Upload eval/injection_eval.md with huggingface_hub

eval/injection_eval.md

@@ -1,37 +1,39 @@
 # injection evaluation
 
-**Threshold 0.19 (calibrated on the validation split, objective recall_at_fpr).** The config default of 0.5 scored 0.938 against 0.961 for the calibrated value, on validation. Every table below is on test, at the calibrated threshold.
+**Threshold 0.02 (calibrated on the validation split, objective recall_at_fpr).** The config default of 0.5 scored 0.985 against 0.993 for the calibrated value, on validation. Every table below is on test, at the calibrated threshold.
+
+> the chosen threshold 0.02 is the lowest value in the sweep, so the scores are compressed toward zero and this is underfitting rather than a calibration success. Check average precision before trusting the F1.
 
 ## Per language
 
 | Language | Support | P | R | F1 | Notes |
 |---|---|---|---|---|---|
-| `bg` Bulgarian | 13 | 1.000 | 1.000 | 1.000 |  |
-| `cs` Czech | 13 | 1.000 | 0.923 | 0.960 |  |
-| `da` Danish | 14 | 0.933 | 1.000 | 0.966 |  |
-| `de` German | 14 | 0.933 | 1.000 | 0.966 |  |
-| `el` Greek | 14 | 1.000 | 1.000 | 1.000 |  |
-| `en` English | 14 | 0.933 | 1.000 | 0.966 |  |
-| `es` Spanish | 12 | 1.000 | 1.000 | 1.000 |  |
-| `et` Estonian | 14 | 0.933 | 1.000 | 0.966 |  |
-| `fi` Finnish | 14 | 0.933 | 1.000 | 0.966 |  |
-| `fr` French | 13 | 0.923 | 0.923 | 0.923 |  |
-| `ga` Irish | 14 | 1.000 | 1.000 | 1.000 |  |
-| `hr` Croatian | 13 | 1.000 | 1.000 | 1.000 |  |
-| `hu` Hungarian | 14 | 1.000 | 1.000 | 1.000 |  |
-| `it` Italian | 14 | 1.000 | 1.000 | 1.000 |  |
-| `lt` Lithuanian | 13 | 1.000 | 1.000 | 1.000 |  |
-| `lv` Latvian | 14 | 1.000 | 1.000 | 1.000 |  |
-| `mt` Maltese | 14 | 1.000 | 0.571 | 0.727 | not in base model pretraining |
-| `nl` Dutch | 14 | 1.000 | 1.000 | 1.000 |  |
-| `pl` Polish | 14 | 1.000 | 1.000 | 1.000 |  |
-| `pt` Portuguese | 14 | 0.875 | 1.000 | 0.933 |  |
-| `ro` Romanian | 14 | 0.933 | 1.000 | 0.966 |  |
-| `sk` Slovak | 14 | 1.000 | 0.929 | 0.963 |  |
-| `sl` Slovenian | 14 | 1.000 | 1.000 | 1.000 |  |
-| `sv` Swedish | 14 | 1.000 | 1.000 | 1.000 |  |
-| `tr` Turkish | 14 | 0.933 | 1.000 | 0.966 |  |
-| `az` Azerbaijani | 14 | 1.000 | 0.929 | 0.963 |  |
+| `bg` Bulgarian | 41 | 1.000 | 1.000 | 1.000 |  |
+| `cs` Czech | 42 | 0.955 | 1.000 | 0.977 |  |
+| `da` Danish | 41 | 0.976 | 1.000 | 0.988 |  |
+| `de` German | 42 | 1.000 | 1.000 | 1.000 |  |
+| `el` Greek | 42 | 1.000 | 1.000 | 1.000 |  |
+| `en` English | 41 | 0.976 | 1.000 | 0.988 |  |
+| `es` Spanish | 40 | 1.000 | 1.000 | 1.000 |  |
+| `et` Estonian | 41 | 1.000 | 1.000 | 1.000 |  |
+| `fi` Finnish | 42 | 1.000 | 1.000 | 1.000 |  |
+| `fr` French | 41 | 1.000 | 0.976 | 0.988 |  |
+| `ga` Irish | 42 | 0.976 | 0.976 | 0.976 |  |
+| `hr` Croatian | 42 | 0.955 | 1.000 | 0.977 |  |
+| `hu` Hungarian | 42 | 0.955 | 1.000 | 0.977 |  |
+| `it` Italian | 42 | 1.000 | 1.000 | 1.000 |  |
+| `lt` Lithuanian | 42 | 1.000 | 1.000 | 1.000 |  |
+| `lv` Latvian | 41 | 0.976 | 1.000 | 0.988 |  |
+| `mt` Maltese | 42 | 0.732 | 0.976 | 0.837 | not in base model pretraining |
+| `nl` Dutch | 41 | 0.976 | 1.000 | 0.988 |  |
+| `pl` Polish | 41 | 1.000 | 1.000 | 1.000 |  |
+| `pt` Portuguese | 42 | 0.977 | 1.000 | 0.988 |  |
+| `ro` Romanian | 42 | 0.977 | 1.000 | 0.988 |  |
+| `sk` Slovak | 41 | 1.000 | 1.000 | 1.000 |  |
+| `sl` Slovenian | 42 | 0.977 | 1.000 | 0.988 |  |
+| `sv` Swedish | 41 | 1.000 | 1.000 | 1.000 |  |
+| `tr` Turkish | 42 | 0.955 | 1.000 | 0.977 |  |
+| `az` Azerbaijani | 42 | 1.000 | 1.000 | 1.000 |  |
 
 The base-model note is a fact about pretraining, not a cause of the score beside it. `nsfw` Maltese carried the same note at 0.000 and reached 1.000 on corpus size alone, with nothing about the base model changed. Check how many examples a weak score rests on before reaching for this.
 
@@ -39,25 +41,27 @@ The base-model note is a fact about pretraining, not a cause of the score beside
 
 | Register | Support | P | R | F1 | FPR |
 |---|---|---|---|---|---|
-| `encoded_payload` | 50 | 1.000 | 0.980 | 0.990 | 0.000 |
-| `hypothetical_framing` | 52 | 1.000 | 0.942 | 0.970 | 0.000 |
-| `ignore_instructions` | 51 | 1.000 | 0.980 | 0.990 | 0.000 |
-| `instruction_in_document` | 52 | 1.000 | 1.000 | 1.000 | 0.000 |
-| `instruction_in_tool_output` | 48 | 1.000 | 1.000 | 1.000 | 0.000 |
-| `meta_question` | 0 | 0.000 | 0.000 | 0.000 | 0.029 |
+| `encoded_payload` | 155 | 1.000 | 0.994 | 0.997 | 0.000 |
+| `hypothetical_framing` | 156 | 1.000 | 1.000 | 1.000 | 0.000 |
+| `ignore_instructions` | 155 | 1.000 | 1.000 | 1.000 | 0.000 |
+| `instruction_in_document` | 155 | 1.000 | 1.000 | 1.000 | 0.000 |
+| `instruction_in_tool_output` | 148 | 1.000 | 0.986 | 0.993 | 0.000 |
+| `meta_question` | 0 | 0.000 | 0.000 | 0.000 | 0.015 |
 | `mundane_informational` | 0 | 0.000 | 0.000 | 0.000 | 0.000 |
-| `mundane_operational` | 0 | 0.000 | 0.000 | 0.000 | 0.000 |
-| `mundane_transactional` | 0 | 0.000 | 0.000 | 0.000 | 0.000 |
-| `ordinary_instruction` | 0 | 0.000 | 0.000 | 0.000 | 0.000 |
-| `ordinary_question` | 0 | 0.000 | 0.000 | 0.000 | 0.000 |
-| `persona_override` | 52 | 1.000 | 0.962 | 0.980 | 0.000 |
-| `quoted_attack` | 0 | 0.000 | 0.000 | 0.000 | 0.019 |
-| `roleplay_benign` | 0 | 0.000 | 0.000 | 0.000 | 0.019 |
-| `security_discussion` | 0 | 0.000 | 0.000 | 0.000 | 0.029 |
-| `system_prompt_extraction` | 52 | 1.000 | 0.942 | 0.970 | 0.000 |
+| `mundane_operational` | 0 | 0.000 | 0.000 | 0.000 | 0.005 |
+| `mundane_transactional` | 0 | 0.000 | 0.000 | 0.000 | 0.005 |
+| `ordinary_instruction` | 0 | 0.000 | 0.000 | 0.000 | 0.015 |
+| `ordinary_question` | 0 | 0.000 | 0.000 | 0.000 | 0.003 |
+| `persona_override` | 155 | 1.000 | 1.000 | 1.000 | 0.000 |
+| `quoted_attack` | 0 | 0.000 | 0.000 | 0.000 | 0.018 |
+| `roleplay_benign` | 0 | 0.000 | 0.000 | 0.000 | 0.015 |
+| `security_discussion` | 0 | 0.000 | 0.000 | 0.000 | 0.015 |
+| `system_prompt_extraction` | 156 | 1.000 | 1.000 | 1.000 | 0.000 |
+| `technical_identifiers` | 0 | 0.000 | 0.000 | 0.000 | 0.003 |
+| `technical_payload` | 0 | 0.000 | 0.000 | 0.000 | 0.003 |
 
 ## Known weaknesses
 
-The three weakest languages by F1: `mt` at 0.727, `fr` at 0.923, `pt` at 0.933.
+The three weakest languages by F1: `mt` at 0.837, `ga` at 0.976, `cs` at 0.977.
 
 These are published rather than dropped. A coverage table with the bad rows removed is not a coverage table.