Fact-Level Evaluation

How Fact-Level Evaluation Works

Fact-level evaluation treats each security-relevant item as its own unit of analysis. That design matters because one prompt can contain multiple disclosures, and different items may have very different security meaning even when they appear in the same text.

This is especially useful in agentic systems, where a single broad score can blur the distinction between harmless context and a genuinely sensitive disclosure. Evaluating facts separately helps preserve that distinction instead of collapsing the whole prompt into one averaged signal.

Why It Is Better Than Prompt-Level Scoring

Prompt-level similarity or relevance scoring is coarse by design, so it can miss mixed-content prompts that contain both benign and high-risk material. Fact-level evaluation gives each item its own score, which makes the analysis more precise when the security question depends on what was disclosed, not just whether the prompt looks broadly similar to a known pattern.

That precision matters for disclosure review, policy enforcement, and triage. A system can only respond proportionately if it can tell the difference between a low-risk reference, a secret, a command, a credential clue, or a sensitive operational detail.

Where Fact-Level Evaluation Helps Most

Fact-level evaluation is strongest when prompts or outputs bundle several disclosure types together, such as a request mixed with embedded secrets, instructions, identifiers, or operational context. It is also useful when the reviewer needs to know which exact item drove the risk decision instead of relying on a single aggregate score.

In security workflows, that makes review more explainable. It also reduces the chance that one low-value item dilutes attention away from a more material one, or that a broad alert masks the real reason the content should be escalated.

Security Implications and Limits

Fact-level evaluation improves visibility, but it is not a substitute for policy design. It still depends on the system knowing which item types matter, how to classify them consistently, and when to escalate based on the highest-risk item rather than the average result.

Used well, it supports sharper detection and more defensible decisions. Used poorly, it can create false confidence if teams assume item-by-item scoring automatically captures intent, context, or downstream misuse.

Risk and Threat Considerations

Fact-level evaluation becomes important because attackers and careless users often mix sensitive and ordinary content in the same prompt or message. If the scoring layer only looks at the prompt as a whole, a dangerous disclosure can be hidden by surrounding text, which weakens detection and response.

Failure mechanism: A broad score averages together distinct items, so a high-risk disclosure can be underweighted, misclassified, or missed when the surrounding text looks benign.

Impact: Sensitive information, malicious instructions, or operationally meaningful leaks can pass through review with less scrutiny than they deserve, creating exposure that is harder to detect and explain after the fact.

Practitioner Guidance

Why practitioners should care: Fact-level evaluation is most useful when review outcomes must be explainable at the item level, not just at the prompt level. That is often the difference between a useful security signal and a vague alert that cannot support consistent action.

Practitioner takeaway: If your review pipeline handles mixed disclosures, design it so the most sensitive item drives the decision, not the average of everything in the prompt.

Related resources from NHI Mgmt Group

• How do you know if component-level AI evaluation is actually working?
• Why do AI agents need step-level evaluation as well as end-to-end testing?
• What is the difference between end-to-end testing and component-level evaluation for AI agents?
• What is the difference between trace-level evaluation and agent trajectory evaluation in AI observability?