An instrumented model-loader scanner identified malicious behavior and showed limited recall on a separate test set. Entry and authority. A defender runs third-party models under an instrumented Linux loading/execution environment. Observed mechanism and consequence. System-call and application event rules detect runtime malicious behavior but can miss…
Inspect the ClaimsCase · DiggingBeagle record
ModelShield detected malicious model execution but missed many independent holdout samples
An instrumented model-loader scanner identified malicious behavior and showed limited recall on a separate test set.
Public disclosure: Nov 6, 2026
Scope
A defender runs third-party models under an instrumented Linux loading/execution environment. System-call and application event rules detect runtime malicious behavior but can miss payloads that do not execute during the observed scan.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-MODELSHIELD; reviewed as research in evaluation. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-MODELSHIELD-01 · CLM-DB233-MODELSHIELD-02 · CLM-ENR234-DB233-MODELSHIELD · Runtime Detection of Malicious ML Models (ModelShield)
At a glance
Separate model-format diversity, test harness and download overhead limit translation to general protection; no production prevention rate established.
Limits and uncertaintyFull account
An instrumented model-loader scanner identified malicious behavior and showed limited recall on a separate test set.
Entry and authority. A defender runs third-party models under an instrumented Linux loading/execution environment.
Observed mechanism and consequence. System-call and application event rules detect runtime malicious behavior but can miss payloads that do not execute during the observed scan.
Limits and status. Separate model-format diversity, test harness and download overhead limit translation to general protection; no production prevention rate established.
ModelShield instrumented model loading and subsequent behavior at API and kernel layers to detect dangerous execution that a static file scan could miss. The independent test set exposed a substantial limitation: the study reported roughly 56% recall on its malicious holdout despite strong results on a smaller attack-variant set. Dormant conditional payloads and execution-path coverage remain unresolved; the reported detections are not a count of customer infections.
Mechanism and trust boundary
- 01
Precondition and trust context
A defender runs third-party models under an instrumented Linux loading/execution environment.
- 02
Crossed boundary
System-call and application event rules detect runtime malicious behavior but can miss payloads that do not execute during the observed scan.
- 03
Observed limit
Separate model-format diversity, test harness and download overhead limit translation to general protection; no production prevention rate established.
Timeline
- Nov 6, 2026Event type unspecified
Initial documented finding
ModelShield detected malicious model execution but missed many independent holdout samples
- Nov 6, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-MODELSHIELD-01The paper evaluates kernel and framework runtime observations to detect active malicious serialized model behaviors.supported
Basis: reported finding
- supportsRuntime Detection of Malicious ML Models (ModelShield)primary disclosure
Methods and attack behavior classification
CLM-DB233-MODELSHIELD-02Independent holdout results include 47 detected out of 84 malicious artifacts, illustrating dormant/conditional evasion.supported
Basis: reported finding
- supportsRuntime Detection of Malicious ML Models (ModelShield)primary disclosure
Evaluation, independent holdout and false negatives
CLM-ENR234-DB233-MODELSHIELDOn the independent 84-malicious, 252-benign evaluation set, ModelShield detected 47 malicious samples, missed 37, and produced no false positives, giving 55.95% recall.supported
Basis: reported finding
- supportsRuntime Detection of Malicious ML Models (ModelShield)primary disclosure
Section VI-A, Table IV: independent holdout detection results
Controls and mitigations
- Use isolated model loading plus static format checks, signature and provenance review, rather than treating a clean dynamic scan as a guarantee.
- Test conditional triggers and different framework/serialization environments on independent malicious model samples.
Unknowns and contradictions
- Separate model-format diversity, test harness and download overhead limit translation to general protection; no production prevention rate established.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235