57.1 Safety in Autonomous Research

1. What Goes Wrong Without Safety Gates

What happens when a discovery system with no concept of "dangerous" optimizes molecular properties without supervision? Each component of the closed-loop architecture from Chapter 53 (hypothesis generator, experiment designer, self-driving lab, result analyzer) can introduce hazards at every step. Without explicit safety gates, those hazards compound silently across the loop.

Hazards by Pipeline Component

The hypothesis generator may propose research directions that are scientifically valid but ethically problematic. A model trained to maximize novelty in chemical space has no intrinsic concept of toxicity, weaponizability, or environmental harm. Urbina et al. (2022) demonstrated this concretely: by inverting the toxicity objective in a generative model originally designed to avoid toxic compounds, they generated 40,000 molecules predicted to be more lethal than VX nerve agent, several of which were novel and not in any public database. The model required no special training data; the same architecture used for beneficial drug discovery produced chemical weapons candidates in under six hours.

The experiment designer may specify protocols that are physically dangerous. An autonomous system optimizing reaction yield might propose high-temperature, high-pressure conditions without accounting for runaway reactions, or specify reagent combinations that produce toxic gases as byproducts.

The self-driving lab may execute protocols without the contextual awareness that a human chemist brings. A robotic arm does not notice the smell of hydrogen sulfide. An automated pipetting system does not recognize that a solution has changed color in a way that indicates contamination.

The result analyzer may draw conclusions from artifacts, reporting a "discovery" that is actually an equipment malfunction, a contaminated sample, or a statistical fluctuation. Without human review, these false discoveries can propagate into the next cycle, compounding errors. In short: an autonomous loop without safety gates does not just risk one bad experiment; it feeds each failure back into itself, turning a single oversight into a compounding cascade.

2. A Taxonomy of Discovery Hazards

Without a shared vocabulary for what can go wrong, safety reviews devolve into ad hoc checklists that miss entire categories of harm; the Urbina experiment succeeded precisely because no existing taxonomy flagged "objective function inversion" as a hazard class worth screening for.

Managing risks systematically requires a structured vocabulary. The following taxonomy classifies hazards by their origin in the discovery pipeline, their mechanism of harm, and their scope of impact. We implement this as a Python enumeration that the governance layer (Section 57.4) uses for automated classification.

from enum import Enum, auto
from dataclasses import dataclass, field
from typing import Optional
import datetime


class HazardCategory(Enum):
    """Top-level hazard categories for autonomous discovery systems."""
    DUAL_USE = auto()         # Research with potential weaponization
    PHYSICAL_SAFETY = auto()  # Lab accidents, environmental release
    BIOSAFETY = auto()        # Pathogen creation, gain-of-function
    DATA_INTEGRITY = auto()   # Fabrication, falsification, bias
    PRIVACY = auto()          # Patient data, genetic information
    ENVIRONMENTAL = auto()    # Ecological harm, pollution
    SOCIAL = auto()           # Discrimination, misinformation


class SeverityLevel(Enum):
    """Severity scale aligned with NIST AI RMF
    (Risk Management Framework) categories."""
    NEGLIGIBLE = 1   # No measurable harm
    MINOR = 2        # Reversible harm, limited scope
    MODERATE = 3     # Significant harm, recoverable
    MAJOR = 4        # Severe harm, difficult to reverse
    CATASTROPHIC = 5 # Irreversible harm, wide scope


class LikelihoodLevel(Enum):
    """Likelihood scale for risk assessment."""
    RARE = 1         # < 1% chance per research cycle
    UNLIKELY = 2     # 1-10% chance per research cycle
    POSSIBLE = 3     # 10-50% chance per research cycle
    LIKELY = 4       # 50-90% chance per research cycle
    ALMOST_CERTAIN = 5  # > 90% chance per research cycle


@dataclass(frozen=True)
class Hazard:
    """A specific hazard identified in a research proposal.

    Frozen dataclass ensures immutability once created,
    supporting audit trail integrity.
    """
    hazard_id: str
    category: HazardCategory
    description: str
    severity: SeverityLevel
    likelihood: LikelihoodLevel
    affected_populations: tuple[str, ...]
    mitigation: str
    residual_risk_score: float  # after mitigation, 0.0 to 1.0

    @property
    def raw_risk_score(self) -> float:
        """Risk score before mitigation: severity * likelihood, normalized."""
        return (self.severity.value * self.likelihood.value) / 25.0

    @property
    def risk_level(self) -> str:
        """Categorical risk level derived from raw score."""
        score = self.raw_risk_score
        if score <= 0.12:
            return "LOW"
        elif score <= 0.36:
            return "MEDIUM"
        elif score <= 0.64:
            return "HIGH"
        else:
            return "CRITICAL"

The Hazard dataclass records what the hazard is, its severity and likelihood, affected populations, mitigation strategy, and residual risk. The frozen=True attribute (which makes instances immutable, so no field can be changed after creation) prevents silent modification after recording, a property the audit trail (Section 57.4) relies on.

Among all the hazard categories in this taxonomy, dual-use risk deserves special attention because it is the hardest to detect automatically and the most consequential when missed.

3. The Dual-Use Problem

Dual-use research is research that can be applied to both beneficial and harmful purposes. The concept is not new: nuclear physics enables both power plants and weapons; recombinant DNA enables both gene therapy and bioweapons. What is new is the speed at which AI systems can generate dual-use knowledge. A human chemist might spend years developing a novel toxic compound; a generative model can propose thousands per hour.

Dual-use screening evaluates whether a proposed research direction could be repurposed for harm. It matters because autonomous systems lack the ethical intuitions that lead a human scientist to pause before pursuing a dangerous line of inquiry. The system compares each research proposal against a library of risk indicators (keywords, structural motifs, objective function signatures) and assigns an aggregate risk score. That score determines whether the proposal proceeds automatically, requires human review, or is blocked outright. Use dual-use screening as the default gate for any autonomous pipeline that generates novel compounds, sequences, or protocols. Reserve manual expert review for domains where the indicator library has poor coverage, such as emerging biotechnologies with few historical precedents.

The following dual-use screening system checks research proposals against known risk indicators. The screening is not a substitute for human review; it is a filter that flags proposals for human attention before the autonomous system can act on them. Figure 57.1 below illustrates how these screening stages connect into a single safety pipeline, from initial proposal through final disposition.

from dataclasses import dataclass
from typing import Optional


@dataclass(frozen=True)
class DualUseIndicator:
    """A signal that research may have dual-use potential."""
    indicator_id: str
    name: str
    description: str
    risk_domains: tuple[str, ...]
    severity_weight: float  # 0.0 to 1.0


# Standard dual-use indicators for chemistry and biology
DUAL_USE_INDICATORS = [
    DualUseIndicator(
        indicator_id="DU-CHEM-001",
        name="Toxicity optimization",
        description="Objective function includes or correlates with "
                    "lethality, toxicity, or incapacitation metrics",
        risk_domains=("chemical_weapons", "assassination"),
        severity_weight=0.95,
    ),
    DualUseIndicator(
        indicator_id="DU-CHEM-002",
        name="Aerosolization potential",
        description="Target compound properties suggest potential "
                    "for aerosolized dispersal",
        risk_domains=("chemical_weapons", "bioweapons"),
        severity_weight=0.90,
    ),
    DualUseIndicator(
        indicator_id="DU-BIO-001",
        name="Gain-of-function modification",
        description="Proposed modifications could enhance pathogen "
                    "transmissibility, virulence, or immune evasion",
        risk_domains=("bioweapons", "pandemic_risk"),
        severity_weight=0.98,
    ),
    DualUseIndicator(
        indicator_id="DU-BIO-002",
        name="Select agent involvement",
        description="Research involves organisms or toxins on the "
                    "Federal Select Agent Program list",
        risk_domains=("bioweapons", "biosecurity"),
        severity_weight=0.85,
    ),
    DualUseIndicator(
        indicator_id="DU-CYBER-001",
        name="Vulnerability exploitation",
        description="Research identifies or exploits security "
                    "vulnerabilities in critical infrastructure",
        risk_domains=("cyberweapons", "critical_infrastructure"),
        severity_weight=0.80,
    ),
    DualUseIndicator(
        indicator_id="DU-INFO-001",
        name="Deception capability enhancement",
        description="System improves ability to generate convincing "
                    "misinformation or deepfakes",
        risk_domains=("information_warfare", "fraud"),
        severity_weight=0.70,
    ),
]


@dataclass
class DualUseScreenResult:
    """Result of screening a research proposal for dual-use risks."""
    proposal_id: str
    triggered_indicators: list[DualUseIndicator]
    aggregate_score: float  # 0.0 to 1.0
    requires_review: bool
    review_level: str  # "none", "standard", "elevated", "emergency"

    @property
    def summary(self) -> str:
        if not self.triggered_indicators:
            return "No dual-use indicators triggered."
        names = [ind.name for ind in self.triggered_indicators]
        return (f"{len(names)} indicator(s) triggered: "
                f"{', '.join(names)}. "
                f"Aggregate score: {self.aggregate_score:.2f}. "
                f"Review level: {self.review_level}.")


def screen_for_dual_use(
    proposal_id: str,
    proposal_keywords: set[str],
    proposal_objectives: list[str],
    indicators: list[DualUseIndicator] = None,
) -> DualUseScreenResult:
    """Screen a research proposal against dual-use indicators.

    This is a keyword-based pre-filter. Production systems would
    use embedding similarity and domain-specific classifiers.
    """
    if indicators is None:
        indicators = DUAL_USE_INDICATORS

    # Keyword-based matching (simplified; real systems use NLP)
    risk_keywords = {
        "DU-CHEM-001": {"toxic", "lethal", "ld50", "nerve", "poison",
                        "incapacitant", "lethality"},
        "DU-CHEM-002": {"aerosol", "dispersal", "volatility",
                        "inhalation", "particle_size"},
        "DU-BIO-001": {"gain-of-function", "transmissibility",
                       "virulence", "immune_evasion", "pathogenicity"},
        "DU-BIO-002": {"anthrax", "botulinum", "ebola", "smallpox",
                       "ricin", "select_agent"},
        "DU-CYBER-001": {"exploit", "zero-day", "vulnerability",
                         "buffer_overflow", "privilege_escalation"},
        "DU-INFO-001": {"deepfake", "synthetic_media",
                        "misinformation", "impersonation"},
    }

    triggered = []
    for indicator in indicators:
        keywords = risk_keywords.get(indicator.indicator_id, set())
        overlap = proposal_keywords & keywords
        if overlap:
            triggered.append(indicator)

    # Aggregate score: max of triggered severity weights
    if triggered:
        aggregate = max(ind.severity_weight for ind in triggered)
    else:
        aggregate = 0.0

    # Determine review level
    if aggregate >= 0.90:
        review_level = "emergency"
    elif aggregate >= 0.70:
        review_level = "elevated"
    elif aggregate > 0.0:
        review_level = "standard"
    else:
        review_level = "none"

    return DualUseScreenResult(
        proposal_id=proposal_id,
        triggered_indicators=triggered,
        aggregate_score=aggregate,
        requires_review=aggregate > 0.0,
        review_level=review_level,
    )

Two test proposals illustrate the screener's behavior: one benign and one that should trigger alerts.

# Benign proposal: optimizing solar cell efficiency
benign_result = screen_for_dual_use(
    proposal_id="PROP-2026-001",
    proposal_keywords={"photovoltaic", "bandgap", "efficiency",
                       "perovskite", "stability"},
    proposal_objectives=["Maximize power conversion efficiency",
                         "Minimize degradation rate"],
)
print(f"Benign proposal: {benign_result.summary}")

# Concerning proposal: optimizing compound with toxicity terms
concerning_result = screen_for_dual_use(
    proposal_id="PROP-2026-002",
    proposal_keywords={"binding_affinity", "selectivity", "toxic",
                       "ld50", "aerosol", "dispersal"},
    proposal_objectives=["Maximize target binding",
                         "Optimize delivery mechanism"],
)
print(f"Concerning proposal: {concerning_result.summary}")

Benign proposal: No dual-use indicators triggered.
Concerning proposal: 2 indicator(s) triggered: Toxicity optimization, Aerosolization potential. Aggregate score: 0.95. Review level: emergency.

4. Building a Risk Register

A risk register is a structured inventory of all identified hazards for a research project, with quantified likelihood, severity, mitigation plans, and residual risk scores (the probability that a hazard still materializes even after mitigations are in place). It serves as the single source of truth that governance workflows (Section 57.3) reference when making approval decisions. The register's disposition logic implements the pipeline shown in Figure 57.1, translating quantified hazards into one of three outcomes: PROCEED, REVIEW_REQUIRED, or BLOCKED.

from dataclasses import dataclass, field
import datetime


@dataclass
class RiskRegister:
    """A structured collection of hazards for a research project.

    The register computes aggregate risk metrics and determines
    whether the project can proceed, needs review, or is blocked.
    """
    project_id: str
    created_at: datetime.datetime = field(
        default_factory=datetime.datetime.now
    )
    hazards: list[Hazard] = field(default_factory=list)

    def add_hazard(self, hazard: Hazard) -> None:
        """Add a hazard to the register."""
        self.hazards.append(hazard)

    @property
    def max_severity(self) -> SeverityLevel:
        """Highest severity among all registered hazards."""
        if not self.hazards:
            return SeverityLevel.NEGLIGIBLE
        return max(self.hazards, key=lambda h: h.severity.value).severity

    @property
    def max_raw_risk(self) -> float:
        """Highest raw risk score among all hazards."""
        if not self.hazards:
            return 0.0
        return max(h.raw_risk_score for h in self.hazards)

    @property
    def aggregate_residual_risk(self) -> float:
        """Combined residual risk: 1 - product of (1 - residual_i).

        This models the probability that at least one hazard
        materializes after mitigation: each (1 - residual_i)
        is the chance hazard i does NOT occur, so their product
        is the chance nothing goes wrong, and subtracting from 1
        gives the chance that at least one hazard strikes.
        """
        if not self.hazards:
            return 0.0
        product = 1.0
        for h in self.hazards:
            product *= (1.0 - h.residual_risk_score)
        return 1.0 - product

    def disposition(self) -> str:
        """Determine project disposition based on risk profile.

        Returns one of: PROCEED, REVIEW_REQUIRED, BLOCKED.
        """
        if self.max_severity == SeverityLevel.CATASTROPHIC:
            return "BLOCKED"
        if self.max_raw_risk > 0.64:
            return "BLOCKED"
        if self.aggregate_residual_risk > 0.3:
            return "REVIEW_REQUIRED"
        if any(h.category == HazardCategory.DUAL_USE for h in self.hazards):
            return "REVIEW_REQUIRED"
        if self.max_raw_risk > 0.12:
            return "REVIEW_REQUIRED"
        return "PROCEED"

    def summary(self) -> str:
        """Human-readable risk summary."""
        lines = [
            f"Risk Register for {self.project_id}",
            f"  Hazards: {len(self.hazards)}",
            f"  Max severity: {self.max_severity.name}",
            f"  Max raw risk: {self.max_raw_risk:.2f}",
            f"  Aggregate residual risk: "
            f"{self.aggregate_residual_risk:.2f}",
            f"  Disposition: {self.disposition()}",
        ]
        return "\n".join(lines)


# Build a risk register for a drug discovery project
register = RiskRegister(project_id="PROJ-2026-DrugOpt")

register.add_hazard(Hazard(
    hazard_id="HAZ-001",
    category=HazardCategory.DUAL_USE,
    description="Generative model may produce compounds with "
                "weaponizable toxicity profiles",
    severity=SeverityLevel.CATASTROPHIC,
    likelihood=LikelihoodLevel.UNLIKELY,
    affected_populations=("general_public", "lab_personnel"),
    mitigation="Toxicity filter on all generated candidates; "
               "human review of top-100 compounds before synthesis",
    residual_risk_score=0.05,
))

register.add_hazard(Hazard(
    hazard_id="HAZ-002",
    category=HazardCategory.PHYSICAL_SAFETY,
    description="Automated synthesis may produce exothermic "
                "reactions exceeding reactor thermal limits",
    severity=SeverityLevel.MAJOR,
    likelihood=LikelihoodLevel.POSSIBLE,
    affected_populations=("lab_personnel",),
    mitigation="Temperature monitoring with automatic shutdown "
               "at 80% of thermal limit; blast shield",
    residual_risk_score=0.08,
))

register.add_hazard(Hazard(
    hazard_id="HAZ-003",
    category=HazardCategory.DATA_INTEGRITY,
    description="Model may overfit to noisy assay data and "
                "report false structure-activity relationships",
    severity=SeverityLevel.MODERATE,
    likelihood=LikelihoodLevel.LIKELY,
    affected_populations=("research_community",),
    mitigation="Independent replication of top findings; "
               "statistical significance thresholds",
    residual_risk_score=0.15,
))

print(register.summary())

Risk Register for PROJ-2026-DrugOpt
  Hazards: 3
  Max severity: CATASTROPHIC
  Max raw risk: 0.48
  Aggregate residual risk: 0.25
  Disposition: BLOCKED

The risk register tells us whether a project should proceed at all, but when multiple projects clear the safety gate, we still need a principled way to rank them by weighing potential benefit against residual danger.

5. Risk-Adjusted Expected Value

Discovery systems optimize expected value: the probability of a successful discovery multiplied by its scientific or commercial value. Safety-aware systems must adjust this calculation to account for the expected cost of hazards that materialize. We define risk-adjusted expected value (RAEV) as:

where \(P(\text{success})\) is the probability of achieving the discovery objective, \(V(\text{success})\) is the value of that discovery, \(P(h_i)\) is the probability of hazard \(h_i\) materializing (after mitigation), and \(C(h_i)\) is the cost of that hazard. A project with positive expected benefit but a single catastrophic hazard may have negative RAEV, and the autonomous system should deprioritize it in favor of safer alternatives.

@dataclass
class ResearchProposal:
    """A research proposal with estimated value and associated risks."""
    proposal_id: str
    title: str
    success_probability: float   # P(success), 0.0 to 1.0
    success_value: float         # V(success), arbitrary units
    risk_register: RiskRegister

    @property
    def expected_benefit(self) -> float:
        return self.success_probability * self.success_value

    @property
    def expected_harm(self) -> float:
        """Sum of P(hazard_i) * C(hazard_i) across all hazards.

        We use residual_risk_score as P(hazard_i) and map
        severity to cost using an exponential scale:
        cost = 10^severity_level.
        """
        total = 0.0
        for hazard in self.risk_register.hazards:
            cost = 10 ** hazard.severity.value
            total += hazard.residual_risk_score * cost
            return total
        return total

    @property
    def raev(self) -> float:
        """Risk-adjusted expected value."""
        return self.expected_benefit - self.expected_harm

    def raev_summary(self) -> str:
        return (
            f"Proposal: {self.title}\n"
            f"  Expected benefit: {self.expected_benefit:,.0f}\n"
            f"  Expected harm:    {self.expected_harm:,.0f}\n"
            f"  RAEV:             {self.raev:,.0f}\n"
            f"  Disposition:      "
            f"{'FAVORABLE' if self.raev > 0 else 'UNFAVORABLE'}"
        )


# Compare two proposals
safe_proposal = ResearchProposal(
    proposal_id="PROP-A",
    title="Optimize perovskite solar cell stability",
    success_probability=0.4,
    success_value=500_000,
    risk_register=RiskRegister(
        project_id="PROJ-A",
        hazards=[
            Hazard(
                hazard_id="HAZ-A1",
                category=HazardCategory.ENVIRONMENTAL,
                description="Lead leaching from perovskite cells",
                severity=SeverityLevel.MODERATE,
                likelihood=LikelihoodLevel.POSSIBLE,
                affected_populations=("environment",),
                mitigation="Encapsulation and lead-free alternatives",
                residual_risk_score=0.10,
            ),
        ],
    ),
)

risky_proposal = ResearchProposal(
    proposal_id="PROP-B",
    title="Design novel organophosphate inhibitors",
    success_probability=0.6,
    success_value=2_000_000,
    risk_register=RiskRegister(
        project_id="PROJ-B",
        hazards=[
            Hazard(
                hazard_id="HAZ-B1",
                category=HazardCategory.DUAL_USE,
                description="Compounds may have nerve agent properties",
                severity=SeverityLevel.CATASTROPHIC,
                likelihood=LikelihoodLevel.UNLIKELY,
                affected_populations=("general_public",),
                mitigation="Toxicity pre-screen and human review",
                residual_risk_score=0.05,
            ),
        ],
    ),
)

print(safe_proposal.raev_summary())
print()
print(risky_proposal.raev_summary())

Proposal: Optimize perovskite solar cell stability
  Expected benefit: 200,000
  Expected harm:    100
  RAEV:             199,900
  Disposition:      FAVORABLE

Proposal: Design novel organophosphate inhibitors
  Expected benefit: 1,200,000
  Expected harm:    5,000
  RAEV:             1,195,000
  Disposition:      FAVORABLE

Quantitative risk scoring, however, is only as reliable as the hazards it accounts for, and discovering which hazards a system actually faces requires deliberately trying to break it.

6. Red-Team Templates for Discovery Systems

A red-team exercise systematically probes a discovery system for failure modes by adopting an adversarial mindset. In this context, "red team" borrows from military terminology: a designated group whose role is to attack the system under test, exposing weaknesses before real adversaries do. The following structured template helps teams organize red-team assessments of their autonomous discovery pipelines.

from dataclasses import dataclass, field


@dataclass
class RedTeamScenario:
    """A structured adversarial scenario for testing discovery systems."""
    scenario_id: str
    attack_vector: str       # How the system is misused or fails
    attacker_capability: str # What the attacker knows or can do
    target_component: str    # Which pipeline component is targeted
    expected_outcome: str    # What happens if the attack succeeds
    detection_method: str    # How we would detect this failure
    mitigation: str          # How we prevent or respond to it
    tested: bool = False
    test_result: Optional[str] = None


# Standard red-team scenarios for autonomous chemistry
RED_TEAM_SCENARIOS = [
    RedTeamScenario(
        scenario_id="RT-001",
        attack_vector="Objective function inversion",
        attacker_capability="Access to model training configuration",
        target_component="Hypothesis generator",
        expected_outcome="Model generates toxic compounds instead "
                         "of therapeutic ones",
        detection_method="Toxicity pre-screen on all generated "
                         "candidates; anomaly detection on "
                         "objective function parameters",
        mitigation="Hardcoded toxicity filter that cannot be "
                   "disabled without physical key; objective "
                   "function parameters logged and audited",
    ),
    RedTeamScenario(
        scenario_id="RT-002",
        attack_vector="Training data poisoning",
        attacker_capability="Write access to training database",
        target_component="Result analyzer / model updater",
        expected_outcome="Model learns incorrect structure-activity "
                         "relationships, leading to systematic "
                         "errors in compound selection",
        detection_method="Statistical monitoring of model predictions "
                         "vs. experimental outcomes; data provenance "
                         "tracking",
        mitigation="Cryptographic signing of training data at "
                   "point of collection; anomaly detection on "
                   "incoming data distributions",
    ),
    RedTeamScenario(
        scenario_id="RT-003",
        attack_vector="Protocol specification tampering",
        attacker_capability="Access to experiment design module",
        target_component="Experiment designer",
        expected_outcome="Dangerous reaction conditions specified "
                         "(extreme temperature, incompatible reagents)",
        detection_method="Safety constraint checker validates all "
                         "protocols against known hazardous "
                         "combinations before execution",
        mitigation="Protocol validation against safety database; "
                   "hardware interlocks on reaction parameters",
    ),
]


def run_red_team_assessment(
    scenarios: list[RedTeamScenario],
) -> dict[str, int]:
    """Summarize red-team assessment status."""
    total = len(scenarios)
    tested = sum(1 for s in scenarios if s.tested)
    passed = sum(1 for s in scenarios
                 if s.tested and s.test_result == "PASSED")
    failed = sum(1 for s in scenarios
                 if s.tested and s.test_result == "FAILED")
    untested = total - tested

    summary = {
        "total_scenarios": total,
        "tested": tested,
        "passed": passed,
        "failed": failed,
        "untested": untested,
        "coverage_pct": round(100 * tested / total, 1) if total else 0,
    }

    print("Red Team Assessment Summary")
    print(f"  Total scenarios:  {total}")
    print(f"  Tested:           {tested}")
    print(f"  Passed:           {passed}")
    print(f"  Failed:           {failed}")
    print(f"  Untested:         {untested}")
    print(f"  Coverage:         {summary['coverage_pct']}%")
    return summary


run_red_team_assessment(RED_TEAM_SCENARIOS)

Red Team Assessment Summary
  Total scenarios:  3
  Tested:           0
  Passed:           0
  Failed:           0
  Untested:         3
  Coverage:         0.0%

# Counterfit: automated AI red-teaming
# pip install counterfit
from counterfit.core import CFTarget, CFAttack

# Define the target model
target = CFTarget(
    name="drug_generator",
    model_endpoint="http://localhost:8080/generate",
    input_type="tabular",
    output_type="classification",
)

# Run an evasion attack to test input filtering
attack = CFAttack(
    target=target,
    attack_name="hop_skip_jump",  # black-box evasion
    parameters={"max_iterations": 100},
)
results = attack.run()
print(f"Attack success rate: {results.success_rate:.1%}")