Testing AI at the Edge: What Standard Evaluations Miss in Defense Systems

Gap 1: The tested model is not the fielded model

Most evaluations are run against a model in its full-precision form, as trained. Edge deployment almost always requires something different: a model fine-tuned for the mission, then quantized so it fits within the memory, power, and latency limits of the target hardware.

Each transformation can change how the model behaves under adversarial or unsafe inputs. In our research, a quantized model showed minimal change in aggregate safety scores while specific safety categories degraded sharply. We explain the mechanism in Why Quantization Can Quietly Break AI Safety.

The practical implication is simple: evaluation results only count for the artifact they were produced on. If the fielded build is a 4-bit quantized model, the safety evidence has to come from that build.

Gap 2: Mission fine-tuning shifts behavior

Fine-tuning a model for a specific operational context is how teams make it useful. It is also one of the most reliable ways to change a model's safety behavior, sometimes in ways that are invisible without targeted testing.

A model fine-tuned to be more decisive, more concise, or more compliant with operator instructions may also become more willing to act on out-of-scope or unauthorized requests. None of this is necessarily a problem, but it needs to be measured, stage by stage, against the same probes used on the base model.

Gap 3: Clean test inputs, messy operational inputs

Evaluation datasets tend to be clean, well-formed, and complete. Operational inputs frequently are not. Sensor data is noisy, communications are partial, and adversaries deliberately craft inputs to mislead.

A model that responds safely to a clean prompt may respond very differently to a degraded, ambiguous, or manipulated version of the same request. Robust evaluation for fielded systems should include:

• Fail-safe behavior: does the model decline out-of-scope, unauthorized, or unsafe actions instead of complying?
• Adversarial robustness: how does it respond to deceptive or hostile inputs designed to induce unsafe behavior?
• Behavioral consistency: does it keep giving safe responses when inputs are incomplete, noisy, or degraded?

Gap 4: Evaluation tools that assume a connection

Many AI evaluation tools run as hosted services. They expect the model, or the model's outputs, to be sent to an external platform for scoring. For defense programs, that is often a non-starter. Model weights may be sensitive, networks may be disconnected, and data may not leave the enclave.

If the evaluation tool cannot run where the model runs, the model either goes untested in its final form or gets tested in a surrogate environment that does not match reality. Neither produces the evidence a program actually needs.

What edge AI assurance should look like

Closing these gaps does not require a new philosophy of testing. It requires applying familiar test and evaluation principles to how AI models are actually built and deployed:

1. Test the exact artifact that will be fielded, including its quantization format and fine-tuned weights.
2. Test every lifecycle stage with identical probes, so changes between base, fine-tuned, and quantized versions are measurable.
3. Report results per category, so a stable average cannot hide a concentrated failure.
4. Run the evaluation inside the program's own environment, including air-gapped networks, so no weights or outputs leave.
5. Produce repeatable, auditable evidence that a test and evaluation team can review, re-run, and attach to program documentation.

A note on scope

There is an important distinction between testing whether a model behaves safely and developing ways to defeat operational systems. The first is assurance. It helps programs field AI that fails safe, stays within scope, and behaves predictably. At SichGate, our work sits entirely on the assurance side.

The takeaway

Defense AI will increasingly run at the edge, in compressed forms, in environments where it cannot be corrected after the fact. The standard for testing has to match that reality: evaluate the model you field, in the environment you field it, stage by stage.

Learn how SichGate supports defense and national security programs, including fully air-gapped deployment, on our defense page.