What it measures

5,000+ labeled adversarial and vanilla user-model interactions testing safety moderation classifiers and guardrail models.

Reading the measurement

F1 balances precision and recall. Check both: a system can miss relevant evidence or include unsupported material, and those errors have different consequences. Keep the matching rule, averaging policy and denominator fixed.

Published evaluation

Classification F1 on the named moderation task over adversarial and vanilla examples. Harmfulness classification and refusal recognition are different objectives.

Where this fits in an evaluation suite

Format compliance, preference, truthfulness, and safety require separate measurements. Keep desirable writing style from masking factual errors.

Start with a capability hypothesis, then choose a second test with a different failure mode. Keep the checkpoint, reasoning effort, agent tools, sampling policy, and scoring procedure fixed when measuring a training intervention. Record failures and missing outputs in the denominator.

A reproducible comparison

Classification F1 on the named moderation task over adversarial and vanilla examples. Harmfulness classification and refusal recognition are different objectives.

Publish the exact run configuration, item coverage, score units, and available uncertainty. If a source supplies only an aggregate or a single run, preserve that limit. A new model name or a rounded score alone does not establish a capability improvement.

PRIMARY EVIDENCE & FURTHER READING

  1. WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs — published result table ↗

    Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert et al. · 2024

    All 8 authors

    Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, Nouha Dziri

Reviewed 2026-10-26. Explanation and interpretation by RLTasks. Benchmark ownership remains with its original authors.