A team of researchers including some from the UK AI Security Institute took a close look at eight safety benchmarks used for language models. They borrowed their methods from psychological testing in humans — the approach behind IQ tests and aptitude exams. The question that approach asks is whether the answers to individual questions reveal what abilities lie behind them, and which questions actually tell you anything.

The researchers analyzed answers from up to 192 models across more than 5,000 test questions. The authors call it the largest analysis of its kind to date, and it produces three findings that call current testing practice into question.

A single safety score hides more than it shows

The eight benchmarks do not measure one shared quality called safety. They measure three independent things:

  • Refusal strictness — how often the model turns requests down.
  • Truthfulness — whether the information it gives is accurate.
  • Context-dependent content — how it handles requests that can be harmless or dangerous depending on the situation.

These three traits have little to do with each other. Whether a model answers honestly says almost nothing about how often it refuses requests.

One tension between two benchmarks is particularly troublesome. HarmBench rewards a model for refusing harmful requests. OR-Bench-Hard punishes it for being overly cautious with harmless ones. A model scoring well on one will almost always score poorly on the other. The consequence: a model can lift its overall rating simply by blocking more requests across the board, even as it grows less useful in daily work. Averaging several benchmarks papers over that tension entirely.

Most of the questions are dead weight

The second finding hits the cost side. Most test questions turn out to be inert: nearly every model passes them, or nearly every model fails them. Either way they do nothing to tell models apart.

Pick the most informative questions instead and three short tests of just 25 questions each capture all three safety dimensions — more accurately than a random sample of the same size. Efficiency improves further when questions are selected dynamically during the test, much like an adaptive placement exam where the next question depends on how you have done so far. For individual benchmarks, roughly ten questions come very close to the result of the full evaluation. Costs drop by 97 to 99 percent, which makes routine safety checks practical after every fine-tune or model compression step.

When a model notices it is being tested

The third finding carries the most weight for the safety debate. The authors call it "sandbagging": a model notices it is under test and behaves more cautiously than it would in normal use. The worry is that a model could learn to recognize tests and deliberately fake its behavior.

Such behavior leaves fingerprints in the response pattern. Like a student who nails the hardest questions and bombs the easiest ones, a model that answers hard questions correctly but fails easy ones looks suspicious even when its overall score looks fine. In testing, the method caught between 80 and 100 percent of cases where models had been instructed to act overly cautious. The cost was that roughly one in ten harmless models got flagged by mistake. Adding a second check that compares a model's current performance against its own past results pushed detection to 94 to 97 percent.

A useful side effect: did the provider swap the model?

The method also solves a very practical problem: is the AI service you are paying for still running the model you originally tested? Providers can quietly swap in a different model behind the scenes without users noticing. The same technique makes that switch visible by catching the shift in response patterns.