A methods evaluation found that Kestrel identified ML-KEM and ML-DSA table patterns across tested build transformations and detected no false positives in 6,224 stock-system binaries. The evaluation also found that the tested runtime-generated and XOR-rewritten constructions evaded the static scan.
