Security operations in smart cities demand detection systems that balance accuracy with response time. While ensemble methods like Random Forest achieve high accuracy, their computational overhead impedes real-time forensic triage. We present the first systematic evaluation of TabPFNv2.5, a transformer-based foundation model, against traditional ensemble classifiers for IoT intrusion detection. Using the TON IoT dataset, we demonstrate that TabPFNv2.5 achieves 40 faster inference than Random Forest while maintaining 97% binary classification accuracy. We propose a hybrid pipeline in which TabPFNv2.5 performs rapid threat screening, while ensemble models handle detailed classification. Our analysis reveals that scanning attacks remain the hardest to detect (F1: 69.8%) and cross-device generalization depends critically on feature similarity. These findings establish foundation models as viable components for time-sensitive IoT security operations

翻译：智慧城市的安全运营需要兼顾准确性与响应时间的检测系统。尽管随机森林等集成方法能够实现高精度，但其计算开销阻碍了实时取证分类。我们首次系统评估了基于Transformer的基础模型TabPFNv2.5与传统集成分类器在物联网入侵检测中的性能。利用TON IoT数据集，我们证明TabPFNv2.5的推理速度比随机森林快40倍，同时保持97%的二分类准确率。我们提出一种混合流水线，其中TabPFNv2.5执行快速威胁筛查，集成模型处理详细分类。分析表明，扫描攻击仍然最难检测（F1分数：69.8%），跨设备泛化能力关键依赖于特征相似性。这些发现确立了基础模型作为时延敏感的物联网安全操作可行组件的地位。