The report
A scanner that successfully catches a generated family of malicious model files can still miss a different family. In the ModelShield paper, the authors scanned roughly 145,000 model artifacts from Hugging Face, ModelScope and Kaggle and identified 41 malicious files in that first survey. Against a separate set of 84 malicious and 252 benign samples, however, the runtime-oriented scanner detected 47 malicious artifacts and missed 37. That is 55.95% recall on the holdout, with no false positives reported among the 252 benign samples.
Observe execution, but also observe its absence
The ModelShield research combines framework activity with low-level runtime observations such as system calls. The target threat is executable behavior carried inside what looks like a model artifact, for example an unsafe serialization format or a model-loading hook. That is a different surface from an adversarial prompt read by an already running model.
Its authors also measured very strong results on a smaller constructed variant set. Those tests are useful for showing that the monitored behavior can be recognized, but the holdout demonstrates the limitation: malware may be dormant, conditional on the environment, or implemented using operations that do not match a known runtime signature.
The study's reported median scan time, about 12.34 seconds, excludes downloading the model. Its evaluation and tooling focus on Linux execution contexts. Neither this timing nor the observed zero false positives establishes the cost or quality of screening every model format on every production runtime.
What a clean result can justify
A passed dynamic scan means no triggering behavior was observed within that scan's limits. It does not establish that a future import, different loader, alternate platform or later execution path is safe. A deployment can reduce the exposure by using isolated loading, review of serialization formats and model-provided code, artifact provenance checks and constrained runtime permissions.
The paper and code record give a narrower but more useful result than a universal scanner claim: some malicious models are detectable by behavior, and independent holdout evaluation is essential for knowing what remains invisible.