Human‑Centred AI

A refusal that holds in one scaffold can fail in another, so testing a model on its own tells you less than testing the configuration it actually ships in. I want scenarios that are reproducible and shareable rather than one-off scripts: prompt injection resistance, refusal consistency, output sanitisation, instruction-following under pressure. Built on UK AISI's Inspect framework.

Most people meet ML security as a list of attack names. I would rather they could watch one work. Adversarial examples, data poisoning, model extraction and membership inference, each as a scenario that runs against any compatible model, written to be read as much as run, so someone can fork it and point it at their own system.

Agents are being handed payments, infrastructure and procurement. That makes the sequence of tool calls the thing worth watching, not the final answer, and almost nobody is watching it. A thin layer over exactly that: what was called, in what order, and what looks unlike the last thousand runs. I am building this because I run one of these in production.

Retrieval poisoning and indirect prompt injection arrive through documents, which means the attack sits in the corpus and never passes an input filter at all. I want that tested the way functional behaviour is tested: probes per attack class, composable into a pipeline audit, running in CI beside everything else.