{"version":"v0.30.0","generated_at":"2026-08-12T21:00:13.322Z","data_source":"/home/runner/workspace/evals/results/latest.json","last_eval":"2026-06-20T01:41:29.169Z","rows":[{"class":"LLM01a","name":"Prompt Injection (Direct)","classifiers":[{"key":"prompt_injection","implemented":true,"since":"v0.1.0"},{"key":"cipher_encoding","implemented":true,"since":"v0.12.0"},{"key":"adversarial_suffix","implemented":true,"since":"v0.20.0"}],"target_tpr":0.99,"target_fpr":0.02,"target_fnr":0.02,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":["advbench","harmbench","ailuminate","llm01a-safe-controls","pint","open-prompt-injection"],"notes":"Stage 1: harmful_content_intent (openai_mod/llama-guard) blocks direct harmful requests; cipher/suffix heuristics catch obfuscated variants. TPR measured via advbench+harmbench attack corpora; FPR via committed safe-prompts control set.","gated":true},{"class":"LLM01b","name":"Prompt Injection (Indirect)","classifiers":[{"key":"indirect_injection","implemented":true,"since":"v0.28.0"},{"key":"tool_call_request","implemented":true,"since":"v0.28.0"}],"target_tpr":0.99,"target_fpr":0.02,"target_fnr":0.02,"measured_tpr":1,"measured_fpr":0,"measured_fnr":0,"last_eval":"2026-06-20T01:41:29.169Z","status":"yellow","datasets":["bipia","injecagent","pint"],"notes":"Stage 1: heuristic tier-1 regex (BIPIA/PINT patterns). Stage 2: PromptArmor mini-LLM on ambiguous chunks.","gated":true},{"class":"LLM02","name":"Sensitive Information Disclosure","classifiers":[{"key":"pii_input","implemented":true,"since":"v0.4.0"},{"key":"pii_output","implemented":true,"since":"v0.4.0"}],"target_tpr":0.99,"target_fpr":0.02,"target_fnr":0.02,"measured_tpr":1,"measured_fpr":0,"measured_fnr":0,"last_eval":"2026-06-20T01:41:29.169Z","status":"yellow","datasets":["bipia","injecagent"],"notes":"Hard-block on PII output patterns. Stage 2 judge confirms paraphrased leaks.","gated":true},{"class":"LLM03","name":"Supply Chain Vulnerabilities","classifiers":[{"key":"provider_attestation","implemented":true,"since":"v0.29.0"}],"target_tpr":1,"target_fpr":0,"target_fnr":0,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":[],"notes":"Deterministic: Sigstore signing + provider_attestation field. Added in Wave 11. See TODO comment in coverage.js.","gated":false},{"class":"LLM04","name":"Data & Model Poisoning","classifiers":[],"target_tpr":null,"target_fpr":null,"target_fnr":null,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":[],"notes":"SCOPED OUT. Not detectable at inference time by a broker-layer tool. Requires training-time controls by the model vendor.","gated":false,"scoped_out":true},{"class":"LLM05","name":"Insecure Plugin Design","classifiers":[{"key":"tool_call_request","implemented":true,"since":"v0.28.0"},{"key":"destination_mismatch","implemented":true,"since":"v0.28.0"}],"target_tpr":0.99,"target_fpr":0.02,"target_fnr":0.02,"measured_tpr":1,"measured_fpr":0,"measured_fnr":0,"last_eval":"2026-06-20T01:41:29.169Z","status":"yellow","datasets":["injecagent","agentdojo"],"notes":"Hard-block on dangerous tools / off-allowlist exfil. Stage 2 judge confirms encoded payloads.","gated":true,"measured_post_defense_asr":null},{"class":"LLM06","name":"Excessive Agency","classifiers":[{"key":"agency_budget","implemented":true,"since":"v0.28.0"}],"target_tpr":1,"target_fpr":0,"target_fnr":0,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":["agentdojo"],"notes":"Deterministic: per-session caps on tool calls, destructive ops, unique destinations, and budget spent.","gated":false,"measured_post_defense_asr":null},{"class":"LLM07","name":"System Prompt Leakage","classifiers":[{"key":"model_extraction","implemented":true,"since":"v0.18.0"},{"key":"indirect_injection","implemented":true,"since":"v0.28.0"}],"target_tpr":0.99,"target_fpr":0.02,"target_fnr":0.02,"measured_tpr":1,"measured_fpr":0,"measured_fnr":0,"last_eval":"2026-06-20T01:41:29.169Z","status":"yellow","datasets":["injecagent","tensortrust"],"notes":"Regex + drift catches most leakage attempts. TensorTrust extraction corpus (569 attacks) probes the model_extraction classifier; injecagent benign user tasks supply FPR baseline.","gated":true},{"class":"LLM08","name":"Vector & Embedding Weaknesses","classifiers":[{"key":"embedding_similarity","implemented":true,"since":"v0.14.0"}],"target_tpr":null,"target_fpr":null,"target_fnr":null,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":[],"notes":"PARTIAL — broker-side embedding similarity check exists. Vector database poisoning and RAG-specific injection deferred. Application-layer concern for vector store owners.","gated":false,"partial":true},{"class":"LLM09","name":"Misinformation / Overreliance","classifiers":[{"key":"harmful_content_output","implemented":true,"since":"v0.27.0"}],"target_tpr":0.9,"target_fpr":0.05,"target_fnr":0.1,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":[],"notes":"Intentionally looser targets — no ground-truth oracle exists. Logged and disclosed, NOT gated. LLM09 misinformation FNR is a separate log-only metric per the 99/2/2 decision §4.","gated":false,"log_only":true},{"class":"LLM10","name":"Unbounded Consumption","classifiers":[{"key":"model_dos","implemented":true,"since":"v0.30.0"}],"target_tpr":1,"target_fpr":0,"target_fnr":0,"measured_tpr":null,"measured_fpr":null,"measured_fnr":null,"last_eval":"2026-06-20T01:41:29.169Z","status":"unknown","datasets":[],"notes":"Deterministic: rate/size/token caps + per-tenant cost circuit-breaker. Added in Wave 12. See TODO comment in coverage.js.","gated":false}],"summary":{"total_classes":11,"green":0,"yellow":4,"red":0,"unknown":7,"scoped_out":1},"methodology_url":"https://vouchsec.io/docs/coverage-methodology","decision_doc":"docs/decisions/2026-06-18-target-99-2-2-operating-point.md","citations":[{"name":"PromptArmor","url":"https://arxiv.org/abs/2507.15219"},{"name":"Sentinel-v2","url":"https://openreview.net/pdf/f9f416d6949bd2f767da4b15fd96a60a4c64f3f8.pdf"},{"name":"BIPIA","url":"https://arxiv.org/abs/2312.14197"},{"name":"InjecAgent","url":"https://arxiv.org/abs/2403.02691"},{"name":"PINT","url":"https://github.com/lakeraai/pint-benchmark"},{"name":"AgentDojo","url":"https://arxiv.org/abs/2406.13352"},{"name":"TensorTrust","url":"https://arxiv.org/abs/2311.01011"},{"name":"OWASP LLM Top 10","url":"https://genai.owasp.org/llmrisk/"}]}