What is the difference between canary and shadow deployment for ML models?

Both reduce the risk of releasing a new model, but differently. In a canary deployment, the new model actually serves a small slice of live traffic (e.g., 5%) and its predictions are returned to those users; you monitor business and quality metrics, then gradually ramp to 100% if healthy or roll back if not. In a shadow (or dark) deployment, the new model receives a copy of real production traffic and produces predictions, but those outputs are never returned to users; they are only logged and compared against the current model. Shadow testing validates latency, stability, and prediction behavior under real load with zero user risk, but it cannot measure downstream business impact since no one acts on its outputs. Canary measures real impact but exposes some users to a potentially worse model. Teams often shadow first, then canary.