Reference material for teams shipping AI.
Organised by topic. Each cluster has a pillar guide and shorter, specific pages beneath it. Looking for derivations and simulations? See research notes.
Evaluation science
Sample sizes, judges, agent reliability metrics and eval design.
Safety training data: a buyer's guide
Pillar guide.
LLM evaluation: the complete guide
Pillar guide.
How many test cases does an LLM eval need?
Wilson intervals, power analysis and a Monte Carlo study of paired vs. unpaired tests. Detecting a 2-point regression takes thousands of cases, not hundreds.
Your LLM judge is a diagnostic test: correcting measured failure rates
Sensitivity, specificity and the Rogan–Gladen correction. At a 0.5% true failure rate, a 97%-accurate judge reports 3.4%.
pass@k vs. pass^k: measuring agent reliability
Three task populations with identical pass@1 = 0.60 have pass^8 between 1.7% and 28.8%. How to estimate pass^k and how many trials you need.
LLM-as-a-judge: how it works, where it fails, how to validate it
Judge designs, documented biases, and a validation protocol with agreement metrics.
LLM-as-a-judge vs. human evaluation
Cost, agreement, latency and failure modes compared, and a hybrid design that uses each where it is strongest.
LLM evaluation plan template
A copy-ready plan: scope, threat model, categories, sample sizes, graders, gates and owners.
Agent security
Prompt injection, jailbreaks, MCP and the OWASP LLM Top 10.
Prompt injection: detection and defense
Pillar guide.
AI red teaming: a field methodology
Pillar guide.
A 2% attack success rate is not low: retry economics of prompt injection
Cumulative compromise probability, and why correlated defence layers deliver 3–30× less protection than the independence assumption predicts.
Indirect prompt injection, explained
How instructions hidden in documents, web pages and tool output hijack agents, with real research and the controls that hold.
Prompt injection vs. jailbreak: what's the difference?
Different attacker, different target, different defences. A precise comparison with examples.
OWASP Top 10 for LLM Applications (2025), explained for engineers
All ten risks, what each looks like in an agent, and the test and control that addresses it.
MCP security: tool poisoning, rug pulls and how to defend
The Model Context Protocol attack surface and a hardening checklist for teams connecting agents to MCP servers.
AI red-team report template
Finding format, severity model, reproduction rate and retest log, ready to copy.
Runtime guardrails
Thresholds, base rates, latency and enforcement architecture.
AI guardrails for agents: an architecture guide
Pillar guide.
Guardrail thresholds under low base rates
With a 0.1% attack rate, a classifier with AUC 0.96 tuned to 95% recall has 0.5% precision. Cost-optimal thresholds, worked through.
The latency budget of AI guardrails: sequential, parallel and hedged
Order statistics of parallel checks. Hedging at the single-check p95 cuts eight-check p99 from 49 ms to 35 ms for 5% extra load.
Evals vs. guardrails vs. red teaming
Comparison.
Compliance & standards
EU AI Act, NIST AI RMF, ISO/IEC 42001 and the evidence they require.
AI compliance testing: EU AI Act, NIST AI RMF and ISO/IEC 42001
What each framework actually asks you to test, mapped to concrete evaluations and evidence.
EU AI Act testing requirements and the 2026–2028 timeline
Articles 9, 15 and 55, the Digital Omnibus delay, and what evidence a test programme should produce.
NIST AI RMF Measure for generative AI: an evaluation checklist
Turning the Measure function and the NIST AI 600-1 profile into tests you can run.
Industries
Sector-specific risks, regulators and evaluation patterns.
Know the number before you ship.
A 45-minute working session with an evaluation engineer. Bring one use case; leave with a threat model, a draft eval plan with sample sizes, and an honest read on where you stand.