Proof · Adversarial AI red-teaming
We generate multi-turn attacks against your AI system, then type and score what breaks — by dimension, with a coverage report and an occurrence rate over N runs. You receive a Score Card, not a verdict.
End to end
Every engagement runs the same path: we attack your AI with probes grounded in your own domain, score what breaks — independently of the attacker — across the eight dimensions, and turn it into evidence, up to readiness mapped per framework. Here is that path, end to end.
What we measure
We type and score every finding against a fixed set of eight measurement dimensions — the language the engine speaks, regardless of the framework you report against.
01
Fairness & Non-Discrimination
02
Safety & Harmful Content
03
Transparency & Explainability
04
Privacy & Data Protection
05
Factuality & Accuracy
06
Robustness & Adversarial Resilience
07
Security & Access Control
08
Accountability & Human Oversight
How Proof works
Probes are built from your real material — the articles of a law, your policies, your products — so an attack only makes sense for your system, not a generic benchmark.
We run multi-turn conversations against your AI. The engine that generates the attack is never the engine that judges the result — independence is a design law.
We treat the number of runs as a first-class parameter and report an occurrence rate with a confidence interval. One run is a story; a rate over N runs is evidence.
Every run ships with a coverage report. Where a budget limits how much we could probe, we say so — silent truncation is not on the table.
From finding to governance
A technical finding on its own does not answer a regulator. We map each of the eight dimensions to the nine control areas of ISO 42001 Annex A, and through them to the framework you report against — turning what your AI did into governance evidence.
Measurement
8 dimensions score what your AI does.
Control areas
9 ISO 42001 Annex A areas evaluate the process.
Frameworks
Readiness expressed per framework you answer to.
For the team who runs it
The answers your engineers will ask for before anyone books a calendar.
01
Through the endpoint your agent already exposes — its API or connector. We are the adversarial interlocutor on the other side of that door. No SDK in your runtime, no model weights, no change to how your agent is served.
02
Multi-turn adversarial conversation against the live agent, not single prompts against a model. Attacks are generated from your own domain — the articles, products and policies that only make sense for your system — and classified across the eight dimensions.
03
Every turn, preserved as an immutable trace you can cite by hash. Risk is reported as an occurrence rate over N runs with a Wilson interval, plus a coverage report that states what was not probed. One run is an anecdote; we do not report one.
04
Before any run exists we establish, in writing, who owns the agent under test, who is authorising the attack, which environment it points at, and the window it may run in. That is a design requirement of onboarding, not a clause someone signs later — and it is the reason there is no trial and no self-service demo. An agent rarely runs in isolation, and nobody can authorise testing against a provider's systems except that provider.
05
It can run entirely inside your own infrastructure — including the models. The model that attacks and the model that judges are open-weight and deploy with the system, so no turn of your agent has to be sent to a third-party model API to be generated or scored. Where a given engagement runs, and what if anything crosses your boundary, is settled in scoping, in writing, before anything is pointed at anything.
Methodology
The eight-dimension framework behind Proof was developed by PhD researchers and validated through peer-reviewed publication. When a finding names a weakness in Factuality & Accuracy or Robustness, the method behind it has been reviewed by the research community.
Because the systems we evaluate are non-deterministic, we report a registered, hash-citable trace and an occurrence rate over N runs — not a promise of a repeatable single result. Where remediation is verified, we confirm it by the intervention applied, as a closed-loop finding.
This is what makes a Proof Score Card defensible before an auditor.
Eight dimensions, an occurrence rate over N runs, and a Score Card you can put in front of your board.