Add PRML predicate: pre-registered evaluation criteria - #587
Open
sk8ordie84 wants to merge 2 commits into
Open
Conversation
Adds a predicate type for the success criteria of an AI/ML evaluation, locked (SHA-256 over a canonical serialisation) before the evaluation is run. Complements the Test Result predicate: Test Result attests what a run produced; this predicate attests that the pass/fail bar existed and was fixed before the run, which is the one property a result-time attestation cannot certify about itself. The example statement is generated by the PRML reference implementation and round-trips through its validator. Signed-off-by: Cüneyt Öztürk <cuneytozturk84@gmail.com>
This was referenced Aug 19, 2026
PRML v0.1 erratum (2026-08-23) closed a defect where a manifest with threshold .inf locked and verified cleanly while asserting nothing: every observation satisfies <= .inf, and no observation satisfies any comparison against .nan. The specification now prohibits the IEEE 754 special values, and the predicate's field list should say so — the other fields carry their type constraints here, and a reader implementing validation from this document alone would otherwise accept a bar no result can fail.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per the new predicate guidelines, this PR proposes a predicate for the pre-registered success criteria of an AI/ML evaluation — the bar (metric, comparator, threshold, dataset content hash, seed, claimant) committed to a SHA-256 digest before the evaluation is run.
Answers to the preliminary questions:
Use case. An eval team (or a vendor under a contractual pre-registration clause) locks the pass/fail criteria of an upcoming evaluation, attests the lock, then runs the evaluation and attests the results separately (e.g. with Test Result). A policy consuming both can verify the bar predates the result and that the run's dataset/seed/threshold match the pre-committed ones. This is the evaluation analogue of pre-registration in empirical science, and it maps to requirements now appearing in AI procurement and EU AI Act documentation contexts.
Why existing predicates don't cover it. Every evaluation-shaped predicate in the directory attests after a run: Test Result records outcomes plus the configuration as reported at result time; SVR records a policy verdict; SCAI records observed attributes. A configuration reported together with a result can have been chosen after seeing the result — no result-time attestation can certify its own criteria were fixed in advance. This predicate is produced at a different point in the supply chain (before execution), which is exactly the property policies need to check. It is complementary to Test Result, not overlapping.
Concrete example. The Example section contains a full Statement generated by the PRML reference implementation from a valid manifest (it round-trips through the validator). The predicate schema is small (9 fields) and deliberately mirrors the PRML v0.1 manifest byte-for-byte, so the
manifest_sha256binding stays recomputable — the one deviation from the lowerCamelCase convention, called out in Parsing Rules.Policy questions it answers. "Reject any evaluation claim whose criteria were not attested before the run"; "reject any result whose dataset hash or seed drifted from the pre-committed manifest"; "treat a digest mismatch as unsupported".
The Type URI is under our own namespace (
https://falsify.dev/prml/v0.1), following the CycloneDX/SPDX precedent, so no in-toto.io redirect entry is needed. PRML is openly specified (CC BY 4.0) with test vectors and independent implementations (Python/JS/Go/Rust). Happy to add a protobuf definition if the maintainers would like language bindings, and to adjust anything in review.