Quizzes

Evals & Safety quiz

24 questions from the Evals & Safety track. Score 80% or higher to unlock a certificate.

1. Why Evals Exist

   1. Why is a correct-looking final answer not enough to pass an agent eval?

   • Users only read the last sentence, so tools never matter
   • The agent may have skipped tools, called the wrong one, or violated a safety rule on the way
   • Evals cannot read traces
   • JSON cannot store answers

2. Measure Side Effects

   2. The agent said “all done” and also called refund. What should the eval do?

   • Pass — the user is happy
   • Fail — a forbidden (or unrequested) side effect ran
   • Ignore tools
   • Average tone and success

3. Offline vs Online

   3. What do offline evals need that dashboards do not?

   • More thumbs-up
   • Frozen fixtures (fake tickets, fake tools, recorded pages) you can rerun
   • Live Stripe on every PR
   • A longer system prompt

4. The Unit Is a Trace

   4. Two traces end with the same sentence. How do you tell them apart?

   • You cannot
   • Compare tools, args, and observations — the path is the eval
   • Pick the longer thought
   • Ask the model which one it likes

5. Write the Eval First

   5. What should you write before you grow the prompt?

   • A longer persona
   • Labeled eval cases (tools, refusals, facts)
   • A swarm
   • A new vendor contract

6. Golden Sets

   6. What is a better expected value for a prose answer in a golden set?

   • Byte-for-byte equality with last week’s model sample
   • A property check (must include a fact, schema, citations, tool predicates)
   • The CEO’s opinion in a meeting
   • Whatever the agent printed in the demo

7. Pass Rate Is a Fraction

   7. The suite has zero cases. What should pass_rate return?

   • 1.0 — nothing failed
   • 0.0 — there is nothing to pass
   • None
   • Last week’s number

8. Properties Beat String Equality

   8. When should you use exact string match on the final answer?

   • Always — paraphrase is cheating
   • On structured fields (ids, SKUs). Use properties for prose.
   • Never
   • Only for safety

9. Quarantine Flaky Rows

   9. A fixture is wrong because finance changed the policy. What should you do?

   • Delete it so CI is green
   • Update the expected property (or quarantine briefly with an owner) in a reviewed commit
   • Lower temperature
   • Hide it in a prompt

10. Coverage by Tag

    10. Your pass rate is 92% and you have zero injection fixtures. What is the number?

    • Proof you are safe
    • A vanity metric — the threat model is not in the table
    • Better than properties
    • Enough to skip HITL

11. Unit Tests for Tools

    11. Where should permission checks live?

    • In the system prompt (“please don’t peek”)
    • In the tool implementation (and its unit tests), as well as any gateway
    • Only in the critic persona
    • In the user’s browser

12. LLM-as-Judge

    12. When should you prefer code over LLM-as-judge?

    • Never; models are better at everything
    • Schemas, allow-lists, citation ids, tests, and other machine-checkable properties
    • Only on weekends
    • When the judge prompt is longer than the actor prompt

13. When Not to Judge

    13. The trace called a forbidden tool. Who should fail the case?

    • An LLM judge with a long rubric
    • Code on the allow-list — before any judge
    • The user in a survey
    • Nobody if the prose was polite

14. Eval the Judge

    14. What number should scare you most on a safety judge?

    • False negatives — missed fails (the judge said pass, humans said fail)
    • Average stars
    • Token count of the rubric
    • How often the judge agrees with the actor

15. Traces and Replay

    15. What is recorded-observation replay good for?

    • Hitting live Stripe twice to be sure
    • Testing a new parser/assembler against a frozen world from the log
    • Deleting traces to save money
    • Training the model on production secrets

16. Safety and Harms

    16. What is the difference between a polite refusal and a safety pass?

    • There is no difference
    • A pass also requires no forbidden tool calls and no cross-tenant reads
    • Safety is only about tone
    • Refusals must be in rhyming couplets

17. Forbidden Tools Are a Gate

    17. The model wrote a careful refusal and still called run_shell. Pass or fail?

    • Pass — the prose was safe
    • Fail — a forbidden tool ran
    • Pass if the shell echoed hello
    • Ask a judge to average tone

18. Score Secret Leaks

    18. Where should you look for a leaked API key?

    • Only the system prompt
    • The user-visible answer and the stored trace excerpt
    • The model card
    • Yesterday’s Slack

19. Prompt Injection, Deep Cut

    19. Which defense stops an injected document from calling wire even if the model asks?

    • A longer constitution paragraph
    • Not including wire in that agent’s tool allow-list (plus executor enforcement)
    • Asking the document if it is trustworthy
    • Printing the system prompt twice

20. Delimit, Then Allow-List

    20. An observation contains a fake tool JSON for refund. What runs?

    • refund, because JSON is official
    • Nothing — the parser only runs names on the allow-list
    • Whatever the detector missed
    • A swarm vote

21. Alignment Basics

    21. When retrieved policy and the model’s prior disagree, what should an enterprise agent usually do?

    • Average the two numbers
    • Follow the spec — typically let the docs win — and eval that behavior
    • Hide the conflict
    • Call a swarm to vote on metaphysics

22. Docs Win (On Purpose)

    22. The doc says 5-7 and the model wants 2. What does docs-win mean?

    • Average to 3.5
    • Answer from the doc, and fail the eval if 2 sneaks in
    • Hide both numbers
    • Ask the user to pick a vibe

23. Red-Team Hour Becomes Goldens

    23. A red-team finds a wire jailbreak on Tuesday. When should it enter the golden set?

    • Next quarter
    • The same week, with a tag and an owner
    • Never — it was a one-off
    • After you delete the tool quietly

24. When the Eval Lies

    24. A dashboard shows 100% pass on zero cases. What is it?

    • Proof you are done
    • An empty suite — not an eval
    • Better than goldens
    • A reason to skip production CI