garak/report.py defines the Report class, which loads a .jsonl report file, extracts eval records and start_run setup metadata, computes per-probe scores, and exports AVID-format reports.[1]
Report.get_evaluations() raises ValueError("No evaluations to report 🤷") if the report file contains no records with entry_type == "eval".[1] When evaluations are present, Report.get_evaluations() computes a score column as 100 * passed / total_evaluated, setting it to 0 when total_evaluated is zero to avoid division by zero.[1]
Report.export() writes AVID-format reports to a file named by replacing .report with .avid in the original report path, writing one JSON object per line.[1] During export, only probe tags prefixed with "avid" are mapped to the AVID taxonomy — each such tag is split on : to extract the risk domain and SEP view; non-AVID tags are silently ignored.[1] Report.export() hard-codes the AVID lifecycle view to LifecycleEnum["L05"] for all exported reports.[1] AVID (AI Vulnerability Database) is an industry taxonomy for classifying AI/ML risks by domain and evaluation lifecycle phase, enabling standardized sharing and comparison of vulnerability findings. Garak maps probe tags to the AVID taxonomy so that scan results can be shared and compared in a standardized, interoperable format. AVID stands for AI Vulnerability Database.
Garak automatically generates an HTML report on completion of a scan, a feature introduced in v0.9.0.10.[2] Report aggregation gained a tier-biased security aggregate score in v0.14.0.[3] In v0.15.1, garak.analyze.qual_review gained JSON and file output modes.[4]
Sources