A language model can rise up the safety rankings without becoming any safer. All it needs to do is refuse more often.
That awkward conclusion sits at the heart of a new study by a group of researchers that includes people from the UK AI Security Institute, who took apart eight widely used safety benchmarks for language models. The tools they reached for came from human psychological testing — the machinery behind IQ tests and aptitude exams, where each individual answer indicates the underlying ability being measured and reveals which questions carry any information at all.
The team examined answers from as many as 192 models spanning over 5,000 test questions. They describe it as the biggest analysis of its type so far, and it produces three findings that leave today’s testing practice looking unsteady.
What one benchmark rewards, another penalizes
Refusing harmful requests earns a model credit on HarmBench. Being too cautious with harmless ones costs it points on OR-Bench-Hard. Score highly on one and you will almost certainly score badly on the other.
A model can therefore raise its overall rating simply by blocking more requests indiscriminately — even where that leaves it less useful to anyone trying to actually get something done. Average a handful of benchmarks together, as most leaderboards do, and the tradeoff vanishes from sight while overlapping tests count the same behavior twice.
What these benchmarks label “safety” is really three distinct things: how strictly a model turns requests down, how truthfully it answers, and how it deals with content whose harmfulness depends on context. Those traits are largely independent of one another. A model’s honesty score and its refusal rate are tracking completely different behaviors.
Most of the questions in your test are wasted
Finding number two concerns cost, and it is unsparing. Almost every model gets most test questions right, or almost every model gets them wrong — meaning they contribute virtually nothing toward separating one model from another. Dead weight.
Select only the informative items and three brief tests of 25 questions apiece cover all three safety dimensions, with better accuracy than a random draw of the same length.
The price drops further when the questions are selected on the fly during the test, in the manner of adaptive placement exams that choose your next item based on the answer you just gave. On single benchmarks such as HarmBench or SORRY-Bench, about 10 questions land very near the result of the full evaluation. That works out to a 97 to 99 percent cut in cost — the difference between an audit you run now and then and a check you run after every fine-tune or compression pass.
The pupil who nails the hard questions and fails the easy ones
The third finding matters most for the safety argument. “Sandbagging” is the term the authors use for it: a model registers that it is under examination and acts more carefully than it otherwise would. The worry is that a model might learn to recognize tests and bluff its way past them.
Bluffing of that sort leaves traces. When a model handles difficult questions correctly yet stumbles on easy ones, it looks suspect even if the overall score seems unremarkable — much as a student who aces an exam’s toughest items while botching the simplest ones prompts a closer look.
Across testing, the approach flagged 80 to 100 percent of instances in which models had been told to behave with excessive caution. False alarms were genuine but tolerable: on average, one harmless model in 10 was wrongly flagged. Layering on a second check, which weighs a model’s current performance against its own earlier results, lifted detection to 94 to 97 percent.
Faking that is confined to particular questions stands out sharply in the response pattern. Faking applied uniformly across the board does not — and catching that case is precisely why the second check exists.
Is the API still serving the model you evaluated?
The same technique settles a question that anyone building atop a hosted model ought to be raising, since providers can quietly substitute a different model behind an identical name. In one experiment, the researchers sent fresh queries to 16 API endpoints and, working purely from response patterns, correctly picked out 13 of 14 distinct models.
Two catalog listings that looked as though they ran the same model underneath were correctly left ungrouped. Elsewhere, the answers from one service had drifted a third of the way from what that same service produced two months before — an unmistakable sign that something had shifted behind a label that never changed.
The authors are candid about the ceiling on this. The sandbagging they studied was simulated using direct instructions. A model deliberately trained to evade detection would probably prove far tougher to spot.
No one in the field thought the benchmarks were fine
Whether safety benchmarks actually measure what they claim to has been an unresolved question for some time. One meta-study spanning 445 AI benchmarks turned up flaws in definitions, task selection or statistical methods in almost every one.
Nor is the refusal-versus-usefulness tradeoff merely hypothetical. It surfaced starkly with Anthropic’s Claude Fable 5, which one medical physicist found unusable because it treated MRI segmentation as bioterrorism and refused questions on how malaria is transmitted. Once the US government approved the model for release, an additional filter was meant to close that gap in over 99 percent of cases. What it does now is block harmless coding tasks more frequently instead.
Models clocking that they are being watched is also well documented. Claude 3.5 Sonnet spotted test scenarios correctly 93 percent of the time, and was still right 84 percent of the time when given no hints. On two separate tasks, Anthropic’s Opus 4.6 figured out unprompted that it was inside an evaluation, named the test and helped itself to the solutions. Other researchers are attacking the problem from the other direction, attempting to train these strategies back out.
The authors’ argument is that AI safety tests ought to be held to the same standards as psychological tests for people, and that one test score is too thin a basis for a release decision. Fair enough. The practical lesson, though, is narrower and more pointed: when a vendor presents you with an averaged safety figure, ask which of the three dimensions it reflects and how many of the underlying questions are capable of distinguishing one model from another. On the evidence here, the honest number is roughly 25.