You cannot ship an LLM proxy without evals
Baseline versus protected profile, 17/17 PASS, and the limits of that number.
A dashboard that “blocks jailbreaks” is a demo. A gateway you would put in front of production traffic needs a battery you can rerun: the same cases, with controls off and on, and a pass/fail that is not a screenshot of a chat.
That is what the Streamlit evaluation tab in the AI Security Gateway does. It replays a fixed suite against the running proxy — legitimate prompts (anti-false-positive), threat layers L2–L4, inbound and outbound DLP, and extraction-style cases — and writes a report: layer hit, HTTP status, latency, block reason.
What 17/17 actually means
On the protected profile the suite is 17/17 PASS. That is not “the model is aligned”. It is: for this catalog, the gateway did what the case specified (block, mask, or allow). The unprotected baseline is there to show that the victim model would otherwise answer. Without that contrast you cannot tell a control from a model that simply refused.
Latency is part of the security story
The expensive AI layers — LLM-as-judge (L3.5) and DistilBERT (L4) — run concurrently with
asyncio.gather. Added latency is the slower of the two, not the sum. Heuristic blocks
(length, regex) fail closed in milliseconds and never reach the provider. That shows up in the metrics
view: overall latency mixes fast denials with full LLM round-trips, so you have to split by outcome.
What the number does not prove
The catalog is finite and known to the author. Regex plus a classifier will not cover every jailbreak. There is no enterprise authentication in front of the MVP, and SQLite is not a SIEM. The unit tests (~175 pytest) protect regressions in parsing, DLP token round-trips and routing; they are not a red-team engagement.
The useful claim is smaller and, I think, more honest: if you put LLM security on the wire, you can measure it the same way you measure any other control — with a suite, a baseline, and a report you can export. That is the same habit as SSDLC scanners in CI, applied to prompts.
Architecture note: why the client only changes a Base URL. Repository: github.com/r4fik1/ai-security-gateway.