We empirically set the cutoff based on dev set performance to optimize F1.
a detection system may desire to optimize recall at the expense of precision, thus choosing a lower λ and forcing the system to predict attacks more often.