EVALUATION METHODS

AI safety and security evaluation methods

AITBM organizes AI evaluation methods into 26 measurable sub-metrics. Each uses five fixed scoring anchors and named test methods so assessors can connect a test result to a repeatable rubric placement instead of an unconstrained label.

Five evaluation areas

Robustness covers adversarial inputs, distribution shift, output consistency, and poisoning. Fairness covers demographic parity, calibration consistency, representation bias, and counterfactual fairness. Transparency covers explainability, confidence calibration, audit trails, and lineage. Privacy covers leakage, inference attacks, minimization, and re-identification. Containment covers scope, escalation, output filtering, side channels, agent identity, action reversibility, and resource or execution-loop boundaries.

Methods must produce admissible evidence

Useful methods include adversarial test suites, counterfactual probes, calibration error measurement, lineage verification, membership and model-inversion testing, cross-tenant retrieval tests, identity-spoofing trials, chain-composition tests, resource-budget violation tests, and repeated boundary attestations. A claimed control earns no credit until the assessed deployment demonstrates its effectiveness.

Match depth to risk

Full, Standard, and Lite pathways change assessment depth, not the meaning of the rubrics. Deployment tiers set minimum thresholds and reassessment cadence. Agentic systems require additional accumulated-state, identity, action, containment, and behavioral evidence because a one-turn model test cannot establish multi-session safety.

A practical next step

Choose one system boundary, document the architecture and deployment tier, and test the evidence required by the applicable sub-metrics. Record unknown evidence explicitly instead of treating it as a passing control.

Benchmarking SecureFlow scenarios with AITBM

AIDEFEND SecureFlow supplies attack paths that can become repeatable tests of a defined AI deployment. The 69 SecureFlow records preserve attack steps, primary sources, and candidate defenses. 48 have bounded deployment scenarios and 21 remain unscored benchmark candidates. Cross-references to existing analyses do not change their scores.

The table identifies possible test routes. Select only metrics whose definitions and architecture applicability match the reproduced failure; neither a threat label nor a recommended defense establishes rubric performance.

Scenario families, candidate metrics, and evidence needed for evaluation
Scenario family	Possible AITBM test routes	Required deployment evidence
Prompt injection and RAG or MCP tool abuse	Ro-1; Cn-8 for untrusted-context isolation; Cn-1, Cn-3 where applicable	Representative adversarial-input trials; measured input resistance, scope-boundary violations, and prohibited-output release rates with authorized clean controls.
Training-data poisoning or artifact supply-chain admission	Ro-4 for content poisoning; Ro-5 for artifact admission; Tr-4 for model lineage	Controlled content-poisoning trials, artifact-admission provenance and integrity checks, and lineage records for the assessed model. A malicious package or infrastructure exploit alone does not measure model poisoning resistance.
Data extraction and exfiltration	Cn-1/Cn-3 for access and release boundaries; Pr-1 for training leakage; Pr-2 for inference attacks	Identify the data source and causal path; use synthetic canaries, extraction or inference tests, and measured boundary enforcement. Stolen credentials or files alone do not establish training leakage or inference attacks.
Agent authority, impersonation, or destructive actions	Cn-1, Cn-2; Cn-5 for agent identity; Cn-6 for action reversibility; Cn-9 for persistent-state writes	Authorization traces, agent identity spoofing trials, pre-execution reversibility classification, human-authority records, and worst-case chain-gating tests. Human biometric or KYC fraud alone is not a Cn-5 finding.
Resource exhaustion, runaway planning, or retry loops	Cn-7	Aggregate budget and execution-loop trials measuring BEC, RBVR, LTFR, and GDSR at the canonical sample sizes; provider limits alone do not prove end-to-end containment.
Classifier evasion and physical adversarial inputs	Ro-1; Ro-2 only for measured distribution shift	Architecture-specific labeled test sets, clean-input baselines, and repeated adversarial trials. Human identity verification and model extraction need their own bounded tests; do not force them into agent metrics.

Turn an attack flow into a measured benchmark

Define one assessed deployment or explicit representative configuration: architecture, model and tool inventory, identity and permission boundaries, deployment tier, and assessment pathway.
Reproduce the relevant steps in an authorized isolated environment using synthetic data. Fix the test set, configuration, control state, and success criteria; retain trial counts and measured results before and after mitigation.
Apply the canonical five-anchor rubrics to admissible evidence. Missing applicable evidence remains UNKNOWN; N/A requires an architecture rationale. The listed families do not cover every IVP metric, including Fairness.
Report IVP, ORP, and ACI separately. Establish autonomy, exposure, remediation evidence, and a verified System Dependency Graph for Cp; without a verified graph, Cp defaults to 1.00. Timestamp evidence and apply applicable calendar, containment, and behavioral freshness rules.
Reassess after mitigation on the same documented test basis. Report uncertainty and evidence limits; an attack narrative, recommended control, or external framework relationship supplies no automatic score credit.

SecureFlow source inventory checked 2 October 2026: 123 flows, all accounted for by records, cross-references, a merged duplicate, or an excluded illustrative demo. Candidate defense routes cite the audited AIDEFEND dataVersion 2026.10.15 basis (re-pinned 18 October 2026). These routes are not a claim of alignment to any later catalog. SecureFlow source · Canonical sub-metric rubrics.

AI safety and security evaluation methods

Five evaluation areas

Methods must produce admissible evidence

Match depth to risk

A practical next step

Benchmarking SecureFlow scenarios with AITBM

Turn an attack flow into a measured benchmark

Related AITBM resources

Open the sub-metric directory →

Compare AI frameworks →

See methods applied to cases →