Spend the Next Test Where the Evidence Points

TL;DR for operators

A fixed red-team suite answers a predetermined set of questions. CART asks an additional operational question: given what the last tests revealed, where should the next test budget go?

In an illustrative 99-round run, the first 12 reconnaissance tests produced zero scores. A cascading-hallucination signal appeared at round 13. From there, 67% of the remaining probes were directed toward the two most brittle categories, while testing strategies continued to vary; the peak risk score reached 4.37.

The broader CART system¹ combines this adaptive allocation with separate probe-generation, target, and judging roles; persistent memory; diversity controls; provenance; risk scoring; and audit reporting. Across the reported Frontier, JAH, and Agentic comparisons, it discovers higher judged failure rates and higher average risk scores than static replay wherever a baseline is available.

For product and assurance teams, the relevant use is not to replace benchmarks. It is to let benchmark results influence subsequent testing while retaining traceability back to the original evidence. The major boundary is equally important: CART deliberately concentrates tests around discovered weaknesses, so its failure rates describe what the search policy finds, not how frequently those failures occur in production.

A completed test can be evidence about the next test

A safety team approaching a release rarely has an unlimited evaluation budget. Once a prepared red-team case has been run, the team faces a choice: spend the next test on another case from the queue, or investigate a weakness that the previous result has just exposed.

Static benchmark replay generally makes that allocation decision in advance. The cases may be broad and well designed, but the evaluation sequence does not learn from its own results.

CART changes that sequence. Each round produces evidence that is stored and fed into later test selection. The system begins with broad reconnaissance, then uses observed failures and uncertainty to decide which risk categories deserve further attention.

The 99-round operational example makes the distinction concrete. Twelve categories were initially scanned without a non-zero result. Once cascading hallucination appeared at round 13, testing shifted toward the categories producing the most concerning evidence. The evaluation process therefore became conditional on what it had already discovered.

That is the paper’s central architectural contribution: red teaming becomes a sequential search process rather than a fixed list of independent checks.

Separate the model that searches from the model that judges

Adaptive testing requires three distinct jobs.

The Challenger constructs the next probe. The Target is the system under evaluation. The Judge evaluates the resulting response, action trace, or other evidence. CART keeps these roles separate and adds memory containing prior tests, failures, scores, judgments, and provenance.

That separation matters because the model generating attacks can substantially affect what gets discovered. In a separate 7×7 role experiment with Kimi fixed as the Target, the paper attributes 73.9% of the observed role-matrix variation descriptively to Challenger main effects, 5.6% to Judge main effects, and 20.5% to Challenger–Judge interaction.

This is not a causal decomposition of universal red-team performance. Each adaptive pairing follows its own feedback-driven trajectory. It does show that probe generation is not an interchangeable front end to a fixed evaluation process. Changing the Challenger can change the evidence the process reaches.

The Judge also remains a measurement component rather than ground truth. In an exhaustive audit of 282 cases from a fully self-coupled Kimi run, six peer models produced 1,692 reviewer–case decisions. Pooled pass/fail agreement was 98.9%, while acceptance of the full original judgment was 97.5%. Agreement was weaker in categories involving uncertainty calibration, hallucination, and domain-sensitive judgments.

Binary verdicts can therefore be reproducible under this controlled protocol while finer calibration and reasoning remain more dependent on adjudication.

Adaptive allocation is controlled search, not repeated paraphrasing

Once some categories have produced failures and others remain sparsely tested, CART faces an exploration problem. Following only the current worst category could miss a different weakness. Continuing uniform coverage could spend too much budget on areas that repeatedly produce little evidence.

CART addresses this with Thompson sampling. For each risk category $r$, it samples

and selects the category with the largest sampled value. Here, $n_r$ is the number of previous tests in that category and $f_r$ the number judged as failures.

Categories with repeated failures tend to attract more follow-up, while categories with limited observations retain a chance of being explored. CART combines this allocation with periodic grounding in benchmark seeds and explicit diversity requirements across persona, domain, language, format, authority source, interaction pattern, and attack surface.

This matters because an adaptive loop that merely rephrased the latest successful attack could quickly collapse into narrow local search. CART instead attempts to exploit productive evidence without abandoning broader coverage.

Agent testing benefits most when failures live in the trajectory

The paper evaluates 4,090 normalized source cases across three families: 76 Frontier cases, 760 JAH cases, and 3,254 Agentic cases. Main adaptive runs use 1,000 rounds for Frontier and JAH and 3,200 for Agentic evaluation.

For every Target with an available static baseline, CART reports higher judged failure rates and higher average risk scores than replaying the seed collection unchanged. The largest separation occurs in the Agentic family.

That result is operationally plausible within the paper’s design because agent failures can occur before the final answer. Retrieved content, indirect injections, tool registration, permissions, state changes, memory, and multi-step actions can create unsafe trajectories even when a final response alone appears acceptable.

The bounded agent harness therefore evaluates interactions with mock files, web, email, storage, shell, database, and HTTP tools, along with deterministic canaries. This is a main extension of the evaluation setting, not evidence that the framework has reproduced production infrastructure. The tools are simulated and bounded.

Adaptation creates an audit problem, so provenance becomes part of the method

Changing benchmark prompts during testing introduces a governance problem: once an adaptive system has transformed a seed several times, a reviewer still needs to know where the resulting finding came from.

CART records whether a probe is a direct seed replay, an adaptation, an expansion, or self-generated, together with its strategy and source metadata. It also retains responses or actions, judgments, scores, and the surrounding trajectory.

For an assurance team, this converts adaptive discovery from an ephemeral attack session into reviewable evidence. A high-risk finding can be traced to its origin, investigated, mitigated, and later retained as a regression case while another adaptive run searches for variants.

That business use is a Cognaptus inference from the architecture rather than a measured ROI result. The paper demonstrates the workflow and its audit artifacts; it does not quantify reduced incident cost or release-review time.

Higher discovered failure rates are not production prevalence

The most consequential interpretation boundary follows directly from CART’s design.

Adaptive testing changes the sampling distribution. Once a category begins producing failures, CART intentionally spends more of its remaining budget there. A 40% failure rate under such a search policy would therefore not mean that 40% of ordinary production interactions fail in the same way.

It means that the evaluation policy, while actively searching for weaknesses, produced failures in 40% of the tests it chose to run.

The primary CART-versus-static gaps are also descriptive. The study does not report confidence intervals or formal significance tests for those comparisons, does not provide paired random seeds across conditions, and does not isolate individual components through a controlled ablation design. Higher observed discovery therefore supports the full adaptive workflow as a comparative testing process, not a causal claim that Thompson sampling—or any single mechanism—produced the improvement.

For absolute safety claims, the paper itself points toward stronger blinded human or multi-Judge adjudication, calibrated human-labelled subsets, and explicit uncertainty estimates.

Continuous evaluation changes what a benchmark is for

CART does not make fixed benchmarks obsolete. It gives them another role.

A benchmark can still provide known cases, coverage, comparability, and regression anchors. But once evaluation begins, its cases can also serve as starting points for an evidence-guided search. Newly discovered weaknesses influence the next allocation decision; provenance links transformed probes back to their origins; and severe findings can return later as fixed regression cases.

For teams operating under finite testing budgets, that changes the evaluation question from “Have we run the suite?” to “Given what the suite has already taught us, what should we test next?”

That is a narrower claim than measuring how safe a system is in deployment. It is also a more operational one: use testing evidence to allocate the next unit of testing effort without losing the trail required to review what happened.

Cognaptus: Automate the Present, Incubate the Future.