Test an agent twice: once for free, once for real

You need to test an agent that reads messages from the outside world more than once. Not just when you first set it up: the model changes, the rules change, and the attacks change too. But every test with a real model costs tokens and time. So I use two layers.

Layer 1 is free and runs with every change. It uses a mock model, one that always gives the same answer. The gateway, limits and rules are real. I send it a fixed set of messages from outsiders: someone telling me to ignore my instructions, someone asking for a password, someone pretending to be a colleague, someone flooding the inbox. The question is simple: does the gateway hold? If a limit fails, this test catches it straight away.

Layer 2 uses the real model, once a week. The same messages travel through the same path as real mail, but in a dry environment where nothing gets sent. This time I am testing the model’s behaviour, not the gateway: does it follow the rules when there is no test harness watching? A model can reason well and still send the wrong thing. It can also reason strangely and arrive at the right answer. That is why I check what actually goes out, not what the model says about its reasoning.

Why use two layers?

• Layer 1 checks the build. It catches a mistake I make right away, at no cost.
• Layer 2 checks behaviour. It catches things only a real model might do, including things I did not think to test for.
• If I change models, the test set still applies. That is the point of testing the output.

There is one more rule: I deliberately make every check fail before I trust it. I loosen a limit, remove the gateway or reverse the attachment check, then make sure the right test turns red. A test that has only ever passed has not shown me that it works.

What happens when a test fails? I get a report with the first failing checks and what I can do next: adjust the rules and run them again. The failure is never repaired silently.

You can start small. Ten fixed messages, a dry environment and a list of things that must never get out are enough to catch something you might otherwise discover only after it goes wrong.

Do you test the agents that read messages from the outside world? How often?

#AIagents #AI #Safety #Testing

All pieces