LLM application testing checklist
By AI Testing Vendors · updated 2026-11-09
Before release, an LLM application needs answer quality checks, retrieval checks if it uses documents, regression runs across prompt and model versions, adversarial tests, load tests and a monitoring plan.
The checklist
Each row maps a check to the directory service and counts the published entries that state that service and LLM applications on their AI page.
| Check | Directory service | Entries stating it for LLM applications |
|---|---|---|
| Hallucination and factuality checks, answer quality rubrics, LLM-as-judge with human review | LLM output evaluation | 34 |
| Retrieval quality, grounding, citation accuracy, chunking regressions | RAG pipeline validation | 14 |
| Golden sets, non-deterministic assertions, repeated runs, version diffs | Prompt and model regression testing | 14 |
| Jailbreaks, harmful output elicitation, OWASP Top 10 for LLM Applications, MITRE ATLAS | Red teaming and adversarial testing | 45 |
| Prompt injection, data exfiltration, agent and tool abuse, supply chain; OWASP LLM Top 10 | AI security penetration testing | 39 |
| Inference load, token throughput, time to first token, cost per request under load | Performance and latency testing | 12 |
| Intent coverage, multi-turn context, tone, handoff to humans, channel parity | Conversational flow testing | 9 |
| Post-release evaluation, drift detection, incident regression suites | Production monitoring and drift testing | 18 |
Answer quality
Score answers against a rubric for correctness, completeness and tone. Count each hallucination as a failure even when the answer reads well.
hallucination: Model output that is fluent but not supported by facts or sources.Retrieval
If the application retrieves documents, test retrieval and generation separately. A wrong passage retrieved and a right passage ignored are different defects.
Regression
Keep a fixed evaluation set and run it after every prompt, model or index change. Assertions must tolerate wording changes and still catch meaning changes.
Adversarial and security tests
Test jailbreaks, prompt injection through user input and through retrieved documents, and leakage of system prompts or private data.
Load and cost
Measure time to first token, throughput and cost per request at the expected peak.
After release
Sample production traffic, grade it with the same rubric, and add every incident to the regression set.