methodology

A from_pretrained() call is a download, a parse, and an execution decision wrapped in one convenient API. A reviewable workflow: pin the revision, approve the whole snapshot, read scan results literally, make the first load disposable, and promote the exact object you tested.

Two RAG systems with the same headline injection rate can need opposite defenses. Why a single number isn't enough, and what to report instead.