AI Tool Tests
Testing applied to the systems that claim to prove who made a piece of content, how it was made and whether it was altered or generated. Twenty-seven guides: detector benchmarks, base rates, thresholds and intervals on one side; Content Credentials pipelines, metadata survival, disclosure labels and evidence-grade test records on the other.
29 guidesUpdated Editorial method
About AI tool tests
Testers measure whether a system can be trusted, and an authenticity system is a system like any other. It arrives in one of three shapes. A classifier (an AI text detector, an image detector) returns a verdict that is wrong some of the time, so its oracle is a labelled evaluation set and its pass criterion is a rate fixed before the run: a false positive ceiling on human-written text, with a confidence interval. A signed pipeline (Content Credentials under the C2PA specification, the EXIF and XMP that a camera or an editor writes) carries a claim about who made a file and how, so its oracle is a validator and its pass criterion is a chain that verifies after every stage, or an honest absence. A label feature (an AI disclosure label on a platform) is a claim that has to appear on every surface and survive every transformation, so its oracle is one expected result per partition of origin, medium and edit state. Each has an oracle and a pass criterion, and each can be benchmarked, regression tested and recorded to an evidence standard. The twenty-seven guides in this hub cover the systems that claim to prove who made a piece of content, how it was made, and whether it was altered or generated, and they are arranged below by the question that brings a reader here.
If the question is about a detector, read how to test AI systems first for the three-layer approach: ordinary tests on the software around the model, rates on an evaluation set for the model's behaviour, and properties that must hold whatever the output. Then false positives, base rates and the confusion matrix, which shows why a detector that is right 98 percent of the time can be wrong about most of the documents it flags. Readers who have been handed a score, or who hand them out, continue with what a detector score means for a writer, teacher or editor, the three ways detectors work and why two detectors disagree about the same text. Readers who have to run the measurement continue with the detector benchmark protocol (300 human and 300 machine documents per slice, threshold fixed before the run, full confusion matrix reported), choosing a threshold from the ROC curve and Wilson intervals for every reported rate. The data side is evaluation set design by slices, size and leakage and agreement statistics for the labels; the slices that most often fail are covered in the fairness test on non-native writers and the adversarial slices: paraphrase, translation round trips and mixed documents. Statistical text watermarking closes the detector set: a watermark test can give strong evidence on long unedited text from a cooperating generator, and no evidence about anything else.
Four guides cover generative features and generated code rather than detectors, because the same teams usually own both. Test design for language-model features layers deterministic, property and rubric assertions and passes on rates over repeated runs. Prompt regression testing turns that suite into a release gate with a baseline and an agreed margin. Metamorphic relations for language models supply an oracle when no expected output exists: invariance, direction and consistency across generated input pairs. Reviewing machine-generated tests and code belongs with them, because a generated test that kills no mutants is a false positive of a different kind.
If the question is about provenance, start with a verification session for content credentials: run the exact bytes through a validator, read the signature, the certificate chain, the content hashes and the assertions, and land on one of four outcomes, each of which proves less than people assume. Testing a content provenance pipeline is the practitioner protocol: a fixture of signed images pushed through every transformation stage of a CMS, the manifest validated after each one, and a worked example of 40 images through 9 stages. Metadata survival testing widens the fixture to every EXIF, XMP and C2PA field, hashes each layer separately and records preserved, rewritten or stripped per channel, with 12 probe images through 10 channels as the worked case. Testing AI disclosure labels treats the label as a feature and a claim at once: inputs partitioned by origin (declared, signed, inferred), medium and edit state, one expected result per partition, and 60 items across 5 surfaces in the example.
If the question is about evidence, two guides apply. Evidence-grade test records sets out what a record needs before it can be relied on in a dispute or an audit: the tester, inputs by hash, the exact version under test, criteria fixed before the run, raw outputs, timestamps and environment, stored write-once and reproducible by a second tester. Authorship evidence that holds up is the reader's side of the same problem: version history, dated drafts and the ability to explain the work carry weight, and a detector score on the finished text carries very little.
The guides lean on the rest of the site and on named sources. Risk-based testing decides how deep an evaluation goes, and its impact column is where a false positive on a person gets its weight. Testing metrics supplies the rule that no rate is reported without its denominator and its interval, and equivalence partitioning is how evaluation slices and label test cases are chosen. Sources are standards and published research rather than vendor material: the C2PA technical specification for manifests, bindings, validation and trust lists; the IPTC photo metadata standard and the ISO standard for XMP; the IETF specifications for signing structures, certificates and timestamps; the NIST overview of technical approaches to synthetic content and its guidance on forensic records; the ISO/IEC 29119 guidance on AI-based systems and the ISTQB AI testing syllabus; and peer-reviewed detector studies, in particular those that measured false positive rates on non-native writers and detection rates after paraphrasing. Every guide lists its sources by name and links them. None of the guides claims that a detector, a watermark or a provenance system is reliable in itself; each shows how to measure how far it can be trusted.
Four guides added in the bridge pass of September 2026 sit on the evidence side of the lane. Testing deepfake detection brings the detector protocol to images, audio and video, with recall per manipulation family and a provenance check on the same media. Chain of custody for test evidence says how a screenshot, a log or a detector report is hashed, held and handed over so it survives a dispute. Data lineage for evaluation sets records where every item in an evaluation set came from and how its label was established, which is the provenance behind every rate this hub reports. Reproducibility lists what to pin so that a second team reruns an AI evaluation to the same rates within the stated interval.
All guides
Nothing matches. Clear the filter to see every entry.
Questions
Can a detector score prove who wrote a text?
No. A score measures how much a text resembles what the detector associates with machine writing. None of the three detector approaches observes who wrote the text, and each infers it from patterns that editing weakens. A score should open a conversation, never close a case.
Why can a detector with a low false positive rate still be wrong so often?
Because precision depends on the base rate. A detector with 94 percent detection and 2 percent false positives is right on 98 percent of its flags when half the documents are machine-written, but on only 32 percent when 1 document in 100 is.
How many documents does a detector benchmark need?
At least 300 human-written and 300 machine-written documents per slice that matters, kept away from anything the detector was tuned on. Fix the threshold before the run, then report the full confusion matrix and the false positive rate per slice with a 95 percent interval.
Does an image without content credentials have to be fake?
No. A verification session lands on one of four outcomes, and each proves less than people assume; reading absence as proof is one of the two traps the verification guide describes. A correctly working pipeline stage may itself leave a clean no-credentials state rather than a broken manifest.
