Skip to main content
multivon-eval bootstrap (covered in the bootstrap guide) is the user-facing CLI. Under it sit three primitives in multivon_eval.auto that you can call directly when you want fine-grained control or want to compose them into your own pipeline. Each one is documented and tested independently — you can use them in any combination.

auto_evaluators(case) — heuristic recommender

Pure pattern-match over an EvalCase shape. Returns a ranked list of recommended evaluators across primary / secondary / guardrail tiers, with a confidence rating per recommendation. Zero LLM cost. Microseconds.

Signature

  • task_type="auto" infers from case shape. Pin explicitly when the shape is ambiguous (e.g., a case with both context and expected_output could be RAG or fact-check).
  • strict_mode=True raises AmbiguousCaseShape if the heuristic can only offer a low-confidence primary. Use this in CI / production code paths where a silent mis-recommendation is worse than failing loud.
  • include_pii=True + pii_jurisdiction appends PIIEvaluator as a guardrail ("gdpr" | "ccpa" | "pipeda" | "hipaa" | "dpdp" | "all").
  • include_safety=True appends Toxicity + Bias as guardrails.

EvaluatorRecommendation shape

You can drop low-confidence picks, override threshold, or feed the recommendation set straight into suite.add_evaluators(...) after instantiation. The function never picks for you — it suggests.

generate_adversarial_cases(seed, mode, n) — LLM-generated stress cases

Synthesises cases targeting one of 10 named failure modes. Uses your configured judge (defaults to Claude Haiku) to write cases plausible enough to look real but designed to trip up a model on the specific weakness.

The 10 failure modes

Signature

Each returned case carries:
  • tags = ["adversarial:<mode>"]
  • metadata["target_failure_mode"] — the mode it was generated for
  • metadata["stress_tests"] — the evaluators it’s designed to test
  • metadata["prompt_version"] — for reproducibility (the prompt template can evolve)
  • metadata["judge_used"] — provider:model of the generator

Deterministic variant: generate_unicode_obfuscation_cases

Some attacks shouldn’t be LLM-generated — LLMs are aligned to NOT produce bypass attacks, so they tend to produce polished-looking but technically-easy attacks. For character-level obfuscation patterns (homoglyph, zero-width, RTL-override), use the deterministic generator:

validate_adversarial_cases(cases, baseline) — N-shot judge-noise filter

The “are these cases actually adversarial, or just synthetic noise?” question. Runs each generated case N times against a baseline model + evaluator, computes per-case failure rate, filters by hardness band. This is the validation step that separates real signal from generation noise.

What this catches

Single-shot validation can’t distinguish a hard case from judge noise on one observation. With N≥3 shots the failure rate has enough granularity for the band to filter on real signal. Validated live: +0.80 mean failure-rate separation between weak (always-confabulate) and strong (always-refuse) baselines on ungrounded_claim cases. Judge noise is visible at the per-shot level as [1.00, 0.00, 1.00] score arrays and gets filtered out by the band.

Signature

  • n_shots — how many times to sample baseline + evaluator per case. Default 3 dampens judge noise; setting to 1 reproduces single-shot behavior (NOT recommended).
  • hardness_band(min, max) failure-rate band. Cases outside the band are dropped from the kept list (but still returned in the full report). Default (0.5, 1.0) keeps cases the baseline fails at least half the time. Use (0.2, 0.8) for a discriminating-case filter that drops both too-easy and impossibly-hard cases.

HardnessReport shape

Inspect baseline_outputs[shot] + scores[shot] to audit why a case ended up in or out of the band.

Composing the primitives

The multivon-eval bootstrap CLI is approximately:
Use the primitives directly when you want to:
  • Add auto_evaluators(case) recommendations to a manually-built suite
  • Run generate_adversarial_cases on a different failure mode than your default
  • Validate any case set (not just generated ones) against your real baseline with N-shot aggregation

See also

  • Bootstrap CLI guide — the one-command path that composes all three primitives + PII redaction + threshold calibration
  • Generate eval cases — the higher-level generate_from_file / generate_from_text helpers, when you want generation without targeting a specific failure mode
  • Statistical rigor — why N-shot aggregation matters and how the hardness band relates to power
  • Quickstart — the manual path