Module 01 · Foundations

What an eval is, and why it matters

An eval is a repeatable experiment that turns "does my AI system work?" into a number you can trust, compare and improve. Everything else in this course is a refinement of that one idea.

Beginner~25 minNo code needed

By the end of this module you can

  • Define an eval precisely and say how it differs from a software unit test.
  • Explain why "vibe checks" fail as soon as a system is non-deterministic or has more than a handful of users.
  • Place any eval on a map: who runs it, when, and what question it answers.
  • Use the core vocabulary (task, sample, grader, metric, benchmark, harness, trajectory) correctly.

The one-sentence definition

An evaluation ("eval") is a fixed set of inputs, run through your AI system, whose outputs are scored by a grader and aggregated into metrics, so that two versions of the system can be compared fairly.

HELD FIXED THE ONLY THING YOU CHANGE HELD FIXED Dataset inputs + expected behavior System under test model + prompt + tools + scaffold Grader code / model / human Metric e.g. 73% ± 4% Decision ship? fix? input output score report change the system, re-run the SAME eval, compare the two numbers
The eval pipeline. The dataset and grader stay fixed; only the system under test changes between runs. That is what makes the comparison fair.

Four words in that definition do the heavy lifting:

  • Fixed: if the inputs change between runs, you cannot tell whether the score moved because the system improved or because the test got easier.
  • System: you are rarely evaluating "a model". You are evaluating a model plus a prompt, tools, retrieval, memory, a loop that decides when to stop. Anthropic and others call the non-model part the scaffold or harness. Change the scaffold and the score changes, sometimes by more than a model upgrade.
  • Grader: something has to decide whether each output is good. It can be a string match, a program that runs unit tests, another LLM, or a human.
  • Compared: an eval score is almost meaningless on its own. "71%" tells you little; "71% vs 64% last week, on the same 400 tasks, with a 95% confidence interval of ±4%" tells you a lot.
Analogy: the driving test

A driving test does not check whether you can recite traffic law (a knowledge benchmark). It puts you in a real car on real roads (an environment), gives you tasks ("parallel park here"), and an examiner (a grader) scores what you actually did, including the path you took, not just whether you ended up at the right address. Agent evals are driving tests for AI.

Evals vs unit tests

If you come from software engineering, the closest thing you know is a test suite. Evals borrow the idea but break three assumptions.

Unit test Eval add(2,3) 5 PASS every time 1 input → 1 correct output deterministic, binary "Refund my last order" asks order ID, refunds ✓ looks up order, refunds ✓ refunds, rude tone ~ refunds WRONG order ✗ P(good) = a rate 1 input → a distribution of outputs, many acceptable stochastic, graded, reported as a rate
Why evals are statistics, not assertions. Run the same agent on the same request five times and you can get five different trajectories. An eval estimates the probability of good behavior.
Unit testEval
Output spaceOne correct answerMany acceptable answers, many wrong ones, and gray zones
DeterminismSame input, same resultSampling makes results vary run to run; you need repeats and error bars
ResultPass / failA rate, a score, a distribution, a ranking
Target100% passing, alwaysOften well below 100%; you care about the trend and where it fails
CheckerassertCode, a model, or a human, each with its own error rate
Cost per runMillisecondsSeconds to hours per sample (agents!), real money in API tokens
Key idea

Your grader is also a measuring instrument, and it has error too. A test harness that is wrong 10% of the time silently caps how much you can trust any difference smaller than that. Much of expert-level eval work is about measuring the measurer (Module 13).

Why "vibe checks" stop working

Almost every AI product starts with a developer typing a few prompts and eyeballing the answers. That is fine on day one. It breaks down for three reasons:

1. Whack-a-mole

You fix the failure you saw today and silently break two you fixed last month. Without a fixed set of cases, regressions are invisible.

2. Anecdotes are noisy

If an agent succeeds 70% of the time, five tries can easily show 5/5 or 2/5. Humans overweight the last few examples they saw.

3. You can't compare

Is the new model better? Is the shorter prompt good enough? Without numbers on the same inputs, every change is a debate.

real quality time / number of changes → vibe checks: fix one thing, break another eval-gated: only ship changes that don't regress
The ratchet effect. An eval suite turns quality into a ratchet: a change ships only if it doesn't make the numbers worse. This illustration is conceptual, not real data.

Feel the second problem for yourself. Below, the system never changes; only the luck of the draw does.

OpenAI's own guidance calls this eval-driven development: write the evals first, like tests in test-driven development, then iterate on prompts, tools and models against them. Practitioners such as Hamel Husain put it bluntly: teams that succeed with LLM products are the ones that invest in evals and in looking at their data.

eval-driven development test-first, for stochastic systems 1 · Write evals from real tasks and failures 2 · Run the suite same cases, every change 3 · Read the failures cluster them into error types 4 · Change one thing prompt, tool, model or data 5 · Gate the change ship only if nothing regresses score look hypothesis re-run new failures become new cases
The eval-driven development loop. Evals come first, like tests in test-driven development. Every change is a hypothesis that the suite accepts or rejects, and every new failure you find in production becomes a new case, so the suite grows with the product.

A map of the eval world

"Evals" means different things to different people. Almost all confusion goes away once you ask three questions: who is evaluating, what question are they answering, and at what stage.

Model builders Anthropic, OpenAI, Google DeepMind, Meta, … Capability benchmarks "How smart / skilled is the model?" MMLU, GPQA, SWE-bench, OSWorld, τ-bench Safety & dangerous-capability evals "Could it help with bio/cyber harm? Does it deceive?" RSP / Preparedness / Frontier Safety evals Training signals & human preference "Which response is better?" (feeds RLHF / RL) reward models, graders, LMArena Product builders you, building an agent on top of a model Offline evals (before shipping) "Does my agent solve MY users' tasks?" custom datasets, CI regression suites Online evals (after shipping) "Is it working in production, right now?" judges on live traces, A/B tests, feedback Model selection "Which model/provider for my use case?" your eval × N models, cost, latency
Two worlds, same toolkit. Public benchmarks answer "is this model generally capable?". Your own evals answer "does my system do my job?". A model that tops a leaderboard can still fail your task.

Three axes you will see everywhere

AxisOne endOther endExample
PurposeCapability eval: "what can it do?" Designed to be hard, starts with low scores.Regression eval: "did we break anything?" Should stay near 100%.A new coding task set where your agent scores 30% vs your "golden 50" that must always pass.
TimingOffline: fixed dataset, run before release.Online: scoring real traffic, after release.CI run on every prompt change vs an LLM judge sampling 5% of production conversations.
ScopePublic benchmark: shared, comparable across labs.Private / product eval: specific to your users and data.SWE-bench Verified vs "our 200 real customer tickets".

Where agents come in

A classic eval is single turn: one prompt in, one answer out, grade the answer. An agent is a model running in a loop: it reads its situation, picks an action (call a tool, click a button, speak, write a file), observes the result, and repeats until it thinks it is done. That changes what you have to evaluate.

Single-turn prompt answer grade this ↑ Agentic environment (files, browser, APIs, OS, a phone call…) task think +act 1 observe act 2 … final state +final answer grade the trajectory (the path) grade the outcome ↑ plus: cost, latency, number of steps, safety of every action along the way
The agent shift. Agents are graded on what they did (the trajectory) and what they achieved (the end state), inside an environment that has to be rebuilt identically for every run. Module 05 goes deep on this.

This course is about that harder, agentic kind of eval, across every way an agent can act: text and tool calls, code, browsers and desktops, voice, and images and video. We build up the foundations first, because every agent eval is still made of the same four parts: dataset, system, grader, metric.

A short history: from answers to actions

Evals have followed what models can do. When models could only fill in blanks, evals were multiple-choice quizzes. When they could write code, evals ran that code. Now that they act in the world, evals build whole worlds for them to act in.

era 1: static Q&A era 2: execute & compare era 3: act in an environment 2018GLUE 2020MMLU 2021HumanEval, pass@k 2023MT-Bench, Arena(LLM judges, votes) 2023SWE-bench 2023WebArena, GAIA 2024OSWorld, τ-bench 2025METR time horizons,GDPval, Terminal-Bench 2026τ-Voice, ARC-AGI-3,SWE-bench Verified retired What gets graded moved from the answer, to the program, to the whole trajectory each generation keeps the old tools (exact match, unit tests, judges) and adds environments, simulated users and longer tasks
Three eras of evals. Static question sets (GLUE, MMLU) gave way to execution-based checks (HumanEval ran the code), then to interactive environments where agents browse, code, operate desktops and talk (WebArena, OSWorld, τ-bench and its voice successor τ-Voice). Dates are the public release years of each benchmark or paper; Module 18 covers why benchmarks get retired.

Notice a pattern that repeats across this course: a benchmark launches with low scores, the field climbs it for a year or two, scores saturate near the ceiling (or flaws surface), and it gets replaced. In February 2026, OpenAI stopped using SWE-bench Verified as a frontier measure after an audit found flawed tests in a majority of the problems it examined. Being an expert means knowing not just the names, but where each eval is in that life cycle.

What makes a good eval

Most evals that fail do so in one of six predictable ways. Use these as a checklist every time you design or read one.

Valid

It measures the thing you care about. A trivia quiz is a poor proxy for "can this agent resolve support tickets".

Unambiguous

Two domain experts would agree on whether each output passes. Anthropic's agent-eval guidance puts it simply: a task should have a clear spec and, ideally, a reference solution.

Reliable

Re-running it gives nearly the same number. Enough samples, repeated trials, a grader that doesn't flip its mind.

Discriminative

Better systems score higher. If everything scores 98% (saturated) or 2% (too hard), it cannot tell systems apart.

Uncontaminated

The answers are not in the model's training data or the agent's reach (a leaked git history, a test file it can edit).

Affordable to run often

An eval nobody runs is worthless. Fast smoke suites on every change, bigger suites nightly.

Too easy (saturated) Too hard (floor) Discriminative 96–98%: differences are noise 1–4%: also mostly noise 25%50%66%80% spread reveals real differences same four systems (A, B, C, D, left to right) in every panel · illustrative numbers
Headroom matters. A capability eval is most informative when systems land in the middle of the scale. This is why labs keep releasing harder benchmarks, and why your regression suite (near 100% on purpose) cannot tell you whether a new model is better, only whether it broke something.

Your first eval, by hand

Before any framework, do one eval with a pencil. Say you're building a weather assistant that must answer with the temperature in Celsius. You write ten test questions, run your assistant once on each, and check every answer yourself.

#InputExpectedAgent saidPass?
1Weather in Paris now?Temp in °C"14 °C, light rain"✓
2How hot is Phoenix?Temp in °C"97 °F"✗ wrong unit
3Is it cold in Oslo?Temp in °C + yes/no"Yes, −3 °C"✓
4Weather at the North Pole?Temp in °C"−25 °C"✓
5Weather in Springfield?Ask which Springfield"22 °C"✗ didn't clarify
6–10…five more………5 × ✓

Result: 8 of 10 pass, 80%. You also learned more than a number: failures cluster into "wrong unit" and "ambiguous city". That is the seed of error analysis (Module 12), the most valuable habit in this whole field.

✓ ✗ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✓ #1#2#3#4#5#6#7#8#9#10 error type A: wrong unit (said °F) error type B: didn't ask which city What the number says 0%25%50%75%100% 80% 95% interval: about 49% to 94% What the failures say fix A: force °C in the prompt fix B: add a clarify-if-ambiguous rule then add 10 more cases of each type
Two outputs from one tiny eval. The score (80%) is very uncertain with only ten samples: the 95% interval (Wilson method, Module 04) runs from about 49% to 94%. The failures, though, are immediately useful: they name two concrete things to fix.
How much should you trust "80%"?

Very little, with ten samples. The 95% confidence interval for 7 out of 10 is roughly 40% to 89%; for 8 out of 10 it is similar in width. With 100 samples at 70% it tightens to about 60% to 78%, and with 1,000 to about 67% to 73%. The width shrinks with the square root of the sample size: four times the data, half the error bar. Module 04 derives this properly, and the widget below lets you feel it.

Now the same eval as code. Nothing magic: a list of cases, a function that calls your system, a grader, an average.

# first_eval.py: the whole idea of an eval in 25 lines
import re

CASES = [
    {"input": "Weather in Paris now?",      "check": "celsius"},
    {"input": "How hot is Phoenix?",        "check": "celsius"},
    {"input": "Weather in Springfield?",    "check": "clarify"},
    # ... more cases
]

def my_agent(question: str) -> str:
    ...  # call your model / agent here and return its reply

def grade(case, reply: str) -> bool:
    if case["check"] == "celsius":          # code-based grader: a regex
        return bool(re.search(r"-?\d+\s*°?\s*C\b", reply))
    if case["check"] == "clarify":          # asks which city?
        return "which" in reply.lower() and "?" in reply
    raise ValueError(case["check"])

results = [grade(c, my_agent(c["input"])) for c in CASES]
print(f"accuracy = {sum(results)}/{len(results)} = {sum(results)/len(results):.0%}")
for c, ok in zip(CASES, results):
    if not ok:
        print("FAIL:", c["input"])            # always look at the failures

Every framework in Module 14 is an industrial version of those 25 lines: better datasets, parallel runs, sandboxed environments, model-based graders, logs you can browse, and statistics on top.

Core vocabulary

Terms are used loosely across the industry. This course uses them like this (closely matching the UK AI Security Institute's Inspect framework and Anthropic's and OpenAI's docs):

SUITE: several tasks run together (e.g. a nightly regression suite) Harness: loads samples, runs every trial, calls graders, writes logs (Inspect, promptfoo, lm-eval-harness) TASK (one eval) Dataset sample 1input + target sample 2input + rubric … 3 trials (epochs) environment / sandbox System under test model scaffoldloop, tools, memory Transcriptmessages, tool calls Outcomefinal env state Gradercode, modelor human scores 1 0 1 Metric 67%
The vocabulary as one picture. A suite holds tasks. A task is a dataset plus how to run and grade it. Each sample is attempted over several trials by the system under test (model plus scaffold) inside an environment; each trial leaves a transcript and an outcome, a grader scores them, and the scores aggregate into a metric. The harness is the machinery that runs all of it.
TermMeaning
Task / evalA complete, runnable evaluation: dataset + how to run the system + how to grade.
Sample / case / itemOne row of the dataset: an input plus whatever the grader needs (a reference answer, a rubric, a checker script, a starting environment).
Trial / epoch / runOne attempt at a sample. Agents are often run several times per sample because results vary.
Transcript / trajectory / traceThe full record of an attempt: every message, tool call, observation and intermediate step.
Grader / scorer / judge / evaluatorThe thing that assigns a score to an output or trajectory.
MetricHow scores aggregate: accuracy, pass@k, mean rubric score, win rate, latency p95.
HarnessThe software that runs evals: loads samples, runs the system, calls graders, records logs. (Inspect, promptfoo, lm-eval-harness…)
Scaffold / agent harnessThe code around the model that makes it an agent: tool definitions, the loop, memory, context management.
Environment / sandboxThe world the agent acts in: a Docker container, a browser, a VM, a simulated user.
OutcomeThe final state of the environment after an agent trial (was the refund actually issued in the database?). Anthropic's agent-eval guide separates the outcome from the transcript that produced it.
SuiteA collection of evals run together, e.g. a regression suite on every change and a capability suite weekly.
BenchmarkA public, standardized eval used to compare systems (SWE-bench, OSWorld, τ-bench, MMMU…).

Key takeaways

  1. An eval is a fixed dataset run through a system under test, scored by a grader and aggregated into a metric. Only the system should change between runs.
  2. AI systems are stochastic, so an eval estimates a probability of good behavior. Numbers need repeats and error bars before you trust a difference.
  3. The grader is a measuring instrument with its own error rate. Measure it before you believe it.
  4. Capability evals should be hard (headroom to improve); regression evals should sit near 100% (any drop is a signal).
  5. Agent evals grade the trajectory (what it did) and the outcome (the final state of the environment), plus cost, latency and safety.
  6. Benchmarks have a life cycle: launch, climb, saturate or get found flawed, retire. Know where each one is.
  7. The score tells you where you are; the failures tell you what to fix. Always read them.

Check yourself

1. Your agent scored 82% on Monday and 78% on Tuesday with no code changes. Most likely explanation?

Stochastic sampling means scores vary between identical runs. On a few hundred samples, a 4-point swing can easily be noise. Module 04 shows how to compute whether a difference is real.

2. Which is the best description of what an eval measures?

Change any of the three (system, data, grader) and the number changes. Always report all three.

3. A regression eval should usually score…

Capability evals are meant to be hard (headroom). Regression evals protect what already works, so any drop is a signal.

4. Every model you are considering scores between 96% and 98% on a public benchmark. What can you conclude about which is best for you?

A saturated eval cannot discriminate between systems. You need an eval with headroom, ideally built from your own tasks.

5. Your support agent says "Refund done!" but the order database shows no refund. Which part of an agent eval catches this?

The transcript records what the agent said. The outcome is what actually happened. Agent evals should check the outcome directly whenever they can.

Sources and further reading