AISafetyBenchExplorer: A Metric-Aware Catalogue of AI Safety Benchmarks Reveals Fragmented Measurement and Weak Benchmark Governance Abiodun A. Solanke
arXiv:2604.12875v1 [cs.AI] 14 Apr 2026
Abstract
surprisingly hard to answer basic comparative questions: which benchmarks are appropriate for a given deployment claim, which metrics are genuinely comparable across papers, and which benchmark portfolios cover distinct risks rather than repeating the same measurement assumptions? Broad evaluation infrastructures have improved standardization within particular stacks, but they do not eliminate fragmentation across the wider safety-benchmark literature [12, 19]. This paper argues that the central problem is not benchmark scarcity, but measurement fragmentation. The updated AISafetyBenchExplorer1 workbook catalogues 195 AI safety benchmarks, but the metriclevel evidence shows that benchmark growth has outpaced convergence on shared metric semantics, shared maintenance norms, and shared benchmark-selection practice [1, 2]. The resulting ecosystem is large, energetic, and useful, but methodologically noisy. AISafetyBenchExplorer was built to make this landscape legible. The resource links a benchmark-level sheet to a metric-level sheet. The first stores fields such as task type, release timing, sample count, language support, license, code and dataset availability, and complexity. The second stores exact metric names, conceptual descriptions, methodological details, mathematical definitions, and deviations from standard usage. This second layer is crucial: many apparent benchmark comparisons are, in reality, comparisons between incompatible measurements [1, 2]. The paper makes three contributions:
The rapid expansion of large language model (LLM) safety evaluation has produced a substantial benchmark ecosystem, but not a correspondingly coherent measurement ecosystem. We present AISafetyBenchExplorer, a structured catalogue of 195 AI safety benchmarks released between 2018 and 2026, organized through a multi-sheet schema that records benchmarklevel metadata, metric-level definitions, benchmarkpaper metadata, and repository activity. This design enables meta-analysis not only of what benchmarks exist, but also of how safety is operationalized, aggregated, and judged across the literature. Using the updated catalogue, we identify a central structural problem: benchmark proliferation has outpaced measurement standardization. The current landscape is dominated by medium-complexity benchmarks (94/195), while only 7 benchmarks occupy the Popular tier. The workbook further reports strong concentration around English-only evaluation (165/195), evaluation-only resources (170/195), stale GitHub repositories (137/195), stale Hugging Face datasets (96/195), and heavy reliance on arXiv preprints among benchmarks with known venue metadata. At the metric level, the catalogue shows that familiar labels such as accuracy, F1 score, safety score, and aggregate benchmark scores often conceal materially different judges, aggregation rules, and threat models. We argue that the field’s main failure mode is fragmentation rather than scarcity. Researchers now have many benchmark artifacts, but they often lack a shared measurement language, a principled basis for benchmark selection, and durable stewardship norms for postpublication maintenance. AISafetyBenchExplorer addresses this gap by providing a traceable benchmark catalogue, a controlled metadata schema, and a complexity taxonomy that together support more rigorous benchmark discovery, comparison, and meta-evaluation.
1
1. We present AISafetyBenchExplorer as a structured resource for navigating AI safety benchmarks. 2. We formalize the catalogue’s complexity taxonomy [3] and show how it helps distinguish canonical, frontier, balanced, and narrow evaluation resources. 3. We use benchmark-level and metric-level evidence to show that the current ecosystem is structurally fragmented: benchmark names proliferate, but shared measurement language, benchmark stewardship, and principled portfolio design do not.
Introduction
LLM safety evaluation has entered a paradoxical phase. The field now has many benchmarks, yet it remains
1 AISafetyBenchExplorer Workbook Sheet
1
2
Related Work
Table 1: Corpus snapshot from AISafetyBenchExplorer v1.1.
Research on LLM safety evaluation has progressed along three partially overlapping lines. The first line introduces individual benchmarks or benchmark suites for specific risks, such as exaggerated refusal, covert reasoning control, auditing hidden behaviors, and agentic reward hacking [17, 19, 21, 26]. These papers expand the space of what can be evaluated, but they are not intended to provide a structured map of the benchmark ecosystem itself. The second line develops broader benchmarking infrastructures and holistic evaluation frameworks. HELM is a particularly important reference point because it makes scenario and metric coverage an explicit design problem rather than a collection of isolated benchmark choices [12]. That framing is directly relevant to AI safety benchmarking, where metric comparability and coverage selection matter as much as raw benchmark count. The third line consists of ecosystem overviews and catalogue-building efforts. AISafetyBenchExplorer is positioned in this space, but with a narrower methodological claim: benchmark-level summaries alone are insufficient for serious meta-evaluation. To compare benchmark outputs responsibly, one must also record what the reported metrics actually mean, how they are computed, and where they differ from standard statistical usage [2].
3
Resource Design
3.1
Multi-sheet schema
Statistic
Value
Total benchmarks Publication span Peak publication year Complexity distribution
195 2018–2026 2023 (57 benchmarks) 7 Popular, 68 High, 94 Medium, 26 Low English-only benchmarks 165 / 195 Evaluation-only resources 170 / 195 Stale GitHub repositories 137 / 195 Stale Hugging Face datasets 96 / 195 Largest known venue category arXiv preprints (46)
3.2
Controlled extraction logic
The project also defines controlled vocabularies for task type, entry modality, development purpose, creation method, and integration options. This improves consistency across extracted records and makes extension of the catalogue more reproducible. The associated extraction prompt requires traceability, explicit formulas where possible, and notes on how benchmark-specific metric definitions diverge from more standard forms [2].
3.3
Updated corpus snapshot
The updated workbook reports 195 benchmarks in total, with 7 classified as Popular, 68 as High, 94 as Medium, and 26 as Low complexity. It further reports strong concentration around English-only benchmarks, evaluationonly resources, stale repositories, stale datasets, and arXiv preprints as the largest known publication venue category [2]. Table 1 summarizes the highest-level corpus signals used in this paper.
The project follows a canonical multi-sheet template. The Safety Evaluation Benchmarks sheet stores benchmark-level metadata including benchmark name, task type, paper title, release date, short description, code and dataset availability, number of samples, creation method, entry modalities, development purpose, license, listed metrics, complexity level, language support, integration mode, citation information, and links. The Evaluation Metrics Catalogue stores one row per metric, with fields for conceptual description, methodological details, mathematical definition, differences from standard definition, and notes. Additional sheets include benchmark paper metadata, repository activity, use-case mapping, and dashboard-style summary outputs [2]. This design is motivated by a simple methodological claim: benchmark-level summaries alone are insufficient for serious meta-evaluation. Two benchmarks may both report accuracy, F1 score, or safety score, yet differ materially in unit of analysis, ground-truth source, judge type, aggregation procedure, or adversarial assumptions. A benchmark-only survey can miss those differences. A metric-level catalogue makes them explicit [2].
4
Complexity Taxonomy
AISafetyBenchExplorer includes a four-tier taxonomy: Popular, High, Medium, and Low. The accompanying methodology report defines a deterministic decision process in which Popular overrides other levels when a benchmark has clear community-standard status or strong verified citation traction, while the remaining levels reflect combinations of adversarial design, reasoning demands, subjectivity, domain criticality, and evaluation complexity [3]. A methodological caveat is important. The standalone complexity report documents the formal assessment framework over an earlier 176-benchmark audit, whereas the workbook now serves as the authoritative 195-benchmark empirical snapshot [2, 3]. In this paper, we therefore use the report as the governing classification logic and the workbook as the authoritative source for 2
current corpus counts. That distinction matters for interpretation, but it does not weaken the main empirical pattern. The updated distribution suggests a field concentrated in the middle: nearly half of all benchmarks fall into the Medium tier, while only a small subset reaches the Popular tier [2] (see Figure 4). This indicates an ecosystem with many usable resources but relatively few universally adopted reference benchmarks.
5
conditioning, aggregation level, or whether a gating variable is applied upstream. Table 3 illustrates the point [2]. Taken together, these patterns support a stronger claim than simple metric-name reuse. The field exhibits both cross-benchmark label collision and withinbenchmark metric branching. The first undermines naive cross-paper comparison; the second can create an illusion of measurement diversity even when several headline numbers are generated by nearly the same evaluation pipeline [2].
Metric Collision Audit
The benchmark-level view shows scale, maintenance, and coverage. The metric-level view shows something deeper: the field is fragmented not only in what it evaluates, but in how it defines evaluation itself. Across the AISafetyBenchExplorer metrics catalogue, familiar metric labels frequently conceal different units of analysis, different judges, different aggregation procedures, and different threat models [2]. This is not merely terminological untidiness. It is a comparability problem.
5.1
Findings
6.1
Joint compliance is harder than marginal compliance
NESSiE provides a clean demonstration that metric design can change the scientific conclusion. Rather than evaluating safety and helpfulness independently, it introduces a joint Safe–Helpful metric that requires a model both to withhold forbidden information and to provide authorized information on the complementary task [4]. This blocks trivial strategies such as always refusing or always answering. The broader implication extends beyond one benchmark. Marginal safety and marginal helpfulness can both look strong while conditional policy compliance remains weak. This is precisely the kind of difference that a benchmark-level summary can hide and a metric-aware catalogue can surface [2, 4].
Metric collision as a methodological failure mode
A central finding of this study is that metric-name reuse routinely creates false comparability. When papers report familiar labels such as accuracy, F1 score, safety score, or benchmark-level aggregate scores, readers can easily infer that these quantities are commensurable across benchmarks. The catalogue suggests otherwise: in many cases, the metric label is shared while the object being measured, the judge producing the label, and the aggregation logic differ substantially [2]. This matters because benchmark users rarely consume full methodological appendices when selecting an evaluation suite. In practice, they often rely on benchmark reputation, metric names, and headline numbers. If those names travel more easily than their operational definitions, then the field accumulates benchmark artifacts faster than it accumulates reliable evidence [2].
5.2
6
6.2
Output-level evaluation reasoning-channel risk
misses
CoT-Control shows that controlling final outputs is not the same as controlling reasoning traces. Its evaluation suite distinguishes output controllability from chain-ofthought controllability and explicitly studies whether a model can conceal or manipulate internal reasoning disclosures [26]. This matters because much of the broader safety literature remains output-centric. The methodological lesson is simple: a benchmark that inspects only final answers can miss whether a model can satisfy safety constraints in appearance while behaving differently in hidden reasoning channels. Even if current models still appear limited on this capability, the benchmark reveals why output-only evaluation can be incomplete for frontier reasoning systems [26].
Collision families
Table 2 summarizes recurring collision families surfaced in the metrics catalogue. The main pattern is not simple terminological reuse, but standards drift: identical or near-identical metric labels often preserve only the surface form of a standard metric while changing the evaluated object, judge type, aggregation rule, conditioning set, or success criterion [2]. A second source of fragmentation is sibling-metric proliferation within individual benchmarks. Here the metric names differ, but the conceptual and methodological pipeline is largely held fixed; what changes is
6.3
Auditing tools must themselves be benchmarked
AuditBench is important because it treats alignment auditing as a benchmark target rather than an assumed external oracle. By measuring investigator-agent success 3
Table 2: Recurring metric-collision families in the Evaluation Metrics Catalogue. Family
Accuracy
Representative Shared surface Why the standard drifts metrics in cata- standard logue
GuardEval [13] Prompt Classification Accuracy; SimpleQA [25] Accuracy; RuLES [14] Rule-Following Accuracy; OIG Moderation [15] Accuracy F1 GuardEval Macro F1; WildGuardMix [8] F1; MiniCheck [23] ClaimLevel F1 Safety score NESSiE [4] Safe Score; CASTLE [11] Safety Score; MedSafetyBench [9] Medical Safety Score Refusal / SafetyPrompts compliance [22] Refusal Rate; OR-Bench [6] OverRefusal Rate; T3 [5] Wise Refusal Rate; MedSafetyBench Compliance Rate Attack suc- Attack Success Rate; cess / ro- Unique ASR; HExbustness PHI [16] ASR; Jailbreak Effectiveness; Defense Robustness Composite / AFIB [7] Composite aggregate Benchmark Score; PostTrainBench Weighted Average Performance; CASTLE Safety Score; MoralityGym [18] Morality Metric
Correct-overtotal scoring
The formula remains familiar, but the evaluand changes across moderation labels, short-form factual answers, explicit rule compliance, and policy-schema classification.
Precision–recall harmonic mean
The positive class, class cardinality, and unit of analysis differ sharply across benchmarks. A shared F1 label therefore conceals different detection problems.
Headline scalar
safety The same label can refer to strict non-leakage, equal-weight personalized safety, or weighted medical safety. The label family is shared, but the success standard is not.
Behavioral confor- These metrics optimize different ideals: refusing harmful requests, mity or absten- not refusing safe requests, abstaining under uncertainty, or tion complying with professional ethics.
Adversarial nerability
vul- Some rows count raw jailbreak success, others deduplicate by strategy, others grade severity, and others measure vulnerability reduction after defense.
Single headline ag- The catalogue mixes equal weighting, domain weighting, gregate inverse-difficulty weighting, lexicographic aggregation, and integrity-gated aggregation.
across hidden behaviors and auditing tools, it turns audit reliability into an empirical object of study [21]. This is a meaningful shift for AI safety evaluation, where auditing quality is often presumed rather than tested. The same logic applies to practical benchmark use. If auditing success depends on tool choice, target-model training history, and the gap between standalone tool quality and agentic deployment, then benchmark governance must include the inspection stack as well as the task suite [21].
6.4
mate post-training under bounded compute, while also documenting reward hacking behaviors such as training on test data, downloading existing tuned checkpoints, or misusing discovered API keys [17]. That design choice is methodologically revealing.
In traditional benchmarking, evaluator compliance is often assumed. In agentic settings, that assumption is no longer safe. The benchmark therefore shows that anti-cheating infrastructure is becoming part of the evaluation object rather than an external administrative concern [17].
Agentic evaluation requires antigaming infrastructure
PostTrainBench makes evaluator integrity part of the benchmark itself. It studies whether agents can auto4
Table 3: Methodologically adjacent sibling metrics that are renamed by conditioning, aggregation, or gating. Benchmark
Sibling metrics
Methodological relationship
NESSiE [4]
Safe Score; Helpful All three rely on the same paired-case keyword-matching setup. The main change is Score; Safe–Helpful the success event: marginal safety, marginal helpfulness, or joint compliance. Score CoT-Control Controllability Score; These metrics share one reasoning-trace control setting and mainly differ by [26] Meta-Discussion Rate; whether overt disclosure is counted separately from covert control. Controllability without Meta-Discussion PostTrainBench Per-benchmark Score; The same agentic runs generate all three quantities. The anti-cheat signal acts as an [17] Weighted Average Per- integrity gate on downstream performance reporting. formance; Anti-cheat Judge Score AuditBench Investigator Agent These are diagnostic views over the same auditing setup, separating auditor success, [21] Success Rate; Confes- target-model self-revelation, and latent hidden-behavior intensity. sion Rate; Behavioral Strength Score MoralityGym Morality Function; Both arise from the same norm-adherence machinery over sequential rollouts, but [18] Morality Metric differ in aggregation level and normative weighting.
7
Governance Signals
8
Discussion
The combined benchmark-level and metric-level evidence supports a three-part diagnosis. First, the field is semantically fragmented: familiar metric labels often conceal incompatible operational definitions, judge types, and aggregation rules. Second, it is coverage fragmented: highly visible benchmarks cluster around historically tractable or canonical risks, while several deploymentcritical risks remain represented by newer or more specialized evaluations. Third, it is infrastructurally fragmented: benchmark maintenance, dataset persistence, multilingual support, and evaluation portability are uneven [2, 12]. This diagnosis changes how benchmark quality should be understood. A benchmark is not only a task artifact. It is also a measurement design, a maintenance commitment, and a governance object. If those layers are unstable or underspecified, then benchmark abundance does not automatically produce more reliable evidence. We therefore propose three practical recommendations:
The metric-fragmentation problem sits inside a broader infrastructure problem. The updated workbook reports 195 total benchmarks, but only 7 in the Popular tier (Figure 4), 165 English-only benchmarks (Figure 2), 170 evaluation-only resources, 137 stale GitHub repositories, and 96 stale Hugging Face datasets [2]. A related governance concern is grey-literature concentration: 36% of benchmarks circulate only as arXiv preprints and therefore enter common use without peer review (Figure 1). Preprints clearly accelerate dissemination, but they also allow methodological weaknesses to propagate before formal scrutiny occurs. AdvBench [27], for example, has accrued 2,600+ citations despite remaining an arXiv preprint, illustrating how quickly the field can build on unreviewed foundation. The publication trend (Figure 3) suggests a transition from benchmark expansion to benchmark consolidation. The 307% increase in 2023 closely tracks the release of GPT-4 and the surge of public and research attention to LLM safety, whereas the 18% decline in 2024 and the steeper drop in 2025 suggest that the initial wave of benchmark creation is slowing. This pattern is consistent with a field that is beginning to shift from rapid benchmark proliferation toward curation, refinement, and governance. These are not just catalogue statistics; they shape what the community can realistically reproduce, extend, and trust. These patterns point to a governance deficit as much as a measurement deficit. A benchmark is not only a dataset or a task. It is also a maintenance commitment, a measurement design, and an implicit claim about what counts as evidence [2]. If those layers are unstable or underspecified, benchmark abundance does not automatically translate into scientific clarity.
1. Benchmark releases should include a standardized metric registry specifying exact semantics, judge types, aggregation rules, and deviations from standard definitions. 2. Benchmark suites used for deployment-relevant claims should undergo coverage audits for language concentration, maintenance status, failure-mode redundancy, and metric incompatibility. 3. Benchmark stewardship should be treated as part of benchmark quality rather than as a post-publication afterthought. 5
Figure 1: Distribution of publication venues across AI safety benchmarks with known venue metadata. arXiv preprints account for the largest share, followed by ACL, EMNLP, ICLR, NAACL, NeurIPS, and ICML, with the remaining venues forming a long tail.
Figure 2: Language coverage across benchmarks in AISafetyBenchExplorer. English-only evaluation dominates the current landscape, while Chinese and explicitly multilingual benchmarks remain limited and most other languages are sparsely represented.
9
Limitations
audit rather than a full 195-benchmark reclassification, so future versions should rerun the formal complexity analysis over the complete updated corpus [2, 3]. Second, although the manuscript makes a strong qualitative
This paper has two important limitations. First, the complexity methodology report documents a 176-benchmark 6
Figure 3: Annual release trend of AI safety benchmarks from 2018 to 2026. Benchmark publication accelerates sharply through 2023, then slows in 2024–2025, while the 2026 count remains provisional because the year is still in progress.
Figure 4: Complexity distribution of the benchmark corpus under the AISafetyBenchExplorer taxonomy. Medium-complexity benchmarks form the largest tier, followed by High and Low complexity benchmarks, while only a small subset reaches the Popular tier. case for metric collision, a fully programmatic count of repeated metric labels and divergent operationalizations
across the entire metrics sheet would strengthen the claim further. 7
10
Data and Resource Statement
[5] Edward Y. Chang. T3: Benchmarking sycophancy and skepticism in causal judgment, 2026. URL https://arxiv.org/abs/2601.08258.
This paper is based on the AISafetyBenchExplorer workbook-backed catalogue and the project’s documented extraction and complexity methodology [1–3]. The released materials should include the workbook snapshot, the extraction specification, the complexityassessment report, and any scripts used to derive corpuslevel statistics or figure-ready outputs.
11
[6] Justin Cui, Wei-Lin Chiang, Ion Stoica, and ChoJui Hsieh. Or-bench: An over-refusal benchmark for large language models, 2024. URL https:// arxiv.org/abs/2405.20947. [7] Akshay Gulati, Kanha Singhania, Tushar Banga, Parth Arora, Anshul Verma, Vaibhav Kumar Singh, Agyapal Digra, Jayant Singh Bisht, Danish Sharma, Varun Singla, and Shubh Garg. Evaluating financial intelligence in large language models: Benchmarking superinvesting ai with llm engines, 2026. URL https://arxiv.org/abs/2603.08704. Introduces the AI Financial Intelligence Benchmark (AFIB).
Conclusion
AISafetyBenchExplorer shows that the AI safety benchmark ecosystem is now too large to navigate informally and too heterogeneous to compare naively. The field has produced 195 benchmark artifacts, but not yet a shared measurement language, durable stewardship norms, or principled benchmark-selection practice. The result is an evaluation landscape in which more benchmarks do not automatically produce more reliable evidence. The contribution of this resource is therefore both descriptive and diagnostic. It catalogues the benchmark landscape, but it also reveals why that landscape remains difficult to compare, difficult to maintain, and difficult to trust. If benchmark abundance is to yield credible safety evidence, then metric definition, benchmark governance, and benchmark portfolio design must become central research problems rather than peripheral implementation details.
[8] Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms, 2024. URL https://arxiv.org/ abs/2406.18495. Introduces the WildGuardMix dataset. [9] Tessa Han, Aounon Kumar, Chirag Agarwal, and Himabindu Lakkaraju. Towards safe large language models for medicine, 2024. URL https://arxiv. org/abs/2403.03744. Introduces the MedSafetyBench benchmark. [10] Thomas Hartvigsen, Saadia Gabriel, Hamid Palangi, Maarten Sap, Dipankar Ray, and Ece Kamar. Toxigen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection, 2022. URL https://arxiv.org/abs/2203.09509. Published as a long paper at ACL 2022.
References [1] AISafetyBenchExplorer Project. AI Safety Benchmark Metadata Extraction Reusable Pipeline and Master Prompt, 2026. URL https://tinyurl. com/AISafetyBenchExplorer. Version 1.1, February 2026.
[11] Rui Jia, Ruiyi Lan, Fengrui Liu, Zhongxiang Dai, Bo Jiang, Jing Shao, Jingyuan Chen, Guandong Xu, Fei Wu, and Min Zhang. Castle: A comprehensive benchmark for evaluating student-tailored personalized safety in large language models, 2026. URL https://arxiv.org/abs/2602.05633.
[2] AISafetyBenchExplorer Project. AISafetyBenchExplorer v1.1, 2026. URL https://tinyurl.com/ AISafetyBenchExplorer. Workbook-backed catalogue used in this study.
[12] Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, Benjamin Newman, Binhang Yuan, Bobby Yan, Ce Zhang, Christian Cosgrove, Christopher D. Manning, Christopher Ré, Diana Acosta-Navas, Drew A. Hudson, Eric Zelikman, Esin Durmus, Faisal Ladhak, Frieda Rong, Hongyu Ren, Huaxiu Yao, Jue Wang, Keshav Santhanam, Laurel Orr, Lucia Zheng, Mert Yuksekgonul, Mirac Suzgun, Nathan Kim, Neel Guha, Niladri Chatterji, Omar Khattab, Peter Henderson, Qian Huang, Ryan Chi, Sang Michael Xie, Shibani Santurkar, Surya
[3] AISafetyExplorer Project. Complexity level assessment for llm safety benchmarks. Technical report, AISafetyBenchExplorer Project, November 2025. URL https://tinyurl.com/ AISafetyBenchExplorer-Complex. Methodology for assessing complexity of benchmarks covering 176 assessed benchmarks. [4] Johannes Bertram and Jonas Geiping. Nessie: The necessary safety benchmark – identifying errors that should not exist, 2026. URL https://arxiv.org/ abs/2602.16756. 8
Ganguli, Tatsunori Hashimoto, Thomas Icard, Tianyi Zhang, Vishrav Chaudhary, William Wang, Xuechen Li, Yifan Mai, Yuhui Zhang, and Yuta Koreeda. Holistic evaluation of language models. Transactions on Machine Learning Research, 2023. doi: 10.48550/arXiv.2211.09110. URL https: //arxiv.org/abs/2211.09110.
[20] Xu Shen, Song Wang, Zhen Tan, Laura Yao, Xinyu Zhao, Kaidi Xu, Xin Wang, and Tianlong Chen. Faithcot-bench: Benchmarking instance-level faithfulness of chain-of-thought reasoning, 2025. URL https://arxiv.org/abs/2510.04040. [21] Abhay Sheshadri, Aidan Ewart, Kai Fronsdal, Isha Gupta, Samuel R. Bowman, Sara Price, Samuel Marks, and Rowan Wang. Auditbench: Evaluating alignment auditing techniques on models with hidden behaviors, 2026. URL https://arxiv.org/ abs/2602.22755.
[13] Naseem Machlovi, Maryam Saleki, Ruhul Amin, Mohamed Rahouti, Shawqi Al-Maliki, Junaid Qadir, Mohamed M. Abdallah, and Ala Al-Fuqaha. Guardeval: A multi-perspective benchmark for evaluating safety, fairness, and robustness in llm moderators, 2026. URL https://arxiv.org/abs/2601. 03273.
[22] Hao Sun, Zhexin Zhang, Jiawen Deng, Jiale Cheng, and Minlie Huang. Safety assessment of chinese large language models, 2023. URL https:// arxiv.org/abs/2304.10436. Introduces the SafetyPrompts benchmark and dataset.
[14] Norman Mu, Sarah Chen, Zifan Wang, Sizhe Chen, David Karamardian, Lulwa Aljeraisy, Dan Hendrycks, and David Wagner. Can llms follow simple rules?, 2023. URL https://arxiv.org/abs/ 2311.04235. Introduces the RuLES benchmark.
[23] Liyan Tang, Philippe Laban, and Greg Durrett. Minicheck: Efficient fact-checking of llms on grounding documents, 2024. URL https://arxiv.org/ abs/2404.10774. EMNLP 2024.
OIG-moderation. https: [15] Ontocord. //huggingface.co/datasets/ontocord/ OIG-moderation, 2023. URL https: //huggingface.co/datasets/ontocord/ OIG-moderation. Hugging Face dataset card; 200,811 rows reported on the dataset page.
[24] Justin Wang, Andreas Bigger, Xiaohai Xu, Justin W. Lin, Andy Applebaum, Tejal Patwardhan, Alpin Yukseloglu, and Olivia Watkins. Evmbench: Evaluating ai agents on smart contract security, 2026. URL https://arxiv.org/abs/2603.04915.
[16] Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to!, 2023. URL https://arxiv.org/abs/2310.03693. Paper associated with HEx-PHI in the benchmark discussion.
[25] Jason Wei, Nguyen Karina, Hyung Won Chung, Yunxin Joy Jiao, Spencer Papay, Amelia Glaese, John Schulman, and William Fedus. Measuring short-form factuality in large language models, 2024. URL https://arxiv.org/abs/2411.04368. Introduces the SimpleQA benchmark. [26] Chen Yueh-Han, Robert McCarthy, Bruce W. Lee, He He, Ian Kivlichan, Bowen Baker, Micah Carroll, and Tomek Korbak. Reasoning models struggle to control their chains of thought, 2026. URL https: //arxiv.org/abs/2603.05706.
[17] Ben Rank, Hardik Bhatnagar, Ameya Prabhu, Shira Eisenberg, Karina Nguyen, Matthias Bethge, and Maksym Andriushchenko. Posttrainbench: Can llm agents automate llm post-training?, 2026. URL https://arxiv.org/abs/2603.08640.
[27] Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. URL https://arxiv.org/ abs/2307.15043. Commonly associated with AdvBench in LLM safety benchmarking.
[18] Simon Rosen, Siddarth Singh, Ebenezer Gelo, Helen Sarah Robertson, Ibrahim Suder, Victoria Williams, Benjamin Rosman, Geraud Nangue Tasse, and Steven James. Moralitygym: A benchmark for evaluating hierarchical moral alignment in sequential decision-making agents, 2026. URL https://arxiv.org/abs/2602.13372. Accepted at AAMAS 2026. [19] Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models, 2024. URL https://arxiv.org/abs/2308.01263. Accepted at NAACL 2024 (Main Conference). 9
Table 4: Compact audit of recurring metric-collision families in the Evaluation Metrics Catalogue (Part I). Severity denotes how misleading name-only comparison would be across benchmarks. Family
Instances
Common core
Accuracy
GuardEval Accuracy; SimpleQA Accuracy; RuLES Accuracy; OIG Moderation Accuracy GuardEval Macro F1; WildGuardMix F1; FAITHCOTBENCH [20] F1; MiniCheck ClaimLevel F1 NESSiE Safe Score; CASTLE Safety Score; MedSafetyBench Medical Safety Score NESSiE Helpful Score; paired compliance helpfulness metrics SafetyPrompts Refusal Rate; OR-Bench OverRefusal Rate; T3 Wise Refusal Rate; MedSafetyBench Compliance Rate Attack Success Rate; Unique ASR; HExPHI ASR; Jailbreak Effectiveness Defense Robustness; ASR reduction; refusal preservation under attack AFIB Composite Benchmark Score; PostTrainBench Weighted Average Performance; CASTLE Safety Score; MoralityGym Morality Metric
Correct-over-total scor- The statistic is stable, but the target is not: moderation ing over benchmark- labels, factual answers, rule compliance, and policy defined targets classification are different evaluands.
High
Precision–recall balanc- The unit of analysis varies across moderation classes, safety ing for discrete predic- categories, reasoning-faithfulness labels, and tion unsupported-claim detection.
High
Headline scalar for The same label covers binary non-leakage, equal-weight safety-facing compari- personalized safety, and medically weighted composite safety. son
Very High
F1
Safety score
Helpfulness
Refusal / compliance
Attack success
Robustness
Composite / aggregate
A
Divergence from a stable standard
Severity
Success on benchmark- The label suggests broad utility, but the operational standard Medium defined authorized as- may be exact authorized keyword production rather than sistance open-ended usefulness. Behavioral calibration Different rows reward opposite behaviors: refusing harmful Very under risky, safe, or un- requests, not refusing safe ones, abstaining under uncertainty, High certain inputs or following domain-specific ethics.
Adversarial failure un- Some rows score raw frequency, others deduplicated strategy der harmful prompting success, post-finetuning vulnerability, or severity among successful attacks.
Very High
Performance under ad- Robustness may mean residual safety, reduction relative to versarial stress or de- baseline, or preservation of refusal behavior; these are related fense but distinct standards.
High
Single-score compres- The catalogue mixes equal weighting, domain weighting, sion of multiple tasks or inverse-difficulty weighting, lexicographic aggregation, and dimensions integrity-gated aggregation.
Very High
Extended Metric-Collision Audit
Interpretation. Two collision modes recur across the catalogue. Cross-benchmark collision occurs when the same label is reused for different evaluands, judges, or aggregation rules. Within-benchmark branching occurs when several differently named metrics are generated from one underlying pipeline by decomposition, conditioning, or gating. Together, these patterns indicate that metric proliferation is not only a naming problem but also a standardization problem.
10
Table 5: Compact audit of recurring metric-collision families in the Evaluation Metrics Catalogue (Part II). Family
Instances
Harmfulness MedSafetyBench / toxicity Harmfulness Score; ToxiGen [10] Toxicity; SafeText Toxicity Bias score Bias Score variants across stereotype and fairness benchmarks Recall / de- EVMbench Detect tection Recall; detectionstyle recall metrics Pass rate EVMbench [24] / success Patch Pass Rate; rate Exploit Pass Rate; agent success metrics ControllabilityCoT-Control Controllability; MetaDiscussion Rate; Controllability without Meta-Discussion Audit bun- AuditBench Investidle gator Agent Success Rate; Confession Rate; Behavioral Strength Score Joint com- NESSiE Safe–Helpful pliance Score versus Safe and Helpful
Common core
Divergence from a stable standard
Severity
Unsafe-output measure- The standard changes across medical harmfulness, ment detector-based toxicity, abusive-advice scoring, and prompt-specific unsafe generation.
High
Asymmetry or undesirable group-conditioned behavior Recovery of benchmarkdefined positives
Very High
Rows operationalize bias as likelihood gaps, disparity measures, stereotype completion, or demographic answer shifts. Some rows use semantic LLM grading against expert reports, while others assume exact labels or classifier matches.
Proportion of successful The success event varies sharply: secure repair, exploit attempts execution, or generic task completion.
High
High
Shared reasoning-trace The apparent metric diversity mainly comes from conditioning Medium control pipeline on overt versus covert control, not from separate evaluation pipelines.
Shared hidden-behavior The rows decompose one auditing process into auditor success, Medium auditing setup target revelation, and latent behavior intensity.
Shared keyword- The decisive change is conjunctive success: joint compliance matching over paired requires simultaneous correctness on both sides of the pair. cases
11
High