Most AI testing in 2026 still tests the wrong thing
When the category was new, Layer 1 was the state of the art: run adversarial prompts, score responses, ship a report. Most platforms still do that.
Article 9 of the EU AI Act requires continuous risk management including pre-deployment testing against foreseeable misuse. Article 15 requires demonstrable robustness. Article 72 requires post-market monitoring against new vulnerabilities.
A regulator wants to see what was tested, what attacks were used, and what new vulnerabilities the buyer tested between deployment and audit. A static library cannot answer the third.
Layer 1: input validators, 65 of them, running in milliseconds
Layer 1 is the direct adversarial check: does this LLM, on this prompt, behave the way policy says it should? Disseqt runs 65 validators across four families covering base model risks, RAG pipelines, agentic workflows, and Model Context Protocol surfaces.
Every validator is a small ML classifier tuned to one failure mode, running on CPU in milliseconds. The same infrastructure does pre-production testing and runtime enforcement, keeping the assurance record continuous.
The 65 are a library, not a checklist. The platform auto-surfaces the top five for the scenario, so the team shipping does not need to be an AI safety expert.
Skip Layer 1 and the Article 9 file has no foundation. But Layer 1 only tests normal prompts, not real jailbreaks.
Layer 2: advanced jailbreaking, 84 techniques, picked by an agent
Layer 2 asks whether the LLM holds up against the jailbreaks attackers use in the wild. Disseqt's library covers 84 known techniques across role-play, encoding, multi-turn, recursive, and adversarial-suffix attacks plus newer agentic patterns.
Running 84 manually is not serious. The Jailbreaking Agent reads the scenario (agent type, data touched, tools called, user population) and picks which to deploy. The user describes the agent in plain English. The platform picks the attacks.
Skip Layer 2 and the Article 15 robustness claim collapses on first contact with a red team. Layer 2 is still a snapshot. Yesterday's attacks are not in it.
Layer 3: a live vulnerability database, and the poetry jailbreak
The poetry jailbreak is the one I show in demos. Four generated poems, encoding a request the LLM has been trained to refuse, fired at the model as creative writing. The model parses them as poetry and complies. That technique was not on any testing library a year ago. It is on ours, because Layer 3 pulled it in the day it published.
Layer 3 is the live vulnerability database. New vulnerabilities from arXiv, researcher disclosures, provider advisories, and red team write-ups get pulled in continuously. A vulnerability dated the ninth of March is testable on the tenth.
The platform also catches reversal of alignment decisions under pressure, where the LLM refuses then capitulates after the user reframes the request as urgent. In every customer's test run within a day of publication.
Almost no competitor has this layer. Most ship a quarterly release and call it "updated." The regulator's real question, the one Article 72 is built around, is not "did you test your AI?" It is: "did you test it against the vulnerabilities that existed when you deployed?" Only a live database can answer that.
Bottom Line
AI testing in 2026 is three layers because the threat model is three layers. Layer 1 catches adversarial prompts. Layer 2 catches today's jailbreaks. Layer 3 catches the vulnerabilities that did not exist at ship but exist by audit.
Disseqt runs all three on one ML and CPU spine across Test & Detect, Protect & Enforce, and Prove & Comply.
Layer 1 alone is the floor. Plus Layer 2 is most of today's threat model. Without Layer 3, Article 72 has a gap that grows every week.
FAQs
What is Layer 3 in AI testing and why does it matter?
Layer 3 is a live vulnerability database that pulls in newly published LLM vulnerabilities continuously, so testing covers attacks discovered after the platform shipped. Article 72 requires post-market monitoring against emerging vulnerabilities, and a static library cannot evidence that.
How is advanced jailbreak testing different from input validation?
Input validators run ML classifiers against failure modes like bias, prompt injection, or PII leakage on normal prompts. Jailbreak testing runs known attack techniques like role-play overrides and recursive prompt chains designed to bypass safety training. Disseqt covers 65 validators and 84 techniques.
Why does Disseqt's testing platform run on CPU and ML rather than LLMs?
LLM-as-judge inherits the same cost, latency, and energy footprint as the model it tests, which breaks at agentic scale. ML classifiers on CPU run in milliseconds with around 98% less CO2 and 99% less water. That makes the infrastructure usable pre-deployment and at runtime.
What does the poetry jailbreak actually do?
It generates four poems that encode a request the LLM has been trained to refuse, and fires them at the model as creative writing prompts. The model parses them as poetry rather than as the underlying request, and complies. Layer 3 picked it up the day it was published.
