0.90$), and by $+0.003$ with both modules ($p=0.24$). The three-class mAP@0.50 shows a larger difference for HMA ($+0.097$, 95% CI $[-0.014,0.209]$, Cohen’s $d_z=1.08$; paired t-test $p=0.073$, exact Wilcoxon signed-rank test $p=0.0625$), but $0.0625$ is the smallest p-value that the Wilcoxon test can attain with five pairs, and after Holm correction over the three comparisons with A the two p-values become 0.22 and 0.19. GTB ($+0.054$, $p=0.34$) and the combination of both modules ($+0.038$, $p=0.46$) differ less. No comparison with A is significant after correction for any of the four metrics tested (three-class mAP@0.50 and mAP@[0.50:0.95], and ship-class AP@0.50 and AP@[0.50:0.95]). The Wilcoxon test is reported alongside the t-test because the normality of the paired differences cannot be checked reliably with five pairs (Shapiro–Wilk $p=0.006$ for the D–A differences in mAP@0.50).

Figure 4. Five-fold ablation of the SLA-Net modules on SSDD (mean ± 1 SD over folds; seed $42+f$ for fold f; $512\times 512$ input; best-validation checkpoints; all-ones sea–land mask). Faster R-CNN is configuration A, and +HMA+GTB is the deployed SLA-Net architecture. The three-class differences are driven by the two population classes, with 1–8 large-population boxes per validation fold; the ship-class AP@0.50 differs by at most 0.004 between configurations. Values are those of Table 6.

The three-class gain of HMA is concentrated in the two rare population classes. Relative to A, the AP@0.50 of configuration B rises by 0.206 for large population and by 0.081 for small population, against 0.004 for ship, so the large-population class accounts for about 70% of the $+0.097$. That class has only 21 boxes, with 1, 4, 2, 8, and 6 in the five validation folds, so a single box can move its AP substantially: in fold 1, whose validation set holds one large-population box, the AP@0.50 of that class is 0.333 for A and 1.000 for B, C, and D. The three-class differences therefore rest on a handful of boxes rather than on a systematic effect of the modules.

The ship-class precision–recall curves of the four configurations at IoU 0.50, averaged over the folds, overlap almost completely (dashed curves in Figure 5). At a score threshold of 0.5, the F1 score is $0.901\pm 0.033$ for A (precision 0.868, recall 0.936) and $0.919\pm 0.016$ for B (precision 0.906, recall 0.931), with C at 0.905 (0.874 and 0.941) and D at 0.901 (0.868 and 0.938); the maximum F1 over all thresholds is 0.925, 0.932, 0.929, and 0.925 for A to D. The slightly higher F1 of B at the default threshold comes from precision rather than recall, and its maximum F1 lies within the fold-to-fold spread of the others. Under this protocol, neither module is shown to improve detection; the deployed SLA-Net rests on its Faster R-CNN backbone (Table 5) rather than on its added modules, and that backbone is on par with, not ahead of, the YOLO models on the ship class (Section 4.1.2).

Figure 5. Ship-class precision–recall curves at IoU 0.50 of eight detectors: the four re-benchmarked Ultralytics detectors (solid) and the four Faster R-CNN ablation configurations (dashed) on the held-out SSDD folds. For each detector, the interpolated precision of each fold is evaluated on a common recall grid and averaged over the five folds; shaded bands ($\pm 1$ SD) are drawn for the Ultralytics detectors only. Dots mark the mean operating point at a score threshold of 0.5. (a) Full range; (b) recall 0.80–1.00. Detections are limited to scores of at least 0.05 for Faster R-CNN and 0.001 for the Ultralytics detectors.

4.1.2. Re-Benchmark of the Compared Detectors Under One Protocol

The single-stage and transformer detectors of Table 5 were trained without seeds, on folds that cannot be recovered, scored with each framework’s own metric code, and their per-fold scores were not retained. For this revision, YOLOv8s, YOLOv11n, and RT-DETR-l, and subsequently YOLOv10s, were retrained on the five folds of the ablation (Section 4.1.1) with the seed $42+f$ for fold f and deterministic training, and their best checkpoints were scored with the evaluation code of the ablation, imported unmodified (torchmetrics, COCO 101-point interpolation, at most 100 detections per image, and ship-class operating points from the same greedy matching at IoU 0.50). RetinaNet was not re-run. Training followed the original benchmark script with four deviations: an epoch limit of 60 in fold 1 and 40 in folds 2–5, reduced after the fold-1 run of RT-DETR-l took 76 min (40 in all five folds for YOLOv10s, trained after this change), against 150 epochs, with a patience of 12 instead of 20 epochs; batches of 16 (YOLO) and eight (RT-DETR-l) images instead of 32 and 16, with gradient accumulation to the same nominal batch of 64; selection of the checkpoint with the highest validation mAP@[0.50:0.95] on the reporting fold, the fitness criterion of this Ultralytics version, instead of the training-log row with the highest mAP@0.50; and evaluation of the checkpoints, stored in fp16, in fp32. In the original runs as in these, the automatic optimizer selection of Ultralytics trained the YOLO models with AdamW at a learning rate of 0.001429 instead of the requested 0.01. Predictions used a score threshold of 0.001, non-maximum suppression at IoU 0.7, and a 640-pixel input, letterboxed for the YOLO models and stretched to $640\times 640$ by the RT-DETR predictor. YOLOv10s was run with its NMS-free one-to-one head, which keeps at most 300 top-scoring boxes without non-maximum suppression, so the IoU 0.7 setting does not apply to it. The Faster R-CNN configurations share the folds, the seeds, the checkpoint selection on the reporting fold, and the evaluation code, but not the recipe (SGD, $512\times 512$ pixels, at most 25 epochs, no augmentation, selection on mAP@0.50, and torchvision post-processing with a score threshold of 0.05 and non-maximum suppression at IoU 0.5), so the comparison is between the standard recipes of the two frameworks, scored identically. The lower score threshold of the Ultralytics models only appends lower-scored detections and cannot reduce their average precision, and all values share the optimistic bias of selection on the reporting fold.

Table 7 and Figure 5 report the results (per fold in Table A2). On the ship class, which holds 2587 of the 2744 boxes, the three YOLO models and the four Faster R-CNN configurations lie within 0.02 of each other in AP@0.50 ($0.949\pm 0.023$ for YOLOv8s, $0.940\pm 0.024$ for YOLOv10s, $0.955\pm 0.015$ for YOLOv11n, and 0.938–0.941 for A–D), so that YOLOv10s is on par with the Faster R-CNN configurations; in ship-class AP@[0.50:0.95], YOLOv11n (0.617) is level with B and C and above A (0.600), and YOLOv8s (0.568) and YOLOv10s (0.563) are lowest. RT-DETR-l is lower and unstable across folds: its ship-class AP@0.50 of $0.759\pm 0.277$ is 0.904–0.944 in folds 1–3 but 0.716 and 0.294 in folds 4 and 5, whose runs stopped early after 32 and 30 epochs. The three-class metrics favor Faster R-CNN (mAP@0.50 0.723–0.820 against 0.669, 0.660, 0.611, and 0.299 for YOLOv8s, YOLOv10s, YOLOv11n, and RT-DETR-l; mAP@[0.50:0.95] 0.415–0.444 against 0.369, 0.370, 0.365, and 0.152), but, as in the ablation, the mAP@0.50 ordering is set by the population classes (157 boxes): their AP@0.50 is 0.509 (small) and 0.550 (large) for YOLOv8s, 0.486 and 0.553 for YOLOv10s, and 0.556 and 0.322 for YOLOv11n, against 0.708 and 0.522 for A.

At a score threshold of 0.5, the ship-class precision, recall, and F1 are 0.953, 0.840, and 0.891 for YOLOv8s; 0.950, 0.852, and 0.898 for YOLOv10s; 0.961, 0.860, and 0.907 for YOLOv11n; 0.726, 0.702, and 0.658 for RT-DETR-l; and 0.868–0.906, 0.931–0.941, and 0.901–0.919 for A–D. At 0.25 they are 0.836, 0.928, and 0.879; 0.821, 0.923, and 0.869; 0.846, 0.934, and 0.887; 0.383, 0.914, and 0.527; and 0.800–0.875, 0.944–0.949, and 0.867–0.908. The maximum F1 is 0.909, 0.904, and 0.920 for YOLOv8s, YOLOv10s, and YOLOv11n (at mean thresholds of 0.42, 0.44, and 0.44), 0.750 for RT-DETR-l, and 0.925–0.932 for A–D (at 0.82–0.92). At a common threshold of 0.5, the YOLO models are thus the more precise and the Faster R-CNN configurations the more complete detectors, a difference in score calibration rather than in ranking quality.

Table 8 shows why the absolute values differ from those of Table 5. On the same checkpoints, the three-class mAP@0.50 of the unified evaluation agrees with that of the Ultralytics validator within 0.001 (0.003 for YOLOv10s), and the rule of the original benchmark, applied to this run’s training logs, gives values higher by less than 0.01 (0.021 for YOLOv10s, about half of its gap of 0.041 to the published value). The evaluation code therefore does not explain the gap to the published values (0.752, 0.701, 0.762, and 0.642), which lies mainly in the training runs (Table 9): 150 epochs instead of 40–60, and unseeded training on a different fold partition. The precision and recall columns are not comparable across protocols, because their definitions differ (caption of Table 8). Table 5 mixed these definitions: its recall column holds the Ultralytics recall for the YOLO and RT-DETR models but mAR@100, a stricter quantity averaged over IoU 0.50–0.95, for Faster R-CNN (0.631) and RetinaNet, and the benchmark recorded no precision for either of them. Under a common definition, the mAR@100 of YOLOv8s, YOLOv10s, and YOLOv11n is 0.622, 0.661, and 0.624 (Table 7).

Table 7. Re-benchmark of the compared detectors on the five SSDD folds of the ablation, scored with one evaluation code (mean ± SD over folds; seed $42+f$ for fold f; checkpoints selected on the reporting fold). mAP and mAR are three-class averages; ship F1 is at IoU 0.50, at a score threshold of 0.5 and at its maximum. Training settings are in Table 9; the Faster R-CNN rows repeat Table 6. YOLOv10s, re-run last, uses its NMS-free head and was trained for at most 40 epochs in every fold.

Detector	mAP@0.50	mAP@[0.50:0.95]	mAR@100	Ship AP@0.50	Ship AP@[0.50:0.95]	Ship F1 at 0.5	Ship F1-Max
YOLOv8s	$0.669\pm 0.123$	$0.369\pm 0.061$	$0.622\pm 0.043$	$0.949\pm 0.023$	$0.568\pm 0.029$	$0.891\pm 0.031$	$0.909\pm 0.023$
YOLOv10s	$0.660\pm 0.121$	$0.370\pm 0.068$	$0.661\pm 0.034$	$0.940\pm 0.024$	$0.563\pm 0.021$	$0.898\pm 0.027$	$0.904\pm 0.025$
YOLOv11n	$0.611\pm 0.062$	$0.365\pm 0.040$	$0.624\pm 0.058$	$0.955\pm 0.015$	$0.617\pm 0.030$	$0.907\pm 0.017$	$0.920\pm 0.014$
RT-DETR-l	$0.299\pm 0.112$	$0.152\pm 0.066$	$0.417\pm 0.079$	$0.759\pm 0.277$	$0.392\pm 0.153$	$0.658\pm 0.345$	$0.750\pm 0.236$
A: Faster R-CNN	$0.723\pm 0.069$	$0.419\pm 0.043$	$0.553\pm 0.025$	$0.938\pm 0.019$	$0.600\pm 0.036$	$0.901\pm 0.033$	$0.925\pm 0.024$
B: +HMA	$0.820\pm 0.077$	$0.444\pm 0.045$	$0.557\pm 0.048$	$0.941\pm 0.017$	$0.619\pm 0.017$	$0.919\pm 0.016$	$0.932\pm 0.019$
C: +GTB	$0.776\pm 0.101$	$0.428\pm 0.038$	$0.560\pm 0.025$	$0.938\pm 0.016$	$0.618\pm 0.025$	$0.905\pm 0.029$	$0.929\pm 0.019$
D: +HMA+GTB	$0.761\pm 0.108$	$0.415\pm 0.086$	$0.552\pm 0.055$	$0.940\pm 0.021$	$0.595\pm 0.044$	$0.901\pm 0.026$	$0.925\pm 0.024$

Table 7. Re-benchmark of the compared detectors on the five SSDD folds of the ablation, scored with one evaluation code (mean ± SD over folds; seed $42+f$ for fold f; checkpoints selected on the reporting fold). mAP and mAR are three-class averages; ship F1 is at IoU 0.50, at a score threshold of 0.5 and at its maximum. Training settings are in Table 9; the Faster R-CNN rows repeat Table 6. YOLOv10s, re-run last, uses its NMS-free head and was trained for at most 40 epochs in every fold.

Detector	mAP@0.50	mAP@[0.50:0.95]	mAR@100	Ship AP@0.50	Ship AP@[0.50:0.95]	Ship F1 at 0.5	Ship F1-Max
YOLOv8s	$0.669\pm 0.123$	$0.369\pm 0.061$	$0.622\pm 0.043$	$0.949\pm 0.023$	$0.568\pm 0.029$	$0.891\pm 0.031$	$0.909\pm 0.023$
YOLOv10s	$0.660\pm 0.121$	$0.370\pm 0.068$	$0.661\pm 0.034$	$0.940\pm 0.024$	$0.563\pm 0.021$	$0.898\pm 0.027$	$0.904\pm 0.025$
YOLOv11n	$0.611\pm 0.062$	$0.365\pm 0.040$	$0.624\pm 0.058$	$0.955\pm 0.015$	$0.617\pm 0.030$	$0.907\pm 0.017$	$0.920\pm 0.014$
RT-DETR-l	$0.299\pm 0.112$	$0.152\pm 0.066$	$0.417\pm 0.079$	$0.759\pm 0.277$	$0.392\pm 0.153$	$0.658\pm 0.345$	$0.750\pm 0.236$
A: Faster R-CNN	$0.723\pm 0.069$	$0.419\pm 0.043$	$0.553\pm 0.025$	$0.938\pm 0.019$	$0.600\pm 0.036$	$0.901\pm 0.033$	$0.925\pm 0.024$
B: +HMA	$0.820\pm 0.077$	$0.444\pm 0.045$	$0.557\pm 0.048$	$0.941\pm 0.017$	$0.619\pm 0.017$	$0.919\pm 0.016$	$0.932\pm 0.019$
C: +GTB	$0.776\pm 0.101$	$0.428\pm 0.038$	$0.560\pm 0.025$	$0.938\pm 0.016$	$0.618\pm 0.025$	$0.905\pm 0.029$	$0.929\pm 0.019$
D: +HMA+GTB	$0.761\pm 0.108$	$0.415\pm 0.086$	$0.552\pm 0.055$	$0.940\pm 0.021$	$0.595\pm 0.044$	$0.901\pm 0.026$	$0.925\pm 0.024$

Table 8. The Ultralytics detectors under three protocols on the re-benchmark runs, and as published (mean ± SD over five folds). (i) Unified code of Table 7: P is the ship-class precision at score 0.5 and IoU 0.50; R is the three-class mAR@100 (IoU 0.50–0.95). (ii) Ultralytics validator on the same checkpoints: P and R are three-class means at IoU 0.50 at the confidence of maximum mean F1. (iii) Original rule on this run: the training-log row (fp16, moving-average weights) with the highest mAP@0.50; P and R as in (ii). (iv) Rule (iii) on the original runs (150 epochs, unseeded, other folds; population SD). For Faster R-CNN and RetinaNet, the recall of Table 5 is mAR@100 as in (i).

Protocol	mAP@0.50	mAP@[0.50:0.95]	P	R
YOLOv8s
(i) Unified (torchmetrics)	$0.669\pm 0.123$	$0.369\pm 0.061$	$0.953\pm 0.026$	$0.622\pm 0.043$
(ii) Ultralytics validator	$0.669\pm 0.117$	$0.364\pm 0.061$	$0.608\pm 0.131$	$0.620\pm 0.148$
(iii) Original rule, this run	$0.679\pm 0.119$	$0.349\pm 0.055$	$0.588\pm 0.131$	$0.614\pm 0.145$
(iv) Published (Table 5)	$0.752\pm 0.064$	$0.449\pm 0.040$	$0.679\pm 0.067$	$0.723\pm 0.088$
YOLOv10s
(i) Unified (torchmetrics)	$0.660\pm 0.121$	$0.370\pm 0.068$	$0.950\pm 0.009$	$0.661\pm 0.034$
(ii) Ultralytics validator	$0.657\pm 0.124$	$0.373\pm 0.063$	$0.545\pm 0.077$	$0.684\pm 0.155$
(iii) Original rule, this run	$0.681\pm 0.119$	$0.364\pm 0.055$	$0.647\pm 0.200$	$0.623\pm 0.167$
(iv) Published (Table 5)	$0.701\pm 0.091$	$0.352\pm 0.088$	$0.651\pm 0.103$	$0.609\pm 0.147$
YOLOv11n
(i) Unified (torchmetrics)	$0.611\pm 0.062$	$0.365\pm 0.040$	$0.961\pm 0.024$	$0.624\pm 0.058$
(ii) Ultralytics validator	$0.611\pm 0.068$	$0.371\pm 0.044$	$0.763\pm 0.100$	$0.554\pm 0.185$
(iii) Original rule, this run	$0.618\pm 0.079$	$0.343\pm 0.050$	$0.760\pm 0.133$	$0.532\pm 0.204$
(iv) Published (Table 5)	$0.762\pm 0.083$	$0.432\pm 0.036$	$0.634\pm 0.112$	$0.790\pm 0.097$
RT-DETR-l
(i) Unified (torchmetrics)	$0.299\pm 0.112$	$0.152\pm 0.066$	$0.726\pm 0.094$	$0.417\pm 0.079$
(ii) Ultralytics validator	$0.298\pm 0.113$	$0.151\pm 0.067$	$0.763\pm 0.168$	$0.298\pm 0.126$
(iii) Original rule, this run	$0.306\pm 0.098$	$0.150\pm 0.068$	$0.765\pm 0.170$	$0.302\pm 0.122$
(iv) Published (Table 5)	$0.642\pm 0.132$	$0.286\pm 0.049$	$0.709\pm 0.134$	$0.575\pm 0.160$

Table 8. The Ultralytics detectors under three protocols on the re-benchmark runs, and as published (mean ± SD over five folds). (i) Unified code of Table 7: P is the ship-class precision at score 0.5 and IoU 0.50; R is the three-class mAR@100 (IoU 0.50–0.95). (ii) Ultralytics validator on the same checkpoints: P and R are three-class means at IoU 0.50 at the confidence of maximum mean F1. (iii) Original rule on this run: the training-log row (fp16, moving-average weights) with the highest mAP@0.50; P and R as in (ii). (iv) Rule (iii) on the original runs (150 epochs, unseeded, other folds; population SD). For Faster R-CNN and RetinaNet, the recall of Table 5 is mAR@100 as in (i).

Protocol	mAP@0.50	mAP@[0.50:0.95]	P	R
YOLOv8s
(i) Unified (torchmetrics)	$0.669\pm 0.123$	$0.369\pm 0.061$	$0.953\pm 0.026$	$0.622\pm 0.043$
(ii) Ultralytics validator	$0.669\pm 0.117$	$0.364\pm 0.061$	$0.608\pm 0.131$	$0.620\pm 0.148$
(iii) Original rule, this run	$0.679\pm 0.119$	$0.349\pm 0.055$	$0.588\pm 0.131$	$0.614\pm 0.145$
(iv) Published (Table 5)	$0.752\pm 0.064$	$0.449\pm 0.040$	$0.679\pm 0.067$	$0.723\pm 0.088$
YOLOv10s
(i) Unified (torchmetrics)	$0.660\pm 0.121$	$0.370\pm 0.068$	$0.950\pm 0.009$	$0.661\pm 0.034$
(ii) Ultralytics validator	$0.657\pm 0.124$	$0.373\pm 0.063$	$0.545\pm 0.077$	$0.684\pm 0.155$
(iii) Original rule, this run	$0.681\pm 0.119$	$0.364\pm 0.055$	$0.647\pm 0.200$	$0.623\pm 0.167$
(iv) Published (Table 5)	$0.701\pm 0.091$	$0.352\pm 0.088$	$0.651\pm 0.103$	$0.609\pm 0.147$
YOLOv11n
(i) Unified (torchmetrics)	$0.611\pm 0.062$	$0.365\pm 0.040$	$0.961\pm 0.024$	$0.624\pm 0.058$
(ii) Ultralytics validator	$0.611\pm 0.068$	$0.371\pm 0.044$	$0.763\pm 0.100$	$0.554\pm 0.185$
(iii) Original rule, this run	$0.618\pm 0.079$	$0.343\pm 0.050$	$0.760\pm 0.133$	$0.532\pm 0.204$
(iv) Published (Table 5)	$0.762\pm 0.083$	$0.432\pm 0.036$	$0.634\pm 0.112$	$0.790\pm 0.097$
RT-DETR-l
(i) Unified (torchmetrics)	$0.299\pm 0.112$	$0.152\pm 0.066$	$0.726\pm 0.094$	$0.417\pm 0.079$
(ii) Ultralytics validator	$0.298\pm 0.113$	$0.151\pm 0.067$	$0.763\pm 0.168$	$0.298\pm 0.126$
(iii) Original rule, this run	$0.306\pm 0.098$	$0.150\pm 0.068$	$0.765\pm 0.170$	$0.302\pm 0.122$
(iv) Published (Table 5)	$0.642\pm 0.132$	$0.286\pm 0.049$	$0.709\pm 0.134$	$0.575\pm 0.160$

Table 9. Training details of the detectors of Table 7; f is the fold index. The original benchmark of Table 5 trained the Ultralytics models for up to 150 epochs (patience 20) with batches of 32 (YOLO) and 16 (RT-DETR) images and no seed. YOLOv10s was re-run after the epoch limit had been reduced and was trained for at most 40 epochs in every fold.

	YOLOv8s, YOLOv10s, YOLOv11n, RT-DETR-l	Faster R-CNN A–D
Framework	Ultralytics 8.4.163	torchvision 0.26.0
Initialization	COCO-pretrained	ImageNet ResNet-50 backbone; other layers random
Optimizer	AdamW; learning rate 0.001429 (YOLO) or 0.0001 (RT-DETR-l), linear decay to 1%	SGD (momentum 0.9); 0.005, constant
Weight decay; warm-up	$5\times {10}^{-4}$ (YOLO) or $1\times {10}^{-4}$; 3 (YOLO) or 5 epochs	$5\times {10}^{-4}$; none
Batch × accumulation	$16\times 4$ (YOLO) or $8\times 8$	$4\times 2$
Input	640 (letterbox for YOLO)	$512\times 512$
Augmentation	mosaic (off in the last 10 epochs), translation 0.1, scale 0.5, horizontal and vertical flips (0.5), rotation up to ${180}^{\circ }$, no color jitter	none
Epoch limit	60 ($f=1$), 40 ($f=2$–5); 40 in all folds for YOLOv10s	25
Epochs run; best	40–55; 33–43 (YOLOv8s), 40–60; 36–56 (YOLOv11n), 30–60; 18–56 (RT-DETR-l), 40; 33–37 (YOLOv10s)	16–25; 10–25
Early stopping	patience 12, validation mAP@[.50:.95]	patience 6, validation mAP@0.50
Checkpoint	best validation mAP@[.50:.95] on the reporting fold (moving-average weights)	best validation mAP@0.50 on the reporting fold
Seed; precision	$42+f$, deterministic; fp16 AMP	$42+f$; fp16 AMP
Post-processing	NMS at IoU 0.7; none for YOLOv10s (one-to-one head, at most 300 boxes)	NMS at IoU 0.5, score $>0.05$

Table 9. Training details of the detectors of Table 7; f is the fold index. The original benchmark of Table 5 trained the Ultralytics models for up to 150 epochs (patience 20) with batches of 32 (YOLO) and 16 (RT-DETR) images and no seed. YOLOv10s was re-run after the epoch limit had been reduced and was trained for at most 40 epochs in every fold.

	YOLOv8s, YOLOv10s, YOLOv11n, RT-DETR-l	Faster R-CNN A–D
Framework	Ultralytics 8.4.163	torchvision 0.26.0
Initialization	COCO-pretrained	ImageNet ResNet-50 backbone; other layers random
Optimizer	AdamW; learning rate 0.001429 (YOLO) or 0.0001 (RT-DETR-l), linear decay to 1%	SGD (momentum 0.9); 0.005, constant
Weight decay; warm-up	$5\times {10}^{-4}$ (YOLO) or $1\times {10}^{-4}$; 3 (YOLO) or 5 epochs	$5\times {10}^{-4}$; none
Batch × accumulation	$16\times 4$ (YOLO) or $8\times 8$	$4\times 2$
Input	640 (letterbox for YOLO)	$512\times 512$
Augmentation	mosaic (off in the last 10 epochs), translation 0.1, scale 0.5, horizontal and vertical flips (0.5), rotation up to ${180}^{\circ }$, no color jitter	none
Epoch limit	60 ($f=1$), 40 ($f=2$–5); 40 in all folds for YOLOv10s	25
Epochs run; best	40–55; 33–43 (YOLOv8s), 40–60; 36–56 (YOLOv11n), 30–60; 18–56 (RT-DETR-l), 40; 33–37 (YOLOv10s)	16–25; 10–25
Early stopping	patience 12, validation mAP@[.50:.95]	patience 6, validation mAP@0.50
Checkpoint	best validation mAP@[.50:.95] on the reporting fold (moving-average weights)	best validation mAP@0.50 on the reporting fold
Seed; precision	$42+f$, deterministic; fp16 AMP	$42+f$; fp16 AMP
Post-processing	NMS at IoU 0.7; none for YOLOv10s (one-to-one head, at most 300 boxes)	NMS at IoU 0.5, score $>0.05$

The argument of Section 4.1 for choosing Faster R-CNN, that the YOLO models trade precision for recall and that precision governs fusion quality, is therefore not supported. At a score threshold of 0.5 the YOLO models are the more precise (0.953, 0.950, and 0.961 for YOLOv8s, YOLOv10s, and YOLOv11n against 0.868–0.906); at maximum F1, which removes the calibration difference, the Faster R-CNN configurations exceed YOLOv11n by 0.005–0.012, YOLOv8s by 0.016–0.023, and YOLOv10s by 0.021–0.028, of the order of the fold-to-fold SD (0.014–0.025); and in ship-class AP@0.50, YOLOv8s and YOLOv11n are 0.008–0.018 higher, while YOLOv10s is level (0.940 against 0.938–0.941). No significance test was computed, because the recipes differ. The re-benchmark supports that the Faster R-CNN backbone is on par with the three YOLO models on SSDD ships, not that it is more accurate, and that RT-DETR-l is less accurate and less stable under this schedule.

With the trained fold-1 checkpoints, measured as in Section 4.1.3 with no other compute process on the GPU, the end-to-end latency at batch size 1 is $8.29\pm 1.26$ ms in fp32 and $8.50\pm 0.86$ ms in fp16 for YOLOv8s, $10.07\pm 1.03$ and $10.85\pm 1.32$ ms for YOLOv11n, $35.47\pm 1.15$ and $29.27\pm 1.62$ ms for RT-DETR-l, and $9.03\pm 0.83$ and $10.08\pm 0.96$ ms for YOLOv10s, all within 1.0 ms of the COCO-weight timings of Table 10. Because the one-to-one head of YOLOv10s needs no non-maximum suppression, its end-to-end time comprises the input transform and transfer, the forward pass (6.65 ms alone in fp32), and a top-k selection of the output boxes. The deployed architecture (configuration D, 38.93 ms) thus takes 3.9 to 4.7 times as long per image as the YOLO models for a ship-class accuracy that is not higher.

Table 10. End-to-end detector latency (mean ± SD over 100 timed iterations after 20 warm-up iterations; NVIDIA GeForce RTX 3060, batch size 1, fp32, inference mode), parameter count, input side length after the model’s own resize, peak allocated GPU memory, and latency-weighted performance (LWP, Equation (4), $t_{\mathrm{ref}}=8.19$ ms). Block (a): benchmark detectors, whose mAP@0.50 is taken from Table 5 and was obtained under a different protocol from the timing; Faster R-CNN was timed with the weights of ablation configuration A, RetinaNet with untrained heads, and the YOLO and RT-DETR models with COCO weights. Block (b): ablation configurations, whose mAP@0.50 is from Table 6, timed with their fold-1 checkpoints. Block (c): the eight re-benchmarked detectors with the accuracy of Table 7 and the latency of their trained fold-1 checkpoints; accuracy and LWP are given as three-class mAP@0.50/ship-class AP@0.50. The accuracies of block (a) are project-record values; YOLOv10s, like YOLOv8s, YOLOv11n, and RT-DETR-l, is re-benchmarked in block (c), whereas RetinaNet was not re-run.

Detector	Params (M)	Input (px)	Latency (ms)	Peak (MB)	mAP@0.50	LWP
(a) Benchmark detectors (accuracy from Table 5)
Faster R-CNN R50-FPN	41.31	800	$61.45\pm 1.25$	476.7	0.821	0.097
RetinaNet R50-FPN	32.21	800	$52.53\pm 0.77$	320.9	0.345	0.047
YOLOv8s	11.17	640	$8.47\pm 1.31$	92.5	0.752	0.370
YOLOv10s	8.13	640	$8.19\pm 1.52$	78.4	0.701	0.350
YOLOv11n	2.62	640	$10.07\pm 8.19$	77.6	0.762	0.342
RT-DETR-l	32.97	640	$36.46\pm 9.44$	219.7	0.642	0.118
(b) Ablation configurations (this study; accuracy from Table 6)
A: Faster R-CNN	41.31	512	$37.94\pm 1.04$	298.6	0.723	0.128
B: +HMA	54.16	512	$38.73\pm 0.87$	348.8	0.820	0.143
C: +GTB	42.10	512	$37.82\pm 1.55$	302.8	0.776	0.138
D: +HMA+GTB	54.95	512	$38.93\pm 1.01$	351.8	0.761	0.132
(c) Re-benchmark (Table 7), trained weights; mAP@0.50/ship AP@0.50
YOLOv8s	11.13	640	$8.29\pm 1.26$	72.7	0.669/0.949	0.333/0.472
YOLOv10s	7.22	640	$9.03\pm 0.83$	89.5	0.660/0.940	0.314/0.447
YOLOv11n	2.58	640	$10.07\pm 1.03$	103.1	0.611/0.955	0.274/0.428
RT-DETR-l	31.99	640	$35.47\pm 1.15$	242.1	0.299/0.759	0.056/0.142
A: Faster R-CNN	41.31	512	$37.94\pm 1.04$	298.6	0.723/0.938	0.128/0.166
B: +HMA	54.16	512	$38.73\pm 0.87$	348.8	0.820/0.941	0.143/0.164
C: +GTB	42.10	512	$37.82\pm 1.55$	302.8	0.776/0.938	0.138/0.167
D: +HMA+GTB	54.95	512	$38.93\pm 1.01$	351.8	0.761/0.940	0.132/0.163

4.1.3. Latency and Latency-Weighted Performance

Detector latency was measured on one GPU (NVIDIA GeForce RTX 3060, 12 GB; PyTorch 2.11.0, torchvision 0.26.0, CUDA 12.8, and Ultralytics 8.4.163) with no other compute process running, at batch size 1 and fp32 precision in inference mode, over 20 warm-up and 100 timed iterations with CUDA synchronization, on a real SSDD validation image resized to $512\times 512$ pixels ($640\times 640$ for the Ultralytics models). The time is measured end to end, including the input transform and non-maximum suppression, and the peak memory is the maximum allocated GPU memory. The four ablation configurations used their fold-1 checkpoints. The Faster R-CNN of Table 5 was timed with the fold-1 weights of configuration A at the default $800/1333$ resize of the benchmark, RetinaNet with an ImageNet-initialized backbone and untrained heads, and the YOLO and RT-DETR models with their public COCO weights; their latency depends on the weights only through the number of boxes passed to non-maximum suppression. Table 10 reports the results. HMA adds 12.8 M parameters (its four MLPs) and 50 MB of peak memory but only about 1 ms of latency (37.94 to 38.73 ms), and GTB adds 0.8 M parameters and no measurable latency. The input resolution matters far more: the same Faster R-CNN weights take 61.45 ms at the $800/1333$ resize, against 37.94 ms at $512\times 512$. The single-stage YOLO models take 8.19–10.07 ms, between 3.8 and 4.8 times less than the ablation configurations, and RT-DETR-l takes 36.46 ms. The large standard deviations of YOLOv11n and RT-DETR-l arise in the end-to-end call; their forward pass alone takes $7.85\pm 0.90$ and $35.26\pm 2.10$ ms. At 38.93 ms per $512\times 512$ tile, the deployed architecture processes about 26 tiles per second at batch size 1 on this GPU.

To combine accuracy and computational time in one number, a latency-weighted performance (LWP) score is defined as

$$\mathrm{LWP}={\displaystyle \frac{\mathrm{mAP}@0.50}{1+t/t_{\mathrm{ref}}}},$$

(4)

where t is the end-to-end latency of Table 10 and $t_{\mathrm{ref}}=8.19$ ms is the lowest latency measured (YOLOv10s with COCO weights). A detector as fast as the reference retains half of its mAP@0.50, and the score decreases towards zero as latency grows; $t_{\mathrm{ref}}$ sets the exchange rate between accuracy and time and is a choice of this study. The work of Miuccio et al. [46] weights decoding performance against decoding latency; its exact formulation was not adopted, and Equation (4) is our own simple form of the same trade-off.

Block (a) of Table 10 combines the mAP@0.50 of the benchmark in Table 5 with the latencies measured here. It therefore mixes accuracies obtained under the benchmark protocol with timings measured under another, and the YOLO and RT-DETR timings use COCO weights at a $640\times 640$ input, so it is indicative only. On it, the YOLO models lead (YOLOv8s 0.370, YOLOv10s 0.350, and YOLOv11n 0.342), far ahead of RT-DETR (0.118), Faster R-CNN (0.097), and RetinaNet (0.047). Block (b) uses the accuracy and latency of this study for the four ablation configurations and ranges only from 0.128 (A) to 0.143 (B), because the configurations differ little in either quantity. Under a latency-weighted criterion, the Faster R-CNN family is thus at a clear disadvantage relative to single-stage detectors. Its choice for the pipeline rested on the strict-IoU accuracy of Table 5, because a false detection propagates into the fusion stage; the re-benchmark of Section 4.1.2, with trained weights and the evaluation code of this study, does not confirm an accuracy advantage on the ship class that would offset the latency cost. Block (c) removes the protocol mismatch of block (a): it combines the re-benchmark accuracy of Table 7 with the latency of the same trained checkpoints. On the ship class, YOLOv8s (LWP 0.472), YOLOv10s (0.447), and YOLOv11n (0.428) lead, the four Faster R-CNN configurations lie between 0.163 and 0.167, and RT-DETR-l is last (0.142); on the three-class mAP@0.50, YOLOv8s (0.333), YOLOv10s (0.314), and YOLOv11n (0.274) again lead the Faster R-CNN configurations (0.128–0.143). Recomputed with $t_{\mathrm{ref}}=5$, 10, or 20 ms, the ranking of the eight detectors is unchanged under either accuracy measure, so the conclusion does not depend on the choice of $t_{\mathrm{ref}}$.

4.2. Operational Fusion Outcomes

On the 12-day operational corpus, the fusion pipeline produced the stage-wise outcome counts of Table 11. These counts were produced by the static gate configuration of the platform at the time of the run, referred to below as the legacy static gate of the run. The project report describes it as a 5 km cap on every cost-matrix entry, but the code of that run was not retained, so it cannot be established whether it coincides with the legacy capped static gate $\min (5\mathrm{km},\mathrm{base})$ of Section 3.3 or with a fixed 5 km radius. The raw static-gate run yields 3217 confirmed, 1720 dark, and 106,062 spoof candidates; port-proximity filtering—which reclassifies the 114 dark detections lying within 5 nm of a known port as port-normal (dark $1720\to 1606$)—together with vessel-type and plausibility filters yields 3190 confirmed, 1606 dark, and 105,549 spoof candidates. We attribute this residual spoof-candidate volume mainly to the time gap between the SAR pass and the last AIS position available to the platform (Section 3.1), rather than to genuine spoofing. This attribution is consistent with the controlled evaluation of Section 4.3, in which temporal-sparsity demotion removes most spoof alerts, but it was not verified record by record. The Dynamic Kinematic Gate is designed to demote such artifacts while preserving the confirmed and dark contacts, and the reproducible evidence for that mechanism—the true-match recall gain and the alert-suppression factor—is the controlled evaluation in Section 4.3, which also shows that the 50 km ceiling can confirm dark contacts to unrelated AIS tracks (Section Association Baselines and Gate Sensitivity). Figure 6 illustrates the outcome classes.

Table 11. Operational SAR–AIS fusion outcomes across the two logged pipeline stages; all counts are logged from the operational corpus run under the legacy static gate of the run (Section 4.2); none has been adjudicated. Under this gate the spoof-candidate volume (105,549 after port-proximity filtering) is a flood that we attribute mainly to the time gap between the SAR pass and the last available AIS position, an attribution consistent with the controlled evaluation of Section 4.3 but not verified per record. The Dynamic Kinematic Gate is designed to demote these artifacts while preserving the confirmed and dark contacts; because the per-record operational split was not logged, its effect is quantified reproducibly in the controlled evaluation of Section 4.3 rather than tabulated here.

Pipeline Stage	Confirmed	Dark	Spoof Candidates
Raw (legacy static gate of the run)	3217	1720	106,062
After port-proximity filter (5 nm)	3190	1606	105,549

Figure 6. Four operational outcome categories from the bidirectional fusion; all values shown are illustrative, but the gate radii are computed with the production gate function. (a) Confirmed: SAR matches interpolated AIS within the gate (gate $=11.3$ km at $\Delta t=12$ min, SOG 12 kn, CEP 50 m; matching confidence $1-C_{ij}=1-185/11,312=0.984$; the vessel identity is an anonymized placeholder). (b) Dark: high-confidence SAR detection with no AIS contact within the 50 km ceiling; the staleness (14.2 h) and dead-reckoned CEP (28.4 km) shown belong to the nearest candidate AIS track, which lies outside the gate. (c) Spoof candidate: AIS broadcast with no SAR echo at small $\Delta t$ (gate $=22.4$ km at SOG 8.3 kn, $\Delta t=0.4$ h). (d) Identity laundering: AIS declares a small craft while the SAR bounding box measures $\approx 180$ m; the flag is a deterministic rule, not a calibrated probability, and is routed to analyst review.

4.3. Controlled Evaluation of the Dynamic Kinematic Gate

To isolate the DKG mechanism reproducibly, we generated 200 controlled synthetic scenes (seed 42) with known ground truth, in which the interpolation residual of each true match grows with speed and staleness (accumulated dead-reckoning error), plus dark, genuine-spoof, and latency-artifact contacts. Both gates were run through the identical deployed matcher (sar_correlator.match_scene). The baseline is the legacy code path described in Section 3.3, referred to hereafter as the legacy capped static gate, $\min (5\mathrm{km},\mathrm{base})$ with $\mathrm{base}=\max (g_0,2{\mathrm{CEP}}_j,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})$: the floor terms of Equation (3) capped at 5 km, with no staleness term and no temporal-sparsity demotion. Because its radius reaches 5 km only when $2{\mathrm{CEP}}_j\ge 5$ km, it is not equivalent to a fixed 5 km radius, which attains a recall of 0.705 on the same scenes (Section Association Baselines and Gate Sensitivity). The scenes contain 2375 ground-truth SAR↔AIS pairs, 2980 SAR detections, and 4736 AIS broadcasts. Table 12 and Figure 7 report the result: the legacy capped static gate misses fast/stale true matches (recall 0.650) and surfaces 3107 spoof alerts; the DKG raises recall to 0.878 (+22.8 pp) while cutting spoof alerts to 764 (a $4.1\times$ reduction) and demoting 993 stale unmatched broadcasts to the silent class. This is a controlled characterization of the algorithm, not a re-measurement of the operational corpus. It shows that the DKG together with the temporal-sparsity rule recovers genuine matches that the legacy gate loses and suppresses the alert flood; Section Association Baselines and Gate Sensitivity separates the contributions of the enlarged radius and of the demotion rule, and shows that the alert reduction is due to the latter.

Figure 7. Controlled synthetic evaluation of the DKG (200 scenes, seed 42). The bar labeled “Static 5 km gate” is the legacy capped static gate, $\min (5\mathrm{km},\mathrm{base})$, not a fixed 5 km radius. (Left) true-match recall; the DKG recovers fast/stale matches the legacy gate misses. (Right) operator-surfaced spoof alerts (lower is better); the DKG with temporal-sparsity demotion reduces the alert flood $4.1$-fold, a reduction produced by the demotion rule (Section Association Baselines and Gate Sensitivity).

Table 12. Controlled synthetic evaluation of the Dynamic Kinematic Gate (200 scenes, seed 42), run through the deployed matcher. Recall is over ground-truth SAR↔AIS pairs. The baseline is the legacy capped static gate, $\min (5\mathrm{km},\mathrm{base})$; further baselines are given in Table 13.

Gate	True-Match Recall	Spoof Alerts	Demoted (Silent)	Alert Reduction
Legacy capped static	0.650	3107	0	—
Dynamic (DKG)	0.878	764	993	4.1×

Table 12. Controlled synthetic evaluation of the Dynamic Kinematic Gate (200 scenes, seed 42), run through the deployed matcher. Recall is over ground-truth SAR↔AIS pairs. The baseline is the legacy capped static gate, $\min (5\mathrm{km},\mathrm{base})$; further baselines are given in Table 13.

Gate	True-Match Recall	Spoof Alerts	Demoted (Silent)	Alert Reduction
Legacy capped static	0.650	3107	0	—
Dynamic (DKG)	0.878	764	993	4.1×

Table 13. Association baselines on the 200 controlled synthetic scenes of Table 12 (seed 42; 2375 ground-truth pairs, 2980 SAR detections, 4736 AIS broadcasts), all run through the deployed matcher. Recall is micro-averaged over ground-truth pairs; per-scene recall is the mean ± SD over the 200 scenes. “Demoted” counts unmatched AIS broadcasts routed to the silent temporal-sparsity class; false confirmations are confirmed pairs that are not ground-truth pairs. $\mathrm{base}=\max (g_0,2{\mathrm{CEP}}_j,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})$. Greedy association was scored on recall only.

Gate	Recall	Per-Scene Recall	Spoof Alerts	Demoted	False Confirmations
Fixed 1 km	0.204	$0.206\pm 0.123$	4234	0	17
Fixed 2 km	0.397	$0.396\pm 0.160$	3745	0	49
Fixed 5 km	0.705	$0.705\pm 0.149$	2878	0	184
Fixed 10 km	0.909	$0.913\pm 0.092$	2187	0	391
Fixed 20 km	0.878	$0.884\pm 0.108$	1920	0	730
Fixed 50 km	0.879	$0.882\pm 0.108$	1757	0	891
Legacy capped static, $\min (5\mathrm{km},\mathrm{base})$	0.650	$0.651\pm 0.156$	3107	0	85
CEP-only, $\max (g_0,2{\mathrm{CEP}}_j)$	0.881	$0.885\pm 0.103$	2562	0	81
Speed-only, $\max (g_0,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})$	0.010	$0.010\pm 0.028$	4712	0	0
DKG, demotion disabled	0.878	$0.883\pm 0.109$	1757	0	893
DKG (full, deployed)	0.878	$0.883\pm 0.109$	764	993	893
Greedy nearest neighbor, DKG gate	0.903	$0.909\pm 0.100$	—	—	—

Table 13. Association baselines on the 200 controlled synthetic scenes of Table 12 (seed 42; 2375 ground-truth pairs, 2980 SAR detections, 4736 AIS broadcasts), all run through the deployed matcher. Recall is micro-averaged over ground-truth pairs; per-scene recall is the mean ± SD over the 200 scenes. “Demoted” counts unmatched AIS broadcasts routed to the silent temporal-sparsity class; false confirmations are confirmed pairs that are not ground-truth pairs. $\mathrm{base}=\max (g_0,2{\mathrm{CEP}}_j,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})$. Greedy association was scored on recall only.

Gate	Recall	Per-Scene Recall	Spoof Alerts	Demoted	False Confirmations
Fixed 1 km	0.204	$0.206\pm 0.123$	4234	0	17
Fixed 2 km	0.397	$0.396\pm 0.160$	3745	0	49
Fixed 5 km	0.705	$0.705\pm 0.149$	2878	0	184
Fixed 10 km	0.909	$0.913\pm 0.092$	2187	0	391
Fixed 20 km	0.878	$0.884\pm 0.108$	1920	0	730
Fixed 50 km	0.879	$0.882\pm 0.108$	1757	0	891
Legacy capped static, $\min (5\mathrm{km},\mathrm{base})$	0.650	$0.651\pm 0.156$	3107	0	85
CEP-only, $\max (g_0,2{\mathrm{CEP}}_j)$	0.881	$0.885\pm 0.103$	2562	0	81
Speed-only, $\max (g_0,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})$	0.010	$0.010\pm 0.028$	4712	0	0
DKG, demotion disabled	0.878	$0.883\pm 0.109$	1757	0	893
DKG (full, deployed)	0.878	$0.883\pm 0.109$	764	993	893
Greedy nearest neighbor, DKG gate	0.903	$0.909\pm 0.100$	—	—	—

Association Baselines and Gate Sensitivity

To test whether the advantage of the DKG is specific to the legacy capped baseline, the same 200 scenes were run through the deployed matcher with ten further association strategies (Table 13, Figure 8): fixed radii of 1, 2, 5, 10, 20, and 50 km applied to every AIS broadcast; a CEP-only radius $\max (g_0,2{\mathrm{CEP}}_j)$ and a speed-only radius $\max (g_0,\kappa \sqrt{1+v_j/v_{\mathrm{ref}}})$, both without a cap and without the staleness term; the full DKG radius with the temporal-sparsity demotion disabled; and greedy nearest-neighbor association within the full DKG gate. As in the deployed code, the fixed, CEP-only, speed-only, and legacy gates are invoked without a SAR capture time and therefore perform no temporal-sparsity demotion. A false confirmation is a confirmed SAR–AIS pair that is not a ground-truth pair. The four DKG parameters were then varied one at a time around their defaults (Table 14, Figure 9); the $v_{\max }$ sweep changes both the staleness term of the gate and the radius of the demotion rule.

Figure 8. Association baselines on the 200 controlled synthetic scenes (seed 42), run through the deployed matcher. (a) Micro-averaged true-match recall. (b) Spoof-candidate alerts surfaced to the operator (lower is better; greedy association was scored on recall only and is omitted). “Legacy capped” is $\min (5\mathrm{km},\mathrm{base})$. Values are those of Table 13.

Table 14. One-at-a-time sensitivity of the DKG (full, with temporal-sparsity demotion) on the same 200 synthetic scenes; defaults are marked with an asterisk, and all other parameters are held at their defaults. Settings with identical results are merged into one row.

Setting	Recall	Spoof Alerts	Demoted	False Confirmations
$g_0\in \{100,200*,500\}$ m	0.878	764	993	893
$g_0=1000$ m	0.879	761	996	892
$\kappa \in \{25,50*,100,200\}$ m	0.878	764	993	893
$v_{\max }=20$ kn	0.872	812	945	908
$v_{\max }=30*$ kn	0.878	764	993	893
$v_{\max }=40$ kn	0.877	730	1027	895
$g_{\max }=10$ km	0.909	829	1359	388
$g_{\max }=25$ km	0.879	734	1131	784
$g_{\max }=50*$ km	0.878	764	993	893
$g_{\max }=100$ km	0.884	839	917	881

Figure 9. One-at-a-time sensitivity of the DKG on the 200 controlled synthetic scenes (seed 42): true-match recall (solid, left axis) and spoof-candidate alerts (dashed, right axis) versus the gate floor $g_0$, the speed coefficient $\kappa$, the maximum vessel speed $v_{\max }$, and the gate ceiling $g_{\max }$. Dotted vertical lines and asterisks mark the defaults. Values are those of Table 14.

Four findings qualify the result of Table 12. First, on these scenes the alert reduction is produced by the temporal-sparsity demotion, not by the speed-scaled radius. A vessel at $v_{\max }=30$ kn covers 50 km in about 0.9 h, whereas the staleness of the generated true pairs ranges from 0.2 to 8 h, so the DKG radius sits at the 50 km ceiling for 2161 of the 2375 true-pair AIS broadcasts (91%). Without demotion the DKG therefore behaves as a fixed 50 km gate (both surface 1757 spoof alerts), and the reduction from 1757 to 764 alerts is due entirely to the demotion rule.

Second, false confirmations rise steeply with the gate size, from 17 at 1 km to 391 at 10 km and 891 at 50 km. In scenes this dense, almost every dark contact finds some AIS broadcast within 50 km: under the fixed 50 km gate, 604 of the 605 synthetic dark SAR contacts were confirmed to an AIS track and thereby removed from the dark class. This is a direct threat to dark-vessel detection, because a dark vessel that is wrongly confirmed is never surfaced to the analyst. A fixed 10 km gate attains a higher recall than the DKG (0.909 versus 0.878) with fewer than half of its false confirmations (391 versus 893), although, lacking demotion, it surfaces more spoof alerts (2187).

Third, recall is not monotone in the gate size. No true pair lies farther than 8014 m from its AIS interpolation (the generator caps the injected residual at 8 km, so a 10 km gate encloses every true pair by construction), yet the fixed 50 km gate misses 287 true pairs. The cause is the assignment objective rather than distance: because out-of-gate and padding cells carry the finite cost ${10}^9$ (Section 3.4), the solver first maximizes the number of in-gate pairs, and with wide gates dark SAR contacts and distractor AIS broadcasts become assignable, so the optimum re-pairs some true pairs to increase the pair count; all 287 missed SAR detections were confirmed to a different AIS broadcast. The same mechanism explains why greedy nearest-neighbor association within the DKG gate slightly exceeds Hungarian assignment on these mixed scenes (recall 0.903 versus 0.878), whereas Hungarian assignment is superior on the dense clustered scenes of Section 4.4 (0.853 versus 0.793), in which every candidate is a genuine vessel and global optimality resolves local ambiguity. The CEP-only radius reaches a recall of 0.881 with only 81 false confirmations, but this is partly an artifact of the generator, which sets the CEP of each true-pair AIS broadcast to half of its injected residual; the speed-only radius, whose speed term does not exceed $\kappa \sqrt{1+28}\approx 270$ m at the highest simulated speed of 28 kn, is far too small (recall 0.010).

Fourth, the sweep of Table 14 shows that $g_0$ and $\kappa$ are immaterial in this regime: $g_0$ between 100 and 500 m and every tested $\kappa$ leave all four metrics unchanged, and $g_0=1000$ m changes them only marginally, because the staleness term dominates the floor terms. $v_{\max }$ acts through both the gate and the demotion radius: at 20 kn, spoof alerts rise to 812 and demotions fall to 945, whereas at 40 kn alerts fall to 730. The ceiling $g_{\max }$ is the decisive parameter. At $g_{\max }=10$ km, recall rises to 0.909 and false confirmations fall to 388, while spoof alerts (829) stay close to the default (764), because the demotion radius $v_{\max }\Delta t_j$ is not capped by $g_{\max }$; at 25 km, recall is unchanged (0.879) and both spoof alerts (734) and false confirmations (784) decrease. On these scenes a ceiling of 10–25 km would therefore be preferable to the deployed 50 km, with 10 km giving the best trade-off.

These are controlled synthetic results. All contacts of a scene lie within roughly $\pm 0.5^{\circ }$ of a common center, so the AIS density is high, and the residual distribution, staleness range, and scene composition are design choices of the generator rather than measurements of the operational corpus. The operational ceiling $g_{\max }=50$ km has not been re-tuned in light of these results, and the per-record operational outcome split needed to do so was not logged (Section 5.4).

4.4. Matcher Ablation: Hungarian Versus Greedy

On dense clustered synthetic scenes (5–9 vessels within ∼2 km, seed 42), optimal Hungarian assignment recovers a correct-match rate of 0.853 versus 0.793 for greedy nearest-neighbor association—a 6.0-percentage-point advantage that arises precisely where local greedy choices are globally sub-optimal, as in dense port approaches. The advantage is not universal: on the 200 mixed scenes of Section Association Baselines and Gate Sensitivity, greedy association within the DKG gate slightly exceeds the deployed Hungarian matcher (recall 0.903 versus 0.878), because the finite padding cost makes the Hungarian optimum maximize the number of in-gate pairs, including pairs formed with dark contacts and distractor broadcasts. Hungarian assignment is therefore preferable in dense clustered scenes, at negligible cost for the small per-scene cardinalities encountered here, but it is not uniformly superior, and a gate-aware cost formulation that does not reward the number of pairs is a direction for future work.

4.5. Assignment Complexity, Measured

Figure 10 reports wall-clock solve time for linear_sum_assignment on random cost matrices of dimension $n\in [8, 1024]$ (25 repetitions each; Python 3.14, NumPy 2.4.1). A log–log fit over the largest sizes gives an empirical exponent of ≈2.2, consistent with the practical sub-cubic behavior of the Jonker–Volgenant solver, whose worst-case bound remains $O\left(N^3\right)$. Because per-scene cardinalities are of order tens, assignment is never the pipeline bottleneck.

Figure 10. Measured Hungarian solve time versus cost-matrix dimension (25 repetitions; error bars $\pm 1$ SD). The dashed line is an $O\left(n^3\right)$ reference; the measured exponent is ≈2.2.

4.6. Fusion Architecture Ablation

Table 15 contrasts four configurations on the operational task. AIS-only detection cannot see transponder-off vessels by construction; SAR-only detection yields the 4937 radar detections that entered fusion (Section 3.1) but attributes identity to none, and 1720 of them had no AIS partner under the legacy static gate of the run; static-gate fusion flags 1606 dark detections after port-proximity filtering but floods the operator with 105,549 spoof candidates; the bidirectional DKG configuration is designed to retain dark detection while demoting the artifacts to which we attribute that flood, and it applies the identity-laundering rule (an AIS-declared small-craft class contradicted by a SAR length over 50 m), whose operational count was not logged. The controlled evaluation (Section 4.3) quantifies the recall gain and the $4.1\times$ alert suppression reproducibly, attributes the suppression to the temporal-sparsity demotion, and shows that the 50 km ceiling puts dark detection at risk, because wide gates confirm dark contacts to unrelated AIS tracks (Section Association Baselines and Gate Sensitivity). The operational dark count under the DKG was therefore not assumed to equal the static-gate count and is not reported.

Table 15. Fusion architecture ablation on the operational task. The dark-detection and static-gate alert counts are measured from the operational corpus under the legacy static gate of the run (Section 4.2), after port-proximity filtering; the DKG’s alert-suppression and true-match-recall effects are quantified reproducibly in the controlled evaluation of Section 4.3, and its false-confirmation cost in Section Association Baselines and Gate Sensitivity.

Configuration	Dark	Surfaced Alerts	ID Laundering	Notes
AIS-only (companion classifier)	0	—	0	Blind to transponder-off vessels
SAR-only (SLA-Net)	n/a	—	0	4937 detections entered fusion, none attributed; 1720 had no AIS partner under the static gate
Static gate of the run	1606	105,549	0	Alert flood; operationally unusable
Bidirectional + DKG (ours)	—	—	not logged	Controlled eval: recall $+23$ pp over the legacy capped static gate; spoof alerts cut $4.1\times$ by temporal-sparsity demotion; 893 false confirmations, against 391 for a fixed 10 km gate (Section 4.3 and Section Association Baselines and Gate Sensitivity)

The DKG’s operational dark and surfaced-alert counts were not logged per record (—); its suppression and recall effects are established in the controlled evaluation (Section 4.3), which also shows that wide gates can confirm dark contacts to unrelated AIS tracks (Section Association Baselines and Gate Sensitivity), so the static-gate dark count cannot be carried over.

4.7. OSINT Attribution and Explainability

Flagged contacts route to the OSINT layer, which returns a dossier of registry documents. No adjudicated set of vessel identities exists, so no precision, recall, or adjudicated accuracy can be given for this layer. It was instead characterized with two measures that do not require ground truth. For identity consistency, 2000 vessels were sampled at random (seed 42) from the 76,252 vessel-static records (MMSIs) that carry an IMO number and at least one ownership or inspection document keyed on it, and the dossier lookup of the deployed service was applied to each. Table 16 reports how often the registry documents agree with the AIS-declared static record, and Figure 11 shows the corpus composition.

Table 16. Identity consistency between the AIS-declared vessel-static record and the OSINT registry documents on 2000 randomly sampled vessels (seed 42), with Wilson 95% confidence intervals. These are internal-consistency rates between two independently populated sources, not precision against ground truth.

Measure	Vessels	Rate, % (95% CI)
IMO number passes the check-digit rule	2000/2000	100 [99.8, 100]
IMO number appears on a single MMSI	1954/2000	97.7 [97.0, 98.3]
Name agrees with at least one document	1797/1995	90.1 [88.7, 91.3]
Name agrees with every document	1439/1995	72.1 [70.1, 74.1]
Flag comparable (static and document flag known)	1664/2000	83.2 [81.5, 84.8]
Flag agrees with at least one document	1194/1664	71.8 [69.5, 73.9]
Flag agrees with every document	1183/1664	71.1 [68.9, 73.2]
At least one ownership record	1981/2000	99.1 [98.5, 99.4]
Beneficial-owner field present	228/2000	11.4 [10.1, 12.9]
Any company field present (beneficial owner, operator, or manager)	741/2000	37.1 [35.0, 39.2]
ISM manager present in inspection records	1080/2000	54.0 [51.8, 56.2]
Documents per vessel, median (IQR): all rows	2000	10 (4–22)
Documents per vessel, median (IQR): distinct	2000	5 (2–11)

Figure 11. OSINT corpus document count per report type (total 1,244,050 rows, dark bars, of which 628,718 are distinct payloads, light bars; Table 2). Inspections dominate; ownership records (238,736 rows) are the most relevant to attribution but are frequently incomplete: only 11.4% of sampled vessels have a beneficial-owner field (Table 16).

An agreement does not prove that an identity is correct, and a disagreement may reflect a renaming or reflagging after a document was written. With that caveat, two findings bear on attribution. First, the IMO number is a dependable join key: it passes the check-digit rule for every sampled vessel and maps to a single MMSI for 97.7%, and the registry name agrees with the AIS name in at least one document for 90.1% of vessels. Second, ownership evidence is thin: although 99.1% of the vessels have an ownership record, only 11.4% carry a beneficial-owner field and 37.1% any company field, which limits the ownership edges available to the SNA layer. The flag agrees for 71.8% of the 83.2% of vessels whose flags can be compared; the disagreements are candidates for analyst review, not evidence of flag fraud.

For sanctions screening, the corrected description of Section 3.5 applies: the deployed service downloads the OFAC SDN list but never compares it with vessels, so its screening recall and false-positive rate cannot be computed. To show what a simple screener achieves on these data, two reference screeners that are not deployed were evaluated offline against the SDN list downloaded on 25 September 2026 (19,391 entries, 1540 vessels, 1525 of them with an IMO number): R1 matches the normalized SDN vessel name or an alias together with the flag, and R2 the name or alias alone. Of the 1525 listed vessels with an IMO number, 1327 (87.0%) occur in the vessel-static table, on 1390 MMSI records; these IMO matches are the reference against which name matching is scored (Table 17).

Table 17. Offline sanctions screening against the OFAC SDN list (downloaded 25 September 2026). R1 and R2 are reference screeners defined for this evaluation, not deployed. Recall is over the 1390 vessel-static records whose IMO number is on the list; the false-positive rate is over the 1958 sampled vessels of Table 16 whose IMO number and MMSI are not on the list; the last column counts flagged non-listed records in the full vessel-static Table (1,951,258 records). Brackets give Wilson 95% confidence intervals.

Screener	Recall	False-Positive Rate	Non-Listed Flagged
R1: name or alias and flag	0.514 [0.488, 0.541] (715/1390)	0.0005 [0.0001, 0.0029] (1/1958)	191
R2: name or alias, any flag	0.670 [0.645, 0.694] (931/1390)	0.0138 [0.0095, 0.0200] (27/1958)	11,761
Deployed service	not computable: no vessel–SDN matching is implemented

Name matching thus misses a third to a half of the listed vessels that an IMO match finds, and widening it to any flag multiplies the false alarms: over the full static table R2 flags 11,761 non-listed records, against 191 for R1. IMO-based matching should therefore be the primary screening key once matching is added to the service. The list is about six months newer than the AIS and OSINT data, so some designations postdate the data and some delistings are not reflected. These are screening measures relative to IMO matching, not sanctions-screening accuracy against adjudicated cases.

Within these limits, every attribution decision is explainable by construction: the outcome class follows a stated rule (e.g., identity laundering is triggered deterministically when a matched AIS declares a small-craft class and the SAR length exceeds 50 m), the matching confidence is $1-C_{ij}$ from the assignment cost, and each dossier document carries its report type. We emphasize that the identity-laundering “confidence 1.0” is a deterministic rule flag, not a calibrated probability; calibration against adjudicated outcomes is deferred (Section 5.4).

4.8. Social Network Analysis on Real Traffic

This section examines the graph that the deployed SNA code builds from real data. One region-month was chosen on position count before any graph was built: the Persian Gulf and Strait of Hormuz box (23–30° N, 48–58° E) in February 2026, with 6,419,282 de-duplicated AIS positions of the history backfill (Section 3.1) from 16,121 vessels. The deployed graph-construction methods were run unmodified, and their database queries were ported to the exported data following the rules of Section 3.5, with ego expansion to two hops from every vessel seen in the box. Because the SAR correlation tables are not part of the export and no record carries the field read by the flag-edge code, the graph has no dark-proximity and no flag edges; it is the graph of the endpoint’s default edge types (STS, ownership, and port call), without the 3000-node cap. The Strait of Malacca box (1–6° N, 95–105° E) in the same month serves as a secondary check. Table 18 summarizes both graphs.

Table 18. Real SNA graphs built with the deployed edge rules from one month of AIS data (February 2026; default edge types STS, ownership, and port call; no node cap). Betweenness is estimated from $k=100$ sampled sources (seed 42), as in the deployed service, with $k=1000$ as a stability check. SDN-linked vessels are vessels in the box whose IMO number or MMSI is on the OFAC SDN list.

Statistic	Persian Gulf	Strait of Malacca
AIS positions/vessels in the box	6,419,282/16,121	4,981,443/14,274
Nodes (vessels/companies/ports)	27,991 (26,368/1544/79)	29,199 (26,554/2607/38)
Edges: STS/ownership/port call	25,468/16,428/9666	181,183/23,536/4887
Edges: dark proximity/flag	0/0	0/0
Louvain communities (isolated vessels)	7218 (6954)	4536 (4059)
Modularity	0.829	0.532
Largest connected component (nodes)	20,419	23,852
Degree: median/90th percentile/maximum (a port)	1/6/1240	1/24/1232
Maximum betweenness (a port)	0.1008	0.0780
Top vessel: rank among all nodes by betweenness	18	26
Top vessel: ratio to next vessel, $k=100$/$k=1000$	1.49/1.33	1.02/1.04
Top-10 vessels shared between $k=100$ and $k=1000$	2 of 10	1 of 10
Vessels with betweenness $\ge 10\times$ the all-node mean	325	388
SDN-linked vessels: number/median betweenness/in top 100	286/0/8	252/0/1

Three findings emerge. First, the real graph is dominated by port hubs rather than by vessel bridges. The degree distribution is highly skewed (median 1, 90th percentile 6, maximum 1240, held by a port), 6954 of the 26,368 vessel nodes are isolated, and Louvain partitions the graph into 7218 communities with a modularity of 0.829, most of them single isolated vessels. The highest betweenness (0.1008) belongs to a port, and the 17 nodes ranked above the top vessel are 14 ports and three companies. Figure 12 shows the two-hop ego network of that top vessel: a fishing vessel of degree 2 whose only edges are port calls at two ports, so that its betweenness arises from linking two port hubs, not from ownership or transfer links.

Figure 12. Two-hop ego network of the vessel with the highest sampled betweenness ($k=100$) in the real SNA graph of the Persian Gulf box (23–30° N, 48–58° E), February 2026, built with the deployed edge rules (STS, ownership, and port-call edges; no dark-proximity or flag edges are available in the exported data). Of the 422 nodes of the ego network, 300 are drawn: the seed, its neighbors, and the two-hop nodes of highest betweenness. The starred seed V* is a fishing vessel of degree 2 whose betweenness arises from port-call edges to two port hubs (P1 and P2); it is not a bridge between ownership or transfer communities. Colors are Louvain communities of the full graph; circles are vessels and triangles ports. Identifiers are anonymized.

Second, no vessel stands out as a bridge. Under the criterion adopted for this evaluation, a betweenness at least three times that of the next-highest vessel, the ratio is 1.49 in the Gulf (1.33 when betweenness is estimated from $k=1000$ rather than 100 sampled sources) and 1.02 in Malacca. The alternative criterion of ten times the mean is not selective in this skewed distribution: the top Gulf vessel exceeds the all-node mean 141-fold, but 325 vessels exceed ten times the mean. The ranking is also unstable under the sampling of the estimator: only two of the top-10 Gulf vessels under $k=100$ remain in the top 10 under $k=1000$ (1 of 10 in Malacca), although the rank correlation over all vessels is high (Spearman 0.98). In Figure 13, the top vessel is the extreme of a continuous tail rather than an isolated outlier. Sanctions exposure does not stand out either: the 286 SDN-linked vessels in the Gulf box have a median betweenness of 0, and eight of them are among the 100 vessels of highest betweenness.

Figure 13. Distributions of (a) degree and (b) sampled betweenness ($k=100$) of the 26,368 vessel nodes of the real SNA graph of the Persian Gulf box, February 2026 (log scales; the 6954 isolated vessels and the 19,282 vessels with zero betweenness). The dashed line marks V*, the vessel of highest betweenness in Figure 12, which links two port hubs; its betweenness is 1.49 times that of the next vessel, the extreme of a continuous tail rather than an isolated outlier.

Third, the STS rule is not selective on real traffic. It produced 25,468 STS edges in the Gulf in one month and 181,183 in Malacca, most of them among vessels waiting at anchorages more than 2 nautical miles from any port point, such as the Singapore Strait anchorages. The median Gulf event consists of five shared 5-min buckets spread over 7.1 h (seven buckets over 20 h in Malacca), because the duration rule measures the span between the first and the last shared bucket rather than continuous co-location. These edges are rule outputs, not confirmed transfers, and they are the main reason why the Malacca graph is denser and less modular (modularity 0.532).

The bridge-vessel evidence path that motivated the SNA layer, in which a vessel links a shell-company ownership cluster to a separate transfer network, therefore remains a design hypothesis that was not observed in these data. Before betweenness can be used for prioritization, port nodes must be down-weighted or excluded from the shortest-path computation, the STS rule must require continuous co-location and exclude anchorages, and a larger betweenness sample must stabilize the ranking. Vessel identifiers in the figures are anonymized, and a high network position is not evidence of wrongdoing: any vessel surfaced by the graph is a candidate for analyst review under the safeguards of Section 5.5.

5. Discussion

5.1. Operational Implications

The pipeline is designed to convert a raw detection stream into a small, prioritized, evidence-backed alert set. The controlled evaluation shows how this is achieved and where it is limited: the DKG with temporal-sparsity demotion recovers genuine fast/stale matches that the legacy capped static gate loses (recall $0.65\to 0.88$) and suppresses the spoof-alert flood ($4.1\times$ fewer spoof alerts), but the suppression is produced by the demotion rule rather than by the enlarged radius (Section Association Baselines and Gate Sensitivity). On the operational corpus, we attribute the static-gate flood to the time gap between the SAR pass and the last AIS position available to the platform: the live AIS tables re-poll a vessel a median of every 3.8 h (Section 3.1), and a vessel at 30 kn covers about 55.6 km per hour of AIS silence, so a 5 km gate can mislabel the resulting geometric mismatch as spoofing. This attribution is consistent with the controlled evaluation (Section 4.3) but was not verified record by record, because the per-record outcomes of the run were not logged. Under the DKG, displacements up to the 50 km ceiling are absorbed by the gate, and longer ones are handled by temporal-sparsity demotion rather than by further enlarging the radius (Section 3.3). The operational lesson is that alert triage and association radius should be tuned separately. Demotion is what keeps the analyst queue manageable, whereas the radius trades recall against false confirmations: on the synthetic scenes, a fixed 50 km gate confirmed 604 of the 605 dark contacts to some AIS track, and a 10 km ceiling combined with demotion raised recall to 0.909 and retained most of the alert reduction (829 alerts) while cutting false confirmations from 893 to 388. Because a falsely confirmed dark vessel is silently lost to the analyst, a deployment should favor the smaller ceiling and log per-record outcomes to confirm the choice operationally.

For the attribution stages, the measured results define what an analyst can rely on. The IMO number is a dependable join key between AIS and registry records, and registry names corroborate the AIS name for nine in ten sampled vessels, so the dossier supports identity corroboration. Ownership chains, by contrast, are available for a minority of vessels (a company field for 37.1%), sanctions status must at present be checked by the analyst because the service does not match vessels against the SDN list, and the SNA ranking on real traffic is driven by port hubs and anchorage clusters. The graph should therefore be read as context around a vessel already flagged by fusion or by its dossier, not as an independent source of prioritization.

5.2. Error Analysis

Several failure modes bound the system and must be stated plainly. Missed detections: the benchmark recall of $0.63$ of the Faster R-CNN backbone (Table 5) implies genuine misses, although that value is a mAR@100 averaged over IoU 0.50–0.95 and not the fraction of ships found (Section 4.1.2). The failure analysis of the ablation detectors (ship class, IoU 0.50, score threshold 0.5, pooled over the 1160 held-out images with 2587 ship boxes) shows where they occur: configuration A misses 153 ships (5.9%), of which 71% are small (box area below ${32}^2$ pixels) and 44% lie in dense clusters (at least three ship centers within 60 pixels), and configuration D misses 149 (5.8%; 67% small and 42% in dense clusters). The misses are thus concentrated on small vessels near the resolution limit and in dense groups (Figure 14); sub-300-GT craft may be undetected in both AIS and SAR. False alarms: speckle, azimuth ambiguities, and strong ocean-surface returns can produce spurious SAR detections that enter the matrix as false dark/spoof outcomes; the land–sea mask mitigates but does not eliminate shoreline clutter, and it is applied inside the network only on the API service path (Section 3.1). In the same analysis, A produces 342 false alarms (61% small and 25% in dense clusters) and D 349 (60% small and 21% in dense clusters). On one harbor image, the false alarms fall from 16 under A to five under D, most of them at bright shore structures (Figure 14), but the totals show no overall reduction. Because SSDD has no land raster and the proxy mask was rejected (Section 4.1.1), false alarms could not be attributed to the shoreline, and the ablation cannot show whether land suppression by HMA would reduce them. Dense-port ambiguity: where many vessels lie within mutual gate range, even optimal assignment can mismatch nearest neighbors; the Hungarian optimum reduces but does not remove this (Section 4.4), and wide gates add a second failure mode, in which dark contacts and distractor broadcasts are confirmed to unrelated partners (Section Association Baselines and Gate Sensitivity). Sea state: high sea state raises the ocean clutter floor and degrades small-target detectability; our corpus does not stratify by sea state, so this effect is uncharacterized here. AIS latency and spoofing: the DKG addresses latency, but a sophisticated adversary can spoof a plausible kinematic track; identity-laundering detection catches only the crude case of class falsification contradicted by physical size. OSINT uncertainty: beneficial ownership is frequently concealed behind nominee directors, and registry updates lag transfers by weeks; ownership recovery is therefore incomplete and time-lagged. In the sampled dossiers only 11.4% of vessels carry a beneficial-owner field (Table 16), and fuzzy company-name merging can join distinct companies with similar names. Quantifying these rates requires labeled ground truth that is not available in this study and is specified as future annotation work.

Figure 14. Detector failure cases on held-out SSDD folds (best-validation checkpoints); the three images were selected under configuration A. Green boxes are ground-truth ships, and red dashed boxes are ship predictions with a score of at least 0.5. Top row: Faster R-CNN (configuration A); bottom row: +HMA+GTB (configuration D) on the same images. (Left) The image with the most ships missed by A, a dense open-sea cluster (fold 2; 11 ships missed by A and 10 by D). (Center) The image with the most false alarms under A, a harbor scene in which the false alarms cluster at bright shore structures (fold 5; 16 false alarms under A and 5 under D). (Right) The image with the most small ships missed by A, an inshore berth with ships moored side by side: the seven missed ships are elongated, up to 66 pixels long, but their boxes are below ${32}^2$ pixels in area (161–971 pixels), and three of the four false alarms of A (two of three under D) are larger boxes over adjacent moored ships (fold 3; the same 7 ships missed by both configurations).

5.3. Cross-Dataset Robustness of the Detector

The operational corpus has no ground truth and covers only 12 days (Section 5.4), so it cannot show whether detection is robust to changes in imaging conditions. As a partial test, the 20 checkpoints of the ablation (configurations A–D, five folds each; Section 4.1.1), all trained on SSDD, were applied without retraining or fine-tuning to the official test splits of two public SAR ship datasets that define inshore and offshore subsets. LS-SSDD-v1.0 [47] is built from large-scale Sentinel-1 interferometric wide-swath scenes cut into $800\times 800$-pixel sub-images; its test split has 3000 sub-images with 2378 ships (inshore 766 images and 883 ships, offshore 2234 images and 1495 ships). HRSID [48] is built from high-resolution SAR images, also cut to $800\times 800$ pixels; its test split has 1962 images with 5922 ships (inshore 369 images and 2841 ships, offshore 1593 images and 3081 ships). Inference followed the ablation: the $512\times 512$ input transform of training, which downscales the images by a factor of 0.64; the all-ones sea–land mask, because neither dataset provides a land raster; fp32 precision; and batches of four images. Two settings differ from the in-domain evaluation. First, the detection score threshold was lowered from 0.05 to 0.001 so that the precision–recall curves extend to low scores; this only appends lower-scored detections to each ranked list and cannot reduce the average precision, so it does not favor the in-domain values. Second, both datasets annotate ships only, so only ship-class predictions were scored and the two population classes were ignored; their predictions with a score of at least 0.5 overlap a ground-truth ship at IoU $\ge 0.5$ in at most eight cases per run. The limit of 100 detections per image was reached on many LS-SSDD images, but raising it to 300 changed the ship AP@0.50 by at most 0.0005 (fold-1 checkpoints). The metrics are the ship AP@0.50 and AP@[0.50:0.95], the maximum F1 over score thresholds at IoU 0.50, and the fraction of small ground-truth ships (box area below ${32}^2$ pixels in the native image) missed at the maximum-F1 operating point, each as mean ± SD over the five folds.

Table 19 and Figure 15 report the results (per fold in Table A3). Against an in-domain ship AP@0.50 of 0.938–0.941 on SSDD, detection collapses on inshore scenes: the ship AP@0.50 is 0.052–0.073 on the LS-SSDD inshore subset and 0.176–0.185 on the HRSID inshore subset, and 85–89% of the small inshore ships are missed at the maximum-F1 operating point. Offshore, the detectors transfer to HRSID (AP@0.50 0.862–0.873) but not to LS-SSDD (0.393–0.477). The misses are dominated by small targets: about 99% of the ships missed on LS-SSDD inshore and about 79% of those missed on HRSID inshore are smaller than ${32}^2$ pixels in the native image.

Table 19. Cross-dataset test of the SSDD-trained ablation detectors on the official test splits of LS-SSDD-v1.0 [47] and HRSID [48], without retraining (mean ± SD over the five fold checkpoints; $512\times 512$ input, a downscale by 0.64; all-ones sea–land mask; score threshold 0.001; ship class only). “Small” ships have a box area below ${32}^2$ pixels in the native $800\times 800$ image, and “Small missed” is the fraction of them not detected at the maximum-F1 operating point (IoU 0.50). For reference, the in-domain ship AP@0.50 on SSDD is 0.938–0.941 (Table 6). Paired with A, only B differs significantly after Holm correction, and only on LS-SSDD (all images and offshore), where it is lower.

Configuration	Ship AP@0.50	Ship AP@[0.50:0.95]	Ship F1-Max	Small Missed
LS-SSDD-v1.0, all: 3000 images, 2378 ships, 91.2% small
A: Faster R-CNN	$0.302\pm 0.028$	$0.087\pm 0.013$	$0.468\pm 0.030$	$0.632\pm 0.031$
B: +HMA	$0.262\pm 0.034$	$0.071\pm 0.013$	$0.435\pm 0.036$	$0.670\pm 0.037$
C: +GTB	$0.290\pm 0.039$	$0.079\pm 0.014$	$0.451\pm 0.046$	$0.653\pm 0.041$
D: +HMA+GTB	$0.322\pm 0.067$	$0.096\pm 0.027$	$0.476\pm 0.060$	$0.630\pm 0.058$
LS-SSDD-v1.0, inshore: 766 images, 883 ships, 97.9% small
A: Faster R-CNN	$0.055\pm 0.012$	$0.017\pm 0.004$	$0.178\pm 0.019$	$0.871\pm 0.022$
B: +HMA	$0.052\pm 0.010$	$0.017\pm 0.004$	$0.163\pm 0.022$	$0.894\pm 0.019$
C: +GTB	$0.061\pm 0.016$	$0.018\pm 0.004$	$0.180\pm 0.024$	$0.877\pm 0.017$
D: +HMA+GTB	$0.073\pm 0.018$	$0.023\pm 0.006$	$0.190\pm 0.019$	$0.868\pm 0.017$
LS-SSDD-v1.0, offshore: 2234 images, 1495 ships, 87.2% small
A: Faster R-CNN	$0.464\pm 0.050$	$0.132\pm 0.023$	$0.624\pm 0.047$	$0.464\pm 0.044$
B: +HMA	$0.393\pm 0.048$	$0.104\pm 0.018$	$0.575\pm 0.042$	$0.513\pm 0.044$
C: +GTB	$0.433\pm 0.059$	$0.117\pm 0.022$	$0.592\pm 0.056$	$0.491\pm 0.060$
D: +HMA+GTB	$0.477\pm 0.103$	$0.140\pm 0.040$	$0.631\pm 0.084$	$0.454\pm 0.084$
HRSID, all: 1962 images, 5922 ships, 54.1% small
A: Faster R-CNN	$0.547\pm 0.011$	$0.285\pm 0.009$	$0.661\pm 0.004$	$0.673\pm 0.008$
B: +HMA	$0.538\pm 0.015$	$0.289\pm 0.015$	$0.660\pm 0.006$	$0.683\pm 0.012$
C: +GTB	$0.548\pm 0.016$	$0.290\pm 0.007$	$0.661\pm 0.009$	$0.667\pm 0.018$
D: +HMA+GTB	$0.546\pm 0.019$	$0.285\pm 0.018$	$0.656\pm 0.007$	$0.678\pm 0.011$
HRSID, inshore: 369 images, 2841 ships, 72.9% small
A: Faster R-CNN	$0.181\pm 0.008$	$0.084\pm 0.003$	$0.302\pm 0.009$	$0.861\pm 0.014$
B: +HMA	$0.176\pm 0.013$	$0.083\pm 0.007$	$0.292\pm 0.011$	$0.871\pm 0.014$
C: +GTB	$0.183\pm 0.010$	$0.085\pm 0.004$	$0.300\pm 0.015$	$0.854\pm 0.012$
D: +HMA+GTB	$0.185\pm 0.013$	$0.083\pm 0.008$	$0.297\pm 0.011$	$0.862\pm 0.013$
HRSID, offshore: 1593 images, 3081 ships, 36.8% small
A: Faster R-CNN	$0.871\pm 0.011$	$0.466\pm 0.015$	$0.898\pm 0.006$	$0.324\pm 0.021$
B: +HMA	$0.862\pm 0.017$	$0.475\pm 0.022$	$0.896\pm 0.007$	$0.338\pm 0.022$
C: +GTB	$0.873\pm 0.021$	$0.475\pm 0.012$	$0.898\pm 0.010$	$0.315\pm 0.034$
D: +HMA+GTB	$0.866\pm 0.019$	$0.466\pm 0.027$	$0.893\pm 0.007$	$0.330\pm 0.023$

Figure 15. Ship AP@0.50 (mean ± 1 SD over the five fold checkpoints) of the four ablation configurations on the SSDD validation folds (in domain) and, without retraining, on the inshore and offshore test subsets of LS-SSDD-v1.0 and HRSID. The in-domain values are those of Table 6 and were evaluated at the default score threshold of 0.05; the cross-dataset values use a threshold of 0.001 and are those of Table 19.

Neither module mitigates the loss. Paired with A over the five folds (paired t-test, with Holm correction over the three comparisons with A in each subset), the only significant differences are losses of configuration B (+HMA) on LS-SSDD: $-0.071$ in AP@0.50 offshore (95% CI $[-0.103,-0.038]$; $p=0.0038$, Holm-adjusted $p=0.012$) and $-0.040$ over all LS-SSDD images ($[-0.067,-0.013]$; $p=0.015$, Holm-adjusted $p=0.045$). No difference is significant on the inshore subsets; the largest is the gain of D on LS-SSDD inshore ($+0.017$, $[-0.005,0.039]$; $p=0.094$, Holm-adjusted $p=0.28$). The exact Wilcoxon signed-rank test, which cannot fall below $p=0.0625$ with five pairs, confirms none of these differences. On HRSID, the four configurations differ by at most 0.011 in AP@0.50 in every subset.

The downscaling to the training input size does not by itself explain the collapse. At the $512\times 512$ input, the median LS-SSDD ship measures 11.9 pixels (square root of the box area; 18.7 pixels in the native image), and 99.9% of the LS-SSDD ships and 87.9% of the HRSID ships are smaller than ${32}^2$ pixels at the model input, against 59.2% of the SSDD training ships (median 26.3 pixels). Rerunning the fold-1 checkpoints at the native $800\times 800$ resolution, a single run per configuration and therefore without a statistical test, raised the AP@0.50 on HRSID by 0.03 to 0.06 but lowered it on LS-SSDD by 0.07 to 0.10, a loss concentrated offshore (0.13 to 0.17), while the LS-SSDD inshore subset gained only 0.01 to 0.03. At native resolution, the inshore AP@0.50 remained at most 0.115 on LS-SSDD and 0.255 on HRSID.

Three conclusions follow. First, the SSDD accuracy does not carry over to other SAR data in general: under this domain shift the detectors lose most of their accuracy on inshore scenes and on the very small ships of Sentinel-1 wide-swath imagery, and they transfer well only to the larger offshore ships of HRSID. Second, neither module mitigates the shift, and the mask-attention variant is significantly worse offshore on LS-SSDD; because it received the all-ones mask, this test evaluates the learned global gain of HMA, not spatial land suppression. Third, the operational corpus consists of Sentinel-1 scenes over shipping corridors that include port approaches, where 114 of the dark detections lay within 5 nautical miles of a port (Table 11); it therefore falls in the regime in which the SSDD numbers do not transfer, and the in-domain accuracies of Table 5 and Table 6 should not be read as the accuracy of the operational detector. The test quantifies the robustness concern rather than resolving it: robust operational detection requires in-domain Sentinel-1 training data with land rasters and fine-tuning on inshore scenes (Section 5.4).

5.4. Limitations

Several limitations bound the claims of this study and are stated explicitly. First, the Dynamic Kinematic Gate’s per-record effect on the operational spoof-candidate flood—how many of the 105,549 static-gate candidates it demotes to the temporal-sparsity class, and how many identity-laundering contacts it surfaces—was not logged during the operational run. We therefore report no operational post-gate split; the gate’s true-match-recall gain and its alert-suppression factor are instead established reproducibly on controlled synthetic scenes through the deployed matcher (Section 4.3), and a fully logged per-record operational pass is the first future-work item. More generally, the operational corpus has no ground truth: none of the confirmed, dark, spoof-candidate, or identity-laundering outcomes in Table 11 has been adjudicated, so the operational counts are logged system outputs, not accuracy measurements. Relatedly, the DKG parameters were set as engineering choices and have not been re-tuned. The controlled sweep of Section Association Baselines and Gate Sensitivity indicates that the deployed ceiling $g_{\max }=50$ km is too wide for dense scenes: the staleness term saturates at the ceiling for most stale tracks, wide gates confirm dark contacts to unrelated AIS tracks (604 of 605 synthetic dark contacts under a fixed 50 km gate), and a ceiling of 10–25 km performed better. Because the assignment objective first maximizes the number of in-gate pairs, such false confirmations are a structural risk of wide gates, and a falsely confirmed dark vessel is removed from the analyst’s view. The false-confirmation rate of the deployed gate on real traffic is unknown; re-tuning $g_{\max }$ on a logged operational pass, and replacing the pair-count-maximizing objective with one that does not reward additional pairs, are required before the association stage can be considered calibrated. Second, attribution confidence is not calibrated: the identity-laundering “confidence 1.0” is a deterministic physical-consistency rule, and no reliability diagram against adjudicated outcomes is available, because adjudicated dark-vessel labels do not exist in this study. For the same reason, no precision, recall, or adjudicated accuracy exists for OSINT identity resolution or for the SNA bridge-vessel signal. What is measured instead (Section 4.7 and Section 4.8) is the consistency between AIS and registry records, the agreement of offline name-based sanctions screeners with IMO matching, and the structure of real graphs for one month in two regions; none of these is attribution accuracy. Further gaps bound these measurements: provenance is recorded only at the level of report type (no document carries its source registry, URL, or retrieval time); the corpus was ingested twice (49.5% duplicate rows); the deployed service performs no SDN matching; on the exported data the SNA graph lacks dark-proximity and flag edges; and the SDN list used for the offline screening is about six months newer than the data. Third, the operational corpus spans 12 days (5–17 March 2026) over a small number of Indo-Pacific and Middle Eastern corridors, and therefore covers a narrow range of seasons, sea states, and traffic regimes. The retained artifacts carry no per-detection sea-state or seasonal annotation, so performance cannot be stratified by environmental condition, and the robustness of detection and association to changes in environmental and operational conditions is not established by this dataset. Longitudinal validation over 6–12 months, spanning several seasons and additional corridors and stratified by sea state and traffic density, is required to establish that robustness, and to test whether the port-hub dominance of the SNA graph found here for one month holds across regions and seasons. For the detector, the cross-dataset test of Section 5.3 gives a first quantitative answer, and it is negative: without retraining, the SSDD-trained detectors reach a ship AP@0.50 of at most 0.19 on the inshore subsets of LS-SSDD-v1.0 and HRSID, miss most small ships, and reach 0.39–0.48 offshore on the Sentinel-1 LS-SSDD imagery; neither HMA nor GTB mitigates this domain shift. The detection accuracy measured on SSDD therefore cannot be assumed for the operational Sentinel-1 scenes. Closing the gap requires in-domain Sentinel-1 training data with land rasters, fine-tuning on inshore scenes, and an evaluation of HMA with a real land mask. Fourth, in the original SLA-Net training code the validation loop ran in train() mode, so early stopping and best-checkpoint selection were driven by a stochastic validation loss (per-batch normalization statistics and active dropout); the final mAP values in Table 5 were nonetheless measured in eval() mode, so the bug affects which checkpoint was retained rather than the reported metric directly. Separately, the SLA-Net training scripts were not seeded (the SSDD cross-validation split itself uses random_state = 42), so those training runs are not bit-reproducible. The five-fold results of Table 5 are reported as mean ± SD; the individual per-fold scores were not retained, so paired significance testing between those detectors is not possible. The ablation of Section 4.1.1 addresses these reproducibility gaps for the SLA-Net modules: its runs are seeded, checkpoints are selected on mAP computed in inference mode, and the per-fold scores are retained. It has limits of its own. Training was shortened to at most 25 epochs at a $512\times 512$ input, and most runs of configurations A–C reached that cap while probably still improving; checkpoints were selected on the reporting fold, which biases the values upwards; SSDD provides no land raster, so HMA was tested only as a learned global gain, and its intended land suppression was not evaluated; and five folds give little statistical power, the smallest attainable exact Wilcoxon p-value being 0.0625. Within these limits, the HMA and GTB modules show no improvement in detection, and the detection claims of this paper rest on the Faster R-CNN backbone. The re-benchmark of Section 4.1.2 brings YOLOv8s, YOLOv10s, YOLOv11n, and RT-DETR-l under the same folds, seeds, and evaluation code, with the same limits and three more. Its schedule was shortened to at most 60 epochs in fold 1 and 40 in folds 2–5, against 150 in the original benchmark, and 17 of the 20 runs reached the limit; YOLOv10s, re-run after the limit had been reduced, was capped at 40 epochs in fold 1 as well, where the other three models had 60, and all five of its runs reached that cap; its folds differ from those of Table 5, so the two tables cannot be compared fold by fold; and each detector was trained with the recipe of its own framework, at a 640-pixel input for the Ultralytics models and $512\times 512$ for Faster R-CNN, so the comparison is between standard recipes, not between identically trained networks. RetinaNet was not re-run, and its values in Table 5 remain unverified.

5.5. Ethical, Legal, and Operational Safeguards

Dark-vessel attribution carries real risk of harm from over-confident or erroneous accusation. Absence from a single SAR pass is not proof of intentional evasion—it may reflect satellite availability, equipment failure, or a sub-threshold vessel—and the system is explicitly designed to surface candidates for human adjudication, not to render verdicts. Three safeguards follow. First, every alert is a rule-explainable hypothesis whose evidence is traceable to rule outputs and to the report types of the supporting documents, not a black-box score; the identity-laundering flag is a deterministic physical-consistency rule, and its confidence value should be read as a rule indicator pending calibration, not as a probability of guilt. Second, a human analyst reviews every surfaced alert (the dashboard is a decision-support tool with an audit trail, not an autonomous enforcement system). Third, the pipeline separates detection, association, and attribution as distinct claims of increasing strength, so downstream users can act on the appropriate level of certainty. Deployment for law-enforcement or sanctions purposes should additionally respect jurisdictional and evidentiary standards beyond the scope of this technical work.

5.6. Generalizability and Deployment

The pipeline runs on a single workstation (NVIDIA RTX 6000 Ada, 128 GB RAM) against a PostgreSQL/PostGIS/TimescaleDB store, and its fusion and graph stages are computationally light (Table 4); the practical throughput ceiling is SAR inference and image download, not association or analysis. On an RTX 3060 GPU, the deployed detector architecture takes $38.93\pm 1.01$ ms per $512\times 512$ tile end to end at batch size 1 (Table 10); the deployment GPU itself was not benchmarked. The pipeline can be configured for any region with Sentinel-1 coverage and an AIS feed, because the geofence and flag priors are configuration, not model parameters. The detector’s accuracy, however, does not carry over with the configuration: under domain shift it drops sharply on inshore scenes and on small targets (Section 5.3), so deployment in a new region requires in-domain validation and, for inshore approaches, fine-tuning.

6. Conclusions

We presented an end-to-end pipeline for maritime dark-vessel screening that implements the chain from non-cooperative SAR detection through adaptive gated AIS–SAR fusion, OSINT identity resolution, and social-network context to prioritized, auditable operator alerts. Under one seeded five-fold evaluation on SSDD, the Faster R-CNN backbone of the deployed SLA-Net is on par with YOLOv8s, YOLOv10s, and YOLOv11n on the ship class and leads only in the three-class metrics, including the strict-IoU mAP@[0.50:0.95] (0.415–0.444 against 0.365–0.370); in the original, unseeded benchmark of the project record it had attained the highest mAP@0.50 ($0.821\pm 0.067$) and mAP@[0.50:0.95] ($0.553\pm 0.034$). A seeded five-fold ablation under a shortened protocol found no significant benefit from the HMA or GTB modules: the ship-class AP@0.50 lies between 0.938 and 0.941 for all four configurations, the larger three-class gain of HMA ($+0.097$ mAP@0.50) rests on a few population-class boxes and is not significant after Holm correction, and HMA adds 12.8 M parameters for about 1 ms of latency. The case for SLA-Net therefore rests on its Faster R-CNN backbone, and the benefit of land suppression remains untested, because SSDD provides no land raster. On an indicative latency-weighted score, single-stage YOLO detectors rank ahead of the Faster R-CNN family. Re-trained on the same seeded folds and scored with the same evaluation code, YOLOv8s, YOLOv10s, and YOLOv11n reach a ship-class AP@0.50 of 0.949, 0.940, and 0.955, against 0.938–0.941 for the four Faster R-CNN configurations, at a fifth to a quarter of the latency, so the benchmark lead of the Faster R-CNN backbone is confined to the three-class mAP and its precision argument is not supported. Applied without retraining to the official test splits of LS-SSDD-v1.0 and HRSID, the same detectors reach a ship AP@0.50 of at most 0.19 on inshore scenes and 0.39–0.48 offshore on the Sentinel-1 LS-SSDD imagery, against about 0.94 in domain, and neither module mitigates this domain shift; the SSDD accuracy therefore does not transfer to the operational setting. The Dynamic Kinematic Gate, evaluated reproducibly on controlled synthetic scenes through the deployed matcher, improves true-match recall by 23 percentage points over the legacy capped static gate and, together with its temporal-sparsity demotion rule, reduces spurious spoofing alerts 4.1-fold. The reduction is produced by the demotion rule; ten further association baselines and a one-at-a-time parameter sweep show that a fixed 10 km gate attains higher recall (0.909 versus 0.878) with fewer false confirmations (391 versus 893), that the 50 km ceiling is the decisive parameter, and that Hungarian assignment outperforms greedy association in dense clustered scenes but not in mixed scenes. The OSINT and SNA layers are implemented and were characterized on the operational data. Registry documents agree with the AIS-declared name for 90.1% and the flag for 71.8% of 2000 sampled vessels; the deployed service synchronizes but does not match the OFAC SDN list; and offline name-based screeners recover 51.4–67.0% of the listed vessels found by IMO number, at false-positive rates of 0.05–1.4%. A real one-month SNA graph of the Persian Gulf is dominated by port hubs and contains no distinct bridge vessel, so the bridge-vessel signal remains a design hypothesis. We have been explicit throughout about the operational results, reported as recorded, the reproducible controlled evaluations, and the ethical and evidentiary limits of attribution.

Future work will (i) produce a fully logged, per-record DKG outcome split over the operational correlation store (currently characterized only through the controlled evaluation), re-tune the gate ceiling $g_{\max }$ within 10–25 km against that logged split, and replace the pair-count-maximizing assignment cost with a gate-aware formulation; (ii) calibrate attribution confidence against adjudicated outcomes and measure the precision and recall of OSINT identity resolution, sanctions screening, and SNA flags on adjudicated cases; (iii) record the source registry, URL, and retrieval time of every OSINT document, add IMO-keyed SDN matching to the service, require continuous time-bucketed co-location and exclude anchorages in the STS rule, normalize or exclude port hubs in the betweenness computation, and add temporal-decay SNA edge weights; (iv) stratify SAR error by sea state, vessel size, and shoreline clutter with annotated ground truth, and repeat the HMA ablation on inshore scenes with a land raster derived from coastline data, a full training schedule, and checkpoint selection on a separate split; train or fine-tune the detector on in-domain Sentinel-1 data with land rasters, including inshore scenes, and repeat the cross-dataset test of Section 5.3; and (v) integrate SAR foundation-model backbones [17,19] and Sentinel-2 optical fusion to supplement coverage during orbit gaps.