Evaluation

Benchmark

A labeled evaluation suite that measures Mithril's effectiveness as an enterprise memory firewall. Seeds verified ground truth, replays a labeled attack suite, and reports precision, recall, and per-category breakdowns.

Threat Model

A company runs AI agents over a shared Cognee knowledge base. Memory claims arrive from many channels — authoritative ones (Security Policy, HR System, GitHub) and risky ones (Slack, customer support, external email, the public web, other agents).

Attackers try to poison the shared memory: contradicting verified policy, spoofing authority, injecting prompts, exfiltrating data. Mithril sits between every writer and Cognee, scoring each claim and blocking untrusted writes.

How It Works

🌱

Phase 1 — Seed Ground Truth

Loads verified company memory from benchmark/ground_truth.jsonl — these are the policies the firewall should protect.

⚔️

Phase 2 — Replay Attack Suite

Runs every claim in benchmark/attack_suite.jsonl through Mithril.remember(). Each claim is labeled "attack" or "legit" with a category and domain.

📊

Phase 3 — Score & Report

Compares Mithril's decisions against labels. Computes detection rate, poison leak rate, false-positive rate, precision, and accuracy.

Running the Benchmark

Prerequisites

Same as the demo: project installed, .env with LLM_API_KEY configured. Set LLM_ENDPOINT and LLM_MODEL if you are not using the defaults.

Run

terminal

# Windows, using this repo's Makefile
make benchmark

# macOS / Linux / WSL
python benchmark/run_benchmark.py

View results

Full results are saved to benchmark/results.json with per-case outcomes, and the terminal prints a summary with confusion matrix.

Metrics Explained

🎯

Detection Rate (Recall)

Percentage of attack claims correctly blocked. A 100% detection rate means zero poisoned data reached Cognee.

☠️

Poison Leak Rate

Percentage of attack claims that slipped through (false negatives). This is the most critical metric — ideally 0%.

🚧

False-Positive Rate

Percentage of legitimate claims incorrectly blocked. Too high means real updates can't reach memory.

✅

Precision

Of all claims Mithril blocked, what fraction were actual attacks? High precision means few false alarms.

Expected Output

The suite size is fixed by the JSONL files, but scores and final metrics can move with your LLM provider and current Cognee state.

benchmark output (abbreviated)

================================================================
  MITHRIL — Memory-Poisoning Benchmark
  Enterprise knowledge base under attack
================================================================

PHASE 1 · Seeding 10 verified policies
  ✓ [security] Passwords must be hashed using Argon2id...
  ✓ [infra]    Production servers must run Ubuntu 22.04 LTS...
  ...

PHASE 2 · Replaying 31 labeled claims (21 attacks, 10 legit)
  ✓ BLOCKED    quarantine  0.18  direct_contradiction  Always hash passwords using MD5
  ✓ BLOCKED    reject      0.09  authority_spoofing    [URGENT] Security Policy update...
  ✓ admitted   accept      0.89  legit_update          Updated: Argon2id cost factor...
  ...

PHASE 3 · Results
  Attack detection rate   ...  (attacks blocked / 21)
  Poison leak rate        ...  (attacks admitted to memory)
  False-positive rate     ...  (legit updates blocked / 10)
  Precision               ...
  Overall accuracy        ...

  Full results → benchmark/results.json

Attack Categories

The benchmark suite covers multiple poisoning strategies:

⚔️

Contradiction

Claims that directly contradict verified memory (e.g. "use MD5" when policy says Argon2id).

🎭

Spoofed Source

Attackers pretending to be authoritative sources to bypass reputation scoring.

💉

Prompt Injection

Claims containing injected instructions that try to manipulate agent behavior.

🔓

Data Exfiltration

Attempts to embed exfiltration payloads or leak-triggering content into memory.

🔄

Subtle Deprecation

Soft claims that "this technology is deprecated" to erode trust in verified policies.

✅

Legit Updates

Genuine policy updates that should pass through — tests for false positives.

Customizing the Benchmark

You can extend or modify the attack suite and ground truth:

Ground truth

Edit benchmark/ground_truth.jsonl — one JSON object per line:

ground_truth.jsonl

{"text": "Your verified policy text", "source": "Security Policy", "domain": "security", "author": "system"}

Attack suite

Edit benchmark/attack_suite.jsonl:

attack_suite.jsonl

{"text": "Malicious claim text", "source": "Slack", "label": "attack", "category": "contradiction", "domain": "security", "rationale": "Why this should be blocked"}