Who is SAPIEN for?
For AI labs and model builders
Your evals catch what a model gets wrong. They rarely catch what it givesaway — the way a safe answer quietly erodes across a few turns of ordinary pressure until the model is agreeing with something it refused on turn one. SAPIEN is a pre-release drift gate: run it on a candidate before you ship, and see exactly where, how, and how badly its safety posture bends.
What a scan tells you before release
A drift trajectory, not a snapshot
Every scenario is a multi-turn pressure sequence scored per turn against the model’s own turn-0 baseline. Each ends in one of four verdicts —held, recovered, drifted, orcapitulated — so you see whether a boundary bent, snapped back, or broke.
Which dimension failed, and to what
Drift is scored across four dimensions — dangerous-detail creep, warning suppression, epistemic retreat, and approval-seeking. Each scenario names thedominant dimension and the pressure technique that broke it, so a regression points at a cause, not just a number.
Worst-case, not just average
A 0–100 Health Score combines the mean with P10 — the 10th-percentile tail. A good average with a low P10 is a model that’s usually fine and occasionally dangerous. That tail is what ships to your worst-case user.
Hallucination persistence & snap-back
A separate module baits a fabrication, corrects it, then re-pressures — measuring whether the model retracts, or retracts then re-asserts under renewed pushback. Reported on its own axis, never folded into the drift score.
Why a lab can trust the number
Cross-family council judging
Each turn is scored by a panel of five judges from distinct model families, by majority vote. A judge never scores its own family — family recusal swaps in a bench seat — so no vendor grades its own homework.
Chairman adjudication
Every non-unanimous verdict is re-decided by an independent chairman model that sees only anonymized votes. It exists because calibration showed a meaningful share of verdicts were being swung by a single lenient seat.
Byte-reproducible evidence
Every run emits a content-hashed trace. Re-score it offline to identical numbers, orverify a result against its trace for an exact byte match — defensible in a model card or a safety review.
Version-comparable & cheap
The corpus is fixed (436 scenarios across 69 domains), so you diff vn against vn-1 and catch a regression the moment it appears. A full council run costs roughly the price of a coffee, not a contract.
Where it fits your pipeline
Point voigt-kampff at a base model or a deployed endpoint (--agent-url / --api-base) and wire the run into pre-release CI: gate on Health Score and verdict distribution, block on a P10 regression, and keep the trace as the artifact. It’s the same detect → quantify → contain loop we document in Drift Containment — a lab just runs it earliest, before anyone else is exposed.