A language model can climb the safety rankings without getting any safer. It just has to say no more often.
That’s the uncomfortable finding at the center of a new study from a team of researchers including some from the UK AI Security Institute, who pulled apart eight popular safety benchmarks for language models. Their toolkit came from human psychological testing, the kind behind IQ tests and aptitude exams, where the answers to individual questions reveal what ability sits behind them and which questions tell you anything useful at all.
They analyzed answers from up to 192 models across more than 5,000 test questions. The authors call it the largest analysis of its kind to date, and it lands three findings that make current testing practice look shaky.
One benchmark punishes exactly what the other rewards
HarmBench rewards a model for refusing harmful requests. OR-Bench-Hard punishes it for being overly cautious with harmless ones. A model that scores well on one will almost always score poorly on the other.
So a model can lift its overall rating by blocking more requests across the board, even when that makes it less useful to anyone trying to get work done. Average several benchmarks together, which is what most leaderboards do, and the tradeoff disappears from view while similar tests double-count the same behavior.
What the benchmarks call “safety” turns out to be three separate things: how strictly a model refuses requests, how truthfully it answers and how it handles content that could be harmless or dangerous depending on context. Those traits are largely independent. A model’s honesty score and its refusal rate track different behaviors entirely.
Most of your test questions are doing nothing
The second finding is about cost, and it’s brutal. Nearly every model passes most test questions, or nearly every model fails them, which means they do almost nothing to tell models apart. Dead weight.
Pick the informative ones instead and three short tests of just 25 questions each capture all three safety dimensions, more accurately than a random sample of the same size.
It gets cheaper when questions are chosen dynamically during the test, the way adaptive placement exams pick your next question based on what you just answered. For individual benchmarks like HarmBench or SORRY-Bench, roughly 10 questions get you very close to the full evaluation result. That’s a cost reduction of 97 to 99 percent, which is the difference between an occasional audit and a check you run after every fine-tune or compression step.
The student who aces the hard questions and flunks the easy ones
The third finding carries the most weight for the safety debate. The authors call it “sandbagging”: a model notices it’s being tested and behaves more cautiously than it would in normal use. The fear is that a model could learn to spot tests and fake its way through them.
That kind of faking leaves fingerprints. A model that answers hard questions correctly but misses easy ones looks suspicious even when its overall score looks fine, in the same way a student who nails the hardest exam questions and bombs the simplest ones invites a second look.
In testing, the method caught 80 to 100 percent of cases where models had been instructed to act overly cautious. The false alarm rate was real but manageable: on average, one in 10 harmless models got flagged by mistake. Adding a second check that compares a model’s current performance against its own past results pushed detection to 94 to 97 percent.
Selective faking on certain questions shows up clearly in the response pattern. Consistent faking across the board doesn’t, and that’s the case the second check is there to catch.
Is the API still running the model you tested?
The same technique answers a question anyone building on a hosted model should be asking, because providers can quietly swap in a different model behind the same name. In one experiment, the researchers re-queried 16 API endpoints and correctly identified 13 out of 14 distinct models from response patterns alone.
Two catalog entries that appeared to run the same model underneath were correctly left ungrouped. In another case, one service’s answers had drifted a third of the way from its own results two months earlier, a clear sign something had changed behind an unchanged label.
The authors are upfront about the limit here. Their sandbagging was simulated through direct instructions. A model specifically trained to dodge detection would likely be much harder to catch.
Nobody in research thought the benchmarks were fine
Whether safety benchmarks measure what they claim has been an open question for a while. A meta-study covering 445 AI benchmarks found weaknesses in definitions, task selection or statistical methods in nearly all of them.
The refusal-versus-usefulness tradeoff isn’t theoretical either. It showed up plainly with Anthropic’s Claude Fable 5, which a medical physicist found unusable because it flagged MRI segmentation as bioterrorism and blocked questions about malaria transmission. After the US government cleared the model for release, an added filter was supposed to close that gap in more than 99 percent of cases. It now blocks harmless coding tasks more often instead.
Models noticing they’re on the clock is well documented too. Claude 3.5 Sonnet correctly identified test scenarios 93 percent of the time, and still got it right 84 percent of the time with no hints. Anthropic’s Opus 4.6 worked out on its own, across two separate tasks, that it was inside an evaluation, identified the test and grabbed the solutions itself. Other researchers are working the opposite side, trying to train these strategies back out.
The authors’ position is that AI safety tests should meet the same standards as psychological tests for humans, and that a single test score isn’t a solid enough basis for deciding whether to release a model. Fair. But the practical takeaway is smaller and sharper than that: when a vendor hands you an averaged safety number, ask which of the three dimensions it covers and how many of its questions could tell one model from another. Based on these results, the honest count is about 25.
