DriftCal

A synthetic benchmark for testing whether a security-relevant classifier's confidence stays trustworthy under distribution shift — and whether that depends on which mechanism caused the shift.

Overview

DriftCal is a fully synthetic tabular dataset (305,000 rows) built from a documented, controlled generative process. Every example has a known latent "behavior vector" that determines both its observed features and its true label, which means — unlike real-world drift datasets — every example also carries a ground-truth label for which distribution-shift mechanism produced it (none / covariate / label / concept / novel-class / adversarial). That's the thing real drift benchmarks (LAMDA, BODMAS, KronoDroid, Drebin) can't give you: on real data, the mechanism behind an observed drop in performance is entangled and unobservable. Here it's a ground-truth column.

Motivation / research problem

Research question: when a security classifier's operating distribution shifts, does its confidence remain trustworthy — and does that depend on which mechanism caused the shift?

Related work on calibration in cybersecurity classifiers (e.g. work on calibrating threat-detection scores, and conformal-prediction approaches to malware-classifier drift) evaluates calibration on real, temporally-drifted data. That's valuable but means the mechanism behind any calibration failure is never isolated — real drift mixes covariate shift, label shift, concept shift, and novel-class emergence together. DriftCal's contribution is narrow and checkable: it is not a larger or more realistic malware corpus, it is a controlled instrument for isolating shift-mechanism effects on calibration and abstention that real datasets structurally can't provide.

Key contributions

• A controlled generative process (12-dim latent behavior vector → 70 observed features) with five distinctly-defined, ground-truth-labeled shift mechanisms.
• A spurious (non-causal) feature block, letting you directly measure a classifier's reliance on shortcut features vs. true causal signal (Task 8) via a spurious-ablation eval.
• Eight tasks (T1-T8, see BENCHMARK.md), including a genuinely novel one: shift-mechanism attribution from unsupervised shard-level statistics (T7) — realistic in that it uses no ground-truth labels, matching what a deployed drift monitor actually has access to.
• Real baseline results (not asserted, computed — see BASELINES.md) showing that post-hoc calibration recovers trustworthy confidence under covariate/label shift but not under concept shift or spurious-feature loss, and that unsupervised drift monitors reliably catch covariate/label shift but miss concept shift most of the time — a real, well-known failure mode this benchmark reproduces on purpose.

Dataset composition & statistics

Split	Rows	Purpose
train	150,000	reference-regime training
validation	25,000	reference-regime validation
test	25,000	reference-regime held-out test
hard_test	15,000	reference regime, higher class overlap (harder decision boundary)
calibration_set	15,000	reference regime, held out only for fitting post-hoc calibrators
ood_test	15,000	60% known families, 40% two held-out novel families
robustness_test	15,000	10,000 adversarial (5 perturbation-budget levels × 2,000) + 5,000 spurious-ablation
generalization_test	45,000	15,000 each of covariate shift / label shift / concept shift
small_data_{1,5,10}pct	1,500 / 7,500 / 15,000	fixed-seed subsamples of train, for few-shot/low-resource experiments

Total: 305,000 rows (plus the small-data subsamples, which reuse train rows and aren't double-counted). 13 known classes (benign + 12 malicious families across 4 superfamilies) + 2 held-out novel families. 70 feature columns (48 continuous + 16 binary + 6 spurious/non-causal) plus 17 metadata columns — see DATASET_SCHEMA.md for the full field list.

Every number above is read directly from the generated parquet files (reports/build_summary.json), not projected.

Tasks

See BENCHMARK.md for full task definitions, and BASELINES.md for measured baseline results on all of them. Summary: T1 binary classification, T2 family (multi-class) classification, T3 calibration-under-shift, T4 selective abstention, T5 novel-family (OOD) detection, T6 robustness to bounded adversarial perturbation, T7 shift-mechanism attribution, T8 causal-vs-spurious feature reliance.

Dataset structure

data/
  train.parquet              val.parquet             test.parquet
  hard_test.parquet          calibration_set.parquet
  ood_test.parquet           robustness_test.parquet
  generalization_test.parquet
  small_data_1pct.parquet    small_data_5pct.parquet  small_data_10pct.parquet
  mechanism_attribution_meta.parquet   # shard-level features for Task 7

Schema

Full field-by-field documentation: DATASET_SCHEMA.md. Pydantic model in src/schema.py.

Example record (abridged)

sample_id: "a1b2c3d4e5f6a7b8"
split: "generalization_test"
shift_type: "concept"
shift_magnitude: 0.167
difficulty: "medium"
label_binary: 0
label_family: "trojan_c"
family_is_novel: false
feat_cont_00 ... feat_cont_47: [70 numeric feature values]
feat_bin_00 ... feat_bin_15
feat_spurious_00 ... feat_spurious_05
generator_seed: 900014
provenance: "synthetic:driftcal-v1.0"

Intended use / research use cases

• Evaluating whether post-hoc calibration methods (Platt, isotonic, temperature scaling, conformal prediction) recover trustworthy confidence under different shift mechanisms.
• Testing selective-prediction / abstention methods under shift.
• Testing OOD/novel-class detectors.
• Studying shortcut learning (Task 8: does your model quietly rely on non-causal features?).
• Testing unsupervised drift-detection methods (Task 7) and specifically their blind spot for concept drift.
• Not intended as a realistic malware/network-traffic corpus — features are stylized analogues of static-analysis-style feature categories, not literal malware semantics. See LIMITATIONS.md.

Benchmark protocol & baselines

See BENCHMARK.md and EVALUATION.md for protocol, and BASELINES.md for measured logistic-regression / random-forest / XGBoost results across every task and split.

Limitations, biases, synthetic-data disclosure

This dataset is 100% synthetic. No real malware samples, network traffic, or organizational data of any kind are used or represented. See LIMITATIONS.md and ETHICS.md for the full disclosure, including the compute-driven decisions made during baseline generation (documented, not hidden) and the known scope limits of the generative process.

Data generation

Full generative-process documentation, formulas, and seed policy: see DATA_GENERATION.md. Fully reproducible from src/generator.py + build.py.

Quality control

12+ automated checks run against the actual generated files (schema validation, duplicate-ID checks, leakage checks, label sanity checks, etc.) — see QUALITY_CONTROL.md and reports/qc_report.json for the full, measured results, including two real generator bugs the QC process caught and the fixes applied.

Licensing

Data: CC BY 4.0. Code: MIT. See LICENSE.

Citation

See CITATION.cff / CITATION.md.

Version history

See CHANGELOG.md.

Contact / project information

Fahad Hafeez.