Writing Evals for an LLM Security Tool: How I Know It Didn't Get Worse

Short summary

The author explains how they built an evaluation suite for their LLM-based smart contract security tool, spectr-ai, to objectively measure whether new models improve or regress. Instead of testing exact text output, they check whether the model correctly identifies the vulnerability class on the right function, scoring each run with precision and recall against hand-labeled ground truth. Starting with just eight labeled cases was enough to catch a regression caused by a prompt instruction rather than the model itself, proving that small disciplined eval sets beat gut feelings.

• •Test LLM findings (vulnerability class + function), not exact text output
• •Score with precision and recall against hand-labeled ground truth contracts
• •Eight labeled cases can catch regressions; a prompt change, not a model rollback, fixed one regression

Generated with AI, which can make mistakes.