Patterns for Building Cybersecurity Evals

This article explores patterns for creating cybersecurity evaluations to assess AI models' ability to find and exploit vulnerabilities. It outlines four key components: a sandboxed target (e.g., Docker containers), inputs influencing task difficulty (from zero-day to one-day scenarios), tools (bash, debuggers, static analyzers), and a grader for outcomes like exploit success or flag capture. It also discusses partial credit via subtasks (e.g., finding vulnerability, reproducing, exploiting) and benchmarks like capture-the-flag and network exfiltration. The content is technical, focused on IT/technology, specifically AI security and software engineering.