AI Evaluation and Red Teaming

MMLU and GPQA now sit near the ceiling, so a five-point spread ranks nothing about your product.

Canary strings, n-gram overlap, and verbatim recall probes on the benchmark you were about to trust.

Private variant testing and silent deprecation, and why an Arena rank is not a procurement decision.

Read one hundred real traces and open-code the failures before you write a single test case.

Group the open codes into categories a grader can score, with counts so you know what to fix first.

Two splits, one you iterate against and one only CI may run, plus items dated after the training cutoff.

Exact match, schema validation, and unit tests, plus reshaping a task so code can score it at all.

Pointwise, pairwise, and binary rubrics, and why a one-to-five Likert judge returns mostly noise.

Quantify position, verbosity, self-preference, and same-family preference leakage on your own set.

Two annotators, Cohen's kappa, and the rubric rewrite that pulls a 0.41 up to something usable.

Pick a threshold from TPR and FPR against human labels, then catch criteria drift when the rubric moves.

Score the final state and the path taken, and catch the run that passed for the wrong reason.

Argument-level scoring, wrong-tool rates, and pass^k across repeated runs of the same task.

A promptfoo and pytest gate on every prompt and model bump, under a fixed token and wall-clock budget.

Re-baseline when the model ID changes, and find the regression no public leaderboard would show you.

Sample live traces into the eval set, and read thumbs-down base rates against guardrail metrics.

Single-shot success rates are marketing, best-of-N at ten thousand tries is the real threat model.

Many-shot, crescendo, and obfuscation, run through garak and PyRIT against your own endpoint.

Attacker text arriving through retrieval, email, tool output, and MCP tool descriptions you approved.

Run the benchmark, then separate a real refusal from an agent too weak to finish the attack.

Dual-LLM isolation, CaMeL-style provenance, typed tools, and authorization enforced outside the model.

Measure a guard model's recall at your false-positive budget, then adapt an attack straight past it.

GPAI duties and Article 50 transparency are live, while the high-risk dates moved to December 2027.

Poisoning, evasion, confidentiality, and injection tests written up so an auditor can rerun them.

A model card that indexes evidence, and a runbook with the fifteen, ten, and two day clocks.