Every point is one simulated test case, placed in a 3D space of three evaluation axes: capability (X), robustness to distribution shift (Y), and safety score (Z). A translucent plane marks the guardrail threshold τ along the safety axis — cases below it are flagged, the rest pass.
μ_safety(p) = 0.75 − 0.50 · p
σ_safety(p) = 0.10 + 0.25 · p
safety ~ Normal(μ_safety, σ_safety), clamped to [0,1]
flagged ⇔ safety < τ
pass rate = (N − flagged) / N
- Sample size — how many synthetic test cases (N) are drawn and evaluated at once.
- Guardrail threshold τ — the safety cutoff; raising it is stricter and flags more borderline cases.
- Red-team pressure p — models adversarial prompting: it lowers the mean safety score and widens its spread, the way jailbreak attempts stress-test a deployed model.
This mirrors real evaluation pipelines: benchmark suites score capability and robustness, red-teaming estimates the tail risk, and a guardrail threshold turns those continuous scores into a ship / block decision before deployment.