`batch` is capped at 100 samples -- the validated protocol limit.
    Returns AUROC drop, flip rate, and the clinical-plausibility rate of
    the generated adversarial samples. A 100% plausibility rate does not
    mean the attack failed: it means bounds clipping alone does not stop
    the attack, since perturbations are clipped to clinical bounds by
    construction.
    

    Moves each sample in `batch` toward an opposite-predicted-class
    sample drawn from the same batch, one step at a time, until the
    model's prediction flips or `max_steps` is exhausted. `batch` is
    capped at 100 samples -- the validated protocol limit.
    

    `member_pool` must be rows known to have been in the model's
    training set -- it trains the shadow models and supplies the
    known-member evaluation sample. `nonmember_pool` must be rows
    known NOT to have been in training (e.g. a held-out test split) --
    it supplies the known-non-member evaluation sample only. Each pool
    is capped at 5,000 samples; shadow-model training does not scale
    past this in the validated protocol.

    Returns the attack's accuracy/AUROC at distinguishing members from
    non-members, a privacy-risk tier, and a direct count of how many
    of the evaluated members would be identifiable -- not a
    population-scale extrapolation.
    

    Each entry in `control_set` needs `result` ("PASS"/"PARTIAL"/"FAIL")
    and may include `mitigation_implemented`/`tested` booleans. A
    PARTIAL counts as half-covered.
    

    This tool does not make live HTTP calls -- probe the system
    yourself and pass the results here. Each entry needs `expected`
    ("ALLOWED" or "DENIED") and the observed `status_code`.
    

    An entry is complete only if every required field is present and
    not null. `required_fields` defaults to the validated field set:
    timestamp, event, user_id, role, patient_id_hash, model_name,
    model_version, input_feature_hash, prediction, confidence.
    

    Each entry needs `id` (prefixed "HIPAA-..." or "FHIR-..." to
    determine which standard it belongs to), `status`
    ("PASS"/"PARTIAL"/"FAIL"/null), and `weight`.
    

    `auroc_drop` should be the WORST-CASE drop across all adversarial
    attack runs performed (max, not mean, across FGSM/boundary and
    any datasets evaluated) -- that's what the validated weighting
    was calibrated against. `compliance_score` is a fraction (0-1),
    e.g. `score_compliance`'s `overall_pct` divided by 100.

    Returns the composite SPS (0-100), a deployment recommendation
    tier, and each dimension's subscore/weight/contribution for a
    transparent breakdown.
    

    Pass the raw dict returned by any subset of run_fgsm,
    run_boundary_attack, run_membership_inference,
    assess_attack_coverage, check_rbac, score_audit_completeness,
    score_compliance, and compute_sps. Sections you didn't run are
    marked "not evaluated", never silently assumed to pass. A
    deployment recommendation only appears if `sps` (compute_sps's
    own output) is supplied -- it is never inferred from partial
    results.
    

    Every authz-gated tool call (run_fgsm, run_boundary_attack,
    run_membership_inference) is recorded here, whether it was
    authorized or denied.