Key takeaway
When evaluating a system decision, ask what task it serves, what data it was trained on and how errors are identified and checked.
An algorithm defines steps; a model captures patterns
An algorithm is a finite set of defined steps applied to input, such as sorting events by time. A machine learning algorithm can learn parameters from examples to produce a model; the model then computes an output for new input. A fixed rule specifies repeatable steps under the same conditions, while a trained model relies on patterns found in selected data. Both can run in software, but “algorithm,” “model” and “AI” do not mean the same thing.
Rule
Applies conditions and actions written by a person.
Model
Scores a new example using parameters learned from data.
Architecture
Defines how a model is structured; a CNN is one example.
Separate training from inference
During training, a model adjusts its parameters using examples and a chosen objective. Memorizing the training set is not enough: useful performance should also hold on data the model has not seen. During inference, the trained model computes an output for new input. For example, a classifier trained on labelled history may assign a new file to a risk category. Its output may be a probability or score; the task, threshold and validation method determine what that value means.
Training
The model fits parameters to historical examples; keep test data separate.
Inference
The model computes an output for new input; check it against observed outcomes and decision rules.
A CNN example: from local features to classification
A convolutional neural network (CNN) uses filters to learn recurring local structure in input data. Convolutional layers produce feature maps, pooling can reduce their size, and later layers combine features to classify the input. For an image, features might be edges and shapes; in a security research task, file bytes can also be represented as an image. For example, convert files to grayscale images using a consistent rule, train on labelled examples, then check errors by family and variant on a separate file set. The result applies to that representation and test set.
Evaluate a model against its intended task
Find out what decision the model supports, what examples it was evaluated on and where its output may be unreliable. For classification, measure both false positives and false negatives: blocking a benign file and missing a malicious one have different costs. Reassess when input data changes, behavior shifts or the model is updated. Ask the vendor for an evaluation report showing training-data scope, how test examples were kept separate, measured false-positive and false-negative rates in a relevant environment, the comparison baseline and known limits.