Subgroup evaluation is the practice of testing a model separately across demographic or contextual groups instead of relying on one overall score. A system may look accurate on average while performing poorly for specific languages, regions, user types, devices, or sensitive populations. By splitting results into groups, defenders can spot hidden error patterns, bias, and uneven reliability that aggregate metrics would miss.
In cyber security, this matters because attackers and users do not interact with models in a uniform way. A phishing detector, fraud scorer, moderation filter, or AI assistant may be strong for standard English prompts but weaker for slang, code-switching, or low-resource languages. That gap can create blind spots that attackers exploit and can also cause unfair blocking, missed threats, or unsafe guidance. Security teams use subgroup evaluation during model testing, red-teaming, and ongoing monitoring to compare false positives, false negatives, and refusal behavior across groups. It is a practical control for building safer, more trustworthy AI systems.