What it measures
A standardized framework measures harmful-compliance and refusal behavior under defined evaluation conditions.
How to read the result
Compare refusal robustness with benign-task usefulness and the rate of unnecessary refusals.
Limits and comparison traps
The behavior taxonomy, classifier, and test protocol shape the result. A single attack-success metric is not a complete safety assessment.
Published evaluation
HarmBench harmful compliance; SORRY-Bench paper · cross-benchmark comparison. The source’s task split, model configuration and scoring units are retained.
Where this fits in an evaluation suite
Format compliance, preference, truthfulness, and safety require separate measurements. Keep desirable writing style from masking factual errors.
Start with a capability hypothesis, then choose a second test with a different failure mode. Keep the checkpoint, reasoning effort, agent tools, sampling policy, and scoring procedure fixed when measuring a training intervention. Record failures and missing outputs in the denominator.
A reproducible comparison
HarmBench harmful compliance; SORRY-Bench paper · cross-benchmark comparison. The source’s task split, model configuration and scoring units are retained.
Publish the exact run configuration, item coverage, score units, and available uncertainty. If a source supplies only an aggregate or a single run, preserve that limit. A new model name or a rounded score alone does not establish a capability improvement.
PRIMARY EVIDENCE & FURTHER READING
- SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal — published result table ↗
All 16 authors
Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, Ruoxi Jia, Bo Li, Kai Li, Danqi Chen, Peter Henderson, Prateek Mittal
- Primary benchmark documentation or model evaluation report ↗
Reviewed 2026-10-26. Explanation and interpretation by RLTasks. Benchmark ownership remains with its original authors.