How do you evaluate the guardrails themselves? How do you measure bypass resistance?

30-second answerSay your answer out loud first, then reveal.

Evaluate guardrails as classifiers and as security controls. Measure precision and recall on labelled benign and harmful datasets (per category, language and context), then test robustness with adversarial variants: paraphrases, obfuscation (encodings, leetspeak, homoglyphs, spacing), language switching, multi-turn splitting, and indirect injection channels. Report the attack success rate (bypass rate) for each technique, track latency and cost, and re-test as attackers and models evolve.

Evaluation dimensions

Dimension	Metric
Detection quality	Recall (harmful caught), precision (benign allowed), per category
Over-refusal	False positive rate on benign look-alikes
Robustness	Bypass rate under adversarial transformations
Coverage	Languages, modalities (text in images), channels (documents, tool outputs)
Performance	Added latency p95, cost per request, availability
Drift	Performance over time as user behaviour and attacks change

Adversarial transformation suite

Paraphrase / synonym substitution.
Encoding (base64, ROT13), character tricks (zero-width spaces, homoglyphs, spacing).
Translation into other languages or code-mixed text.
Payload splitting across turns or documents.
Role-play / hypothetical framing.
Injection hidden in markup (HTML comments, white text, alt text).

Interpretation: a guardrail with 98% recall on the clean dataset but a 40% bypass rate under encoding needs fixes (normalise or decode inputs before classification, add more layers). Report both numbers.

PreviousDesign a human review and annotation operation that supports evals at scale (thousands of items per week).

This is what real progress feels like.

How do you evaluate the guardrails themselves? How do you measure bypass resistance?

Evaluation dimensions

Adversarial transformation suite

Related