The Setup
Since March 28, 1,152 vessels have triggered 4,578 high-severity behavioral alerts in the motif detection pipeline. Every single alert carries severity "high." The confidence score on each is 1.0. The robustness score on each is 1.0.
Zero have been acknowledged.
The fleet isn't hiding. The alerts are right there. But the gap between detection and human review is the actual story, and it stretches 38 days.
The Chain
Motif detection classifies vessel behavior into named patterns by matching sequences of temporal graph edges: ship_to_ship_transfer, AIS_manipulation_dark, AIS_manipulation_spoof, and fraudulent_documentation. The breakdown across 38 days ending May 4, 2026:
- AIS manipulation (dark): 1,060 detections — vessels that went silent in a way that matches a manipulation signature, not random coverage loss
- AIS manipulation (spoof): 865 detections — vessels broadcasting position data inconsistent with actual movement
- Combined AIS manipulation: 1,925 detections, 42.0% of all alerts
- Ship-to-ship transfers: 2,652 detections (57.9%)
- Fraudulent documentation: 1 detection
Confidence=1.0 and robustness_score=1.0 on all 4,578 rows. These aren't probabilistic risk scores — they are hard pattern matches against defined motif sequences. The detection engine is saying it found exactly the sequence it was looking for.
The acknowledged column across all 4,578 rows: 0.
The Implication
Zero acknowledgment at 38 days isn't a data quality failure — it's an ops tempo signal. Either the alert volume has outrun the review capacity, or the triage threshold is set such that these alerts haven't yet routed to a human queue. At 4,578 high-severity items in 38 days, that's roughly 120 new alerts per day. If each requires even five minutes of analyst time, that's 10 hours of review per day — which implies this pipeline is either automated-forward or functionally unreviewed.
AIS manipulation is not the same as AIS signal loss. Coverage gaps in open ocean are common and don't trigger these detections. These 1,060 dark-type and 865 spoof-type alerts fired because the gap duration, geography, and surrounding edge patterns matched behavioral templates built from known evasion sequences. The spoof variant is the more aggressive signal: the vessel is transmitting, just not truthfully.
What to Watch
Track the dark-to-spoof ratio within the manipulation bucket. Right now dark (1,060) leads spoof (865) at a 1.22:1 ratio. If that ratio compresses — meaning spoof volume catches dark — it suggests a fleet shift from passive silence to active false broadcasting. Those are different risk profiles: dark is evasion by absence; spoof is evasion by deception.
Watch the acknowledgment count. If it remains at zero past 60 days, the motif alert pipeline is producing signal that isn't connected to a review workflow. That's a process gap, not a fleet gap.
Limitations
Confidence=1.0 means the sequence matches the pattern definition precisely — it does not confirm that the underlying vessel behavior was intentionally deceptive. A vessel conducting a legitimate port call in a coverage-sparse region can still trip a dark manipulation motif if the surrounding context fits the template. Robustness=1.0 means the detection is stable across the edge set, not that it has been independently verified through satellite or SAR cross-reference.
The 2,652 STS transfer alerts are counted in the total but excluded from the AIS manipulation analysis above. Prior analysis (see April 28 posts) covers STS motifs separately.
Sample: 1,152 unique vessels, motif detections from March 28 – May 4, 2026. Total fleet tracked: ~45,889 vessels.
Data as of 2026-05-04. Source: Axiom Overwatch motif_alerts. Detection engine: behavioral pattern matching against temporal edge sequences.