Paper: Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security arXiv: 2608.27424 Authors: Qianlong Lan, Vinothini Pandurangan, Anuj Kaul, Indranil Sanyal Posted: 2026-08-27
Key Points
Static scanners are increasingly used to identify executable or otherwise unsafe content in machine-learning artifacts, yet conventional evaluation metrics characterize only cases where a scanner yields a usable security judgment.
The authors evaluate ModelScan, ModelAudit, and Fickling using a controlled, artifact-backed benchmark on a synthetic corpus of 170 Pickle and PyTorch focused artifacts across 145 specimen families — 135 with binary security ground truth and 10 intentionally malformed without labels.
They explicitly distinguish:
- Non-N/A coverage
- Analysis completion
- Definitive security decisions
- Non-security findings
- Unsupported outcomes
Results on Labeled Families
| Scanner | Definitive security decisions | Coverage | |---|---|---| | ModelAudit | 135 / 135 | 100% | | Fickling | 110 / 135 | 81.5% | | ModelScan | 67 / 135 | 49.6% |
Conditioned on making a definitive judgment, ModelScan achieved 100% precision, recall, and F1 — demonstrating that judgment accuracy and judgment availability are orthogonal and must be evaluated separately.
The paper's central argument: security scanner evaluation should go beyond F1 to capture coverage and failure recovery behavior.