We publish the methods we sell.
Our research team works on the questions our customers' launches depend on: how agents get attacked, when automated graders can be trusted, and how to make models safer without making them useless.
3,100 tool-use attacks against production-style agents.
We built 14 realistic agents (support, claims, procurement, coding, travel) with real tool schemas and sandboxed side effects, then attacked them with direct, indirect and multi-step injections.
- 41% attack success against undefended agents
- Input-only filtering reduced success to 23%
- Provenance tracking plus tool-call policy reduced it to 3.3%, a 92% reduction
- Over-blocking on benign tasks stayed under 0.5%
When can you trust an LLM grader?
We compared model-based graders with expert human labels across 26 evaluation categories and 48,000 judgements.
Agreement was high for format, PII and policy-violation detection (κ above 0.9) and acceptable for groundedness. It collapsed for five categories: subtle medical harm, persuasion, humour-dependent toxicity, legal advice boundaries and long-horizon agent plans. Our conclusion: model graders are reliable instruments only when they are calibrated per category and paired with human review where agreement is low. That is how the Evals grader library is built.
Over-refusal is a safety bug.
A model that refuses to explain medication interactions isn't safe. It sends people to worse sources.
Our calibration set pairs 6,000 borderline-but-legitimate prompts with 6,000 look-alikes that should be declined, written by clinicians, security researchers and lawyers. Measuring both on one axis exposes the trade-off most safety tuning hides, and gives post-training teams a target that improves safety and helpfulness together. Available as part of Reinforced Data.
Longer reads.
LLM evaluation: the complete guide
Metrics, graders, datasets and CI gates for evaluating LLMs and agents in production.
AI guardrails for agents: an architecture guide
Where to put guardrails, what each layer catches, and how to keep latency under budget.
AI red teaming: a field methodology
How to scope, run, score and fix an AI red-team engagement, from threat model to retest.
Prompt injection: detection and defense
Direct and indirect injection, why filters alone fail, and the controls that actually hold.
Safety training data: a buyer's guide
Red-team corpora, preference data and refusal calibration: what to buy, what to build, how to check quality.
Evals vs. guardrails vs. red teaming
Three controls that get confused constantly. What each one does and when you need it.
Find out what your model does before your users do.
A 45-minute briefing with our evaluation team. Bring a use case; leave with a threat model, a draft eval plan and a sense of where you stand.