{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"wmdp","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","aliases":["WMDP"],"authors":["Nathaniel Li","Alexander Pan","Anjali Gopal","Summer Yue","Daniel Berrios","Alice Gatti","Justin D. Li","Ann-Kathrin Dombrowski","Shashwat Goel","Long Phan","Gabriel Mukobi","Nathan Helm-Burger","Rassin Lababidi","Lennart Justen","Andrew B. Liu","Michael Chen","Isabelle Barrass","Oliver Zhang","Xiaoyuan Zhu","Rishub Tamirisa","Bhrugu Bharathi","Adam Khoja","Zhenqi Zhao","Ariel Herbert-Voss","Cort B. Breuer","Samuel Marks","Oam Patel","Andy Zou","Mantas Mazeika","Zifan Wang","Palash Oswal","Weiran Lin","Adam A. Hunt","Justin Tienken-Harder","Kevin Y. Shih","Kemper Talley","John Guan","Russell Kaplan","Ian Steneker","David Campbell","Brad Jokubaitis","Alex Levinson","Jean Wang","William Qian","Kallol Krishna Karmakar","Steven Basart","Stephen Fitz","Mindy Levine","Ponnurangam Kumaraguru","Uday Tupakula","Vijay Varadharajan","Ruoyu Wang","Yan Shoshitaishvili","Jimmy Ba","Kevin M. Esvelt","Alexandr Wang","Dan Hendrycks"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"wmdp","attributionSourceId":"wmdp-author-source","originalUrl":"https://arxiv.org/abs/2403.03218v7","publicationDate":"2024-03-05","updatedOn":"2026-10-25","areas":["cbrn"],"scopeNote":{"en":"Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.","zh":"主维度依据来源实际测量的构念；具体指标可能属于其他维度。"},"protocolIds":["wmdp"],"contributions":[{"organizationId":"cais","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"berkeley","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"mit","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"securebio","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"scale","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"nyu","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"iiit","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"stanford","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"harvard","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"usc","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"uiuc","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"lapis","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"ucla","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"caltech","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"sybil","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"northeastern","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"cmu","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"bbn","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"newcastle","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"keio","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"ariel","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"asu","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"xai","role":"research","sourceId":"wmdp-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Hazardous knowledge proxies and unlearning evaluation.","zh":"危险知识代理测量与遗忘效果评测。"},"note":{"question":{"en":"Multiple-choice knowledge measurements.","zh":"选择题形式的知识测量。"},"method":{"en":"Model answering hazardous knowledge questions","zh":"回答危险知识问题的模型"},"finding":{"en":"Hazardous knowledge proxies and unlearning evaluation.","zh":"危险知识代理测量与遗忘效果评测。"},"supports":null,"limits":{"en":"Knowledge is a proxy; scores do not establish practical harmful-task ability.","zh":"知识属于代理指标；分数不能确定实际有害任务能力。"},"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"Existing source-specific draft sections are retained with limited review status. A complete methods, findings and limitations check remains pending; generic sections were omitted.","zh":"已有的来源相关草稿章节予以保留，审核状态为有限核查。完整的方法、发现与限制核查仍待完成；通用套话章节已省略。"},"noteSourceLocator":"Retained existing source-specific note sections; this pass audits duplicate/boilerplate structure and source availability, not complete section-level verification.","tags":[]},"reading":{"id":"wmdp","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","en":{"question":"Can a public proxy benchmark track hazardous knowledge while supporting mitigation research?","design":"WMDP contains 3,668 expert-written multiple-choice items across three risk domains, filtered to exclude sensitive and export-controlled information.","findings":["The paper evaluates knowledge-reduction methods alongside general-capability retention.","Reported mitigation gains also affect some adjacent benign subjects, revealing a precision trade-off (§7)."],"interpretation":"NUWA interpretation: proxy knowledge accuracy measures a narrower construct than operational harm or user uplift.","limits":"A low multiple-choice score does not by itself establish durable removal of knowledge or reduced real-world misuse.","decisionRelevance":"Model recommendation: evaluate safeguard durability and benign utility separately; retain only nonoperational benchmark statistics in this index.","takeaway":"NUWA interpretation: proxy knowledge accuracy measures a narrower construct than operational harm or user uplift.","connections":[],"scoring":"Multiple-choice hazardous-knowledge proxy accuracy plus separate general-capability retention.","conditions":"3,668 filtered expert questions; no operational task execution is measured.","statistics":"Reported mitigation gains also affect some adjacent benign subjects, revealing a precision trade-off (§7).","usage":"Model recommendation: evaluate safeguard durability and benign utility separately; retain only nonoperational benchmark statistics in this index."},"zh":{"question":"公开代理基准能否追踪危险知识并支持缓解研究？","design":"WMDP 含三个风险领域3,668道专家选择题，并过滤敏感及出口管制信息。","findings":["论文同时评价知识削减与一般能力保留。","缓解效果也影响部分相邻良性学科，显示精确性权衡（§7）。"],"interpretation":"NUWA 解读：代理知识正确率比实际伤害或用户能力增益更窄。","limits":"低选择题分数本身不能确立知识被持久移除或真实滥用风险下降。","decisionRelevance":"模型建议：分别评价防护持久性与良性效用；索引仅保留非操作性统计。","takeaway":"NUWA 解读：代理知识正确率比实际伤害或用户能力增益更窄。","connections":[],"scoring":"危险知识代理选择题正确率，另测一般能力保留。","conditions":"3,668道过滤后专家题，不测操作性任务执行。","statistics":"缓解效果也影响部分相邻良性学科，显示精确性权衡（§7）。","usage":"模型建议：分别评价防护持久性与良性效用；索引仅保留非操作性统计。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"wmdp-author-source","url":"https://arxiv.org/html/2403.03218v7","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2403.03218v7; sha256:472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78; archived source capture; exact capture time not independently established","artifactSha256":"472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78"},{"sourceId":"wmdp-author-source","url":"https://arxiv.org/html/2403.03218v7","locator":"§3 The WMDP Benchmark","version":"Selected original resource https://arxiv.org/html/2403.03218v7; sha256:472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78; archived source capture; exact capture time not independently established","artifactSha256":"472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78"},{"sourceId":"wmdp-author-source","url":"https://arxiv.org/html/2403.03218v7","locator":"§5 Experimental Results","version":"Selected original resource https://arxiv.org/html/2403.03218v7; sha256:472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78; archived source capture; exact capture time not independently established","artifactSha256":"472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78"},{"sourceId":"wmdp-author-source","url":"https://arxiv.org/html/2403.03218v7","locator":"§7 Conclusion","version":"Selected original resource https://arxiv.org/html/2403.03218v7; sha256:472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78; archived source capture; exact capture time not independently established","artifactSha256":"472585ab0b6df3fe4f74bee849a6a68087e4641617a5c8914c0b057a27ca3d78"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"a85ced8ed62123961b2e58a4574b437d771df759d0197f3beb22b046d7ee6ff8"}},"sources":[{"id":"wmdp","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","url":"https://arxiv.org/abs/2403.03218v7","version":"arXiv:2403.03218v7","publicationDate":"2024-05-15","datePrecision":"day","type":"benchmark","verifiedOn":"2026-10-24","documentId":"arxiv:2403.03218","authors":["Nathaniel Li ∗","Alexander Pan ∗","Anjali Gopal †","Summer Yue †","Daniel Berrios †","Alice Gatti ‡","Justin D. Li ‡","Ann-Kathrin Dombrowski ‡","Shashwat Goel ‡","Long Phan ‡","Gabriel Mukobi","Nathan Helm-Burger","Rassin Lababidi","Lennart Justen","Andrew B. Liu","Michael Chen","Isabelle Barrass","Oliver Zhang","Xiaoyuan Zhu","Rishub Tamirisa","Bhrugu Bharathi","Adam Khoja","Zhenqi Zhao","Ariel Herbert-Voss","Cort B. Breuer","Samuel Marks","Oam Patel","Andy Zou","Mantas Mazeika","Zifan Wang","Palash Oswal","Weiran Lin","Adam A. Hunt","Justin Tienken-Harder","Kevin Y. Shih","Kemper Talley","John Guan","Russell Kaplan","Ian Steneker","David Campbell","Brad Jokubaitis","Alex Levinson","Jean Wang","William Qian","Kallol Krishna Karmakar","Steven Basart","Stephen Fitz","Mindy Levine","Ponnurangam Kumaraguru","Uday Tupakula","Vijay Varadharajan","Ruoyu Wang","Yan Shoshitaishvili","Jimmy Ba","Kevin M. Esvelt","Alexandr Wang ∗∗","Dan Hendrycks ∗∗"],"aliases":["https://doi.org/10.48550/arXiv.2403.03218","https://arxiv.org/abs/2403.03218","https://arxiv.org/pdf/2403.03218"]}]}