The Auditable AI Ecosystem

From data anomalies to agent decisions: one research-to-product stack.

This ecosystem covers auditing AI across its full lifecycle: a research method, an over-privilege benchmark (FORTIS), an open-source tool, and a curated knowledge base, each built to cite and reinforce the others. It underpins Auditable AI, the company building the auditable layer for AI agents.

The auditable Stack

Three open artifacts form the agent action arm of the ecosystem: the GRADE method, the production-grade auditable tool, and the awesome-auditable-ai knowledge base. FORTIS appears below as the pre-deployment benchmark in the lifecycle view.

Auditing Across the Agent Lifecycle

Auditable Agents is the framework that organizes what agent auditability requires: five dimensions and three mechanism classes (detect, enforce, recover). The research below instantiates them at each point in an agent's life.

The Three Levels of Auditable AI Systems

One question runs through the lab, asked at three levels: did this depart from what was expected, and can anyone still tell? A departure can start at any level and can travel: an unfamiliar input can surface as a model failure, and a model failure can surface as an action nobody authorized. Neither step is guaranteed, and an action can go wrong with no model failure behind it. The list below runs the other way, from the consequence a person feels back toward where it may have started. Evidence has to survive the levels an incident touches, or the trail stops short of the origin.

1. Agent Action: Auditability and Control of Agent Systems
   Auditability frameworks, runtime control surfaces, and agent-specific failure modes (over-privilege, cross-user contamination). The current frontier is turning this research into deployable open-source infrastructure that audits agents from before deployment to after a run. See the PRE / LIVE / POST grid above.
2. Model Behavior: Trust and Robustness of Foundation Models
   Behavior under attack, hallucination of fact and reasoning, and adversarial robustness of retrieval. Failures on any of these surfaces can propagate downstream when the model's output is passed to an agent or a user-facing system. Work covers jailbreak detection for vision-language models, causal analysis of hallucination, query-agnostic attacks on RAG, and LLM-as-anomaly-detector benchmarks.
3. Input Distribution: Anomaly and Out-of-Distribution Detection
   At the input distribution level, the question is whether an input departed from the conditions represented during development and evaluation. That boundary is hard to estimate when labels or representative examples are sparse. This is the program's methodological and open-source base, built through the PyOD ecosystem. PyOD is the canonical open-source anomaly-detection library: 55M+ downloads, named by OpenAI, used in Amazon and European Space Agency anomaly-detection work, and listed by the U.S. DoD CDAO. It is now in its third major release. When an incident involves distribution shift, these methods supply the evidence for whether unfamiliar input conditions contributed to it; an action-only incident is established from evidence at the agent action level instead. Current research emphasis sits at model behavior and agent action.

Get Involved

The ecosystem is open: every artifact is public, citable, and built to be extended. If you are building on any part of this stack, the best starting points are the auditable tool page for the SDK, GRADE (arXiv:2606.22741) for the research method, and awesome-auditable-ai for a map of the broader literature.

For the company building on top of this stack, visit Auditable AI (auditable.run). All open-source work lives under github.com/yzhao062.