Golden, adversarial, and regression describe why a case was included in an evaluation set. They are overlapping purposes rather than mutually exclusive directories, and treating them as separate collections produces a filing system where an evidence argument should be.
A golden case supplies a reviewed reference answer or rubric. An adversarial case is a targeted attempt to reveal a specified weakness. A regression case confirms that a property which previously held, or a failure which was corrected, still behaves.
Why the overlap matters
An invoice case that once caused a duplicate payment illustrates the whole problem. After the fix, a reviewed reference requires exactly one payment action, so it is a golden case. It is retained specifically because that failure occurred, so it is a regression case. It is perturbed to challenge the duplicate-detection logic, so it is an adversarial case.
Three tags, one underlying case family. Three passing tags are not three independent successes, and a report counting them as such has inflated its evidence threefold from a single fact.
This is why membership is recorded by case identity and case family rather than by folder. Related variants of one underlying case need an explicit split rule, because putting a variant in the development set and its sibling in the held-out set defeats the separation.
What each purpose cannot do
Each has a characteristic limitation and they do not overlap.
A golden reference is fallible. Experts can be wrong, and reference material goes out of date. The maintenance response is to preserve provenance, recorded dissent, and versioned corrections, so that a disputed reference is visible as disputed rather than silently authoritative.
An adversarial challenge does not estimate frequency. Selected attacks reveal whether a weakness exists; they say nothing about how often the condition arises in ordinary workload. Refresh them when the assumptions or the failure mechanisms change.
A regression check is backward-looking by construction. Familiar cases miss new mechanisms and new populations, so a suite that only grows by adding fixed bugs converges on last year’s failures.
The perturbation rule needs approving
Behavioural testing distinguishes minimum-functionality tests, invariance tests under changes expected to preserve the output, and directional tests with an expected output relationship. The middle one carries the risk.
Whether a perturbation preserves the correct answer depends on the task. Changing a place name leaves a generic sentiment judgement unchanged and changes the correct answer to a geographic question. So a generated variant is a hypothesis about the task, and generating ten thousand of them multiplies the hypothesis rather than testing it.
Construction starts from a decision
An evaluation set is a versioned collection of cases, admissible inputs, and scoring instructions assembled to support a specified decision. The object being evaluated — a model response, a tool action, or a whole reviewed workflow — is chosen before the cases are.
Four aims get conflated and one collection need not serve all of them: estimating typical performance, detecting a particular failure, comparing versions, and checking a release requirement.
Documentation practice for datasets asks creators to state the population a sample comes from, whether representativeness was checked, what is missing, how it was processed, and how it is maintained — while being explicit that documentation does not solve dataset bias.
The coverage plan runs across task and consequence, and records which intersections were sampled and which are absent. A team with 200 accessible clean documents and 30 deliberately damaged scans, whose real workload includes handwritten attachments it could not obtain, can report results for two groups and a coverage gap for the third. It cannot call 230 cases representative because the total is large.
Labels, and the agreement they carry
Expertise is chosen against the judgement required. Domain knowledge, familiarity with the annotation tool, and authority to approve a real transaction are three different qualifications, and factual extraction, interpretation, and policy judgement can need different people.
An annotator must be able to mark insufficient evidence or an out-of-scope question rather than being forced into a fabricated answer. Original judgements are preserved before reconciliation, because the disagreements are the diagnostic: unclear instructions, incomplete inputs, differing interpretations, and legitimate policy uncertainty each need a different response.
Agreement is then reported on the independently recorded judgements, with the task, rubric version, raters, time window, paired-case denominator, label distributions, and missingness. Raw agreement and chance-corrected coefficients answer different questions. Take 100 binary cases where both raters say yes on 85, each says yes alone on 5, and both say no on 5: raw agreement is 0.90, and with each rater using yes 90 percent of the time the expected agreement is 0.82, giving a kappa near 0.44. Neither number says that 90 or 44 percent of labels are correct.
Reliability is not validity. Raters can agree and be wrong together, which is exactly what a shared misreading of the rubric produces.
The rule
What stays fixed is that a score is interpretable only against what was actually tested. What changes is the purpose the set was built for, and a set built to detect a failure cannot be re-used to estimate a rate.
Not to be confused with
A clean held-out set. A reserved label file does not resolve every form of overlap or contamination. Record exposure history — whether developers saw results or answers — and report it when test feedback drove changes.
A release gate. A gate for a specific prohibited action stays distinct from an average quality score. An average cannot fail a system on the one behaviour that must never occur.