SShortSingh.
Back to feed

Developer Finds AI Eval Was Circular After Rule Engine Labeled Its Own Test Data

0
·1 views

A developer building SugarShield, a tool to detect hidden sugars in ingredient lists, discovered a critical flaw in their model evaluation process: most of the 59-record gold test set had been labeled using the same rule engine being tested. This circular setup caused the rule engine to score 100% accuracy — not because it performed well, but because it was essentially graded against its own answers. Meanwhile, a fine-tuned Qwen2.5-based model scored only 69% accuracy on the same set, exposing that neither result could be trusted for real-world use. The developer resolved the issue by building a completely separate 132-record evaluation set that neither system had any hand in producing. The incident highlights a broader risk in ML development: when training or labeling pipelines contaminate evaluation data, benchmark scores become meaningless.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

MCP OAuth Confirms Identity But Cannot Authorize Individual Tool Calls

The 2026-07-28 MCP specification strengthens authentication through issuer validation, CIMD direction, and Mcp-Method/Mcp-Name headers, but these advances address only identity verification. Authentication (AuthN) confirms who is making a request, while tool-call authorization is a separate decision determining whether that principal may execute a specific tool in a given context. Risk levels vary significantly across operations — a read action carries far less risk than a financial transaction or a destructive database command. A recommended architecture routes requests through an MCP client, gateway, and Policy Decision Point (PDP) before reaching the MCP server, with deny-by-default rules and step-up checks applied to high-risk operations.

0
ProgrammingDEV Community ·

How JWT Tokens Carry Identity and Permissions Across Microservices

In microservice architectures, every request requires context about who is making it and what they are allowed to do, which is handled through JWT access tokens created at login. A User Profiles Service issues these tokens via two endpoints — one returning a full login response and another returning only a Bearer token for callers that already have user context. Before generating a token, the service verifies the user's password, resolves their relationships to projects, accounts, and organizations, and retrieves permissions from a dedicated permissions service. The resulting JWT payload contains not just a user ID but a full security context including project, account, organization, group, and per-service permission mappings. This graph-like linking model ensures that authorization decisions across services are based on verified, structured context rather than raw request headers.

0
ProgrammingDEV Community ·

Dev.to's Underused API Can Reconstruct Your Full Follower History in One Pull

A developer who has been publishing on Dev.to since April 2017 used the platform's largely overlooked public API to analyse nine years of their own writing and audience data. By querying the followers endpoint with the correct v1 accept header and a per_page value of 1000, they reduced a 227-request operation to just 19 calls. A key discovery was that each follower record includes a created_at timestamp, allowing the entire follower growth curve to be reconstructed retroactively from a single API pull rather than daily snapshots. However, the dataset only reflects current followers, meaning anyone who unfollowed is absent and the resulting curve rises monotonically, masking any real-world declines. The author notes that omitting the v1 accept header silently returns older v0 data with no error, a subtle gotcha that can cause documented fields to appear missing.

0
ProgrammingDEV Community ·

How to Build Production-Grade Mobile Apps With Failure-First Architecture

A technical guide published on DEV Community outlines a failure-first approach to designing production-grade mobile applications, arguing that real engineering complexity lies beneath seemingly simple user interactions. The guide emphasizes defining clear system boundaries and layer ownership — separating presentation, domain, and data concerns — rather than starting with a list of screens. It warns against representing UI state with unrelated booleans, which can produce impossible combinations, and instead recommends sealed state interfaces to model meaningful transitions explicitly. The principles discussed are framework-neutral but are said to apply well to Kotlin/Android, Swift/iOS, Flutter, and React Native. The article also addresses offline-first behavior, network failure handling, and recovery strategies as essential considerations for scalable mobile codebases.

Developer Finds AI Eval Was Circular After Rule Engine Labeled Its Own Test Data · ShortSingh