Prepare and test your skills
Prepare and test your skills
Automated and model-based quality evaluation pipelines turn one-time checks of generative output into a repeatable system for production. The Gen AI evaluation service (opens in a new tab) sits at the center, where evaluation datasets flow from storage into the service, a model-based auto-rater scores each output, and scored metrics flow onward to monitoring, alerting, and retraining. This design supports reference-based checks that compare output to a golden answer with metrics such as ROUGE, BLEU, semantic similarity, and answer recall, and reference-free checks that judge context relevance, groundedness, quality, and safety without a reference.
The Gen AI evaluation service is the managed service for continuously monitoring generative model output in production. Production responses flow from the serving endpoint into scheduled evaluation jobs, and the service computes automatic metrics for response quality, safety, instruction adherence, grounding, writing style, and verbosity. Those metric streams flow into Cloud Logging and Cloud Monitoring, where thresholds and alerts trigger rollback or retraining when quality shifts or harmful content emerges. Use this service when outputs are variable and subjective and cannot be judged by traditional accuracy alone.
Automatic metrics cover distinct failure modes that must be tracked together:
A standardized evaluation pipeline is the reproducible workflow that moves a model from prototype to reliable production. The pipeline standardizes indicators, datasets, and execution so iterations can be compared, bias can be detected, and results can be audited for regulatory needs. Data flows from BigQuery or Cloud Storage into the evaluation service, scores flow into Agent Platform ML Metadata for lineage, and drift signals flow into Agent Platform Pipelines for retraining.
The pipeline is built in an ordered sequence:
Computation-based metrics and qualitative indicators divide evaluation work by whether quality can be calculated by formula. Computation-based metrics are calculated with numeric formulas applied to predictions versus labels, while qualitative indicators such as fluency or entertainment value cannot be objectively computed and require a judge. Training loss can differ from the evaluation metric that matters to the business, so a fraud model may train with cross-entropy loss but be evaluated on recall for coverage of fraud.
| Evaluation type | How it is scored | Example use |
|---|---|---|
| Computation-based metrics | Numeric formula applied in the evaluation service | Recall, precision, area under the precision-recall curve (AuPRC), ROUGE, BLEU |
| Qualitative indicators | LLM-as-a-judge auto-rater or human labeling | Fluency or entertainment value of generated content |
Choose computation-based metrics when a correct answer or label exists, and choose LLM-as-a-judge when quality depends on human perception of text.
Evaluation datasets and auto-rater methods determine whether automated scores stay trustworthy in production. The evaluation dataset must reflect the probability distribution of production traffic, or the pipeline will optimize for cases users rarely see. The evaluation service reads evaluation data from BigQuery for SQL-driven inference tasks like natural language processing and machine translation, and from Cloud Storage for cost-efficient storage of large evaluation datasets.
For batch prediction workloads, standard evaluation jobs run on batch inferences in the evaluation service, while resource consumption is tracked separately in Metrics Explorer.
Grounding checks verify that retrieval-augmented generation (RAG) output stays factual to its retrieved sources. During source verification testing, the grounding metric computed by the Gen AI evaluation service checks factuality of the response against the source text provided with the test case. At serving time, enabling grounding for the model output provides a second layer of source verification at the user level, so tested factuality flows forward into user-visible attribution.
Exam tip: The grounding metric checks factuality against provided source text during evaluation, while enabling grounding adds verification for live model output.
Development-time evaluation is the pre-deployment testing stage that defines the production monitoring strategy. Agent Platform rapid evaluation automatically runs evaluations based on the provided dataset and prompts, and teams can add custom metrics specific to the use case plus human-in-the-loop workflows. Robustness work flows from test orchestration into findings, using adversarial testing for vulnerabilities and failure modes, subgroup analysis and counterfactual generation for bias, and fairness measures evaluated across data slices.
Insights from development flow into production as monitoring thresholds, and production signals flow back into development as retraining. Model versions are compared against defined metrics and datasets as a pipeline component, evaluation results are logged to ML Metadata for lineage and tracking, and Model Monitoring alerts flow into Pipelines to automatically retrain models and improve them continuously.
Production monitoring and observability for generative AI workloads is the continuous collection of serving telemetry, generation quality signals, and infrastructure health to keep large language model (LLM) applications reliable, safe, and fast. Cloud Monitoring (opens in a new tab) provides operational metrics and dashboards, Model Monitoring on Vertex AI (Agent Platform) detects data drift and prediction shifts, and the Gen AI evaluation service scores output quality and safety in production. Together these systems detect distribution shift, quality degradation, and capacity risk, then trigger alerts and automated remediation such as rollback, fallback, or prompt refinement.
Reliability goals for generative AI translate business key performance indicators (KPIs) into measurable service-level objectives (SLOs) from the user's perspective. A KPI such as satisfaction with a conversational assistant maps to technical metrics such as request success rate, response latency, time to first token (TTFT) and token streaming behavior, rate of irrelevant or harmful responses, and agent task-completion rate. For training, complementary reliability metrics include model FLOPS utilization (MFU), iterations per second, tokens per second, and tokens per device. Defining SLOs makes reliability an engineering property that monitoring can enforce.
Production SLOs for generative AI workloads typically combine availability, latency, and safety:
When an SLO is breached, the breach routes to a specific response such as scaling, rollback, or prompt revision, so monitoring stays focused on behavior that affects users and the business.
Serving telemetry for generative AI tracks how the endpoint behaves under live traffic across throughput, latency, errors, and capacity. Cloud Monitoring collects, stores, and visualizes infrastructure and application metrics, including request rate, error rate, latency, resource utilization, and quota usage for Vertex AI endpoints. The model observability dashboard shows model queries per second (QPS), token throughput, first-token latency, throughput, latency, and error rates across Google Cloud models, while Metrics Explorer exposes built-in Gemini metrics such as TTFT for provisioned-throughput models. Token consumption is tracked as input-output token counts and token throughput, which directly links cost, quota burn, and user-perceived speed.
Monitoring follows the four golden signals for AI applications, with each signal revealing a different failure mode:
The serving stack that feeds these signals spans managed and self-managed layers. Cloud Monitoring ingests metrics that Vertex AI exports for custom training, endpoints, and performance, plus metrics from serving frameworks such as vLLM and NVIDIA Triton Inference Server via Google Cloud Managed Service for Prometheus (GMP). Infrastructure health covers Compute Engine instances, Google Kubernetes Engine (GKE) clusters and nodes, Cloud Run instances, TPUs, and GPUs, with accelerator detail such as per-process GPU utilization, memory, and temperature from NVIDIA Data Center GPU Manager (DCGM). Cloud Trace maps request flow and pinpoints latency across distributed inference pipelines and multi-component agent interactions, while Cloud Profiler identifies CPU and memory bottlenecks inside application code. Quota risk is managed by analyzing historical utilization in Cloud Monitoring, load testing for bottlenecks, monitoring quota metrics with alerts as usage approaches limits, and proactively requesting increases with forecasting data.
Exam tip: Use Cloud Monitoring and the model observability dashboard for operational telemetry such as QPS, TTFT, latency, and error rate, and use Model Monitoring plus the Gen AI evaluation service for drift and output-quality signals such as grounding, safety, and instruction adherence.
Drift detection for generative AI separates changes in what the model receives from changes in what the model produces. Model Monitoring on Vertex AI compares live serving distributions against a baseline such as the training set or past production traffic, using a golden dataset that represents the ideal data distribution and a TensorFlow Data Validation (TFDV) schema to detect training-serving skew automatically. When the serving distribution shifts, predictive performance, relevance, and safety can degrade even if endpoint latency and error rates look normal. Model Monitoring v2 supports managed Vertex AI endpoints and self-hosted services such as GKE, and it can track parameters at the model level rather than only at the endpoint level for granular diagnosis.
| Monitoring objective | What is compared | What it signals |
|---|---|---|
| Input feature drift | Live input distribution versus golden dataset or training baseline | Prompt, user, or retrieval-context shift and training-serving skew |
| Output drift | Live output distribution versus baseline | Behavior change, style shift, or emerging low-quality patterns |
| Feature attribution drift | Production feature attributions versus baseline attributions | Change in which features drive predictions |
Generation quality is scored continuously because LLM outputs are variable and subjective. The Gen AI evaluation service runs automatic metrics for response quality, safety, instruction adherence, grounding, writing style, verbosity, and toxicity, and its grounding metric checks factuality against provided source text. Human-in-the-loop evaluation assesses quality, relevance, safety, and guideline adherence for cases numeric formulas cannot judge, while Model Armor screens outputs for unsafe, biased, off-topic, or malicious content. Custom dashboards and log-based metrics from Cloud Logging capture application-level error patterns, spikes in low-confidence predictions, and non-compliant outputs that generic endpoint metrics miss.
Data and retrieval observability for generative AI covers the full path from ingestion to grounded response. Dataflow telemetry tracks data ingestion rates, processed volumes, and transformation latencies, while Vertex AI Pipelines telemetry tracks job success and failure rates for MLOps and retraining workflows. Continuous data-quality checks are governed through Knowledge Catalog dimensions such as accuracy validated against ground truth or outlier rates, freshness measured by data age and update frequency against SLAs, completeness measured by null-value percentages and required field-fill rates, and validity and consistency measured by schema adherence and duplication. Clear data lineage preserves traceability when an anomaly must be traced back to its source.
RAG and token behavior need dedicated signals because retrieval failure looks like model failure to the user. RAG observability examines retrieved-context relevance, response groundedness and attribution to source, and vector-database query throughput, so a drop in grounding can be traced to retrieval rather than generation. Key model observability metrics include input-output token counts, token throughput, hallucination or query-resolution failure rates, toxicity scores, and user-feedback ratings. Together these metrics show whether cost and latency growth comes from longer prompts, longer completions, noisier retrieval, or degraded generation.
Alerting and remediation for generative AI connect detection to action through logs, metrics, notifications, and versioned recovery. Cloud Logging collects, stores, and analyzes logs from all AI system components, and log-based metrics turn specific error strings or quality flags into alertable Monitoring signals. Cloud Monitoring creates custom dashboards, defines custom metrics, and configures threshold alerts that integrate with incident tools such as PagerDuty or Slack, while Error Reporting groups errors and Cloud Trace and Cloud Profiler preserve latency and code context for diagnosis. Notification channels are defined through Pub/Sub integrations for Slack, email, or SMS and are customized by alert severity and owning team.
A production alert then drives a closed remediation loop in which each stage depends on the prior stage:
This loop is what makes observability operational: token, latency, quota, and error telemetry reveals that a problem exists, drift and quality evaluation reveals what changed, and lineage plus pipelines make recovery repeatable.
Safety, adversarial, and alignment testing is the practice of systematically probing a generative AI application for harmful, manipulated, or ungrounded outputs and then blocking or measuring those failures in production. In Google Cloud, this work is split across three layers: responsible AI filters screen responses in the serving path, a quality evaluation subsystem scores factual accuracy and relevance offline, and prompt injection detection guards agentic computer use against untrusted screen content.
Responsible AI filters are the inline safety control that screens model responses before they reach the user. In the serving flow, the application first generates a response, then loads the response to BigQuery for offline analytics, then passes the response through the responsible AI filters, and only then sends the screened response to users through the frontend. This order creates two safety boundaries: the filter sits between the model and the user to block harmful output in real time, while BigQuery sits beside the serving path to retain prompts and responses for later review of hallucinations, leakage, and policy violations. Use systematic red teaming to probe this path for prompt injection, jailbreaking, data leakage, and hallucination risks, and configure Vertex AI safety thresholds to enforce regulatory compliance.
The quality evaluation subsystem is the offline system that measures whether serving responses remain accurate and relevant over time. The subsystem depends on Pub/Sub, Cloud Run functions, AlloyDB for PostgreSQL (opens in a new tab), and BigQuery, with evaluation prompts flowing from storage to scoring to analysis. Factual accuracy scoring directly targets hallucination risk, while relevance scoring targets alignment between the user prompt, retrieved grounding data, and the final answer.
When the subsystem receives a request, it executes an ordered workflow:
Prompt injection detection is the adversarial control for agents that use the computer use tool to act on browsers or mobile screens. The computer use agent receives screenshots as input, and an attacker can embed malicious instructions in that screen content to redirect the agent from the user's goal. When enabled, the enable_prompt_injection_detection setting checks if an included screenshot has the potential to introduce a prompt injection attack.
The control is disabled by default and must be explicitly enabled in the computer use configuration. In the REST API, the request sends tools with computer_use containing environment set to ENVIRONMENT_BROWSER and enable_prompt_injection_detection set to true when calling models such as gemini-3.5-flash on aiplatform.googleapis.com. In Python with python-genai version 2.7.0 or later, the same control is set with Tool(computer_use=ComputerUse(environment=Environment.ENVIRONMENT_MOBILE, enable_prompt_injection_detection=True)) in the GenerateContentConfig for models such as gemini-3.6-flash.
Exam tip: Prompt injection detection for computer use defaults to false, so screenshots are not checked for injection unless you explicitly set enable_prompt_injection_detection to true.
Adversarial risk categories for computer use describe how an agent that acts on untrusted content can fail. Red teaming must probe these risks because the model acts on screens rather than only generating text, so a misread button or a scam banner can cause real actions and data exposure.
Mitigation requires layered safety measures around the agent, combining injection detection on input screenshots with responsible AI filtering on outputs and BigQuery logging for post-incident review.
Monitoring, testing, and evaluating generative AI solutions connects quality scoring, operational telemetry, and adversarial controls into one feedback system. Evaluation pipelines define what good output means and score it with auto-raters, production observability shows when live behavior drifts from that definition, and safety testing ensures the drift that matters most — harmful, manipulated, or ungrounded output — is blocked and fed back into retraining and prompt refinement.
enable_prompt_injection_detection set to true to check screenshots for injection attacks.Computation-based metrics are calculated with numeric formulas applied to predictions versus labels, such as recall, precision, area under the precision-recall curve, ROUGE, and BLEU. Qualitative indicators such as fluency or entertainment value cannot be objectively computed and require an LLM-as-a-judge auto-rater or human labeling. Choose computation-based metrics when a correct answer or label exists, and choose LLM-as-a-judge when quality depends on human perception of text.
Use Cloud Monitoring and the model observability dashboard for operational telemetry such as queries per second, time to first token, latency, and error rate. Use Model Monitoring on Vertex AI plus the Gen AI evaluation service for drift and output-quality signals such as grounding, safety, and instruction adherence.
Prompt injection detection for agents that use computers is disabled by default and must be explicitly enabled by setting enable prompt injection detection to true. When enabled, it checks if an included screenshot has the potential to introduce a prompt injection attack from untrusted screen content.
Last updated