A classifier learns the attacks it is shown. This is not a criticism of classifiers, it is what they are, and within the region it has been shown one can be very good indeed.
The difficulty is that the region is defined by what somebody has already thought of and named. Every attack in every benchmark is one that exists because a person invented it and then wrote it down. The interesting failures are the ones nobody has written down.
What follows from that
Defence has to be able to say it does not know. A system that returns a confident answer for everything has no way to signal the case it was not built for, and that case is the one worth escalating. Uncertainty is a feature to preserve, not a defect to train away.
State is not optional. Anything that distributes intent across time defeats a defence that looks at one input in isolation, and looking at one input in isolation is what most defences do because it is cheap.
The interesting number is not accuracy. On a benchmark built from named attacks, accuracy measures how well the region was memorised. It says nothing about the edge, and the edge is the subject.
What this rules out
It rules out claiming a system is safe. Safety is not a property something has; it is a description of how it behaved against a set of things that were tried. Publishing the set matters more than publishing the score.
It also rules out treating a benchmark result as a finished argument. A number obtained on named attacks is a floor. Presenting it as a ceiling is the most common way this field misleads without saying anything false.
The uncomfortable part
None of the above is a method for detecting the unnamed. If it were, they would be named.
What it is, is a set of constraints on what to build: keep the uncertainty, keep the state, and be honest that the benchmark measures the past. Everything published here on this subject should be read as work against that problem, not as a claim to have solved it.