F1 Score in AI Evaluation: How to Balance Precision and Recall

Your toxicity classifier reports 95% accuracy. It looks solid in the dashboard. But when you dig into the results, it's missing 40% of actually toxic outputs that reach your customers. On imbalanced data, accuracy rewards correct calls on the majority class and hides misses on the class you care about.

The F1 score forces precision and recall into balance, exposing where your model succeeds and where it breaks down.

What is the F1 score?

The F1 score evaluates the balance between precision (how many predicted positives are correct) and recall (how many actual positives your model identifies). It's the harmonic mean of these values and produces a score between zero and one.

Unlike accuracy, F1 excludes true negatives from its calculation. This makes it more reliable when one class heavily outnumbers the other, which is common in fraud detection, medical diagnosis, security threat classification, and some large language model (LLM) safety evals. If either precision or recall drops significantly, F1 drops with it, so you can't hide poor minority-class performance behind majority-class dominance.

How to calculate the F1 score

Calculate F1 like this:

F1 = 2 × (Precision × Recall) / (Precision + Recall)

Unlike the arithmetic mean, the harmonic mean penalizes extreme imbalances between precision and recall. Precision of 0.95 with recall of 0.20 gives an arithmetic mean of 0.58, while the harmonic mean returns approximately 0.33 and flags that the model is missing most positive cases.

Example

Suppose your safety classifier flags 100 outputs as toxic. Of those, 80 are genuinely toxic and 20 are false positives. There were 120 actually toxic outputs in total, meaning the model missed 40. The resulting metrics are:

• Precision = 80 / (80 + 20) = 0.80
• Recall = 80 / (80 + 40) = 0.67
• F1 score = 2 × (0.80 × 0.67) / (0.80 + 0.67) = 0.73

An F1 of 0.73 says the balance is reasonable, but one in three toxic outputs still shipped.

When to use the F1 score in AI evaluation

Imbalanced classification tasks

When rare failures get lost in normal production traffic, accuracy becomes unreliable. A fraud detector trained on data where 0.1% of transactions are fraudulent reaches 99.9% accuracy by predicting "legitimate" every time and catches zero fraud. Google's ML crash course recommends F1 over accuracy for class-imbalanced datasets.

This applies equally to LLM safety metrics. Prompt injection attacks are a small fraction of production traffic. Personally identifiable information (PII) detection events are rare but high-impact. Toxicity may appear in a small fraction of responses. In each case, you need a metric that evaluates the minority class, not the majority. For a binary classifier with a much rarer class, F1 is often a better primary eval metric than accuracy.

Multi-class and multi-label evaluation

For production evals spanning many categories, such as five-class sentiment analysis or dozens of intents, F1 variants provide per-class and aggregate visibility. Without it, strong performance on common classes masks failures on high-stakes rare ones.

F1 score variants and how to choose

Macro, micro, and weighted F1

The main variants are:

• Macro F1 calculates F1 separately for each class and averages without weighting, so every class contributes equally regardless of size.
• Micro F1 aggregates all true positives, false positives, and false negatives across classes before computing a single F1.
• Weighted F1 extends Macro F1 by weighting each class by its frequency.

Fβ score for precision-recall prioritization

scikit-learn's fbeta_score documentation notes that values below one favor precision and values above one favor recall.

• F0.5 (precision-heavy): Use this in spam detection or content moderation, where blocking legitimate content degrades user experience more than occasional spam slipping through.
• F2 (recall-heavy): Use this in medical screening, where a missed case is the expensive error. The same logic applies to threat hunting: a missed prompt injection can lead to data exfiltration or unauthorized actions, while a false alarm is minor operational friction.

F1 score limitations you should know

Equal weighting may not match your risk profile

The standard F1 score assumes precision and recall are equally important, which may not match your risk profile. In fraud detection, missing a fraudulent transaction is typically more costly than flagging a legitimate one, so equal weighting may leave you under-indexed on recall.

Single threshold blindness and confidence gaps

F1 is calculated at a single decision threshold and says nothing about model confidence. Two models can post identical F1 scores with different confidence distributions, and borderline predictions are more likely to flip under distribution shift. Perplexity research presented at a language evaluation workshop argues that metrics focused mainly on the chosen token's probability can miss information about the broader output distribution, making self-perplexity an unreliable indicator of true model confidence. Distribution shift compounds the problem: a deployment-aware evaluation found a DeBERTa-based prompt injection classifier scoring 0.93 macro-F1 in-distribution fell to 0.75 on out-of-distribution data, so test-set F1 may not survive production traffic.

F1 score vs. other evaluation metrics

Let’s compare F1 score to other evaluation metrics.

F1 score vs. accuracy

Accuracy measures the percentage of all predictions that are correct using true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN): (TP + TN) / (TP + TN + FP + FN). Counting true negatives lets a model coast on the majority class. Per scikit-learn's documentation, F1 = 2×TP / (2×TP + FP + FN), so that route to a high score is closed.

F1 score vs. AUC-ROC

The area under the receiver operating characteristic curve (AUC-ROC) summarizes ranking quality across all thresholds. F1 evaluates a specific operating threshold, making it a deployment-ready metric. Saito and Rehmsmeier's PLOS ONE study showed ROC plots stay essentially unchanged between balanced and imbalanced datasets while precision-recall plots change, concluding that the PR plot is more informative for imbalanced cases.

Use AUC-ROC for threshold-agnostic comparison during development and F1 or area under the precision-recall curve (PR-AUC) when choosing the production threshold.

How F1 score applies to LLM and agent evaluation

You can use F1 confidently for safety and compliance classifiers, but don't expect it to show whether generated answers are factual, well-reasoned, or useful.

Classification-based safety and compliance metrics

Many LLM safety evals are classification tasks where F1 is the standard performance measure. Toxicity detection, PII detection, and prompt injection identification produce binary or multi-class outputs where precision and recall map directly to operational risk.

Published benchmarks show wide F1 variation across safety categories. A peer-reviewed benchmark in MDPI Algorithms tested nine embedding-plus-classifier configurations for indirect prompt injection detection on a 70,000-sample dataset and found F1 ranging from 0.85 to 0.98 depending on the embedding model and classifier. Roblox's open-sourced production model achieves 94% F1 on production chat data but 83.10% on its all-languages eval set, while OpenAI's Privacy Filter reports 96% F1 on PII-Masking-300k.

F1 captures the trade-off between over-blocking legitimate content (precision) and missing harmful outputs (recall), which is the decision your safety and compliance pipeline needs to optimize.

Moving beyond F1 for generative AI quality

F1 works for classification subtasks within LLM pipelines, but it can't evaluate core generative capabilities. F1 tells you whether the classifier caught an issue. It can't tell you whether the agent should have said it.

Hallucination detection requires checking factual accuracy against external knowledge, not token overlap; a research study found ROUGE-based evaluation consistently rewards fluent yet factually incorrect responses, a failure mode that matters heavily in retrieval-augmented generation (RAG) evaluation. Instruction adherence requires structural and semantic evaluation of complex multi-step requirements. For reasoning quality, recent research shows current probabilistic confidence metrics are largely insensitive to inter-step logical structure and primarily capture surface-level fluency.

In practice, you'll combine F1-based safety metrics with LLM-as-a-judge metrics for subjective quality dimensions and custom domain-specific metrics for business requirements. A layered-evaluation study found zero redundant metric pairs across evaluation layers, supporting stacks where each metric type covers a different failure mode.

Choosing F1 as part of a stronger eval stack

F1 clearly measures whether a classifier balances precision and recall, especially when class imbalance makes accuracy misleading. It works for safety classifiers, threshold selection, and model comparison when both error types matter. It doesn't capture confidence, generative quality, or autonomous agent behavior, so teams pair it with complementary metrics and observability platforms.

Agents fail in ways a single number can't see. Splunk Agent Observability is the intelligence layer for trusted agentic operations, helping engineers ship reliable AI agents with visibility, evaluation, and control:

• Metrics comparison: Compare safety, quality, and agentic metrics alongside custom LLM-as-judge evaluators.
• Luna evaluation models: Purpose-built small language model (SLM) evaluators that run checks in under 200ms at up to 96% lower cost than frontier LLM-as-a-judge models.
• Autotune: Improve LLM-as-a-judge metric accuracy by up to 30% with a handful of annotated examples through human feedback.
• Signals: Review production traces to find recurring failure patterns.

Read the report The Agentic Shift: Redefining Observability for the AI Era to see where agent observability goes next.

FAQs about F1 for AI evaluation