Locating and Repairing Negative Transfer in Few-Shot IoT and Encrypted Traffic Classification with a Control-Led Evaluation Protocol

Few-shot traffic classifiers promise to adapt to new devices, protocols and attacks from a few labeled flows, yet headline accuracies can conceal failures under domain shift. We propose the Control-Led Few-Shot Traffic Evaluation Protocol (CL-FSTP), which labels each target by distribution status, compares every model with a same-budget random-initialization control given the same readout, audits shortcut features, and reports every loss, attributing it to a component only once localized. Applied to TrafficMAML, a meta-learned TLS, QUIC and IoT traffic classifier, the protocol certifies an in-distribution gain on CICIoMT2024 (+17.0 points over the control, +13.7 over a target-only classifier) but exposes a 12.8-point reversal on held-out RT-IoT2022. A stage-wise decomposition attributes 12.0 points to TrafficMAML’s Stage-2 attention block (query cross-attention plus support self-attention), and an ablation implicates prototype alignment and per-domain adapters. A retrospectively designed support-set router removes the reversal without retraining (77.0% to 91.4%) by falling back on the target’s own features, matching a target-only classifier; it costs at most 0.1 points on the other primary targets and misses unfamiliar networks in a familiar feature format. Against seven competitors it stays within about four points of the best on every primary target, as does one competitor given the same fallback.