Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners
2026-08-27 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors tested three tools—ModelScan, ModelAudit, and Fickling—that scan machine learning files for security risks, using a set of 170 controlled test files. They found that ModelAudit always gave a clear security decision, while Fickling and ModelScan did so less often. When ModelScan did provide a decision, it was always correct, but it frequently failed to finish analysis on some malicious samples. The study highlights the importance of measuring not just how accurate a tool's results are but also how often it can produce any judgment at all, and how different tools may overlap or complement each other.
Static scannersMachine learning artifactsSecurity evaluationModelScanModelAuditFicklingPickle filesPyTorchPrecisionRecall
Authors
Qianlong Lan, Vinothini Pandurangan, Anuj Kaul, Indranil Sanyal
Abstract
Static scanners are increasingly used to identify executable or otherwise unsafe content in machine- learning artifacts, yet conventional evaluation metrics characterize only cases where a scanner yields a usable security judgment. We evaluate ModelScan, ModelAudit, and Fickling using a controlled, artifact-backed benchmark on a synthetic corpus of 170 Pickle and PyTorch focused artifacts across 145 specimen families, 135 of which have binary security ground truth and 10 of which are intentionally malformed without labels. We explicitly distinguish non-N/A coverage, analysis completion, definitive security decisions, non-security findings, and unsupported outcomes. On labeled families, ModelAudit produced definitive security decisions for all 135 families (100%), Fickling for 110 (81.5%), and ModelScan for 67 (49.6%). Conditional on making a definitive judgment, ModelScan achieved 100% precision, recall, and F1. Fickling identified no unique true- positive families beyond those found by the combination of ModelAudit and ModelScan. Furthermore, for the 48 malicious families where ModelScan failed to complete its analysis, both ModelAudit and Fickling generated detections consistent with ground truth. These findings underscore the need to separate judgment accuracy from judgment availability, as well as incremental detection coverage from tool-level redundancy.