Modern networks increasingly operate at line rate, yet most Intrusion Detection Systems (IDSs) still rely on off-path servers to analyze mirrored traffic, resulting in latency, bandwidth overhead, and scalability bottlenecks. As high-throughput,
low-latency infrastructures become the norm, there is a pressing need for intrusion detection that operates directly within the
network fabric itself. In this work, we address the challenge
of bringing intelligent anomaly detection into the data plane
without sacrificing performance or adaptability. We present
BINOCULAR, an in-network anomaly-detection framework that
embeds a compact neural network within a programmable
switch and augments it with a control-plane refinement loop
to enable confidence-aware decisions and continuous model
adaptation. Our results show that our solution sustains line-rate
inference with microsecond-scale latency, achieves up to 95% F1 on standard intrusion-detection benchmarks, and leverages confidence-aware retraining to recover over 70% of lost F1 under traffic distribution shifts.