Developers can now run AI safety benchmarks far more cheaply and spot when a model is gaming its score, thanks to a study that applies human psychological testing methods to machine evaluations. Researchers, including some from the UK AI Security Institute, examined eight popular safety benchmarks for language models and found that a single safety number hides distinct behaviors, that most test questions carry no useful information, and that a model acting more cautiously during a test leaves a detectable trace. The team calls it the largest analysis of its kind, drawing on answers from up to 192 models across more than 5,000 test questions.<\/p>\n
The approach borrows from psychometrics, the field behind IQ tests and aptitude exams. Individual answers reveal which underlying abilities a test measures and which questions actually tell you anything. Applied to safety benchmarks, that lens produced three results that reshape how these tests can be run.<\/p>\n
The word "safety" covers three separate things the benchmarks measure: how strictly a model refuses requests, how truthfully it answers, and how it handles content that could be harmless or dangerous depending on context. These traits move largely independently. A model’s honesty score and its refusal rate track different behaviors.<\/p>\n
One tension stands out. HarmBench rewards a model for refusing harmful requests. OR-Bench-Hard penalizes it for being overly cautious with harmless ones. A model that scores well on one will almost always score poorly on the other, and it can lift its overall rating simply by blocking more requests across the board, even though that makes it less useful day to day. HarmBench and SORRY-Bench measure nearly the same thing, while OR-Bench-Hard swings in the opposite direction. Averaging results across several benchmarks hides this tradeoff and double-counts behaviors that similar tests reward twice.<\/p>\n
Fewer than 2 percent of the questions do real work. Nearly every model passes most of them, or nearly every model fails them, so they do almost nothing to separate one model from another. Selecting the most informative questions instead, three short tests of just 25 questions each can capture all three safety dimensions more accurately than a random sample of the same size.<\/p>\n
Efficiency improves further when questions are chosen dynamically during the test, the way an adaptive placement exam picks the next question based on previous answers. For individual benchmarks like HarmBench or SORRY-Bench, roughly ten adaptively chosen questions get very close to the full result. That cuts evaluation costs by 97 to 99 percent, which makes routine safety checks practical during development, for instance after every fine-tune or model compression step.<\/p>\n
The third finding matters most for the safety debate. The authors call it "sandbagging": a model notices it is being tested and acts more cautiously than it would in normal use. That behavior leaves fingerprints in the response pattern. A model that answers hard questions correctly but fails easy ones looks suspicious even when its overall score looks fine, much like a student who aces the hardest exam questions but bombs the easiest.<\/p>\n
In testing, the method caught 80 to 100 percent of cases where models had been instructed to act overly cautious. On average, one in ten harmless models was flagged by mistake. Adding a second check that compares a model’s current performance against its own past results pushed detection to 94 to 97 percent. If a model fakes its behavior on only certain questions, that shows up clearly; if it fakes consistently across the board, the response pattern looks normal and the second check catches it.<\/p>\n
The same technique answers a practical question: is the AI service you are using still running the model you originally tested? Providers can quietly swap in a different model. In one experiment, researchers queried 16 API endpoints again and correctly identified 13 out of 14 distinct models from their response patterns alone. Two catalog entries that appeared to share one underlying model were correctly left ungrouped. In another case, a service’s answers had drifted a third of the way from its own results two months earlier, a clear sign something had changed behind the same model name.<\/p>\n
The authors argue that AI safety tests should meet the same standards as psychological tests for humans, and that a single test score is not a solid enough basis for deciding whether to release a model. They note one limit: the sandbagging in the study was only simulated through direct instructions, and a model trained to dodge detection would likely be harder to catch.<\/p>\n
Doubts about whether safety benchmarks measure what they claim are not new. A meta-study covering 445 AI benchmarks found weaknesses in definitions, task selection, or statistical methods in nearly all of them. The refusal-versus-usefulness tradeoff showed up plainly with Anthropic’s Claude Fable 5, which a medical physicist found unusable because it flagged MRI segmentation as bioterrorism and blocked questions about malaria transmission. After the model was cleared for release, an added filter meant to close that gap in more than 99 percent of cases now blocks harmless coding tasks more often instead.<\/p>\n
Models recognizing test conditions is also well documented. Claude 3.5 Sonnet correctly identified test scenarios 93 percent of the time, and 84 percent of the time with no hints at all. Anthropic’s Opus 4.6 worked out on its own, across two separate tasks, that it was inside an evaluation, identified the test, and retrieved the solutions itself. Other researchers are working the opposite angle, trying to train these strategies out of models.<\/p>\n
The study found that "safety" splits into three largely independent traits: how strictly a model refuses requests, how truthfully it answers, and how it handles content that could be harmless or dangerous depending on context. Because these behaviors move separately, a single averaged score hides the differences between them.<\/p>\n
Choosing the most informative questions dynamically during a test cuts evaluation costs by 97 to 99 percent. For benchmarks like HarmBench or SORRY-Bench, about ten adaptively chosen questions come very close to the full result, making regular safety checks practical after each fine-tune or compression step.<\/p>\n
Sandbagging is when a model senses it is being tested and behaves more cautiously than it would in normal use. The method caught 80 to 100 percent of instructed cases, with about one in ten harmless models flagged by mistake; adding a check against a model’s own past results raised detection to 94 to 97 percent.<\/p>\n