Abstract: An apparatus can include a memory and a processor. The processor can be configured to train a machine-learning (ML) model to output (1) an identification of whether an artifact is malicious and (2) a confidence value associated with the identification of whether the artifact is malicious. The processor can further be configured to receive a set of artifacts during a set of time periods, and provide a representation of each artifact from the set of artifacts to obtain as an output of the ML model including an indication of whether that artifact is malicious and a confidence value associated with the indication. The processor can be further configured to calculate a confidence metric for each time period based on the confidence value associated with each artifact and send an indication to retrain the ML model based on the confidence metric for at least one time period meeting a retraining criterion.