Application evals — testing AI systems where the model is one component of a larger piece of software. Each entry is a repeatable technique for catching regressions, measuring accuracy, and finding the failures that create risk for the application and the people who depend on it. Not the foundational benchmarks that rank base models on leaderboards.
60 methods
Serve two variants — prompts, models, or settings — to comparable slices of real traffic and let live outcomes decide which behaves better.
Check that the system meets the transparency duties the law places on its provider and deployer — people told they are talking to an AI, generated content marked as such — in every channel, at the latest at the first interaction, and every time rather than most of the time.
Deliberately craft inputs designed to elicit failure — confusion, unsafe output, or broken constraints — to map the model's weak boundaries.
Judge the whole path an agent took, not just its final message — did it reach the goal, in how many steps, with which tools, and did it loop, stall, or wander.
Compare the AI feature with the process it replaces — the search box, the rules engine, the form, the person — on the same work, so 'it works' is measured against what users had before rather than against nothing.
Score the model against a fixed, known-answer dataset so performance becomes a number you can track across versions and compare across models.
Measure outcome disparities across a population of demographically varied inputs, reporting fairness as statistics rather than anecdotes.
Push inputs to limits — very long contexts, token boundaries, empty/extreme values — where behavior tends to degrade sharply.
Check that the system speaks the way the organization wants to be seen — in voice, in role, and above all in what it promises — and never commits the organization to a policy, price or exception that doesn't exist.
Route a small slice of real traffic to a new model or prompt first, watch it closely, and widen or roll back based on what the canary shows.
Test whether the reasons a system gives — its step-by-step reasoning, or the explanation it shows a user for a decision — actually determine its answer, or are a plausible story told afterwards.
Deliberately inject failures — tool timeouts, malformed tool responses, truncated context, adversarial inputs — to test whether the system degrades gracefully and recovers.
Compare what an agent says it did with what the trace shows it did — 'tests pass', 'file saved', 'email sent' — and treat every mismatch as a failure, even when the task itself went fine.
Hold a prompt fixed while swapping a protected attribute (name, gender, ethnicity) — the output should not change. When it does, you've measured bias.
Ask the same question in each language the system serves and check the substance of the answer is the same — the facts, the refusal, the recommendation and the caveats, not just the topic.
Re-measure the accuracy, robustness and per-group performance a provider declares for its system — under the conditions the declaration names — and check the system actually meets what its documentation says.
Run the same input across models or versions and treat divergence as a signal worth investigating.
Probe whether a deployed model can be cheaply queried to reconstruct its behaviour, training data, or a usable distilled copy — a confidentiality and IP attack surface.
Sample the model many times and test the distribution of its outputs — not any single answer — for drift, miscalibration, or instability.
Re-run a fixed suite against each release and over time, watching for the quiet regressions and capability decay that a one-off evaluation can't see.
Try to make the agent do more than its task needs — call a tool it shouldn't have, act without confirmation, or use a permission nobody meant to grant it — and check that scope, not just competence, is enforced.
Check generated claims against a trusted ground-truth source to catch hallucinations and fabricated citations.
For systems whose outputs feed back into their future inputs — retraining on their own decisions, retrieving their own generated content, ranking by engagement they produced — simulate the loop over many cycles and measure whether error or bias amplifies.
Feed anomalous tokens, rare unicode, homoglyphs and malformed encodings to trigger out-of-distribution behavior.
Decompose an answer into its claims and check each one against the retrieved context — is the answer actually supported by what was retrieved, or did the model fill in the gaps?
Treat the safety filters around the model as their own system under test — measuring bypass rate on unsafe inputs, false-positive cost on benign ones, and what happens when the guardrail itself fails.
Deliberately steer the model toward fabrication — asking about non-existent entities or beyond its knowledge — to map where it invents instead of declining.
Test the human in the loop, not just the model — seed known errors into the system's output and measure whether the people overseeing it catch them, understand what it is doing, and can actually override or stop it.
Check that the system actually does what it was told — every constraint rather than most of them, still at turn forty, and with the right source winning when two instructions conflict.
Exercise the seams where the model meets the rest of the system — tool and function contracts, MCP handshakes, retrieval calls, API auth — to catch connectivity and contract failures end to end.
Check that the model's outputs obey the rules of logic — valid inference, transitivity, symmetry, no self-contradiction — across related questions.
Check whether a persuasive or engagement-driven system uses deceptive or manipulative techniques to steer people — and whether it treats users made vulnerable by age, disability or a social or economic situation differently in ways that exploit that vulnerability.
Test by transforming an input in a way whose effect on the output is known in advance, then checking the relation holds — no ground-truth label required.
Treat the base model, fine-tuning data, embeddings, plugins, and every third-party package pulled into the pipeline as a software supply chain — provenance-checked and version-pinned, not merely capability-tested.
Use a strong model as an approximate oracle — grading, comparing, or fact-checking another model's output where no cheap ground-truth label exists.
Before moving a working system to a newer model, replay what it did on the old one and check the new version keeps every behaviour you rely on — better on average is not the same as no worse anywhere.
Plant a specific fact at varying depths in a long context and test whether the model can retrieve it from each position.
Find out what people actually use the system for, beyond what it was built for, and test how it handles those uses — serve them well, decline them clearly, or redirect — rather than improvising.
Treat the model's output as untrusted input to whatever consumes it next — feed it into the real downstream sink and check the sink's own defences, not the model's judgement.
Treat durable memory as a system with a lifecycle — what got written, whether it returns at the right moment, whether it was corrected when the world moved, and what one wrong entry costs three sessions later.
Apply small, meaning-preserving changes to an input — typos, spacing, paraphrase, reordering — and check that the output stays stable. When it doesn't, you've measured brittleness.
Embed adversarial instructions in user input or retrieved/tool content to test whether the model follows attacker text over its system policy.
Specify invariants the output must always satisfy, then generate many inputs automatically and check the invariant on each.
Check what survives when the system puts someone else's words in its own — whether the claim, its hedging, its attribution and its scope come through the paraphrase intact, or quietly shift.
Measure the retriever on its own terms — did the right documents come back, and how far up the ranking — before judging anything the model wrote with them.
Ask the same question multiple times (or multiple ways) and measure how often the answers agree.
Measure whether a model that grades, routes to, or recommends other models favours its own family — by re-running the same comparison with authorship hidden, swapped, and deliberately mislabelled.
Probe the model and its outputs for PII, credentials, or proprietary data it was never meant to reveal — memorized training data, leaked context, or a secret pasted earlier in the same conversation.
A fast, shallow pass on every build — a handful of canonical prompts and health checks — whose only job is to fail loudly on gross breakage before anything deeper runs.
Check whether the answer moves when the user signals what they want to hear — pushing back on a correct answer, stating a false belief up front, or showing which conclusion they prefer — while the facts stay exactly the same.
Deliberately probe whether a model abandons a correct answer or endorses a false one when the user pushes back, to catch approval-seeking behavior that plain accuracy evals miss.
Try to get the model to reveal its own system prompt or hidden instructions, then check whether that prompt held anything — a credential, an access-control rule, unfiled business logic — that mattered only because nobody expected it to leak.
Walk inputs across a decision boundary — refusal, classification, confidence cutoff — to find exactly where the model's behaviour flips, and whether it flips in the right place.
Price the task, not the call — run the same work through competing encodings, protocols and verbosity levels, and report cost per successful outcome rather than tokens per request.
Instrument the whole request — prompt, retrieval, model call, tool calls, tokens, latency, outcome — so real production behaviour becomes evidence you can query, sample, and score.
Look for the backdoors and bias a manipulated training, fine-tuning, or retrieval corpus can plant — a trigger phrase that flips behaviour, or a quality drift a routine corpus audit won't catch.
Push volume, length, and concurrency past what the system enforces — unbounded prompts, recursive agent loops, or scripted request floods — to find where cost or capacity, not correctness, breaks first.
Give the system work that cannot be done responsibly as stated — ambiguous, missing a premise, resolvable two ways — and score whether it establishes the missing context or silently picks a reading and commits.
Test the deterministic code around the model — prompt builders, output parsers, schema validators, tool wrappers — in isolation, with exact assertions, the way you'd test any software.
Probe the RAG pipeline's storage layer, not just its retrieval quality — can embeddings be inverted back to source text, can one tenant's query surface another tenant's documents, can a crafted document poison what gets embedded and returned.
