04 — testing & measurement

Hard negative

A benign sample deliberately shaped like an attack — a security engineer legitimately asking about base64 decoding, a role-play prompt with no harmful goal, an urgent-sounding request with an ordinary purpose, a developer pasting a real credential-rotation runbook. Hard negatives are what make a benign corpus adversarial rather than decorative: a control can score 0% false positives on ordinary prompts and still be unusable, and only hard negatives reveal it.

Related terms

False positive Testing & measurement
Benign activity flagged as malicious. In an agent security control this is the failure mode that actually kills deployments: a tool that blocks legitimate…
Precision Testing & measurement
Of everything the control flagged, the share that was genuinely malicious — true positives divided by all positives.

Testing & measurement

The words that decide whether a published detection number is evidence or decoration. Most vendor numbers in this space are quoted without any of them; see how we test for how these are applied in practice.

Hard negative is term 9 of 15 in this part of the glossary.

Held-out set Tune/test split Overfitting Baseline validation False positive False negative Precision RecallHard negativeDetection vs prevention Model refusal Marginal value Red teaming Adversarial mutation Variance

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.