Model drift

A model getting worse because the fraud patterns or user behavior it was trained on have shifted since launch.

A model learns from past data. When the world changes, such as attackers using new tricks or customers behaving differently, the model's lessons grow out of date.

Degradation of model performance from shifts in input distribution or attack behavior over time. An input distribution is the pattern of data the model sees, such as the mix of devices, documents, and users.

Drift comes in a few forms:

• Data drift, in which the inputs change, such as new phone models, new document designs, or a new customer base.
• Concept drift, in which the link between inputs and the right answer changes, such as fraudsters adopting a new method that looks different from old attacks.
• Adversarial drift, in which attackers adapt on purpose to avoid detection.

Teams manage it with a routine:

1. Monitor, by tracking accuracy, score distributions, and error rates over time.
2. Detect, by setting alerts for shifts that cross a threshold.
3. Investigate, by finding what changed and which cases are affected.
4. Retrain and test, by updating the model on fresh data and checking it before release.

Model drift sits next to terms that are easy to mix up:

• Deepfake detection is especially exposed to drift, because generation methods keep improving.
• Trust score comes from models that can drift and need monitoring.
• Risk signal quality can also decay as fraud tactics change.

For more, see Facial Recognition: How to Train Models and Keep Improving Over Time.