Illustrative: layers of units and their weighted connections, an activation front sweeping from input to output

Risk Academy, led by the Nexus Consortium · Technology and Digital Systems · Department of Artificial Intelligence and Autonomous Systems

Evaluation design, red-teaming, benchmarks and safety cases

AI safety and evaluation

AI safety and evaluation covers how the capabilities, reliability and risks of AI systems are tested before and after deployment.

01Scope

What the discipline covers

The subtopics its courses and labs teach.

Courses
In preparation
Levels
In development
Labs
In development
  • Evaluation design and metrics
  • Red-teaming and adversarial testing
  • Benchmarks and data contamination
  • Dangerous capability evaluations
  • Safety cases for frontier models
  • Agentic system evaluation
  • Monitoring after deployment
  • Incident reporting and disclosure

Courses in development extend the scope to further subjects: AI system evaluation methods; Frontier AI risk and safety cases.

02Maps

Build a twin of any place

Search any place or open the world; the layers and generators follow aI safety and evaluation on the planet map, the globe and in 3D.

West Cornwall: Goonhilly and the Porthcurno cable landings: a flat plan of the faculty twin. Terrain 0 to 245 m; 4 satellite dishes; 74 communication masts and towers; 12 telephone exchanges; 7 data centres and cable landing stations; 12 aerodromes; 1 telecom offices; Communication line 161 km; 729 known exploited vulnerabilities since 2023-10-17; Night-time lights, VIIRS day-night band: read live when the 3D twin opens. Contours every 25 metres from the elevation grid; communication cables by class; ground infrastructure as marks.
West Cornwall: Goonhilly and the Porthcurno cable landings, United Kingdom. Flat plan of the same data: relief as contours from the inline grid, the mapped ground infrastructure by kind, the mapped cables and the numbers below. The 3D twin opens on devices that can draw it, once its data and code have been checked.
  • Terrain 0 to 245 m
  • 4 satellite dishes
  • 74 communication masts and towers
  • 12 telephone exchanges
  • 7 data centres and cable landing stations
  • 12 aerodromes
  • 1 telecom offices
  • Communication line 161 km
  • 729 known exploited vulnerabilities since 2023-10-17
  • Night-time lights, VIIRS day-night band: read live when the 3D twin opens
Credits and dates per layer are listed under the stage. Relief in the twin is exaggerated ×1.5 for legibility.

Drag to move, right drag or Shift with a drag to turn and tilt, Ctrl with the wheel to zoom. Keyboard: arrows move, Shift with arrows turn and tilt, + and – zoom, 0 resets, V steps through the views, Escape clears.

Flat plan of the same data: relief as contours from the inline grid, the mapped ground infrastructure by kind, the mapped cables and the numbers below. The 3D twin opens on devices that can draw it, once its data and code have been checked.

The boundaries, names and designations shown do not imply any judgement on the legal status of any territory, or any endorsement or acceptance of such boundaries. Countries: Natural Earth (public domain).

03Live map

Connected activity in the United Kingdom and Ireland

Night-time lights and population density, the footprint of electrified, connected activity, over the United Kingdom and Ireland.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Connected activity

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Connected activity, framed on the United Kingdom and Ireland.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONETSources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Optional layers (3 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

04The subject

The subject, methods and measures and debates and bodies

The field and its scope

For evaluators, red teams, safety researchers and the public officers who read their results, who need to design tests of AI systems and know what a result can and cannot support.

05The method

From one attempt to an attacker's budget: how a per-attempt success rate becomes a release gate

An attack success rate is measured per attempt against a stated attacker budget; the chance that at least one of k attempts succeeds grows as 1 minus (1 minus s) to the k, and a release gate compares that cumulative figure, after defences, with the level a safety case can tolerate.

Sources: Shevlane et al., Model evaluation for extreme risks (2023); Phuong et al., Evaluating Frontier Models for Dangerous Capabilities (2024); Clymer et al., Safety Cases: How to Justify the Safety of Advanced AI Systems (2024); Bengio et al., International AI Safety Report (2025).

06At a glance

At a glance, standards and evidence, research and evidence, what is changing and learning

AI safety and evaluation at a glance

risksacademy.comtechnology-digitaldiscipline

AI safety and evaluation: 0 primary courses open, 2 in preparation and 0 also taught here, across 8 subtopics. Courses: RAS-428 L3 in preparation, RAT-239 L3 in preparation.AI safety and evaluationRAS-428RAT-239
AI safety and evaluation at a glance
  • Open, 0
  • In preparation, 2
  • Subtopics, 8
Course codes from the curriculum; study levels L1 to L4.
Twin builderBuild a twin of any placeWorked example: West Cornwall: Goonhilly and the Porthcurno cable landings · 4 generators · 7 layers · 3 instruments
07Console

How AI safety and evaluation is taught, as a process you can run

Press Play to run this process from this page's own data.

08Learning

Achievements, where this is practised, practised in and across the ecosystem

Achievements in this discipline

  1. Course achievements

    One for each course with this as its primary discipline, earned when you pass the course's assessed activities.

An achievement is a record of the learning completed and assessed here. How recognition works.

09Take part

Take part in Technology and Digital Systems

Start from who you are.

10References

Core references and where to begin

Start with Bengio, then Shevlane, then Weidinger.

11Questions

Questions, answers and key terms

Is study here free?
Yes. Every course and learning material of Risk Academy, led by the Nexus Consortium, is free to study, self-paced or with a cohort. Ordinary participation has no fee; paid work, internships and fellowships are separate arrangements.
What does completing a course give me?
A completion record: the course, its version, the date and what was assessed, private by default and shared by you. It stacks into discipline, department and programme achievements. A record states what was studied and assessed and does not certify competence; it is not a licence, a professional title or an employment status.
Where do the data and the places come from?
Every faculty teaches on a twin of a real place built from open data; each layer carries its provider, licence and date, and every result on the Academy states its source. Maps and figures are indicators for teaching, never an assessment of a place.
How do I take part beyond the courses in aI safety and evaluation?
Form a competence cell of three to seven people, study a shared pathway, take a supervised assignment in the National Working Groups, or bring a cohort from your institution. For organisations.

Key terms

Term

Red-teaming

Structured attempts to make a system fail or misbehave, to find weaknesses before others do.

Term

Benchmark contamination

When test data have leaked into a model's training data, so scores overstate its ability.

Term

Safety case

A structured argument, supported by evidence, that a system is acceptably safe for a given use.

Term

Frontier model

A general-purpose AI model at or near the most capable level available at a given time.

ReportsContribute

Contribute evidence from this page.

Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Risk Academy
AI safety and evaluation

Prepare with a related course

Open courses in connected disciplines teach the methods this discipline will build on.

Risk Academy

Courses · practice · credentials

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

Risk Academy is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.