Model Tests

Robust Intelligence provides a large suite of tests to ensure in-depth testing for your models. The following pages and tables explain the available test categories and tests.

• Test Categories
• Test Descriptions

• Test Quick Reference

• Standards Mapping and Supplementary Literature

Test Quick Reference

Below, we list the tests that Robust Intelligence can perform.

Name	Category	Description	Why it matters	Configuration
Average Confidence	Model Performance	This test checks the average confidence of the model predictions between the reference and evaluation sets to see if the metric has experienced significant degradation. The “confidence” of a prediction for classification tasks is defined as the distance between the probability of the predicted class (defined as the argmax over the prediction vector) and 1. We average this metric across all predictions. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly. Since oftentimes labels are not available in a production setting, this metric can serve as a useful proxy for model performance.	By default, this test runs if predictions are specified (no labels required).
Average Thresholded Confidence	Model Performance	This test checks the average thresholded confidence (ATC) of the model predictions between the reference and evaluation sets to see if the metric has experienced significant degradation. ATC is a method for estimating accuracy of unlabeled examples taken from [this paper](https://arxiv.org/abs/2201.04234). The threshold is first computed on the reference set: we pick a confidence threshold such that the percentage of datapoints whose max predicted probability is less than the threshold is around equal to the error rate of the model (here, it is 1-accuracy) on the reference set. Then, we apply this threshold in the evaluation set: the predicted accuracy is then equal to the percentage of datapoints with max predicted probability greater than this threshold. Policies: NIST Map 1.5	During production, factors like distribution shift may cause model performance to decrease significantly. Since oftentimes labels are not available in a production setting, this metric can serve as a useful proxy for model performance.	By default, this test runs if predictions/labels are specified in the reference set and predictions are specified in the eval set (no labels required).
Calibration Comparison	Model Performance	This test checks that the reference and evaluation sets have sufficiently similar calibration curves as measured by the Mean Squared Error (MSE) between the two curves. The calibration curve is a line plot where the x-axis represents the average predicted probability and the y-axis is the proportion of positive predictions. The curve of the ideal calibrated model is thus a linear straight line from (0, 0) moving linearly. Policies: NIST Map 1.5	Knowing how well-calibrated your model is can help you better interpret and act upon model outputs, and can even be an indicator of generalization. A greater difference between reference and evaluation curves could indicate a lack of generalizability. In addition, a change in calibration could indicate that decision-making or thresholding conducted upstream needs to change as it is behaving differently on held-out data.	By default, this test runs over the predictions and labels.
Average Rank	Model Performance	This test checks the Average Rank metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Average Rank has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Average Rank metric with the below thresholds set for the absolute and degradation tests.
Recall	Model Performance	This test checks the Recall metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Recall has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5, NIST Map 2.3, NIST Map 3.4, NIST Measure 1.1, NIST Measure 2.3	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Recall metric with the below thresholds set for the absolute and degradation tests.
Average Number of Predicted Entities	Model Performance	This test checks the Average Number of Predicted Entities metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Average Number of Predicted Entities has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Average Number of Predicted Entities metric with the below thresholds set for the absolute and degradation tests.
Normalized Discounted Cumulative Gain (NDCG)	Model Performance	This test checks the Normalized Discounted Cumulative Gain (NDCG) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Normalized Discounted Cumulative Gain (NDCG) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Normalized Discounted Cumulative Gain (NDCG) metric with the below thresholds set for the absolute and degradation tests.
Macro Recall	Model Performance	This test checks the Macro Recall metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Macro Recall has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Macro Recall metric with the below thresholds set for the absolute and degradation tests.
F1	Model Performance	This test checks the F1 metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of F1 has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the F1 metric with the below thresholds set for the absolute and degradation tests.
Mean-Absolute Percentage Error (MAPE)	Model Performance	This test checks the Mean-Absolute Percentage Error (MAPE) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Mean-Absolute Percentage Error (MAPE) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Mean-Absolute Percentage Error (MAPE) metric with the below thresholds set for the absolute and degradation tests.
Positive Prediction Rate	Model Performance	This test checks the Positive Prediction Rate metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Positive Prediction Rate has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Positive Prediction Rate metric with the below thresholds set for the absolute and degradation tests.
Macro Precision	Model Performance	This test checks the Macro Precision metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Macro Precision has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Macro Precision metric with the below thresholds set for the absolute and degradation tests.
Root-Mean-Squared Error (RMSE)	Model Performance	This test checks the Root-Mean-Squared Error (RMSE) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Root-Mean-Squared Error (RMSE) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Root-Mean-Squared Error (RMSE) metric with the below thresholds set for the absolute and degradation tests.
Precision	Model Performance	This test checks the Precision metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Precision has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5, NIST Map 2.3, NIST Map 3.4, NIST Measure 1.1, NIST Measure 2.3	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Precision metric with the below thresholds set for the absolute and degradation tests.
Prediction Variance (Positive Labels)	Model Performance	This test checks the Prediction Variance (Positive Labels) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Prediction Variance (Positive Labels) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Prediction Variance (Positive Labels) metric with the below thresholds set for the absolute and degradation tests.
Multiclass AUC	Model Performance	This test checks the Multiclass AUC metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Multiclass AUC has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Multiclass AUC metric with the below thresholds set for the absolute and degradation tests.
False Negative Rate	Model Performance	This test checks the False Negative Rate metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of False Negative Rate has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5, NIST Map 2.3, NIST Map 3.4, NIST Measure 1.1, NIST Measure 2.3	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the False Negative Rate metric with the below thresholds set for the absolute and degradation tests.
Average Prediction	Model Performance	This test checks the Average Prediction metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Average Prediction has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Average Prediction metric with the below thresholds set for the absolute and degradation tests.
Mean Reciprocal Rank (MRR)	Model Performance	This test checks the Mean Reciprocal Rank (MRR) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Mean Reciprocal Rank (MRR) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Mean Reciprocal Rank (MRR) metric with the below thresholds set for the absolute and degradation tests.
AUC	Model Performance	This test checks the AUC metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of AUC has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5, NIST Map 2.3, NIST Map 3.4, NIST Measure 1.1, NIST Measure 2.3	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the AUC metric with the below thresholds set for the absolute and degradation tests.
Rank Correlation	Model Performance	This test checks the Rank Correlation metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Rank Correlation has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Rank Correlation metric with the below thresholds set for the absolute and degradation tests.
Prediction Variance (Negative Labels)	Model Performance	This test checks the Prediction Variance (Negative Labels) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Prediction Variance (Negative Labels) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Prediction Variance (Negative Labels) metric with the below thresholds set for the absolute and degradation tests.
False Positive Rate	Model Performance	This test checks the False Positive Rate metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of False Positive Rate has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5, NIST Map 2.3, NIST Map 3.4, NIST Measure 1.1, NIST Measure 2.3	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the False Positive Rate metric with the below thresholds set for the absolute and degradation tests.
Prediction Variance	Model Performance	This test checks the Prediction Variance metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Prediction Variance has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Prediction Variance metric with the below thresholds set for the absolute and degradation tests.
Accuracy	Model Performance	This test checks the Accuracy metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Accuracy has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5, NIST Map 2.3, NIST Map 3.4, NIST Measure 1.1, NIST Measure 2.3	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Accuracy metric with the below thresholds set for the absolute and degradation tests.
Mean-Absolute Error (MAE)	Model Performance	This test checks the Mean-Absolute Error (MAE) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Mean-Absolute Error (MAE) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Mean-Absolute Error (MAE) metric with the below thresholds set for the absolute and degradation tests.
Mean-Squared-Log Error (MSLE)	Model Performance	This test checks the Mean-Squared-Log Error (MSLE) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Mean-Squared-Log Error (MSLE) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Mean-Squared-Log Error (MSLE) metric with the below thresholds set for the absolute and degradation tests.
Macro F1	Model Performance	This test checks the Macro F1 metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Macro F1 has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Macro F1 metric with the below thresholds set for the absolute and degradation tests.
Mean-Squared Error (MSE)	Model Performance	This test checks the Mean-Squared Error (MSE) metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Mean-Squared Error (MSE) has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Mean-Squared Error (MSE) metric with the below thresholds set for the absolute and degradation tests.
Multiclass Accuracy	Model Performance	This test checks the Multiclass Accuracy metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Multiclass Accuracy has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Multiclass Accuracy metric with the below thresholds set for the absolute and degradation tests.
Average Number of Predicted Boxes	Model Performance	This test checks the Average Number of Predicted Boxes metric to see both if its performance on the evaluation set alone is satisfactory, as well as if performance in terms of Average Number of Predicted Boxes has degraded from the reference to evaluation set. The key detail displays whether the given performance metric has degraded beyond a defined threshold. Policies: NIST Map 1.5	During production, factors like distribution shift or a change in p(y|x) may cause model performance to decrease significantly.	By default, this test runs over the Average Number of Predicted Boxes metric with the below thresholds set for the absolute and degradation tests.
Protected Feature Drift	Bias and Fairness	This test measures the change in the distribution of a feature by comparing the distribution in an evaluation set to a reference set. The test severity is a function of both the degree to which the distribution has changed and the estimated impact the observed drift has had on model performance. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Distribution shift between training and inference can cause degradation in model performance. If the shift is sufficiently large, retraining the model on newer data may be necessary.	By default, this test runs over all feature columns with sufficiently many samples in both the reference and evaluation sets.
Demographic Parity (Pos Pred)	Bias and Fairness	This test checks whether the Selection Rate for any subset of a feature performs as well as the best Selection Rate across all subsets of that feature. The Demographic Parity is calculated as the Positive Prediction Rate. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Selection Rate of model predictions within a specific subset is significantly lower than that of other subsets by taking a ratio of the rates. Also included in this test is the Impact Ratios tab, which includes a calculation of Disparate Impact Ratio for each subset. Disparate Impact Ratio is defined as the Positive Prediction Rate for the subset divided by the best Positive Prediction Rate across all subsets. Policies: NYC Local Law 144, NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Assessing differences in Selection Rate is an important measures of fairness. It is meant to be used in a setting where we assert that the base Selection Rates between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a sensitive attribute. Comparing Positive Prediction Rates and Impact Ratios over all subsets can be useful in legal/compliance settings where we want the Selection Rate for any sensitive group to fundamentally be the same as other groups.	By default, the Selection Rate is computed for all protected features. The severity threshold baseline is set to 80% by default, in accordance with the four-fifths law for adverse impact detection.
Demographic Parity (Avg Pred)	Bias and Fairness	This test checks whether the Average Prediction for any subset of a feature performs as well as the best Average Prediction across all subsets of that feature. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Prediction of model predictions within a specific subset is significantly lower than that of other subsets by taking a ratio of the rates. Also included in this test is the Impact Ratios tab, which includes a calculation of Disparate Impact Ratio for each subset. Disparate Impact Ratio is defined as the Positive Prediction Rate for the subset divided by the best Positive Prediction Rate across all subsets. Policies: NYC Local Law 144, NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Assessing differences in Average Prediction is an important measures of fairness. It is meant to be used in a setting where we assert that the base Average Predictions between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a sensitive attribute. Comparing Positive Prediction Rates and Impact Ratios over all subsets can be useful in legal/compliance settings where we want the Average Prediction for any sensitive group to fundamentally be the same as other groups.	By default, the Average Prediction is computed for all protected features. The severity threshold baseline is set to 80% by default, in accordance with the four-fifths law for adverse impact detection.
Demographic Parity (Avg Rank)	Bias and Fairness	This test checks whether the Average Rank for any subset of a feature performs as well as the best Average Rank across all subsets of that feature. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Rank of model predictions within a specific subset is significantly lower than that of other subsets by taking a ratio of the rates. Also included in this test is the Impact Ratios tab, which includes a calculation of Disparate Impact Ratio for each subset. Disparate Impact Ratio is defined as the Positive Prediction Rate for the subset divided by the best Positive Prediction Rate across all subsets. Policies: NYC Local Law 144, NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Assessing differences in Average Rank is an important measures of fairness. It is meant to be used in a setting where we assert that the base Average Ranks between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a sensitive attribute. Comparing Positive Prediction Rates and Impact Ratios over all subsets can be useful in legal/compliance settings where we want the Average Rank for any sensitive group to fundamentally be the same as other groups.	By default, the Average Rank is computed for all protected features. The severity threshold baseline is set to 80% by default, in accordance with the four-fifths law for adverse impact detection.
Class Imbalance	Bias and Fairness	This test checks whether the training sample size for any subset of a feature is significantly smaller than other subsets of that feature. The test first splits the dataset into various subset classes within the feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the class imbalance measure of that subset compared to the largest subset exceeds a set threshold. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.10, NIST Measure 2.11	Assessing class imbalance is an important measure of fairness. Features with low subset sizes can result in the model overfitting those subsets, and hence cause a larger error when those subsets appear in test data. This test can be useful in legal/compliance settings where sufficient data for all subsets of a protected feature is important.	By default, class imbalance is tested for all protected features. For each subset, the class imbalance ratio is calculated using the feature’s largest subset’s size with the formula (largest_subset_size-subset_size) / (largest_subset_size+subset_size).
Equalized Odds	Bias and Fairness	This test checks for equal true positive and false positive rates over all subsets for each protected feature. The test first splits the dataset into various subset classes within the feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the true positive and false positive rates of that subset significantly varies as compared to the largest subset. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Equalized odds (or disparate mistreatment) is an important measure of fairness in machine learning. Subjects in protected groups may have different true positive rates or false positive rates, which imply that the model may be biased on those protected features. Fulfilling the condition of equalized odds may be a requirement in various legal/compliance settings.	By default, equalized odds is tested for all protected features.
Feature Independence	Bias and Fairness	This test checks the independence of each protected feature with the predicted label class. It runs over categorical protected features and uses the chi square test of independence to determine the feature independence. The test compares the observed data to a model that distributes the data according to the expectation that the variables are independent. Wherever the observed data does not fit the model, the likelihood that the variables are dependent becomes stronger. Policies: NIST Map 1.5, NIST Map 1.6, NIST Map 2.3, NIST Measure 2.5, NIST Measure 2.11	A test of independence assesses whether observations consisting of measures on two variables, expressed in a contingency table, are independent of each other. This can be useful when assessing how protected features impact the predicted class and helping with the feature selection process.	By default, this test is run over all protected categorical features.
Predict Protected Features	Bias and Fairness	The Predict Protected Features test works by training a multi-class logistic regression model to infer categorical protected features from unprotected categorical and numerical features. The model is fit to the reference data and scored based on its accuracy over the evaluation data. The unprotected categorical features are one-hot encoded. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	In a compliance setting, it may be prohibited to include certain protected features in your training data. However, unprotected features might still provide your model with information about the protected features. If a simple logistic regression model can be trained to accurately predict protected features, your model might have a hidden reliance on protected features, resulting in biased decisions.	By default, the selection rate is computed for all protected features.
Equal Opportunity (Recall)	Bias and Fairness	The recall test is more popularly referred to as equal opportunity or false negative error rate balance in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Recall of model predictions within a specific subset is significantly lower than the model prediction Recall over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different Recall between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. An intuitive example is when the label indicates a positive attribute: if predicting whether to interview a given candidate, make sure that out of qualified candidates, the rate at which the model predicts a rejection is similar to group A and B.	By default, Recall is computed over all predictions/labels. Note that we round predictions to 0/1 to compute recall.
Equal Opportunity (Macro Recall)	Bias and Fairness	The recall test is more popularly referred to as equal opportunity or false negative error rate balance in fairness literature. When transitioning to the multiclass setting we can use macro recall which computes the recall of each individual class and then averages these numbers. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro Recall of model predictions within a specific subset is significantly lower than the model prediction Macro Recall over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different Macro Recall between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. An intuitive example is when the label indicates a positive attribute: if predicting whether to interview a given candidate, make sure that out of qualified candidates, the rate at which the model predicts an interview is similar to group A and B.	By default, Macro Recall is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted class probability.
Intersectional Group Fairness (Pos Pred)	Bias and Fairness	This test checks whether the model performs equally well across subgroups created from the intersection of protected groups. The test first creates unique pairs of categorical protected features. We then test whether the positive prediction rate of model predictions within a specific subset is significantly lower than the model positive prediction rate over the entire population. This will expose hidden biases against groups at the intersection of these protected features. Also included in this test is the Impact Ratios tab, which includes a calculation of Disparate Impact Ratio for each subgroup. Disparate Impact Ratio is defined as the Positive Prediction Rate for the subgroup divided by the best Positive Prediction Rate across all subgroups. Policies: NYC Local Law 144, NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Most existing work in the fairness literature deals with a binary view of fairness - either a particular group is performing worse or not. This binary categorization misses the important nuance of the fairness field - that biases can often be amplified in subgroups that combine membership from different protected groups, especially if such a subgroup is particularly underrepresented in opportunities historically. The intersectional group fairness test is run over subsets representing this intersection between two protected groups.	This test runs over unique pairs of categorical protected features.
Intersectional Group Fairness (Avg Pred)	Bias and Fairness	This test checks whether the model performs equally well across subgroups created from the intersection of protected groups. The test first creates unique pairs of categorical protected features. We then test whether the average prediction of model predictions within a specific subset is significantly lower than the model average prediction over the entire population. This will expose hidden biases against groups at the intersection of these protected features. Also included in this test is the Impact Ratios tab, which includes a calculation of Disparate Impact Ratio for each subgroup. Disparate Impact Ratio is defined as the Positive Prediction Rate for the subgroup divided by the best Positive Prediction Rate across all subgroups. Policies: NYC Local Law 144, NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Most existing work in the fairness literature deals with a binary view of fairness - either a particular group is performing worse or not. This binary categorization misses the important nuance of the fairness field - that biases can often be amplified in subgroups that combine membership from different protected groups, especially if such a subgroup is particularly underrepresented in opportunities historically. The intersectional group fairness test is run over subsets representing this intersection between two protected groups.	This test runs over unique pairs of categorical protected features.
Intersectional Group Fairness (Avg Rank)	Bias and Fairness	This test checks whether the model performs equally well across subgroups created from the intersection of protected groups. The test first creates unique pairs of categorical protected features. We then test whether the average rank of model predictions within a specific subset is significantly lower than the model average rank over the entire population. This will expose hidden biases against groups at the intersection of these protected features. Also included in this test is the Impact Ratios tab, which includes a calculation of Disparate Impact Ratio for each subgroup. Disparate Impact Ratio is defined as the Positive Prediction Rate for the subgroup divided by the best Positive Prediction Rate across all subgroups. Policies: NYC Local Law 144, NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.11	Most existing work in the fairness literature deals with a binary view of fairness - either a particular group is performing worse or not. This binary categorization misses the important nuance of the fairness field - that biases can often be amplified in subgroups that combine membership from different protected groups, especially if such a subgroup is particularly underrepresented in opportunities historically. The intersectional group fairness test is run over subsets representing this intersection between two protected groups.	This test runs over unique pairs of categorical protected features.
Predictive Equality (FPR)	Bias and Fairness	The false positive error rate test is also popularly referred to as predictive equality, or equal mis-opportunity in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the False Positive Rate of model predictions within a specific subset is significantly upper than the model prediction False Positive Rate over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different False Positive Rate between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. As an intuitive example, consider the case when the label indicates an undesirable attribute: if predicting whether a person will default on their loan, make sure that for people who didn’t default, the rate at which the model incorrectly predicts positive is similar for group A and B.	By default, False Positive Rate is computed over all predictions/labels. Note that we round predictions to 0/1 to compute false positive rate.
Discrimination By Proxy	Bias and Fairness	This test checks whether any feature is a proxy for a protected feature. It runs over categorical features, using mutual information as a measure of similarity with a protected feature. Mutual information measures any dependencies between two variables. Policies: NIST Map 1.5, NIST Map 1.6, NIST Map 2.3, NIST Measure 2.11	A common strategy to try to ensure a model is not biased is to remove protected features from the training data entirely so the model cannot learn over them. However, if other features are highly dependent on those features, that could lead to the model effectively still training over those features by proxy.	By default, this test is run over all categorical protected columns.
Subset Sensitivity (Pos Pred)	Bias and Fairness	This test measures how sensitive the model is to substituting the lowest performing subset of a feature into a sample of data. The test splits the dataset into various subsets based on the feature values and finds the lowest performing subset, based on the lowest Positive Prediction Rate. The test then substitutes this subset into a sample from the original data and calculates the change in Positive Prediction Rate. This test fails if the Positive Prediction Rate changes significantly between the original rows and the rows substituted with the lowest performing subset. Policies: NIST Map 1.5, NIST Map 1.6, NIST Map 2.3, NIST Measure 2.11	Assessing differences in model output is an important measure of fairness. If the model performs worse because of the value of a protected feature such as race or gender, then this could indicate bias. It can be useful in legal/compliance settings where we fundamentally want the prediction for any protected group to be the same as for other groups.	By default, the subset sensitivity is computed for all protected features that are strings.
Subset Sensitivity (Avg Pred)	Bias and Fairness	This test measures how sensitive the model is to substituting the lowest performing subset of a feature into a sample of data. The test splits the dataset into various subsets based on the feature values and finds the lowest performing subset, based on the lowest Average Prediction. The test then substitutes this subset into a sample from the original data and calculates the change in Average Prediction. This test fails if the Average Prediction changes significantly between the original rows and the rows substituted with the lowest performing subset. Policies: NIST Map 1.5, NIST Map 1.6, NIST Map 2.3, NIST Measure 2.11	Assessing differences in model output is an important measure of fairness. If the model performs worse because of the value of a protected feature such as race or gender, then this could indicate bias. It can be useful in legal/compliance settings where we fundamentally want the prediction for any protected group to be the same as for other groups.	By default, the subset sensitivity is computed for all protected features that are strings.
Subset Sensitivity (Avg Rank)	Bias and Fairness	This test measures how sensitive the model is to substituting the lowest performing subset of a feature into a sample of data. The test splits the dataset into various subsets based on the feature values and finds the lowest performing subset, based on the lowest Average Rank. The test then substitutes this subset into a sample from the original data and calculates the change in Average Rank. This test fails if the Average Rank changes significantly between the original rows and the rows substituted with the lowest performing subset. Policies: NIST Map 1.5, NIST Map 1.6, NIST Map 2.3, NIST Measure 2.11	Assessing differences in model output is an important measure of fairness. If the model performs worse because of the value of a protected feature such as race or gender, then this could indicate bias. It can be useful in legal/compliance settings where we fundamentally want the prediction for any protected group to be the same as for other groups.	By default, the subset sensitivity is computed for all protected features that are strings.
Gendered Pronoun Distribution	Bias and Fairness	This test checks that both masculine and feminine pronouns are approximately equally likely to be predicted by the fill-mask model for various templates. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Fill-mask models can be tested for gender bias by analyzing predictions for a masked portion of a semantically-bleached template. If a model is significantly more likely to suggest a masculine or feminine pronoun within a sentence relative to its counterpart, it may be learning biased behaviors, which can have important ethical implications.	This test runs only on fill-mask model tasks.
Fill Mask Invariance	Bias and Fairness	This test uses templates to check that word associations of fill-mask models are similar for majority and protected minority groups. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Fill-mask models are vulnerable to significant bias based on the target groups provided in a semantically-bleached template. If a model is significantly more likely to suggest certain attributes within a sentence for one protected group relative to a counterpart, it may be learning biased behaviors, which can have important ethical implications.	This test runs only on fill-mask model tasks.
Replace Masculine with Feminine Pronouns	Bias and Fairness	This test measures the robustness of your model to Replace Masculine with Feminine Pronouns transformations. It does this by taking a sample input, swapping all masculine pronouns from the input string to feminine ones, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Replace Feminine with Masculine Pronouns	Bias and Fairness	This test measures the robustness of your model to Replace Feminine with Masculine Pronouns transformations. It does this by taking a sample input, swapping all feminine pronouns from the input string to masculine ones, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Replace Masculine with Feminine Names	Bias and Fairness	This test measures the invariance of your model to swapping gendered names transformations. It does this by taking a sample input, swapping all instances of traditionally masculine names (in the provided list) with a traditionally feminine name, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences should properly support people of all demographics. It is important that your language models are robust to spurious correlations and bias from the data.	By default, this test runs over a sample of text instances from the evaluation set that containone or more words from the source list.
Replace Feminine with Masculine Names	Bias and Fairness	This test measures the invariance of your model to swapping gendered names transformations. It does this by taking a sample input, swapping all instances of traditionally feminine names (in the provided list) with a traditionally masculine name, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences should properly support people of all demographics. It is important that your language models are robust to spurious correlations and bias from the data.	By default, this test runs over a sample of text instances from the evaluation set that containone or more words from the source list.
Replace Masculine with Plural Pronouns	Bias and Fairness	This test measures the robustness of your model to Replace Masculine with Plural Pronouns transformations. It does this by taking a sample input, swapping all masculine pronouns from the input string to plural ones, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Replace Feminine with Plural Pronouns	Bias and Fairness	This test measures the robustness of your model to Replace Feminine with Plural Pronouns transformations. It does this by taking a sample input, swapping all feminine pronouns from the input string to plural ones, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Swap High Income with Low Income Countries	Bias and Fairness	This test measures the invariance of your model to country name swap transformations. It does this by taking a sample input, swapping all instances of traditionally high-income countries (in the provided list) with a traditionally low-income country, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences should properly support people of all demographics. It is important that your language models are robust to spurious correlations and bias from the data.	By default, this test runs over a sample of text instances from the evaluation set that containone or more words from the source list.
Swap Low Income with High Income Countries	Bias and Fairness	This test measures the invariance of your model to country name swap transformations. It does this by taking a sample input, swapping all instances of traditionally low-income countries (in the provided list) with a traditionally high-income country, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences should properly support people of all demographics. It is important that your language models are robust to spurious correlations and bias from the data.	By default, this test runs over a sample of text instances from the evaluation set that containone or more words from the source list.
Swap Majority Ethnicity Names with Minority Names	Bias and Fairness	This test measures the invariance of your model to swapping names of various ethnicities transformations. It does this by taking a sample input, swapping all instances of traditionally majority names (in the provided list) with a traditionally minority name, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences should properly support people of all demographics. It is important that your language models are robust to spurious correlations and bias from the data.	By default, this test runs over a sample of text instances from the evaluation set that containone or more words from the source list.
Swap Minority Ethnicity Names with Majority Names	Bias and Fairness	This test measures the invariance of your model to swapping names of various ethnicities transformations. It does this by taking a sample input, swapping all instances of traditionally minority names (in the provided list) with a traditionally majority name, and measuring the behavior of the model on the transformed input. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.11	Production natural language input sequences should properly support people of all demographics. It is important that your language models are robust to spurious correlations and bias from the data.	By default, this test runs over a sample of text instances from the evaluation set that containone or more words from the source list.
Out of Range Substitution	Transformations	This test measures the impact on the model when we substitute values outside the inferred range of allowed values into clean datapoints. Policies: NIST Measure 2.5	In production, the model may encounter corrupted or manipulated out of range values. It is important that the model is robust to such extremities.	By default, this test runs over all numeric features.
Numeric Outliers Substitution	Transformations	This test measures the impact on the model when we substitute outliers into clean datapoints. Outliers are values which may not necessarily be outside of an allowed range for a feature, but are extreme values that are unusual and may be indicative of abnormality. Policies: NIST Measure 2.5	Outliers can be a sign of corrupted or otherwise erroneous data, and can degrade model performance if used in the training data, or lead to unexpected behaviour if input at inference time.	By default this test is run over each numeric feature that is neither unique nor ascending.
Feature Type Change	Transformations	This test measures the impact on the model when we substitute valid feature values with values of the incorrect type. Policies: NIST Measure 2.5, NIST Measure 2.6	A feature may require a specific type. However, errors in the data pipeline may produce values that are outside the expected type. Failing to catch such errors may lead to errors or undefined behavior from the model.	By default, this test runs over all features.
Empty String Substitution	Transformations	This test measures the impact on the model when we substitute empty string values instead of null values into clean datapoints. Policies: NIST Measure 2.5, NIST Measure 2.6	In production, the model may encounter corrupted or manipulated string values. Null values and empty strings are often expected to be treated the same, but the model might not treat them that way. It is important that the model is robust to such extremities.	By default, this test runs over all string features with null values.
Required Characters Deletion	Transformations	This test measures the impact on the model when we delete required characters, inferred from the reference set, from the strings of clean datapoints. Policies: NIST Measure 2.5	A feature may require specific characters. However, errors in the data pipeline may allow invalid data points that lack these required characters to pass. Failing to catch such errors may lead to noisier training data or noisier predictions during inference, which can degrade model metrics.	By default, this test runs over all string features that are inferred to have required characters.
Unseen Categorical Substitution	Transformations	This test measures the impact on the model when we substitute unseen categorical values into clean datapoints. Policies: NIST Measure 2.5, NIST Measure 2.6	Unseen categorical values are a common failure point in machine learning systems; since these models are trained over a reference set, they may yield uninterpretable or undefined behavior when interacting with an unseen categorical value. In addition, such errors may expose gaps or errors in data collection.	By default, this test runs over all categorical features.
Null Substitution	Transformations	This test measures the impact on the model when we substitute nulls in features that should not have nulls into clean datapoints. Policies: NIST Measure 2.5, NIST Measure 2.6	The model may make certain assumptions about a column depending on whether or not it had nulls in the training data. If these assumptions break during production, this may damage the model’s performance. For example, if a column was never null during training then a model may not have learned to be robust against noise in that column.	By default, this test runs over all columns that had zero nulls in the reference set.
Capitalization Change	Transformations	This test measures the impact on the model when we substitute different types of capitalization into clean datapoints. Policies: NIST Measure 2.5	In production, models can come across the same value with different capitalizations, making it important to explicitly check that your model is invariant to such differences.	By default, this test runs over all categorical features.
Identity	Transformations	This test measures the robustness of your model to Identity transformations. It does this by taking a sample input, doing nothing to it, and measuring the behavior of the model on the same input on two different occasions. The purpose of this test is to ensure that the model’s predictions are stable when passed the same input twice, since LLMs can be highly unstable, especially if they have high settings for parameters like temperature or top_p. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Upper-Case Text	Transformations	This test measures the robustness of your model to Upper-Case Text transformations. It does this by taking a sample input, upper-casing all text, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Lower-Case Text	Transformations	This test measures the robustness of your model to Lower-Case Text transformations. It does this by taking a sample input, lower-casing all text, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Remove Special Characters	Transformations	This test measures the robustness of your model to Remove Special Characters transformations. It does this by taking a sample input, removing all periods and apostrophes from the input string, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Unicode to ASCII	Transformations	This test measures the robustness of your model to Unicode to ASCII transformations. It does this by taking a sample input, converting all characters in the input string to their nearest ASCII representation, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Character Substitution	Transformations	This test measures the robustness of your model to character substitution attacks. It does this by randomly substituting characters in the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Character Deletion	Transformations	This test measures the robustness of your model to character deletion attacks. It does this by randomly deleting characters in the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Character Insertion	Transformations	This test measures the robustness of your model to character insertion attacks. It does this by randomly adding characters to the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Character Swap	Transformations	This test measures the robustness of your model to character swap attacks. It does this by randomly swapping characters in the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Keyboard Augmentation	Transformations	This test measures the robustness of your model to keyboard augmentation attacks. It does this by adding common typos based on keyboard distance to the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Common Misspellings	Transformations	This test measures the robustness of your model to common misspellings attacks. It does this by adding common misspellings to the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
OCR Error Simulation	Transformations	This test measures the robustness of your model to ocr error simulation attacks. It does this by adding common OCR errors to the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Synonym Swap	Transformations	This test measures the robustness of your model to synonym swap attacks. It does this by randomly swapping synonyms in the input string and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Contextual Word Swap	Transformations	This test measures the robustness of your model to contextual word swap attacks. It does this by replacing words with those close in embedding space and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Contextual Word Insertion	Transformations	This test measures the robustness of your model to contextual word insertion attacks. It does this by inserting words generated from a language model and measuring your model’s performance on the attacked string. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your NLP models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 5% of the words in each input.
Lower-Case Entity	Transformations	This test measures the robustness of your model to Lower-Case Entity transformations. It does this by taking a sample input, lower-casing all entities, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Upper-Case Entity	Transformations	This test measures the robustness of your model to Upper-Case Entity transformations. It does this by taking a sample input, upper-casing all entities, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Ampersand	Transformations	This test measures the robustness of your model to Ampersand transformations. It does this by taking a sample input, changing & to and, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Abbreviation Expander	Transformations	This test measures the robustness of your model to Abbreviation Expander transformations. It does this by taking a sample input, expanding abbreviations in entities, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Whitespace Around Special Character	Transformations	This test measures the robustness of your model to Whitespace Around Special Character transformations. It does this by taking a sample input, adding whitespace around special characters, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Entity Unicode to ASCII	Transformations	This test measures the robustness of your model to Entity Unicode to ASCII transformations. It does this by taking a sample input, converting all characters in the input string to their nearest ASCII representation, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Entity Remove Special Characters	Transformations	This test measures the robustness of your model to Entity Remove Special Characters transformations. It does this by taking a sample input, removing all periods and apostrophes from the input string, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Swap Seen Entities	Transformations	This test measures the robustness of your model to Swap Seen Entities transformations. It does this by taking a sample input, swapping all the entities in a text with random entities of the same type seen in the rest of the data, and measuring the behavior of the model on the transformed input. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Swap Unseen Entities	Transformations	This test measures the robustness of your model to Swap Unseen Entities transformations. It does this by taking a sample input, swapping all the entities in a text with random entities of the same category, unseen in the data, and measuring the behavior of the model on the transformed input. This test supports swapping entities from commonly-appearing categories in NER tasks: Person, Geopolitical Entity, Location, Nationality, Product, Corporation, and Organization. Policies: NIST Measure 2.5	Production natural language input sequences can have errors from data preprocessing or human input (mistaken or adversarial). It is important that your language models are robust to the introduction of such errors.	By default, this test runs over a sample of strings from the evaluation set, and it performs this attack on 30% of the words in each input.
Gaussian Blur	Transformations	This test measures the robustness of your model to Gaussian Blur transformations. It does this by taking a sample input, blurring the image, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Color Jitter	Transformations	This test measures the robustness of your model to Color Jitter transformations. It does this by taking a sample input, jittering the image colors, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Gaussian Noise	Transformations	This test measures the robustness of your model to Gaussian Noise transformations. It does this by taking a sample input, adding gaussian noise to the image, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Vertical Flip	Transformations	This test measures the robustness of your model to Vertical Flip transformations. It does this by taking a sample input, flipping the image vertically, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Horizontal Flip	Transformations	This test measures the robustness of your model to Horizontal Flip transformations. It does this by taking a sample input, flipping the image horizontally, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Randomize Pixels With Mask	Transformations	This test measures the robustness of your model to Randomize Pixels With Mask transformations. It does this by taking a sample input, randomizing pixels with fixed probability, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Contrast Increase	Transformations	This test measures the robustness of your model to Contrast Increase transformations. It does this by taking a sample input, increase image contrast, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Contrast Decrease	Transformations	This test measures the robustness of your model to Contrast Decrease transformations. It does this by taking a sample input, decrease image contrast, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Motion Blur	Transformations	This test measures the robustness of your model to Motion Blur transformations. It does this by taking a sample input, motion blurring the image, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Add Rain	Transformations	This test measures the robustness of your model to Add Rain transformations. It does this by taking a sample input, adding rain texture to the image, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Add Snow	Transformations	This test measures the robustness of your model to Add Snow transformations. It does this by taking a sample input, adding snow texture to the image, and measuring the behavior of the model on the transformed input. Policies: N/A	Production inputs can have unusual variations amongst many different dimensions, ranging from lighting changes to sensor errors to compression artifacts. It is important that your models are robust to the introduction of such variations.
Correlation Drift (Feature-to-Feature)	Drift	This test measures the severity of feature-feature correlation drift from the reference to the evaluation set for a given pair of features. The severity is a function of the correlation drift in the data. The key detail is the difference in correlation scores between the reference and evaluation sets, along with an associated p-value. Correlation is a measure of the linear relationship between two numeric columns (feature-feature) so this test checks for significant changes in this relationship between each feature-feature in the reference and evaluation sets. To compute the p-value, we use Fisher’s z-transformation to convert the distribution of sample correlations to a normal distribution, and then we run a standard two-sample test on two normal distributions. Policies: NIST Map 2.3, NIST Measure 2.4, NIST Measure 2.5	Correlation drift between training and inference can be caused by a variety of factors, including a change in the data generation process or a change in the underlying processing stage. A big shift in these dependencies could indicate shifting datasets and degradation in model performance, signaling the need for relabeling and retraining.	By default, this test runs over all pairs of features in the dataset.
Correlation Drift (Feature-to-Label)	Drift	This test measures the severity of feature-label correlation drift from the reference to the evaluation set for a given pair of a feature and label. The severity is a function of the correlation drift in the data. The key detail is the difference in correlation scores between the reference and evaluation sets, along with an associated p-value. Correlation is a measure of the linear relationship between two numeric columns (feature-label) so this test checks for significant changes in this relationship between each feature-label in the reference and evaluation sets. To compute the p-value, we use Fisher’s z-transformation to convert the distribution of sample correlations to a normal distribution, and then we run a standard two-sample test on two normal distributions. Policies: NIST Map 2.3, NIST Measure 2.4, NIST Measure 2.5	Correlation drift between training and inference can be caused by a variety of factors, including a change in the data generation process or a change in the underlying processing stage. A big shift in these dependencies could indicate shifting datasets and degradation in model performance, signaling the need for relabeling and retraining.	By default, this test runs over all pairs of features and labels in the dataset.
Mutual Information Drift (Feature-to-Feature)	Drift	This test measures the severity of feature mutual information drift from the reference to the evaluation set for a given pair of features. The severity is a function of the mutual information drift in the data. The key detail is the difference in mutual information scores between the reference and evaluation sets. Mutual information is a measure of how dependent two features are, so this checks for significant changes in dependence between pairs of features in the reference and evaluation sets. Policies: NIST Measure 2.4	Mutual information drift between training and inference can be caused by a variety of factors, including a change in the data generation process or a change in the underlying processing stage. A big shift in these dependencies could indicate shifting datasets and degradation in model performance, signaling the need for relabeling and retraining.	By default, this test runs over all pairs of features in the dataset.
Mutual Information Drift (Feature-to-Label)	Drift	This test measures the severity of feature mutual information drift from the reference to the evaluation set for a given pair of features. The severity is a function of the mutual information drift in the data. The key detail is the difference in mutual information scores between the reference and evaluation sets. Mutual information is a measure of how dependent two features are, so this checks for significant changes in dependence between pairs of features in the reference and evaluation sets. Policies: NIST Map 2.3, NIST Measure 2.4, NIST Measure 2.5	Mutual information drift between training and inference can be caused by a variety of factors, including a change in the data generation process or a change in the underlying processing stage. A big shift in these dependencies could indicate shifting datasets and degradation in model performance, signaling the need for relabeling and retraining.	By default, this test runs over all pairs of features in the dataset.
Label Drift (Categorical)	Drift	This test checks that the difference in label distribution between the reference and evaluation sets is small, using PSI test. The key detail displayed is the PSI statistic which is a measure of how different the frequencies of the column in the reference and evaluation sets are. Policies: NIST Measure 2.4	Label distribution shift between reference and test can indicate that the underlying data distribution has changed significantly enough to modify model decisions. This may mean that the model needs to be retrained to adjust to the new data environment. In addition, significant label distribution shift may indicate that upstream decision-making modules (e.g. thresholds) may need to be updated.	This test is run by default whenever both the reference and evaluation sets have associated labels.
Predicted Label Drift	Drift	This test checks that the difference in predicted label distribution between the reference and evaluation sets is small, using PSI test. The key detail displayed is the PSI statistic which is a measure of how different the frequencies of the column in the reference and evaluation sets are. Policies: NIST Measure 2.4	Predicted Label distribution shift between reference and test can indicate that the underlying data distribution has changed significantly enough to modify model decisions. This may mean that the model needs to be retrained to adjust to the new data environment. In addition, significant predicted label distribution shift may indicate that upstream decision-making modules (e.g. thresholds) may need to be updated.	This test is run by default whenever the model or predictions is provided.
Label Drift (Regression)	Drift	This test checks that the difference in label distribution between the reference and evaluation sets is small, using the PSI test. The key detail displayed is the KS statistic which is a measure of how different the labels in the reference and evaluation sets are. Concretely, the KS statistic is the maximum difference of the empirical CDF’s of the two label columns. Policies: NIST Measure 2.4	Label distribution shift between reference and test can indicate that the underlying data distribution has changed significantly enough to modify model decisions. This may mean that the model needs to be retrained to adjust to the new data environment. In addition, significant label distribution shift may indicate that upstream decision-making modules (e.g. thresholds) may need to be updated.	This test is run by default whenever both the reference and evaluation sets have associated labels.
Feature Drift	Drift	This test measures the change in the distribution of a feature by comparing the distribution in an evaluation set to a reference set. The test severity is a function of both the degree to which the distribution has changed and the estimated impact the observed drift has had on model performance. Policies: NIST Measure 2.4	Distribution shift between training and inference can cause degradation in model performance. If the shift is sufficiently large, retraining the model on newer data may be necessary.	By default, this test runs over all feature columns with sufficiently many samples in both the reference and evaluation sets.
Prediction Drift	Drift	This test checks that the difference in the prediction distribution between the reference and evaluation sets is small, using Population Stability Index. The key detail displayed is the PSI which is a measure of how different the prediction distributions in the reference and evaluation sets are. Policies: NIST Measure 2.4	Prediction distribution shift between reference and test can indicate that the underlying data distribution has changed significantly enough to modify model decisions. This may mean that the model needs to be retrained to adjust to the new data environment. In addition, significant prediction distribution drift may indicate that upstream decision-making modules (e.g. thresholds) may need to be updated.	This test is run by default whenever both the reference and evaluation sets have associated predictions. Different thresholds are associated with different severities.
Embedding Drift	Drift	This test measures the severity of passing to the model data points associated with embeddings that have drifted from the distribution observed in the reference set. The severity is a function of the impact on the model, as well as the presence of drift in the data. The model impact measures how much model performance changes due to drift in the given feature. The key detail is the Euclidean Distance statistic. The Euclidean Distance is defined as the square root of the sum of the squared differences between two vectors X and Y. The normalized version of this metric first divides each vector by its L2 norm. This test takes the normalized Euclidean distance between the centroids of the ref and eval data sets. Policies: NIST Measure 2.4	Distribution shift between training and inference can cause degradation in model performance. If the shift is sufficiently large, retraining the model on newer data may be necessary.	By default, this test runs over all specified embeddings with sufficiently many samples in each of the reference and evaluation sets.
Nulls Per Feature Drift	Drift	This test measures the severity of passing to the model data points that have features with a null proportion that has drifted from the distribution observed in the reference set. The severity is a function of the impact on the model, as well as the presence of drift in the data. The model impact measures how much model performance changes due to drift in the given feature. The key detail is the p-value from a two-sample proportion test that checks if there is a statistically significant difference in the frequencies of null values between the reference and evaluation sets. Policies: NIST Measure 2.4	Distribution drift in null values between training and inference can be caused by a variety of factors, including a change in the data generation process or a change in the preprocessing pipeline. A big shift in null value proportion could indicate a degradation in model performance and signal the need for relabeling and retraining.	By default, this test runs over all columns with sufficiently many samples.
Nulls Per Row Drift	Drift	This test measures the severity of passing to the model data points that have proportions of null values that have drifted from the distribution observed in the reference set. The severity is a function of the impact on the model, as well as the presence of drift in the data. The model impact measures how much predictions change when the observed drift is applied to a given row. The key detail displayed is the PSI statistic that is a measure of how statistically significant the difference in the proportion of null values in a row between the reference and evaluation sets is. Policies: NIST Measure 2.4	Distribution drift in null values between training and inference can be caused by a variety of factors, including a change in the data generation process or a change in the preprocessing pipeline. A big shift in null value proportion could indicate a degradation in model performance and signal the need for relabeling and retraining.	By default, this test runs over all rows.
Single-Feature Changes	Adversarial	This test measures the severity of passing to the model data points that have been manipulated across a single feature in an unbounded manner. The severity is a function of the impact of these manipulations on the model. Policies: NIST Map 1.5, NIST Measure 2.5, NIST Measure 2.7	In production, your model will likely come across inputs that are out-of-distribution with respect to the training data, and it is often difficult to know ahead of time how your model will behave on such inputs. ‘Attacking’ a model in the manner of this test is a technique for finding the out-of-distribution regions of the input space where your model most severely misbehaves, before putting it into production. Rstricting ourselves to changing a single feature at a time is one proxy for what ‘realistic’ out-of-distribution data can look like.	By default, for a given input we aim to change your model’s prediction in the opposite direction of the true label. This test raises a warning if the average prediction change that can be achieved exceeds an acceptable threshold.
Bounded Single-Feature Changes	Adversarial	This test measures the severity of passing to the model data points that have been manipulated across a single feature in a bounded manner. The severity is a function of the impact of these manipulations on the model.We bound the manipulations to be less than some fraction of the range of the given feature. Policies: NIST Map 1.5, NIST Measure 2.5, NIST Measure 2.7	In production, your model will likely come across inputs that are out-of-distribution with respect to the training data, and it is often difficult to know ahead of time how your model will behave on such inputs. ‘Attacking’ a model in the manner of this test is a technique for finding the out-of-distribution regions of the input space where your model most severely misbehaves, before putting it into production. Restricting ourselves to changing a single feature by a small amount is one proxy for what ‘realistic’ out-of-distribution data can look like.	By default, for a given input we aim to change your model’s prediction in the opposite direction of the true label. This test raises a warning if the average prediction change that can be achieved exceeds an acceptable threshold. This test runs only over numeric features.
Multi-Feature Changes	Adversarial	This test measures the severity of passing to the model data points that have been manipulated across multiple features in an unbounded manner. The severity is a function of the impact of these manipulations on the model. Policies: NIST Map 1.5, NIST Measure 2.5, NIST Measure 2.7	In production, your model will likely come across inputs that are out-of-distribution with respect to the training data, and it is often difficult to know ahead of time how your model will behave on such inputs. ‘Attacking’ a model in the manner of this test is a technique for finding the out-of-distribution regions of the input space where your model most severely misbehaves, before putting it into production. Restricting the number of features that can be changed is one proxy for what ‘realistic’ out-of-distribution data can look like.	By default, for a given input we aim to change your model’s prediction in the opposite direction of the true label. This test raises a warning if the average prediction change that can be achieved exceeds an acceptable threshold.
Bounded Multi-Feature Changes	Adversarial	This test measures the severity of passing to the model data points that have been manipulated across multiple features in an bounded manner. The severity is a function of the impact of these manipulations on the model.We bound the manipulations to be less than some fraction of the range of the given feature. Policies: NIST Map 1.5, NIST Measure 2.5, NIST Measure 2.7	In production, your model will likely come across inputs that are out-of-distribution with respect to the training data, and it is often difficult to know ahead of time how your model will behave on such inputs. ‘Attacking’ a model in the manner of this test is a technique for finding the out-of-distribution regions of the input space where your model most severely misbehaves, before putting it into production. Restricting the number of features that can be changed and the magnitude of the change that can be made to each feature is one proxy for what ‘realistic’ out-of-distribution data can look like.	By default, for a given input we aim to change your model’s prediction in the opposite direction of the true label. This test raises a warning if the average prediction change that can be achieved exceeds an acceptable threshold. This test runs only over numeric features.
Tabular HopSkipJump Attack	Adversarial	This test measures the robustness of your model to HopSkipJump attacks. It does this by taking a sample of inputs, applying a HopSkipJump attack to each input, and measuring the performance of the model on the perturbed input. See the paper “HopSkipJumpAttack: A Query-Efficient Decision-Based Attack” by Chen, et al. (https://arxiv.org/abs/1904.02144) for more details. Policies: NIST Map 1.5, NIST Measure 2.5, NIST Measure 2.7	Malicious actors can perturb input data to alter model behavior in unexpected ways. It is important that your models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Invisible Character Attack	Adversarial	This test measures the robustness of your model to invisible character attacks. It does this by taking a sample input, inserting zero-width unicode characters, and measuring the performance of the model on the perturbed input. See the paper “Fall of Giants: How Popular Text-Based MLaaS Fall against a Simple Evasion Attack” by Pajola and Conti (https://arxiv.org/abs/2104.05996) for more details. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can perturb natural language input sequences to alter model behavior in unexpected ways. It is important that your NLP models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Deletion Control Character Attack	Adversarial	This test measures the robustness of your model to deletion control character attacks. It does this by taking a sample input, inserting deletion control characters, and measuring the performance of the model on the perturbed input. See the paper “Bad Characters: Imperceptible NLP Attacks” by Boucher, Shumailov, et al. (https://arxiv.org/abs/2106.09898) for more details. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can perturb natural language input sequences to alter model behavior in unexpected ways. It is important that your NLP models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Intentional Homoglyph Attack	Adversarial	This test measures the robustness of your model to intentional homoglyph attacks. It does this by taking a sample input, substituting homoglyphs designed to look like other characters, and measuring the performance of the model on the perturbed input. See the paper “Bad Characters: Imperceptible NLP Attacks” by Boucher, Shumailov, et al. (https://arxiv.org/abs/2106.09898) for more details. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can perturb natural language input sequences to alter model behavior in unexpected ways. It is important that your NLP models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Confusable Homoglyph Attack	Adversarial	This test measures the robustness of your model to confusable homoglyph attacks. It does this by taking a sample input, substituting homoglyphs that are easily confused with other characters, and measuring the performance of the model on the perturbed input. See the paper “Bad Characters: Imperceptible NLP Attacks” by Boucher, Shumailov, et al. (https://arxiv.org/abs/2106.09898) for more details. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can perturb natural language input sequences to alter model behavior in unexpected ways. It is important that your NLP models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
HotFlip Attack	Adversarial	This test measures the robustness of your model to hotflip attacks. It does this by taking a sample input, applying gradient-based token substitutions, and measuring the performance of the model on the perturbed input. See the paper “HotFlip: White-Box Adversarial Examples for Text Classification” by Ebrahimi, Rao, et al. (https://arxiv.org/abs/1712.06751) for more details. Policies: NIST Map 1.5, NIST Measure 2.5, NIST Measure 2.7	Malicious actors can perturb natural language input sequences to alter model behavior in unexpected ways. It is important that your NLP models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Universal Prefix Attack	Adversarial	This test measures the robustness of your model to ‘universal’ adversarial prefix injections. It does this by sampling a batch of inputs, and searching over the model vocabulary to find a prefix that is nonsensical to a reader but that, when prepended to the batch of inputs, will cause the model to output a different prediction. See the paper “Universal Adversarial Triggers for Attacking and Analyzing NLP” by Wallace, Feng, Kandpal, et al. (https://arxiv.org/abs/1908.07125) for more details.	Malicious actors can perturb natural language input sequences to alter model behavior in unexpected ways. ‘Universal triggers’ pose a particularly large threat since they easily transfer between models and data points to permit an adversary to make large-scale, cost-efficient attacks. It is important that your NLP models are robust to such threat vectors.	By default, this test runs when the ‘Adversarial’ category is specified.
Image HopSkipJump Attack	Adversarial	This test measures the robustness of your model to Image HopSkipJump attacks. It does this by taking a sample input, applying a HopSkipJump attack, and measuring the performance of the model on the perturbed input. See the paper “HopSkipJumpAttack: A Query-Efficient Decision-Based Attack” by Chen, et al. (https://arxiv.org/abs/1904.02144) for more details. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can perturb input images to alter model behavior in unexpected ways. It is important that your Computer Vision models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Pixel Attack	Adversarial	This test measures the robustness of your model to Pixel attacks. It does this by taking a sample input, applying a Pixel attack to perturb a bounded number of pixels, and measuring the performance of the model on the perturbed input. See the paper “One pixel attack for fooling deep neural networks” by Su, et al. (https://arxiv.org/abs/1710.08864) for more details. Policies: N/A	Malicious actors can perturb input images to alter model behavior in unexpected ways. It is important that your Computer Vision models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Square Attack	Adversarial	This test measures the robustness of your model to Square attacks. It does this by taking a sample input, applying a Square attack, and measuring the performance of the model on the perturbed input. See the paper “Square Attack: a query-efficient black-box adversarial attack via random search” by Andriushchenko, Croce, et al. (https://arxiv.org/abs/1912.00049) for more details. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can perturb input images to alter model behavior in unexpected ways. It is important that your Computer Vision models are robust to such attacks.	By default, this test runs when the “Adversarial” test category is selected.
Required Features	Data Cleanliness	This test checks that the features of a dataset are as expected. Policies: NIST Map 2.3	Errors in data collection and processing can lead to invalid missing (or extra) features. In the case of missing features, this can cause failures in models. In the case of extra features, this can lead to unnecessary storage and computation.	This test runs only when required features are specified.
Duplicate Row	Data Cleanliness	This test checks if there are any duplicate rows in your dataset. The key detail displays the number of duplicate rows in your dataset. Policies: N/A	Duplicate rows are potentially a sign of a broken data pipeline or an otherwise corrupted input.	By default this test is run over all features, meaning two rows are considered duplicates only if they match across all features.
Mutual Information Decrease (Feature to Label)	Data Cleanliness	This test flags a likely data leakage issue in the model. Data leakage occurs when a model is trained on features containing information about the label that is not normally present during production.This test flags an issue if both of the following occur:* the normalized mutual information between the feature and the label is too high in the reference set * the normalized mutual information for the reference set is much higher than for the evaluation set The first criterion is an indicator that the feature has unreasonably high predictive power for the label during training, and the second criterion checks that the feature is no longer a good predictor in the evaluation set. One requirement for this test to flag data leakage is that the evaluation set labels and features are collected properly. This test should be utilized if one trusts their eval data is collected correctly, else the High MI test should be used. Policies: N/A	Errors in data collection and processing can lead to some features containing information about the label in the reference set that do not appear in the evaluation set. This causes the model to under-perform during production.	By default, this test always runs on all categorical features.
High Mutual Information (Feature to Label)	Data Cleanliness	This test flags a likely data leakage issue if the normalized mutual information between the feature and the label is too high in the reference set. Data leakage occurs when a model is trained on features containing information about the label that is not normally present during production. This criterion is an indicator that this feature has unreasonably high predictive power for the label during training. One requirement for this test to flag data leakage is that the reference set labels and features are collected properly. This test should be utilized when one doesn’t trust their eval data is collected correctly, else the MI Decrease test should be used. Policies: N/A	Errors in data collection and processing can lead to some features containing information about the label in the reference set. This causes the model to under-perform during production.	By default, this test always runs on all categorical features.
High Feature Correlation	Data Cleanliness	This test checks that the correlation between two features in the reference set is not too high. Correlation is a measure of the linear relationship between two numeric features. Policies: NIST Map 2.3, NIST Measure 2.5	Correlation in training features can be caused by a variety of factors, including interdependencies between the collected features, data collection processes, or change in data labeling. Training on too similar features can lead to underperforming or non-robust models.	By default, this test runs over all pairs of numeric features in the dataset.
Label Imbalance	Data Cleanliness	This test checks that no labels have exceedingly high frequency. Policies: N/A	Label imbalance in the training data can introduce bias into the model and possibly result in poor predictive performance on examples from the minority classes.	This test runs only on classification tasks.
Subset Average Rank	Subset Performance	This test is commonly known as the demographic parity or statistical parity test in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Rank of model predictions within a specific subset is significantly upper than the model prediction Average Rank over the entire population. Policies: N/A	Demographic parity is one of the most well-known and strict measures of fairness. It is meant to be used in a setting where we assert that the base label rates between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a protected attribute. It can be useful in legal/compliance settings where we want a Selection Rate for any protected group to fundamentally be the same as other groups.	By default, Average Rank is computed for all protected features.
Subset Recall	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Recall of model predictions within a specific subset is significantly lower than the model prediction Recall over the entire population. Policies: N/A	Having different Recall between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Recall is computed over all predictions/labels.
Subset Normalized Discounted Cumulative Gain (NDCG)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Normalized Discounted Cumulative Gain (NDCG) of model predictions within a specific subset is significantly lower than the model prediction Normalized Discounted Cumulative Gain (NDCG) over the entire population. Policies: N/A	Having different Normalized Discounted Cumulative Gain (NDCG) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Normalized Discounted Cumulative Gain (NDCG) is computed over all predictions/labels.
Subset Macro Recall	Subset Performance	The recall test is more popularly referred to as equal opportunity or false negative error rate balance in fairness literature. When transitioning to the multiclass setting we can use macro recall which computes the recall of each individual class and then averages these numbers. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro Recall of model predictions within a specific subset is significantly lower than the model prediction Macro Recall over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different Macro Recall between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. An intuitive example is when the label indicates a positive attribute: if predicting whether to interview a given candidate, make sure that out of qualified candidates, the rate at which the model predicts an interview is similar to group A and B.	By default, Macro Recall is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted class probability.
Subset F1	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the F1 of model predictions within a specific subset is significantly lower than the model prediction F1 over the entire population. Policies: N/A	Having different F1 between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, F1 is computed over all predictions/labels.
Subset Mean-Absolute Percentage Error (MAPE)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Absolute Percentage Error (MAPE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Absolute Percentage Error (MAPE) over the entire population. Policies: N/A	Having different Mean-Absolute Percentage Error (MAPE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Absolute Percentage Error (MAPE) is computed over all predictions/labels.
Subset Positive Prediction Rate	Subset Performance	This test is commonly known as the demographic parity or statistical parity test in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Positive Prediction Rate of model predictions within a specific subset is significantly both than the model prediction Positive Prediction Rate over the entire population. Policies: N/A	Demographic parity is one of the most well-known and strict measures of fairness. It is meant to be used in a setting where we assert that the base label rates between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a protected attribute. It can be useful in legal/compliance settings where we want a Selection Rate for any protected group to fundamentally be the same as other groups.	By default, Positive Prediction Rate is computed for all protected features.
Subset Average Confidence	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Confidence of model predictions within a specific subset is significantly lower than the model prediction Average Confidence over the entire population. Policies: N/A	Having different Average Confidence between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Average Confidence is computed over all predictions/labels.
Subset Macro Precision	Subset Performance	The precision test is also popularly referred to as positive predictive parity in fairness literature. When transitioning to the multiclass setting, we can compute macro precision which computes the precisions of each class individually and then averages them. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro Precision of model predictions within a specific subset is significantly lower than the model prediction Macro Precision over the entire population. Policies: N/A	Having different Macro Precision between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. Note that positive predictive parity does not necessarily indicate equal opportunity or predictive equality: as a hypothetical example, imagine that a loan qualification classifier flags 100 entries for group A and 100 entries for group B, each with a precision of 100%, but there are 100 actual qualified entries in group A and 9000 in group B. This would indicate disparities in opportunities given to each subgroup.	By default, Macro Precision is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted
Subset Root-Mean-Squared Error (RMSE)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Root-Mean-Squared Error (RMSE) of model predictions within a specific subset is significantly upper than the model prediction Root-Mean-Squared Error (RMSE) over the entire population. Policies: N/A	Having different Root-Mean-Squared Error (RMSE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Root-Mean-Squared Error (RMSE) is computed over all predictions/labels.
Subset Precision	Subset Performance	The precision test is also popularly referred to as positive predictive parity in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Precision of model predictions within a specific subset is significantly lower than the model prediction Precision over the entire population. Policies: N/A	Having different Precision between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. Note that positive predictive parity does not necessarily indicate equal opportunity or predictive equality: as a hypothetical example, imagine that a loan qualification classifier flags 100 entries for group A and 100 entries for group B, each with a precision of 100%, but there are 100 actual qualified entries in group A and 9000 in group B. This would indicate disparities in opportunities given to each subgroup.	By default, Precision is computed over all predictions/labels. Note that we round predictions to 0/1 to compute precision.
Subset Prediction Variance (Positive Labels)	Subset Performance	The subset variance test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the variance of model predictions within a specific subset significantly higher than model prediction variance of the entire population. In this test, the population refers to all data positive.	High variance within a feature subset compared to the overall population could mean a few different things, and should be analyzed with other subset performance tests (accuracy, AUC) for a more clear view. In the variance metric over positive/negative labels, this could mean the model is much more uncertain about the given subset. When paired with a decrease in AUC, this implies the model underperforms on this subset.	By default, the variance is computed over all
Subset Multiclass AUC	Subset Performance	In the multiclass setting, we compute one vs. one area under the curve (AUC), which computes the AUC between every pairwise combination of classes. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Multiclass AUC of model predictions within a specific subset is significantly lower than the model prediction Multiclass AUC over the entire population. Policies: N/A	Having different Multiclass AUC between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Multiclass AUC is computed over all predictions/labels.
Subset False Negative Rate	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the False Negative Rate of model predictions within a specific subset is significantly upper than the model prediction False Negative Rate over the entire population. Policies: N/A	Having different False Negative Rate between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, False Negative Rate is computed over all predictions/labels.
Subset Mean Reciprocal Rank (MRR)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean Reciprocal Rank (MRR) of model predictions within a specific subset is significantly lower than the model prediction Mean Reciprocal Rank (MRR) over the entire population. Policies: N/A	Having different Mean Reciprocal Rank (MRR) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean Reciprocal Rank (MRR) is computed over all predictions/labels.
Subset AUC	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the AUC of model predictions within a specific subset is significantly lower than the model prediction AUC over the entire population. Policies: N/A	Having different AUC between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, AUC is computed over all predictions/labels. Note that we compute AUC of the Receiver Operating Characteristic (ROC) curve.
Subset Rank Correlation	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Rank Correlation of model predictions within a specific subset is significantly lower than the model prediction Rank Correlation over the entire population. Policies: N/A	Having different Rank Correlation between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Rank Correlation is computed over all predictions/labels.
Subset Prediction Variance (Negative Labels)	Subset Performance	The subset variance test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the variance of model predictions within a specific subset significantly higher than model prediction variance of the entire population. In this test, the population refers to all data negative.	High variance within a feature subset compared to the overall population could mean a few different things, and should be analyzed with other subset performance tests (accuracy, AUC) for a more clear view. In the variance metric over positive/negative labels, this could mean the model is much more uncertain about the given subset. When paired with a decrease in AUC, this implies the model underperforms on this subset.	By default, the variance is computed over all
Subset False Positive Rate	Subset Performance	The false positive error rate test is also popularly referred to as predictive equality, or equal mis-opportunity in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the False Positive Rate of model predictions within a specific subset is significantly upper than the model prediction False Positive Rate over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different False Positive Rate between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. As an intuitive example, consider the case when the label indicates an undesirable attribute: if predicting whether a person will default on their loan, make sure that for people who didn’t default, the rate at which the model incorrectly predicts positive is similar for group A and B.	By default, False Positive Rate is computed over all predictions/labels. Note that we round predictions to 0/1 to compute false positive rate.
Subset Prediction Variance	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Prediction Variance of model predictions within a specific subset is significantly both than the model prediction Prediction Variance over the entire population. Policies: N/A	Having different Prediction Variance between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Prediction Variance is computed over all predictions/labels.
Subset Accuracy	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Accuracy of model predictions within a specific subset is significantly lower than the model prediction Accuracy over the entire population. Policies: N/A	Having different Accuracy between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Accuracy can be thought of as a ‘weaker’ metric of model bias compared to measuring false positive rate (predictive equality) or false negative rate (equal opportunity). This is because we can have similar accuracy between group A and group B; yet group A actually has higher false positive rate, while group B has higher false negative rate (e.g. we reject qualified applicants in group A but accept non-qualified applicants in group B). Nevertheless, accuracy is a standard metric used during evaluation and should be considered as part of performance bias testing.	By default, Accuracy is computed over all predictions/labels. Note we round predictions to 0/1 to compute accuracy.
Subset Mean-Absolute Error (MAE)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Absolute Error (MAE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Absolute Error (MAE) over the entire population. Policies: N/A	Having different Mean-Absolute Error (MAE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Absolute Error (MAE) is computed over all predictions/labels.
Subset Mean-Squared-Log Error (MSLE)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Squared-Log Error (MSLE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Squared-Log Error (MSLE) over the entire population. Policies: N/A	Having different Mean-Squared-Log Error (MSLE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Squared-Log Error (MSLE) is computed over all predictions/labels.
Subset Macro F1	Subset Performance	F1 is a holistic measure of both precision and recall. When transitioning to the multiclass setting we can use macro F1 which computes the F1 of each class and averages them. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro F1 of model predictions within a specific subset is significantly lower than the model prediction Macro F1 over the entire population. Policies: N/A	Having different Macro F1 between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Macro F1 is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted probability.
Subset Mean-Squared Error (MSE)	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Squared Error (MSE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Squared Error (MSE) over the entire population. Policies: N/A	Having different Mean-Squared Error (MSE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Squared Error (MSE) is computed over all predictions/labels.
Subset Multiclass Accuracy	Subset Performance	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Multiclass Accuracy of model predictions within a specific subset is significantly lower than the model prediction Multiclass Accuracy over the entire population. Policies: N/A	Having different Multiclass Accuracy between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Multiclass Accuracy is computed over all predictions/labels.
Numeric Outliers	Abnormal Inputs	This test measures the number of failing rows in your data with outliers and their impact on the model. Outliers are values which may not necessarily be outside of an allowed range for a feature, but are extreme values that are unusual and may be indicative of abnormality. The model impact is the difference in model performance between passing and failing rows with outliers. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	Outliers can be a sign of corrupted or otherwise erroneous data, and can degrade model performance if used in the training data, or lead to unexpected behaviour if input at inference time.	By default this test is run over each numeric feature that is neither unique nor ascending.
Unseen Categorical	Abnormal Inputs	This test measures the number of failing rows in your data with unseen categorical values and their impact on the model. The model impact is the difference in model performance between passing and failing rows with unseen categorical values. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	Unseen categorical values are a common failure point in machine learning systems; since these models are trained over a reference set, they may yield uninterpretable or undefined behavior when interacting with an unseen categorical value. In addition, such errors may expose gaps or errors in data collection.	By default, this test runs over all categorical features.
Rare Categories	Abnormal Inputs	This test measures the severity of passing to the model data points whose features contain rarely observed categories (relative to the reference set). The severity is a function of the impact of these values on the model, as well as the presence of these values in the data. The model impact is the difference in model performance between passing and failing rows with rarely observed categorical values. If labels are not provided, prediction change is used instead of model performance change. The number of failing rows refers to the number of times rarely observed categorical values are observed in the evaluation set. Policies: NIST Map 2.3	Rare categories are a common failure point in machine learning systems because less data often means worse performance. In addition, this may expose gaps or errors in data collection.	By default, this test runs over all categorical features. A category is considered rare if it occurs fewer than min_num_occurrences times, or if it occurs less than min_pct_occurrences of the time. If neither of these values are specified, the rate of appearance below which a category is considered rare is min_ratio_rel_uniform divided by the number of classes.
Out of Range	Abnormal Inputs	This test measures the number of failing rows in your data with values outside the inferred range of allowed values and their impact on the model. The model impact is the difference in model performance between passing and failing rows with values outside the inferred range of allowed values. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	In production, the model may encounter corrupted or manipulated out of range values. It is important that the model is robust to such extremities.	By default, this test runs over all numeric features.
Required Characters	Abnormal Inputs	This test measures the number of failing rows in your data with strings without any required characters and their impact on the model. The model impact is the difference in model performance between passing and failing rows with strings without any required characters. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	A feature may require specific characters. However, errors in the data pipeline may allow invalid data points that lack these required characters to pass. Failing to catch such errors may lead to noisier training data or noisier predictions during inference, which can degrade model metrics.	By default, this test runs over all string features that are inferred to have required characters.
Inconsistencies	Abnormal Inputs	This test measures the severity of passing to the model data points whose values are inconsistent (as inferred from the reference set). The severity is a function of the impact of these values on the model, as well as the presence of these values in the data. The model impact is the difference in model performance between passing and failing rows with data containing inconsistent feature values. If labels are not provided, prediction change is used instead of model performance change. The number of failing rows refers to the number of times data containing inconsistent feature values are observed in the evaluation set. Policies: NIST Map 2.3	Inconsistent values might be the result of malicious actors manipulating the data or errors in the data pipeline. Thus, it is important to be aware of inconsistent values to identify sources of manipulations or errors.	By default, this test runs on pairs of categorical features whose correlations exceed some minimum threshold. The default threshold for the frequency ratio below which values are considered to be inconsistent is 0.02.
Capitalization	Abnormal Inputs	This test measures the number of failing rows in your data with different types of capitalization and their impact on the model. The model impact is the difference in model performance between passing and failing rows with different types of capitalization. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	In production, models can come across the same value with different capitalizations, making it important to explicitly check that your model is invariant to such differences.	By default, this test runs over all categorical features.
Empty String	Abnormal Inputs	This test measures the number of failing rows in your data with empty string values instead of null values and their impact on the model. The model impact is the difference in model performance between passing and failing rows with empty string values instead of null values. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	In production, the model may encounter corrupted or manipulated string values. Null values and empty strings are often expected to be treated the same, but the model might not treat them that way. It is important that the model is robust to such extremities.	By default, this test runs over all string features with null values.
Embedding Anomalies	Abnormal Inputs	This test measures the number of failing rows in your data with anomalous embeddings and their impact on the model. The model impact is the difference in model performance between passing and failing rows with anomalous embeddings. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	In production, the presence of anomalous embeddings can indicate breaks in upstream data pipelines, poor model generalization, or other issues.	By default, this test runs over all configured embeddings.
Null Check	Abnormal Inputs	This test measures the number of failing rows in your data with nulls in features that should not have nulls and their impact on the model. The model impact is the difference in model performance between passing and failing rows with nulls in features that should not have nulls. If labels are not provided, prediction change is used instead of model performance change. Policies: NIST Map 2.3	The model may make certain assumptions about a column depending on whether or not it had nulls in the training data. If these assumptions break during production, this may damage the model’s performance. For example, if a column was never null during training then a model may not have learned to be robust against noise in that column.	By default, this test runs over all columns that had zero nulls in the reference set.
Feature Type Check	Abnormal Inputs	This test checks for feature values of the incorrect type. The test severity is a function of both the presence of values of the incorrect type and the observed effect of these values on model performance. Policies: NIST Map 2.3	A feature may require a specific type. However, errors in the data pipeline may produce values that are outside the expected type. Failing to catch such errors may lead to errors or undefined behavior from the model.	By default, this test runs over all features.
Subset Drift Average Rank	Subset Performance Degradation	This test is commonly known as the demographic parity or statistical parity test in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Rank of model predictions within a specific subset is significantly upper than the model prediction Average Rank over the entire population. Policies: N/A	Demographic parity is one of the most well-known and strict measures of fairness. It is meant to be used in a setting where we assert that the base label rates between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a protected attribute. It can be useful in legal/compliance settings where we want a Selection Rate for any protected group to fundamentally be the same as other groups.	By default, Average Rank is computed for all protected features.
Subset Drift Recall	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Recall of model predictions within a specific subset is significantly lower than the model prediction Recall over the entire population. Policies: N/A	Having different Recall between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Recall is computed over all predictions/labels.
Subset Drift Average Number of Predicted Entities	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Number of Predicted Entities of model predictions within a specific subset is significantly both than the model prediction Average Number of Predicted Entities over the entire population. Policies: N/A	Having different Average Number of Predicted Entities between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Average Number of Predicted Entities is computed over all predictions/labels.
Subset Drift NDCG	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Normalized Discounted Cumulative Gain (NDCG) of model predictions within a specific subset is significantly lower than the model prediction Normalized Discounted Cumulative Gain (NDCG) over the entire population. Policies: N/A	Having different Normalized Discounted Cumulative Gain (NDCG) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Normalized Discounted Cumulative Gain (NDCG) is computed over all predictions/labels.
Subset Drift Macro Recall	Subset Performance Degradation	The recall test is more popularly referred to as equal opportunity or false negative error rate balance in fairness literature. When transitioning to the multiclass setting we can use macro recall which computes the recall of each individual class and then averages these numbers. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro Recall of model predictions within a specific subset is significantly lower than the model prediction Macro Recall over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different Macro Recall between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. An intuitive example is when the label indicates a positive attribute: if predicting whether to interview a given candidate, make sure that out of qualified candidates, the rate at which the model predicts an interview is similar to group A and B.	By default, Macro Recall is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted class probability.
Subset Drift F1	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the F1 of model predictions within a specific subset is significantly lower than the model prediction F1 over the entire population. Policies: N/A	Having different F1 between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, F1 is computed over all predictions/labels.
Subset Drift Mean-Absolute Percentage Error (MAPE)	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Absolute Percentage Error (MAPE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Absolute Percentage Error (MAPE) over the entire population. Policies: N/A	Having different Mean-Absolute Percentage Error (MAPE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Absolute Percentage Error (MAPE) is computed over all predictions/labels.
Subset Drift Macro Precision	Subset Performance Degradation	The precision test is also popularly referred to as positive predictive parity in fairness literature. When transitioning to the multiclass setting, we can compute macro precision which computes the precisions of each class individually and then averages them. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro Precision of model predictions within a specific subset is significantly lower than the model prediction Macro Precision over the entire population. Policies: N/A	Having different Macro Precision between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. Note that positive predictive parity does not necessarily indicate equal opportunity or predictive equality: as a hypothetical example, imagine that a loan qualification classifier flags 100 entries for group A and 100 entries for group B, each with a precision of 100%, but there are 100 actual qualified entries in group A and 9000 in group B. This would indicate disparities in opportunities given to each subgroup.	By default, Macro Precision is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted
Subset Drift Root-Mean-Squared Error (RMSE)	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Root-Mean-Squared Error (RMSE) of model predictions within a specific subset is significantly upper than the model prediction Root-Mean-Squared Error (RMSE) over the entire population. Policies: N/A	Having different Root-Mean-Squared Error (RMSE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Root-Mean-Squared Error (RMSE) is computed over all predictions/labels.
Subset Drift Precision	Subset Performance Degradation	The precision test is also popularly referred to as positive predictive parity in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Precision of model predictions within a specific subset is significantly lower than the model prediction Precision over the entire population. Policies: N/A	Having different Precision between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. Note that positive predictive parity does not necessarily indicate equal opportunity or predictive equality: as a hypothetical example, imagine that a loan qualification classifier flags 100 entries for group A and 100 entries for group B, each with a precision of 100%, but there are 100 actual qualified entries in group A and 9000 in group B. This would indicate disparities in opportunities given to each subgroup.	By default, Precision is computed over all predictions/labels. Note that we round predictions to 0/1 to compute precision.
Subset Drift Prediction Variance (Positive Labels)	Subset Performance Degradation	The subset variance test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the variance of model predictions within a specific subset significantly higher than model prediction variance of the entire population. In this test, the population refers to all data positive.	High variance within a feature subset compared to the overall population could mean a few different things, and should be analyzed with other subset performance tests (accuracy, AUC) for a more clear view. In the variance metric over positive/negative labels, this could mean the model is much more uncertain about the given subset. When paired with a decrease in AUC, this implies the model underperforms on this subset.	By default, the variance is computed over all
Subset Drift Multiclass AUC	Subset Performance Degradation	In the multiclass setting, we compute one vs. one area under the curve (AUC), which computes the AUC between every pairwise combination of classes. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Multiclass AUC of model predictions within a specific subset is significantly lower than the model prediction Multiclass AUC over the entire population. Policies: N/A	Having different Multiclass AUC between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Multiclass AUC is computed over all predictions/labels.
Subset Drift False Negative Rate	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the False Negative Rate of model predictions within a specific subset is significantly upper than the model prediction False Negative Rate over the entire population. Policies: N/A	Having different False Negative Rate between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, False Negative Rate is computed over all predictions/labels.
Subset Drift Average Prediction	Subset Performance Degradation	This test is commonly known as the demographic parity or statistical parity test in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Prediction of model predictions within a specific subset is significantly both than the model prediction Average Prediction over the entire population. Policies: N/A	Demographic parity is one of the most well-known and strict measures of fairness. It is meant to be used in a setting where we assert that the base label rates between subgroups should be the same (even if empirically they are different). This contrasts with equality of opportunity or predictive parity tests, which permit classification rates to depend on a protected attribute. It can be useful in legal/compliance settings where we want a Selection Rate for any protected group to fundamentally be the same as other groups.	By default, Average Prediction is computed for all protected features.
Subset Drift Mean Reciprocal Rank (MRR)	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean Reciprocal Rank (MRR) of model predictions within a specific subset is significantly lower than the model prediction Mean Reciprocal Rank (MRR) over the entire population. Policies: N/A	Having different Mean Reciprocal Rank (MRR) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean Reciprocal Rank (MRR) is computed over all predictions/labels.
Subset Drift AUC	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the AUC of model predictions within a specific subset is significantly lower than the model prediction AUC over the entire population. Policies: N/A	Having different AUC between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, AUC is computed over all predictions/labels. Note that we compute AUC of the Receiver Operating Characteristic (ROC) curve.
Subset Drift Rank Correlation	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Rank Correlation of model predictions within a specific subset is significantly lower than the model prediction Rank Correlation over the entire population. Policies: N/A	Having different Rank Correlation between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Rank Correlation is computed over all predictions/labels.
Subset Drift Prediction Variance (Negative Labels)	Subset Performance Degradation	The subset variance test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the variance of model predictions within a specific subset significantly higher than model prediction variance of the entire population. In this test, the population refers to all data negative.	High variance within a feature subset compared to the overall population could mean a few different things, and should be analyzed with other subset performance tests (accuracy, AUC) for a more clear view. In the variance metric over positive/negative labels, this could mean the model is much more uncertain about the given subset. When paired with a decrease in AUC, this implies the model underperforms on this subset.	By default, the variance is computed over all
Subset Drift False Positive Rate	Subset Performance Degradation	The false positive error rate test is also popularly referred to as predictive equality, or equal mis-opportunity in fairness literature. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the False Positive Rate of model predictions within a specific subset is significantly upper than the model prediction False Positive Rate over the entire population. Policies: NIST Map 1.5, NIST Map 1.6, NIST Measure 2.2, NIST Measure 2.9, NIST Measure 2.11	Having different False Positive Rate between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Unlike demographic parity, this test permits assuming different base label rates but flags differing mistake rates between different subgroups. As an intuitive example, consider the case when the label indicates an undesirable attribute: if predicting whether a person will default on their loan, make sure that for people who didn’t default, the rate at which the model incorrectly predicts positive is similar for group A and B.	By default, False Positive Rate is computed over all predictions/labels. Note that we round predictions to 0/1 to compute false positive rate.
Subset Drift Prediction Variance	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Prediction Variance of model predictions within a specific subset is significantly both than the model prediction Prediction Variance over the entire population. Policies: N/A	Having different Prediction Variance between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Prediction Variance is computed over all predictions/labels.
Subset Drift Accuracy	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Accuracy of model predictions within a specific subset is significantly lower than the model prediction Accuracy over the entire population. Policies: N/A	Having different Accuracy between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation. Accuracy can be thought of as a ‘weaker’ metric of model bias compared to measuring false positive rate (predictive equality) or false negative rate (equal opportunity). This is because we can have similar accuracy between group A and group B; yet group A actually has higher false positive rate, while group B has higher false negative rate (e.g. we reject qualified applicants in group A but accept non-qualified applicants in group B). Nevertheless, accuracy is a standard metric used during evaluation and should be considered as part of performance bias testing.	By default, Accuracy is computed over all predictions/labels. Note we round predictions to 0/1 to compute accuracy.
Subset Drift Mean-Absolute Error (MAE)	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Absolute Error (MAE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Absolute Error (MAE) over the entire population. Policies: N/A	Having different Mean-Absolute Error (MAE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Absolute Error (MAE) is computed over all predictions/labels.
Subset Drift Mean-Squared-Log Error (MSLE)	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Squared-Log Error (MSLE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Squared-Log Error (MSLE) over the entire population. Policies: N/A	Having different Mean-Squared-Log Error (MSLE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Squared-Log Error (MSLE) is computed over all predictions/labels.
Subset Drift Macro F1	Subset Performance Degradation	F1 is a holistic measure of both precision and recall. When transitioning to the multiclass setting we can use macro F1 which computes the F1 of each class and averages them. This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Macro F1 of model predictions within a specific subset is significantly lower than the model prediction Macro F1 over the entire population. Policies: N/A	Having different Macro F1 between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Macro F1 is computed over all predictions/labels. Note that the predicted label is the label with the largest predicted probability.
Subset Drift Mean-Squared Error (MSE)	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Mean-Squared Error (MSE) of model predictions within a specific subset is significantly upper than the model prediction Mean-Squared Error (MSE) over the entire population. Policies: N/A	Having different Mean-Squared Error (MSE) between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Mean-Squared Error (MSE) is computed over all predictions/labels.
Subset Drift Multiclass Accuracy	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Multiclass Accuracy of model predictions within a specific subset is significantly lower than the model prediction Multiclass Accuracy over the entire population. Policies: N/A	Having different Multiclass Accuracy between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Multiclass Accuracy is computed over all predictions/labels.
Subset Drift Average Number of Predicted Boxes	Subset Performance Degradation	This test checks whether the model performs equally well across a given subset of rows as it does across the whole dataset. The key detail displays the performance difference between the lowest performing subset and the overall population. The test first splits the dataset into various subsets depending on the quantiles of a given feature column. If the feature is categorical, the data is split based on the feature values. We then test whether the Average Number of Predicted Boxes of model predictions within a specific subset is significantly both than the model prediction Average Number of Predicted Boxes over the entire population. Policies: N/A	Having different Average Number of Predicted Boxes between different subgroups is an important indicator of performance bias; in general, bias is an important phenomenon in machine learning and not only contains implications for and ethics, but also indicates failures in adequate feature representation and fairness spurious correlation.	By default, Average Number of Predicted Boxes is computed over all predictions/labels.
Label Flipping Detection (Exact Match)	Data Poisoning Detection	This test detects corrupted data points in the evaluation dataset. It does this by checking for data points in the evaluation set that are also present in the reference set, but with a different label. This test assumes that the reference set is clean, trusted data and the evaluation set is potentially corrupted. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can tamper with data pipelines by sending mislabeled data points to undermine the trustworthiness of your model and cause it to produce incorrect or harmful output. Detecting poisoning attacks before they affect your model is critical to ensuring model security.	By default, this test runs when the “Data Poisoning Detection” test category is selected.
Label Flipping Detection (Near Match)	Data Poisoning Detection	This test detects corrupted data points in the evaluation dataset. It does this by checking for data points in the evaluation set that appear to be mislabeled based on their relative distances to each class in the reference set. This test assumes that the reference set is clean, trusted data and the evaluation set is potentially corrupted. Policies: NIST Map 1.5, NIST Measure 2.5	Malicious actors can tamper with data pipelines by sending mislabeled data points to undermine the trustworthiness of your model and cause it to produce incorrect or harmful output. Detecting poisoning attacks before they affect your model is critical to ensuring model security.	By default, this test runs when the “Data Poisoning Detection” test category is selected.
Stateful Black Box Evasion Detection	Evasion Attack Detection	This test examines query patterns in the evaluation set to identify behavior indicative of an attempt to generate an adversarial example. It does this by flagging points for which the average distance to its k-nearest neighbors among a fixed number of preceding queries is below a threshold configured from the reference set. Often when only black box access to the model is available, the process of generating an adversarial example will involve querying the model on several similar data points in a short time period.	Malicious actors can perturb inputs to alter model behavior in unexpected ways. It is important to be able to identify data coming from an adversarial attack.	This test requires timestamps to be specified in the evaluation set.

Standards Mapping and Supplementary Literature

The following table maps test categories (and individual tests, where relevant) to NIST’s suggested actions for achieving the outcomes laid out in the AI Risk Management Framework. In addition, we provide supplementary literature relevant to the test category.

Risk Category	Test Category	NIST MAP	NIST MEASURE	NIST MANAGE	Literature
Operational	Model Performance	MAP 1.4: understand how model performance tests map to specific business use case/model task (NOTE: we can recommend sensible default tests for business outcomes) MAP 1.5: configurable thresholds MAP 2.3: standard performance metrics, e.g. AUC, Accuracy, False Positive Rate, Positive Prediction Rate, Precision, and Recall MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.3: standard performance metrics, e.g. False Positive Rate, False Negative Rate MEASURE 2.5: Average Thresholded Confidence MEASURE 2.6	MANAGE 1.2 MANAGE 2.2 MANAGE 2.4 MANAGE 4.1
Operational	Subset performance	MAP 1.5: configurable thresholds MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.2 MEASURE 2.6	MANAGE 1.2 MANAGE 2.2 MANAGE 2.4 MANAGE 4.1	Ackerman, Samuel, Orna Raz, and Marcel Zalmanovici. “FreaAI: Automated Extraction of Data Slices to Test Machine Learning Models”. In Engineering Dependable and Secure Machine Learning Systems, edited by Onn Shehory, Eitan Farchi, and Guy Barash, 67–83. Communications in Computer and Information Science. Cham: Springer International Publishing, 2020. Gattermann-Itschert, Theresa, and Ulrich W. Thonemann. “How Training on Multiple Time Slices Improves Performance in Churn Prediction”, European Journal of Operational Research 295, no. 2 (December 1, 2021): 664–74. Wexler, James, Mahima Pushkarna, Tolga Bolukbasi, Martin Wattenberg, Fernanda Viégas, and Jimbo Wilson. “The What-If Tool: Interactive Probing of Machine Learning Models”. IEEE Transactions on Visualization and Computer Graphics 26, no. 1 (January 2020): 56–65.
Operational	Transformations	MAP 1.5: configurable thresholds MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.5 MEASURE 2.6	MANAGE 1.2 MANAGE 2.4 MANAGE 4.1	Balestriero, Randall, Leon Bottou, and Yann LeCun. “The Effects of Regularization and Data Augmentation Are Class Dependent.” arXiv, April 8, 2022. Bhagoji, Arjun Nitin, Daniel Cullina, Chawin Sitawarin, and Prateek Mittal. “Enhancing Robustness of Machine Learning Systems via Data Transformations”. In 2018 52nd Annual Conference on Information Sciences and Systems (CISS), 1–5, 2018. Woodie, Alex. “Why You Need Data Transformation in Machine Learning” Datanami, November 8, 2019.
Operational	Abnormal input	MAP 1.5: configurable thresholds MAP 2.3: Numeric Outliers MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.6	MANAGE 1.2 MANAGE 2.4 MANAGE 4.1	Chen, Haihua, Chen, Jiangping, and Ding, Junhua. “Data Evaluation and Enhancement for Quality Improvement of Machine Learning”. IEEE Transactions on Reliability 70, no. 2 (June 2021): 831–47. Rukat, Tammo, Lange, Dustin, Schelter, Sebastian, and Biessman, Felix. “Towards Automated Data Quality Management for Machine Learning”, n.d., 3. Schelter, Sebastian, Grafberger, Stefan, Schmidt, Philipp, Rukat, Tammo, Kiessling, Mario, Taptunov, Andrey, Biessmann, Felix, and Lange, Dustin. “Deequ - Data Quality Validation for Machine Learning Pipelines”, n.d., 3.
Operational	Drift	MAP 1.5: configurable thresholds MAP 2.3: Correlation Drift, Mutual Information Drift MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.5: Correlation Drift, Mutual Information Drift	MANAGE 1.2 MANAGE 2.4 MANAGE 4.1	Ackerman, Samuel, Eitan Farchi, Orna Raz, Marcel Zalmanovici, and Parijat Dube. “Detection of Data Drift and Outliers Affecting Machine Learning Model Performance over Time”. arXiv, January 20, 2021. Ackerman, Samuel, Orna Raz, Marcel Zalmanovici, and Aviad Zlotnick. “Automatically Detecting Data Drift in Machine Learning Classifiers”. arXiv, November 10, 2021. Mallick, Ankur, Kevin Hsieh, Behnaz Arzani, and Gauri Joshi. “Matchmaker: Data Drift Mitigation in Machine Learning for Large-Scale Systems”. Proceedings of Machine Learning and Systems 4 (April 22, 2022): 77–94.
Operational	Data cleanliness	MAP 1.5: configurable thresholds MAP 2.3: Required Features MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed	MANAGE 1.2 MANAGE 2.4 MANAGE 4.1
Security	Adversarial	MAP 1.5: configurable thresholds MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.6 MEASURE 2.7	MANAGE 1.2 MANAGE 2.4 MANAGE 4.1	Goodfellow, Ian J., Shlens, Jonathon, and Szegedy, Christian. “Explaining and Harnessing Adversarial Examples”. arXiv, March 20, 2015. Kotyan, Shashank, and Vasconcellos Vargas, Danilo. “Adversarial Robustness Assessment: Why Both $L_0$ and $L_infty$ Attacks Are Necessary”. arXiv, July 16, 2020. Raj, Sunny, Pullum, Laura, Ramanthan, Arvind, and Jha, Sumit Kumar. “$$mathcal {SATYA}$$: Defending Against Adversarial Attacks Using Statistical Hypothesis Testing”. In Foundations and Practice of Security, edited by Abdessamad Imine, José M. Fernandez, Jean-Yves Marion, Luigi Logrippo, and Joaquin Garcia-Alfaro, 10723:277–92. Lecture Notes in Computer Science. Cham: Springer International Publishing, 2018.
Fairness	Bias and Fairness	MAP 1.5: configurable thresholds MAP 2.3: Discrimination by Proxy MAP 3.4	MEASURE 1.1, 1.2, 2.13: run all tests and choose preferred metrics for specific use case; regularly test and update metrics as needed MEASURE 2.5 MEASURE 2.11	MANAGE 1.2 MANAGE 2.2 MANAGE 2.4 MANAGE 4.1	Audit-AI. Python. 2018. Reprint, Pymetrics, 2022. https://github.com/pymetrics/audit-ai. Corbett-Davies, Sam, and Sharad Goel. “The Measure and Mismeasure of Fairness: A Critical Review of Fair Machine Learning” arXiv, August 14, 2018. Ghosh, Avijit, Lea Genuit, and Mary Reagan. “Characterizing Intersectional Group Fairness with Worst-Case Comparisons” arXiv, May 4, 2022.