• We explored three major paradigms of machine learning
• Supervised learning: Learn from labelled examples (classification, regression)
• Unsupervised learning: Find patterns without labels (clustering, dimensionality reduction)
• Reinforcement learning: Learn from rewards (agents and environments)
• We discussed how different problems require different approaches
• Today: How do we know if our models are actually any good? 🤔

Part 1: Traditional ML Metrics

• Why accuracy isn’t enough
• Confusion matrix, precision, recall
• ROC curves and regression metrics
• Overfitting and cross-validation

Part 2: LLM Evaluation

• Why LLMs are harder to evaluate
• LLM-as-a-Judge and G-Eval
• Hallucinations, RAG, and red teaming
• Benchmarks vs real-world performance

• This is called the accuracy paradox
• Accuracy measures overall correctness, but doesn’t tell us:
  • How many sick patients we actually found
  • How many healthy patients we falsely alarmed
  • Whether errors are concentrated in one group
• The problem is especially severe with class imbalance
• Real examples of imbalanced data:
  • Fraud: 0.2% of transactions
  • Security threats: < 0.01% of events
  • Manufacturing defects: Often < 1%

• Every metric captures one aspect of model performance
• There’s no single “best” metric, it all depends on your specific context
• Questions to ask yourself:
  • What’s the cost of a false positive? (Saying “yes” when it’s “no”)
  • What’s the cost of a false negative? (Saying “no” when it’s “yes”)
  • Are the classes balanced or imbalanced?
  • What action will be taken based on the prediction?
• The choice of metric is a design decision with real-world consequences

• A table showing all possible prediction outcomes
• Four key quantities:
  • True Positives (TP): Correctly predicted positive
  • True Negatives (TN): Correctly predicted negative
  • False Positives (FP): Predicted positive, but actually negative (Type I error)
  • False Negatives (FN): Predicted negative, but actually positive (Type II error)
• All classification metrics come from these four numbers!

Precision = TP / (TP + FP)

• When the model says “yes”, how often is it right?
• High precision = few false alarms
• Important when false positives are costly (spam, fraud)

Recall = TP / (TP + FN)

• Of all actual positives, how many did we find?
• High recall = we don’t miss many positives
• Important when false negatives are costly (disease, security)

Most classifiers output a probability score. Moving the threshold trades off precision and recall…you can’t maximise both!

• Overfitting: Model performs well on training data but poorly on new data
• The model has memorised the training set, including its noise and quirks
• It hasn’t learned the underlying patterns
• Signs of overfitting:
  • Excellent training performance
  • Poor test performance
  • Gap grows with model complexity
• Think of it like memorising exam answers vs understanding the material
• The student who memorises fails when questions are rephrased

Underfitting 📉

• Model too simple
• High bias, low variance
• Poor on training AND test
• Hasn’t captured the pattern
• Solution: More complex model

Good fit ✅

• Right complexity
• Balanced bias and variance
• Good on both sets
• Captures the true pattern
• This is what we want!

Overfitting 📈

• Model too complex
• Low bias, high variance
• Great on training, poor on test
• Memorised noise
• Solution: Regularisation

The three-way split:

• Training set (~60-70%): Fit the model
• Validation set (~15-20%): Tune hyperparameters
• Test set (~15-20%): Final evaluation only!
• Never peek at test data during development—that’s cheating!

K-fold cross-validation:

• Split data into K parts (folds)
• Train on K-1 folds, validate on the remaining fold
• Repeat K times, average the results
• Every data point gets tested once
• More robust than a single split, especially for small datasets

• Traditional ML: One correct answer per input
  • 😺: Cat or dog? → “Cat” ✅
• Language generation: Many valid outputs!
  • “The cat sat on the mat” ≈ “A feline rested upon the rug”
  • Both are correct! How do we score them?
• We need to evaluate multiple dimensions at once:
  • Fluency: Is it grammatical and natural?
  • Relevance: Does it address the question?
  • Factuality: Is it actually true?
  • Helpfulness: Is it useful to the user?
• Old text metrics (BLEU, ROUGE) just count word overlaps
• They can’t tell if text is meaningful or even correct!

• Perplexity measures how well an LLM predicts a sequence of text
• Imagine the model guessing the next word
  • If it’s very confident about the right answer → Low perplexity
  • If it’s confused among many options → High perplexity
• Think of it as: How many equally likely words could come next?
  • Perplexity of 10 → Model choosing from ~10 words
  • Perplexity of 100 → Model choosing from ~100 words
• Lower is better: A model that understands language well makes confident, correct predictions
• Critical limitation: Perplexity measures fluency, not truth
• 🎬 Watch: What is Perplexity for LLMs? (5 min)

• Use a powerful LLM to grade responses from other models
• Give the judge a rubric (evaluation criteria) and examples
• The judge scores responses on dimensions like:
  • Helpfulness, accuracy, relevance, safety
• Why it works:
  • Evaluating is often easier than generating
  • Scales infinitely (no human bottleneck)
  • Can evaluate subjective qualities
• The catch:
  • The judge is only as good as its own capabilities
  • Potential biases: May favour its own style
  • Need a strong judge (often GPT-5 or Claude)

• Hallucination: AI output that is fluent but factually incorrect or fabricated
• The model generates plausible-sounding content that isn’t grounded in reality
• Common forms:
  • Fabricated citations: Inventing papers that don’t exist
  • Made-up statistics: “73% of scientists agree…”
  • False biographical details: Wrong dates, events, achievements
  • Confident nonsense: Eloquent explanations of things that are simply wrong
• This is one of the biggest challenges in deploying language models
• Why? Because they’re trained to predict likely text, not true text

Notable incidents (all real!):

• ⚖️ Legal (2023): Two lawyers submitted a brief citing six non-existent cases generated by ChatGPT. They were sanctioned by the court.

• 🏥 Medical: AI chatbots have provided dangerous health advice citing fabricated studies

• 📰 News: AI-generated fake news stories have moved stock prices

• 📚 Academic: Students have submitted essays with entirely invented references

• More people trusting AI outputs without verification

• Harder for non-experts to spot fabrications

• Legal and reputational risks for organisations

• Red teaming: Deliberately trying to make the AI fail or behave badly
• Like hiring hackers to test your security!
• What red teamers look for:
  • Harmful or unsafe outputs
  • Jailbreaks (bypassing safety guardrails)
  • Bias and offensive content
  • Factual errors and hallucinations
• Manual red teaming: Humans craft tricky prompts
  • Gold standard but expensive and slow
• AI-Assisted Red Teaming (AART): Use AI to generate adversarial test cases automatically
  • Scales up testing dramatically
  • Covers diverse cultural and geographic contexts
  • Paper: AART (2023)

Benchmarks: Standardised tests (MMLU, TruthfulQA, HumanEval)

Leaderboards: Human preference rankings (LM Arena uses Elo ratings)

Goodhart’s Law: “When a measure becomes a target, it ceases to be a good measure”

Common problems:

• Benchmark contamination: Test data leaks into training
• Teaching to the test: Optimising for quirks, not capability
• Metric saturation: “Human-level” on benchmarks, fails in real-world

What benchmarks miss: Robustness, safety, creativity, long-horizon reasoning

• Overall accuracy can hide serious failures for specific groups
• Real example (Buolamwini & Gebru, 2018):
  • Commercial face recognition error rates:
  • Light-skinned men: 0.8% error
  • Dark-skinned women: 34.7% error
  • 43× worse performance for one group!
• This is called data slicing or subgroup analysis
• The model “works” overall, but fails for specific populations
• Even removing sensitive features doesn’t help—they correlate with other features
• Always evaluate models per subgroup, not just overall

Traditional ML Metrics:

• Accuracy is not enough: Especially dangerous with class imbalance
• Precision/Recall trade-off: Choose based on false positive vs. false negative costs
• Use cross-validation and keep a truly unseen test set

LLM Evaluation:

• Perplexity ≠ truth: Fluent text can still be wrong
• LLM-as-a-Judge and G-Eval: Scalable evaluation with rubrics
• RAG: Ground answers in documents to reduce hallucinations
• Red teaming: Proactively find vulnerabilities before users do
• Benchmarks have limits: Goodhart’s Law and “benchmaxxing”
• Subgroup analysis: Always look beyond averages