Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners
ModelScan was perfect only when it produced a judgment, but it did so for less than half the labeled test families.
The paper tests ModelScan, ModelAudit, and Fickling on 170 synthetic Pickle and PyTorch-focused artifacts across 145 specimen families. ModelAudit gave definitive security decisions for all 135 labeled families, compared with 110 for Fickling and 67 for ModelScan. On the cases where ModelScan did decide, it posted 100% precision, recall, and F1. The authors argue scanner evaluations should separate accuracy from whether a scanner can complete analysis and issue a usable decision. ArXiv · AI/CL/LG's note
The paper tests ModelScan, ModelAudit, and Fickling on 170 synthetic Pickle and PyTorch-focused artifacts across 145 specimen families. ModelAudit gave definitive security decisions for all 135 labeled families, compared with 110 for Fickling and 67 for ModelScan. On the cases where ModelScan did decide, it posted 100% precision, recall, and F1. The authors argue scanner evaluations should separate accuracy from whether a scanner can complete analysis and issue a usable decision. ArXiv · AI/CL/LG's note
score 4