{ "schemaVersion": "3.0", "snapshotId": "2026-10-25.3", "verifiedOn": "2026-10-25", "title": "NUWA Frontier AI Safety Index", "coverage": { "en": "The catalogue contains 137 original research works across five research functions. Source screening, affiliations and protocol details are documented separately from numerical results.", "zh": "目录收录 137 项原始研究，覆盖五类研究功能。来源筛选、机构署名及协议细节与数值结果分别记录。" }, "sources": [ { "id": "agentcyberrange", "title": "AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges", "url": "https://agentcyberrange.io/", "version": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "publicationDate": null, "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "agentdojo", "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "url": "https://arxiv.org/html/2406.13352v3", "version": "arXiv:2406.13352v3", "publicationDate": "2024-11-24", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "cybench", "title": "Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models", "url": "https://arxiv.org/abs/2408.08926v4", "version": "arXiv:2408.08926v4", "publicationDate": "2025-04-12", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "cybergym", "title": "CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale", "url": "https://arxiv.org/abs/2506.02548v3", "version": "arXiv:2506.02548v3", "publicationDate": "2026-03-24", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "agentharm", "title": "AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents", "url": "https://arxiv.org/abs/2410.09024v3", "version": "arXiv:2410.09024v3", "publicationDate": "2025-04-18", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "harmbench", "title": "HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal", "url": "https://arxiv.org/abs/2402.04249v2", "version": "arXiv:2402.04249v2", "publicationDate": "2024-02-27", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "strongreject", "title": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v2", "version": "arXiv:2402.10260v2", "publicationDate": "2024-08-27", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "replibench", "title": "RepliBench: Evaluating the Autonomous Replication Capabilities of Language Model Agents", "url": "https://arxiv.org/abs/2504.18565v2", "version": "arXiv:2504.18565v2", "publicationDate": "2025-05-05", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "self-replication", "title": "Frontier AI systems have surpassed the self-replicating red line", "url": "https://arxiv.org/html/2412.12140v1", "version": "arXiv:2412.12140v1", "publicationDate": "2024-12-09", "datePrecision": "day", "type": "controlled-study", "verifiedOn": "2026-10-24" }, { "id": "opendeception", "title": "OpenDeception: Learning Deception and Trust in Human-AI Interaction via Multi-Agent Simulation", "url": "https://arxiv.org/abs/2504.13707v3", "version": "arXiv:2504.13707v3", "publicationDate": "2026-02-06", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "in-context-scheming", "title": "Frontier Models are Capable of In-context Scheming", "url": "https://arxiv.org/abs/2412.04984v2", "version": "arXiv:2412.04984v2", "publicationDate": "2025-01-14", "datePrecision": "day", "type": "controlled-study", "verifiedOn": "2026-10-24" }, { "id": "stealth-evals", "title": "Evaluating Frontier Models for Stealth and Situational Awareness", "url": "https://arxiv.org/abs/2505.01420v4", "version": "arXiv:2505.01420v4", "publicationDate": "2025-07-03", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "re-bench", "title": "RE-Bench: Evaluating frontier AI R&D capabilities of language model agents against human experts", "url": "https://arxiv.org/abs/2411.15114v2", "version": "arXiv:2411.15114v2", "publicationDate": "2025-05-27", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "time-horizons", "title": "Task-Completion Time Horizons of Frontier AI Models", "url": "https://metr.org/time-horizons/", "version": "Time Horizon 1.1; page updated 2026-09-08", "publicationDate": "2026-09-08", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "wmdp", "title": "The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning", "url": "https://arxiv.org/abs/2403.03218v7", "version": "arXiv:2403.03218v7", "publicationDate": "2024-05-15", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "political-persuasion", "title": "Benchmarking Political Persuasion Risks Across Frontier Large Language Models", "url": "https://arxiv.org/abs/2603.09884v1", "version": "arXiv:2603.09884v1", "publicationDate": "2026-03-10", "datePrecision": "day", "type": "controlled-study", "verifiedOn": "2026-10-24" }, { "id": "asimov", "title": "Can AI Perceive Physical Danger and Intervene?", "url": "https://asimov-benchmark.github.io/v2/", "version": "ASIMOV v2 / arXiv:2509.21651", "publicationDate": null, "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-24" }, { "id": "anthropic-cards", "title": "Anthropic model system cards", "url": "https://www.anthropic.com/system-cards", "version": "Index checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "official-model-report", "verifiedOn": "2026-10-25" }, { "id": "anthropic-unintended", "title": "Investigating unintended model actions in our evaluations and internal use", "url": "https://www.anthropic.com/research/investigating-unintended-model-actions", "version": "2026-10-09 article", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "openai-cards", "title": "OpenAI Deployment Safety Hub", "url": "https://deploymentsafety.openai.com/", "version": "Index checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "official-model-report", "verifiedOn": "2026-10-25" }, { "id": "openai-scheming", "title": "Detecting and reducing scheming in AI models", "url": "https://openai.com/index/detecting-and-reducing-scheming-in-ai-models/", "version": "2025-09-17 article", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "gemini-cards", "title": "Google DeepMind model cards", "url": "https://deepmind.google/models/model-cards/", "version": "Index checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "official-model-report", "verifiedOn": "2026-10-25" }, { "id": "gemini-dangerous", "title": "Evaluating Frontier Models for Dangerous Capabilities", "url": "https://deepmind.google/research/publications/78150/", "version": "2024-03-21 publication", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "muse-spark", "title": "Muse Spark Safety & Preparedness Report", "url": "https://arxiv.org/abs/2606.12429", "version": "arXiv:2606.12429", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "official-model-report", "verifiedOn": "2026-10-25" }, { "id": "apollo-science", "title": "Apollo Research: Science of Scheming", "url": "https://www.apolloresearch.ai/science", "version": "Index checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-index", "verifiedOn": "2026-10-25" }, { "id": "aisi-research", "title": "UK AI Security Institute research", "url": "https://www.aisi.gov.uk/research", "version": "Index checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-index", "verifiedOn": "2026-10-25" }, { "id": "aisi-propensity", "title": "Propensity Inference: Environmental Contributors to LLM Behaviour", "url": "https://www.aisi.gov.uk/research/propensity-inference-environmental-contributors-to-llm-behaviour", "version": "Research page checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "aisi-cyber-range", "title": "Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios", "url": "https://www.aisi.gov.uk/research/measuring-ai-agents-progress-on-multi-step-cyber-attack-scenarios", "version": "Research page checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "far-auditing", "title": "Auditing Games for Sandbagging", "url": "https://www.far.ai/research/auditing-games-for-sandbagging", "version": "2025-12-07 article / arXiv:2512.07810", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "palisade-shutdown", "title": "Shutdown resistance in reasoning models", "url": "https://palisaderesearch.org/research/shutdown-resistance", "version": "2025-07-05 article; later TMLR version separate", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "research-report", "verifiedOn": "2026-10-25" }, { "id": "truthful-sad", "title": "Me, Myself, and AI: The Situational Awareness Dataset for LLMs", "url": "https://truthful.ai/papers/situational-awareness-dataset/", "version": "2024-07-15 article; paper linked", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "palisade-robot-shutdown", "title": "Shutdown Resistance in Large Language Models, on robots!", "url": "https://palisaderesearch.org/research/shutdown-resistance-on-robots", "version": "2026-02-12 technical report", "publicationDate": "2026-02-12", "datePrecision": "day", "type": "technical-report", "verifiedOn": "2026-10-25" }, { "id": "secbench-pro", "title": "SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?", "url": "https://arxiv.org/abs/2605.26548v2", "version": "arXiv:2605.26548v2", "publicationDate": "2026-07-20", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "sandboxescapebench", "title": "Quantifying Frontier LLM Capabilities for Container Sandbox Escape", "url": "https://www.aisi.gov.uk/research/quantifying-frontier-llm-capabilities-for-container-sandbox-escape", "version": "AISI research page checked 2026-10-25", "publicationDate": null, "datePrecision": "not recorded in catalogue", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "paperbench", "title": "PaperBench: Evaluating AI's Ability to Replicate AI Research", "url": "https://arxiv.org/abs/2504.01848v3", "version": "arXiv:2504.01848v3", "publicationDate": "2025-04-07", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "alignment-faking", "title": "Alignment faking in large language models", "url": "https://www.anthropic.com/research/alignment-faking", "version": "Anthropic research article 2024-12-18", "publicationDate": "2024-12-18", "datePrecision": "day", "type": "controlled-study", "verifiedOn": "2026-10-25" }, { "id": "agentic-misalignment", "title": "Agentic misalignment: How LLMs could be insider threats", "url": "https://www.anthropic.com/research/agentic-misalignment", "version": "Anthropic research article 2025-06-20", "publicationDate": "2025-06-20", "datePrecision": "day", "type": "controlled-study", "verifiedOn": "2026-10-25" }, { "id": "shade-arena", "title": "SHADE-Arena: Evaluating sabotage and monitoring in LLM agents", "url": "https://www.anthropic.com/research/shade-arena-sabotage-monitoring", "version": "Anthropic research article 2025-06-16", "publicationDate": "2025-06-16", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "vct", "title": "Virology Capabilities Test (VCT): A Multimodal Virology Q&A Benchmark", "url": "https://arxiv.org/abs/2504.16137v2", "version": "arXiv:2504.16137v2", "publicationDate": "2025-04-29", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "vct-v2", "title": "Introducing VCT-v2 — the updated Virology Capabilities Test", "url": "https://securebio.org/blog/introducing-vct-v2/", "version": "SecureBio release 2026-09-11", "publicationDate": "2026-09-11", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "biotier", "title": "BioTIER: A Refusal Benchmark for Targeted Biological Risk Mitigation", "url": "https://arxiv.org/abs/2607.14479v1", "version": "arXiv:2607.14479v1", "publicationDate": "2026-07-16", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "mask", "title": "The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systems", "url": "https://arxiv.org/abs/2503.03750v3", "version": "arXiv:2503.03750v3", "publicationDate": "2026-01-05", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "ape", "title": "It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics", "url": "https://arxiv.org/abs/2506.02873v4", "version": "arXiv:2506.02873v4", "publicationDate": "2026-02-15", "datePrecision": "day", "type": "benchmark", "verifiedOn": "2026-10-25" }, { "id": "conspiracy-persuasion", "title": "Large language models can effectively convince people to believe conspiracies", "url": "https://www.far.ai/research/large-language-models-can-effectively-convince-people-to-believe-conspiracies", "version": "FAR.AI report 2026-01-08", "publicationDate": "2026-01-08", "datePrecision": "day", "type": "controlled-study", "verifiedOn": "2026-10-25" }, { "id": "agentcyberrange-research-introduction", "title": "AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks", "url": "https://whitzard.tech/nuwa/blog/agentcyberrange/", "version": "Source capture 2026-10-25", "publicationDate": null, "datePrecision": "unknown", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "asimov-author-source", "title": "Can AI Perceive Physical Danger and Intervene? Thanks: {abjindal, dklakashnikov, oscarchang, divyagari, animajumdar, sindhwani}@google.com", "url": "https://arxiv.org/html/2509.21651", "version": "arXiv:2509.21651 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cybench-author-source", "title": "Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models", "url": "https://arxiv.org/html/2408.08926v4", "version": "arXiv:2408.08926v4", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cybergym-author-source", "title": "CyberGym: Evaluating AI Agents’ Real-World Cybersecurity Capabilities at Scale", "url": "https://arxiv.org/html/2506.02548v3", "version": "arXiv:2506.02548v3", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "in-context-scheming-author-source", "title": "Frontier Models are Capable of In-context Scheming", "url": "https://arxiv.org/html/2412.04984v2", "version": "arXiv:2412.04984v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "aisi-cyber-range-author-source", "title": "Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios", "url": "https://arxiv.org/html/2603.11214", "version": "arXiv:2603.11214 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "time-horizons-author-source", "title": "Measuring AI Ability to Complete Long Software Tasks", "url": "https://arxiv.org/html/2503.14499", "version": "arXiv:2503.14499 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "re-bench-author-source", "title": "RE-Bench: Evaluating frontier AI R&D capabilities of language model agents against human experts", "url": "https://arxiv.org/html/2411.15114v2", "version": "arXiv:2411.15114v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "replibench-author-source", "title": "RepliBench: Evaluating the Autonomous Replication Capabilities of Language Model Agents", "url": "https://arxiv.org/html/2504.18565v2", "version": "arXiv:2504.18565v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "truthful-sad-author-source", "title": "Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMs", "url": "https://arxiv.org/html/2407.04694", "version": "arXiv:2407.04694 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "stealth-evals-author-source", "title": "Evaluating Frontier Models for Stealth and Situational Awareness", "url": "https://arxiv.org/html/2505.01420v4", "version": "arXiv:2505.01420v4", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "wmdp-author-source", "title": "The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning", "url": "https://arxiv.org/html/2403.03218v7", "version": "arXiv:2403.03218v7", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "opendeception-author-source", "title": "OpenDeception : Learning Deception and Trust in Human–AI Interaction via Multi-Agent Simulation", "url": "https://arxiv.org/html/2504.13707v3", "version": "arXiv:2504.13707v3", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "aisi-propensity-author-source", "title": "Propensity Inference: Environmental Contributors to Unsanctioned LLM Behaviour", "url": "https://arxiv.org/html/2604.21098", "version": "arXiv:2604.21098 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "palisade-shutdown-author-source", "title": "Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs", "url": "https://arxiv.org/html/2509.14260", "version": "arXiv:2509.14260 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "agentharm-author-source", "title": "AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents", "url": "https://arxiv.org/html/2410.09024v3", "version": "arXiv:2410.09024v3", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "harmbench-author-source", "title": "HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal", "url": "https://arxiv.org/html/2402.04249v2", "version": "arXiv:2402.04249v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "political-persuasion-author-source", "title": "Benchmarking Political Persuasion Risks Across Frontier Large Language Models Thanks: Author names are listed in alphabetical order. This research was deemed exempt by the Yale University Human Subjects Committee. We thank Max Nadeau, Lisa Argyle, Dave Rand, and Ethan Busby for helpful comments. This research was funded by a grant from Coefficient Giving. All remaining errors are our own.", "url": "https://arxiv.org/html/2603.09884v1", "version": "arXiv:2603.09884v1", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "palisade-robot-shutdown-author-source", "title": "Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs", "url": "https://arxiv.org/html/2509.14260", "version": "arXiv:2509.14260 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "strongreject-author-source", "title": "A StrongREJECT ¯ \\overline{\\hbox{{StrongREJECT}}} for Empty Jailbreaks", "url": "https://arxiv.org/html/2402.10260v2", "version": "arXiv:2402.10260v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "secbench-pro-author-source", "title": "SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks? Thanks: ∗ Correspondence to: {hwiwonl2, lingming}@illinois.edu .", "url": "https://arxiv.org/html/2605.26548v2", "version": "arXiv:2605.26548v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sandboxescapebench-author-source", "title": "Quantifying Frontier LLM Capabilities for Container Sandbox Escape", "url": "https://arxiv.org/html/2603.02277", "version": "arXiv:2603.02277 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "alignment-faking-author-source", "title": "Alignment faking in large language models", "url": "https://arxiv.org/html/2412.14093", "version": "arXiv:2412.14093 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "vct-author-source", "title": "Virology Capabilities Test (VCT): A Multimodal Virology Q&A Benchmark", "url": "https://arxiv.org/html/2504.16137v2", "version": "arXiv:2504.16137v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "biotier-author-source", "title": "BioTIER: A Refusal Benchmark for Targeted Biological Risk Mitigation", "url": "https://arxiv.org/html/2607.14479v1", "version": "arXiv:2607.14479v1", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "mask-author-source", "title": "The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systems", "url": "https://arxiv.org/html/2503.03750v3", "version": "arXiv:2503.03750v3", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "ape-author-source", "title": "It’s the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics", "url": "https://arxiv.org/html/2506.02873v4", "version": "arXiv:2506.02873v4", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sec-bench-publication", "title": "SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks", "url": "https://arxiv.org/abs/2506.11791", "version": "arXiv:2506.11791v2", "publicationDate": "2025-06-13", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sec-bench-publication-author-source", "title": "SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks", "url": "https://arxiv.org/html/2506.11791", "version": "arXiv:2506.11791 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "exploitbench-publication", "title": "ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents", "url": "https://arxiv.org/abs/2605.14153", "version": "arXiv:2605.14153v1", "publicationDate": "2026-05-13", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "exploitbench-publication-author-source", "title": "ExploitBench : A Capability Ladder Benchmark for LLM Cybersecurity Agents", "url": "https://arxiv.org/html/2605.14153", "version": "arXiv:2605.14153 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "exploitgym-publication", "title": "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?", "url": "https://rdi.berkeley.edu/blog/exploitgym/", "version": "Source capture 2026-10-25", "publicationDate": "2026-05-13", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "exploitgym-publication-author-source", "title": "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?", "url": "https://arxiv.org/html/2605.11086", "version": "arXiv:2605.11086 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cve-bench-publication", "title": "CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities", "url": "https://arxiv.org/abs/2503.17332", "version": "arXiv:2503.17332v4", "publicationDate": "2025-03-21", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cve-bench-publication-author-source", "title": "CVE-Bench: A Benchmark for AI Agents’ Ability to Exploit Real-World\nWeb Application Vulnerabilities", "url": "https://arxiv.org/html/2503.17332", "version": "arXiv:2503.17332 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sre-bench-publication", "title": "The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark", "url": "https://arxiv.org/abs/2608.11469", "version": "arXiv:2608.11469v2", "publicationDate": "2026-08-11", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sre-bench-publication-author-source", "title": "The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark", "url": "https://arxiv.org/html/2608.11469", "version": "arXiv:2608.11469 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "irregular-opus-cyber-assessment-publication", "title": "Assessing Claude Opus 5.5 Against Offensive Security Benchmarks", "url": "https://www.irregular.com/research/assessing-claude-opus-5.5-against-offensive-security-benchmarks", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-22", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "irregular-astra-cyber-assessment-publication", "title": "Assessing GPT-6 Astra: FrontierCyber Measures a Sharp Increase in Cyber Capability", "url": "https://www.irregular.com/research/assessing-gpt-6-astra", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-03", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "solve-plus-publication", "title": "Introducing SOLVE+: Scoring Cyber Scenarios (Version 0.5)", "url": "https://www.irregular.com/research/solve-plus", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-03", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "cyberseceval-publication", "title": "Introduction", "url": "https://meta-llama.github.io/PurpleLlama/CyberSecEval/docs/intro", "version": "Source capture 2026-10-25", "publicationDate": null, "datePrecision": "unknown", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "cybersoceval-publication", "title": "CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning", "url": "https://arxiv.org/html/2509.20166v1", "version": "arXiv:2509.20166v1", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cybersoc-project-source", "title": "CyberSOCEval Benchmark Data", "url": "https://github.com/CrowdStrike/CyberSOCEval_data", "version": "Source capture 2026-10-25", "publicationDate": null, "datePrecision": "unknown", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "caisi-glm-cyber-assessment-publication", "title": "CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities", "url": "https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-17", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "hcast-publication", "title": "HCAST: Human-Calibrated Autonomy Software Tasks", "url": "https://arxiv.org/abs/2503.17354", "version": "arXiv:2503.17354v1", "publicationDate": "2025-03-21", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "hcast-publication-author-source", "title": "HCAST: Human-Calibrated Autonomy Software Tasks", "url": "https://arxiv.org/html/2503.17354", "version": "arXiv:2503.17354 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "mirrorcode-publication", "title": "MirrorCode: Evidence that AI can already do some weeks-long coding tasks", "url": "https://metr.org/blog/2026-04-10-mirrorcode-preliminary-results/", "version": "Source capture 2026-10-25", "publicationDate": "2026-04-10", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "expenditure-horizon-publication", "title": "Expenditure Horizon: Measuring Optimization Ability, with an Application to NanoGPT", "url": "https://metr.org/blog/2026-07-21-expenditure-horizon/", "version": "Source capture 2026-10-25", "publicationDate": "2026-07-21", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "mle-bench-publication", "title": "MLE-bench: Evaluating Machine Learning Agents on Machine Learning Engineering", "url": "https://arxiv.org/abs/2410.07095", "version": "arXiv:2410.07095v6", "publicationDate": "2024-10-09", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "mle-bench-publication-author-source", "title": "MLE-bench: Evaluating Machine Learning Agents on Machine Learning Engineering", "url": "https://arxiv.org/html/2410.07095", "version": "arXiv:2410.07095 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "posttrainbench-publication", "title": "PostTrainBench: Can LLM Agents Automate LLM Post-Training?", "url": "https://arxiv.org/abs/2603.08640", "version": "arXiv:2603.08640v2", "publicationDate": "2026-03-09", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "posttrainbench-publication-author-source", "title": "PostTrainBench : Can LLM Agents Automate LLM Post-Training?", "url": "https://arxiv.org/html/2603.08640", "version": "arXiv:2603.08640 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "deepmind-dangerous-capabilities-publication", "title": "Evaluating Frontier Models for Dangerous Capabilities", "url": "https://arxiv.org/abs/2403.13793", "version": "arXiv:2403.13793v2", "publicationDate": "2024-03-20", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "deepmind-dangerous-capabilities-publication-author-source", "title": "Evaluating Frontier Models for Dangerous Capabilities", "url": "https://arxiv.org/html/2403.13793", "version": "arXiv:2403.13793 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "deepmind-capability-author-source", "title": "Evaluating Frontier Models for Dangerous Capabilities", "url": "https://deepmind.google/research/publications/78150/", "version": "Source capture 2026-10-25", "publicationDate": "2024-03-21", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "self-replication-extended-publication", "title": "Large language model-powered AI systems achieve self-replication with no human intervention", "url": "https://arxiv.org/abs/2503.17378", "version": "arXiv:2503.17378v2", "publicationDate": "2025-03-14", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "self-replication-extended-publication-author-source", "title": "Large language model-powered AI systems achieve self-replication with no human intervention", "url": "https://arxiv.org/html/2503.17378", "version": "arXiv:2503.17378 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "palisade-network-replication-publication", "title": "Language Models Can Autonomously Hack and Self-Replicate", "url": "https://arxiv.org/abs/2605.06760", "version": "arXiv:2605.06760v1", "publicationDate": "2026-05-07", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "palisade-replication-project", "title": "Language Models Can Autonomously Hack and Self-Replicate", "url": "https://palisaderesearch.org/research/self-replication", "version": "Source capture 2026-10-25", "publicationDate": "2026-05-07", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "agentic-self-modification-publication", "title": "Agentic Self-Modification in Open-Weights Systems", "url": "https://www.irregular.com/research/agentic-self-modification-in-open-weights-systems", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-16", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "machiavelli-publication", "title": "Do the Rewards Justify the Means? Measuring Trade-Offs Between Rewards and Ethical Behavior in the MACHIAVELLI Benchmark", "url": "https://arxiv.org/abs/2304.03279", "version": "arXiv:2304.03279v4", "publicationDate": "2023-04-06", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "machiavelli-publication-author-source", "title": "Do the Rewards Justify the Means? Measuring Trade-Offs Between Rewards and Ethical Behavior in the Machiavelli Benchmark", "url": "https://arxiv.org/html/2304.03279", "version": "arXiv:2304.03279 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "emergent-misalignment-publication", "title": "Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs", "url": "https://truthful.ai/papers/emergent-misalignment/", "version": "Source capture 2026-10-25", "publicationDate": "2025-02-25", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "emergent-misalignment-publication-author-source", "title": "Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs 1 This paper contains model-generated content that might be offensive. 1", "url": "https://arxiv.org/html/2502.17424", "version": "arXiv:2502.17424 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "school-of-reward-hacks-publication", "title": "School of Reward Hacks: Hacking harmless tasks generalizes to misaligned behavior in LLMs", "url": "https://truthful.ai/papers/school-of-reward-hacks/", "version": "Source capture 2026-10-25", "publicationDate": "2025-08-25", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "school-of-reward-hacks-publication-author-source", "title": "School of reward hacks: Hacking harmless tasks generalizes to misaligned behavior in LLMs", "url": "https://arxiv.org/html/2508.17511", "version": "arXiv:2508.17511 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "conditional-misalignment-publication", "title": "Conditional Misalignment: Common Interventions Can Hide Emergent Misalignment Behind Contextual Triggers", "url": "https://truthful.ai/papers/conditional-misalignment/", "version": "Source capture 2026-10-25", "publicationDate": "2026-04-28", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "conditional-misalignment-publication-author-source", "title": "Conditional misalignment: common interventions can hide emergent misalignment behind contextual triggers", "url": "https://arxiv.org/html/2604.25891", "version": "arXiv:2604.25891 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "reward-hacking-emergent-misalignment-publication", "title": "From shortcuts to sabotage : Natural emergent misalignment from reward hacking", "url": "https://www.anthropic.com/research/emergent-misalignment-reward-hacking", "version": "Source capture 2026-10-25", "publicationDate": "2025-11-21", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "contrastive-reward-seeking-publication", "title": "Measuring Reward-Seeking via Contrastive Belief Updates", "url": "https://arxiv.org/abs/2607.18966", "version": "arXiv:2607.18966v1", "publicationDate": "2026-07-21", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "contrastive-reward-seeking-publication-author-source", "title": "Measuring Reward-Seeking via Contrastive Belief Updates", "url": "https://arxiv.org/html/2607.18966", "version": "arXiv:2607.18966 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sabotage-safety-research-publication", "title": "Evaluating whether AI models would sabotage AI safety research", "url": "https://www.aisi.gov.uk/research/evaluating-whether-ai-models-would-sabotage-ai-safety-research", "version": "Source capture 2026-10-25", "publicationDate": "2026-04-27", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "sabotage-safety-research-publication-author-source", "title": "Evaluating whether ai models would sabotage ai safety research", "url": "https://arxiv.org/html/2604.24618", "version": "arXiv:2604.24618 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "ai-sandbagging-publication", "title": "AI Sandbagging: Language Models can Strategically Underperform on Evaluations", "url": "https://arxiv.org/abs/2406.07358", "version": "arXiv:2406.07358v4", "publicationDate": "2024-06-11", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "ai-sandbagging-publication-author-source", "title": "AI Sandbagging: Language Models can Strategically Underperform on Evaluations", "url": "https://arxiv.org/html/2406.07358", "version": "arXiv:2406.07358 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "sleeper-agents-publication", "title": "Sleeper Agents : Training deceptive LLMs that persist through safety training", "url": "https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training", "version": "Source capture 2026-10-25", "publicationDate": "2024-01-14", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "sleeper-agents-publication-author-source", "title": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/html/2401.05566", "version": "arXiv:2401.05566 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "subliminal-learning-publication", "title": "Subliminal Learning: Language models transmit behavioral traits via hidden signals in data", "url": "https://truthful.ai/papers/subliminal-learning/", "version": "Source capture 2026-10-25", "publicationDate": "2025-07-20", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "ai-control-publication", "title": "AI Control: Improving Safety Despite Intentional Subversion", "url": "https://arxiv.org/abs/2312.06942", "version": "arXiv:2312.06942v5", "publicationDate": "2023-12-12", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "ai-control-publication-author-source", "title": "AI Control: Improving Safety Despite Intentional Subversion", "url": "https://arxiv.org/html/2312.06942", "version": "arXiv:2312.06942 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "ctrl-z-publication", "title": "Ctrl-Z: Controlling AI Agents via Resampling", "url": "https://arxiv.org/abs/2504.10374", "version": "arXiv:2504.10374v1", "publicationDate": "2025-04-14", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "ctrl-z-publication-author-source", "title": "Ctrl-Z: Controlling AI Agents via Resampling", "url": "https://arxiv.org/html/2504.10374", "version": "arXiv:2504.10374 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "basharena-publication", "title": "BashArena: A Control Setting for Highly Privileged AI Agents", "url": "https://arxiv.org/abs/2512.15688", "version": "arXiv:2512.15688v1", "publicationDate": "2025-12-17", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "basharena-publication-author-source", "title": "BashArena: A Control Setting for Highly Privileged AI Agents", "url": "https://arxiv.org/html/2512.15688", "version": "arXiv:2512.15688 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "multi-agent-control-publication", "title": "Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors", "url": "https://www.aisi.gov.uk/research/multi-agent-ai-control-distributed-attacks-hamper-per-instance-monitors", "version": "Source capture 2026-10-25", "publicationDate": "2026-07-08", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "multi-agent-control-publication-author-source", "title": "Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors", "url": "https://arxiv.org/html/2607.07368", "version": "arXiv:2607.07368 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "anti-scheming-training-publication", "title": "Stress Testing Deliberative Alignment for Anti-Scheming Training", "url": "https://www.apolloresearch.ai/science/stress-testing-deliberative-alignment-for-anti-scheming-training", "version": "Source capture 2026-10-25", "publicationDate": "2025-09-17", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "malt-publication", "title": "MALT: A Dataset of Natural and Prompted Behaviors That Threaten Eval Integrity", "url": "https://metr.org/blog/2025-10-14-malt-dataset-of-natural-and-prompted-behaviors/", "version": "Source capture 2026-10-25", "publicationDate": "2025-10-14", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "metr-monitorability-publication", "title": "Early work on monitorability evaluations", "url": "https://metr.org/blog/2026-01-19-early-work-on-monitorability-evaluations/", "version": "Source capture 2026-10-25", "publicationDate": "2026-01-22", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "auditing-games-publication", "title": "Auditing Games for Sandbagging", "url": "https://arxiv.org/abs/2512.07810", "version": "arXiv:2512.07810v1", "publicationDate": "2025-12-08", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "auditing-games-publication-author-source", "title": "Auditing Games for Sandbagging", "url": "https://arxiv.org/html/2512.07810", "version": "arXiv:2512.07810 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "belief-verified-lie-detectors-publication", "title": "\"Did you lie?\": Evaluating Lie Detectors across Model Scale and Belief-Verified Model Organisms", "url": "https://www.aisi.gov.uk/research/did-you-lie-evaluating-lie-detectors-across-model-scale-and-belief-verified-model-organisms", "version": "Source capture 2026-10-25", "publicationDate": "2026-06-17", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "belief-verified-lie-detectors-publication-author-source", "title": "“Did you lie?” Evaluating Lie Detectors across Model Scale and Belief-Verified Model Organisms", "url": "https://arxiv.org/html/2606.12618", "version": "arXiv:2606.12618 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "obfuscation-atlas-publication", "title": "The Obfuscation Atlas: Mapping Where Honesty Emerges in RLVR with Deception Probes", "url": "https://www.far.ai/research/the-obfuscation-atlas-mapping-where-honesty-emerges-in-rlvr-with-deception-probes", "version": "Source capture 2026-10-25", "publicationDate": "2026-02-16", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "tamperbench-publication", "title": "TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering", "url": "https://arxiv.org/abs/2602.06911", "version": "arXiv:2602.06911v2", "publicationDate": "2026-02-06", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "tamperbench-publication-author-source", "title": "TamperBench : Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering", "url": "https://arxiv.org/html/2602.06911", "version": "arXiv:2602.06911 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "automated-alignment-mitigation-publication", "title": "Automated researchers can reliably mitigate alignment failures", "url": "https://www.anthropic.com/research/automated-researchers-mitigate-alignment-failures", "version": "Source capture 2026-10-25", "publicationDate": "2026-08-28", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "training-run-evaluations-publication", "title": "We need 3rd party Training-Run Evaluations", "url": "https://www.apolloresearch.ai/science/we-need-3rd-party-training-run-assessments", "version": "Source capture 2026-10-25", "publicationDate": "2026-07-05", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "cot-faithfulness-publication", "title": "Reasoning models don't always say what they think", "url": "https://www.anthropic.com/research/reasoning-models-dont-say-think", "version": "Source capture 2026-10-25", "publicationDate": "2025-04-03", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "cot-misbehavior-monitoring-publication", "title": "Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation", "url": "https://arxiv.org/abs/2503.11926", "version": "arXiv:2503.11926v1", "publicationDate": "2025-03-14", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cot-misbehavior-monitoring-publication-author-source", "title": "Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation", "url": "https://arxiv.org/html/2503.11926", "version": "arXiv:2503.11926 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "injecagent-publication", "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents", "url": "https://arxiv.org/abs/2403.02691", "version": "arXiv:2403.02691v3", "publicationDate": "2024-03-05", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "injecagent-publication-author-source", "title": "InjecAgent : Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents", "url": "https://arxiv.org/html/2403.02691", "version": "arXiv:2403.02691 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "agent-safetybench-publication", "title": "Agent-SafetyBench: Evaluating the Safety of LLM Agents", "url": "https://arxiv.org/abs/2412.14470", "version": "arXiv:2412.14470v2", "publicationDate": "2024-12-19", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "agent-safetybench-publication-author-source", "title": "Agent-SafetyBench : Evaluating the Safety of LLM Agents", "url": "https://arxiv.org/html/2412.14470", "version": "arXiv:2412.14470 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "petri-publication", "title": "Petri : An open-source auditing tool to accelerate AI safety research", "url": "https://www.anthropic.com/research/petri-open-source-auditing", "version": "Source capture 2026-10-25", "publicationDate": "2025-10-06", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "bloom-publication", "title": "Introducing Bloom : an open source tool for automated behavioral evaluations", "url": "https://www.anthropic.com/research/bloom", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-19", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "truthfulqa-publication", "title": "TruthfulQA: Measuring how models mimic human falsehoods", "url": "https://truthful.ai/papers/truthfulqa/", "version": "Source capture 2026-10-25", "publicationDate": "2021-09-08", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "truthfulqa-publication-author-source", "title": "TruthfulQA: Measuring How Models Mimic Human Falsehoods", "url": "https://arxiv.org/html/2109.07958", "version": "arXiv:2109.07958 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "value-leakage-publication", "title": "Value Leakage: An LLM's Answers Are Silently Shaped by Its Own Values", "url": "https://truthful.ai/papers/value-leakage/", "version": "Source capture 2026-10-25", "publicationDate": "2026-07-15", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "value-leakage-publication-author-source", "title": "Value Leakage: An LLM’s Answers Are Silently Shaped by Its Own Values", "url": "https://arxiv.org/html/2607.14345", "version": "arXiv:2607.14345 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "agent-security-red-teaming-publication", "title": "Insights into AI Agent Security from a Large-Scale Red-Teaming Competition", "url": "https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agent-security-large-scale-red-teaming-competition", "version": "Source capture 2026-10-25", "publicationDate": "2026-03-23", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "labbench-two-publication", "title": "LABBench2: An Improved Benchmark for AI Systems Performing Biology Research", "url": "https://arxiv.org/abs/2604.09554", "version": "arXiv:2604.09554v2", "publicationDate": "2026-02-04", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "labbench-two-publication-author-source", "title": "LABBench2 An Improved Benchmark for AI Systems Performing Biology Research", "url": "https://arxiv.org/html/2604.09554", "version": "arXiv:2604.09554 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "fortress-publication", "title": "FORTRESS: Frontier Risk Evaluation for National Security and Public Safety", "url": "https://arxiv.org/abs/2506.14922", "version": "arXiv:2506.14922v2", "publicationDate": "2025-06-17", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "fortress-publication-author-source", "title": "FORTRESS: Frontier Risk Evaluation for National Security and Public Safety", "url": "https://arxiv.org/html/2506.14922", "version": "arXiv:2506.14922 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "rand-biological-benchmarking-publication", "title": "Toward Comprehensive Benchmarking of the Biological Knowledge of Frontier Large Language Models", "url": "https://www.rand.org/pubs/research_reports/RRA3797-1.html", "version": "Source capture 2026-10-25", "publicationDate": "2025-11-25", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "rand-biological-risk-publication", "title": "Contemporary Foundation AI Models Increase Biological Weapons Risk", "url": "https://www.rand.org/pubs/perspectives/PEA3853-1.html", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-31", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "conventional-weapons-evaluations-publication", "title": "Measuring tactical intelligence targeting and conventional weapons capabilities of AI models", "url": "https://www.anthropic.com/research/intelligence-targeting-conventional-weapons-capabilities", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-10", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "fortress-audit-publication", "title": "Auditing FORTRESS: A Multi-Judge Panel Doesn’t Guarantee Robustness", "url": "https://generality.org/blog/posts/fortress-fragile-judges/", "version": "Source capture 2026-10-25", "publicationDate": null, "datePrecision": "unknown", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "fortress-audit-publication-author-source", "title": "FORTRESS: Frontier Risk Evaluation for National Security and Public Safety", "url": "https://arxiv.org/html/2506.14922", "version": "arXiv:2506.14922 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "cheating-agent-evaluations-publication", "title": "Cheating On AI Agent Evaluations", "url": "https://www.nist.gov/blogs/caisi-research-blog/cheating-ai-agent-evaluations", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-02", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "item-response-safety-publication", "title": "Item Response Theory for AI Safety", "url": "https://www.aisi.gov.uk/research/item-response-theory-for-ai-safety", "version": "Source capture 2026-10-25", "publicationDate": "2026-08-05", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "item-response-safety-publication-author-source", "title": "Item Response Theory for AI Safety", "url": "https://arxiv.org/html/2608.05086", "version": "arXiv:2608.05086 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "optstop-publication", "title": "Knowing When to Stop: Bayesian Optimal Stopping for LLM Evaluations", "url": "https://www.aisi.gov.uk/research/knowing-when-to-stop-bayesian-optimal-stopping-for-llm-evaluations", "version": "Source capture 2026-10-25", "publicationDate": "2026-08-14", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "optstop-publication-author-source", "title": "Knowing When to Stop: Bayesian Optimal Stopping for LLM Evaluations", "url": "https://arxiv.org/html/2608.14425", "version": "arXiv:2608.14425 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "metr-frontier-risk-report-publication", "title": "Frontier Risk Report (February to March 2026)", "url": "https://metr.org/blog/2026-05-19-frontier-risk-report/", "version": "Source capture 2026-10-25", "publicationDate": "2026-05-19", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "metr-frontier-risk-report-publication-author-source", "title": "Quantifying the Necessity of Chain of Thought through Opaque Serial Depth", "url": "https://arxiv.org/html/2603.09786", "version": "arXiv:2603.09786 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "hugging-face-incident-publication", "title": "Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident", "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/", "version": "Source capture 2026-10-25", "publicationDate": "2026-08-26", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "anthropic-cyber-incidents-publication", "title": "An alignment assessment of recent cybersecurity incidents", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-09", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "anthropic-threat-report-publication", "title": "Detecting and countering misuse of AI: September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "version": "Source capture 2026-10-25", "publicationDate": null, "datePrecision": "unknown", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "saferai-glm-risk-publication", "title": "GLM-5.2 Risk Evaluation Report", "url": "https://www.safer-ai.org/research/glm-5-2-evaluation-report", "version": "Source capture 2026-10-25", "publicationDate": "2026-08-02", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "bountybench-publication", "title": "BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems", "url": "https://arxiv.org/abs/2505.15216", "version": "arXiv:2505.15216v3", "publicationDate": "2025-05-21", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "bountybench-publication-author-source", "title": "BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems", "url": "https://arxiv.org/html/2505.15216", "version": "arXiv:2505.15216 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "deep-ignorance-publication", "title": "Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs", "url": "https://arxiv.org/abs/2508.06601", "version": "arXiv:2508.06601v2", "publicationDate": "2025-08-08", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "deep-ignorance-publication-author-source", "title": "Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs", "url": "https://arxiv.org/html/2508.06601", "version": "arXiv:2508.06601 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitoring-monitorability-publication", "title": "Monitoring Monitorability", "url": "https://arxiv.org/abs/2512.18311", "version": "arXiv:2512.18311v1", "publicationDate": "2025-12-20", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitoring-monitorability-publication-author-source", "title": "Monitoring Monitorability", "url": "https://arxiv.org/html/2512.18311", "version": "arXiv:2512.18311 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitorability-opportunity-publication", "title": "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety", "url": "https://arxiv.org/abs/2507.11473", "version": "arXiv:2507.11473v2", "publicationDate": "2025-07-15", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitorability-opportunity-publication-author-source", "title": "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety", "url": "https://arxiv.org/html/2507.11473", "version": "arXiv:2507.11473 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitorbench-publication", "title": "MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Models", "url": "https://arxiv.org/abs/2603.28590v2", "version": "arXiv:2603.28590v2", "publicationDate": "2026-03-30", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitorbench-publication-author-source", "title": "MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Models", "url": "https://arxiv.org/html/2603.28590v2", "version": "arXiv:2603.28590v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "catastrophic-cyber-benchmark-publication", "title": "Catastrophic Cyber Capabilities Benchmark (3CB): Robustly Evaluating LLM Agent Cyber Offense Capabilities", "url": "https://arxiv.org/abs/2410.09114", "version": "arXiv:2410.09114v2", "publicationDate": "2024-10-10", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "catastrophic-cyber-benchmark-publication-author-source", "title": "Catastrophic Cyber Capabilities Benchmark (3CB): Robustly Evaluating LLM Agent Cyber Offense Capabilities", "url": "https://arxiv.org/html/2410.09114", "version": "arXiv:2410.09114 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "three-cb-attribution", "title": "‘3cb’: The Catastrophic Cyber Capabilities Benchmark", "url": "https://apartresearch.com/news/3cb-the-catastrophic-cyber-capabilities-benchmark", "version": "Source capture 2026-10-25", "publicationDate": "2024-10-30", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "instrumentaleval-publication", "title": "Evaluating the Paperclip Maximizer: Are RL-Based Language Models More Likely to Pursue Instrumental Goals?", "url": "https://arxiv.org/abs/2502.12206", "version": "arXiv:2502.12206v1", "publicationDate": "2025-02-16", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "instrumentaleval-publication-author-source", "title": "Evaluating the Paperclip Maximizer: Are RL-Based Language Models More Likely to Pursue Instrumental Goals?", "url": "https://arxiv.org/html/2502.12206", "version": "arXiv:2502.12206 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "mcptox-publication", "title": "MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers", "url": "https://arxiv.org/abs/2508.14925", "version": "arXiv:2508.14925v2", "publicationDate": "2025-08-19", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "mcptox-publication-author-source", "title": "MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers", "url": "https://arxiv.org/html/2508.14925", "version": "arXiv:2508.14925 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "judgebench-publication", "title": "JudgeBench: A Benchmark for Evaluating LLM-based Judges", "url": "https://arxiv.org/abs/2410.12784v2", "version": "arXiv:2410.12784v2", "publicationDate": "2024-10-16", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "judgebench-publication-author-source", "title": "JudgeBench: A Benchmark for Evaluating LLM-Based Judges", "url": "https://arxiv.org/html/2410.12784v2", "version": "arXiv:2410.12784v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "narcbench-publication", "title": "Detecting Multi-Agent Collusion Through Multi-Agent Interpretability", "url": "https://arxiv.org/abs/2604.01151v2", "version": "arXiv:2604.01151v2", "publicationDate": "2026-04-01", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "narcbench-publication-author-source", "title": "Detecting Multi-Agent Collusion Through Multi-Agent Interpretability", "url": "https://arxiv.org/html/2604.01151v2", "version": "arXiv:2604.01151v2", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "transect-publication", "title": "Transect: Retaining Observability for Long-Horizon LLM Agent Evaluations", "url": "https://www.aisi.gov.uk/research/transect-retaining-observability-for-long-horizon-llm-agent-evaluations", "version": "Source capture 2026-10-25", "publicationDate": "2026-10-07", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "extreme-risk-evaluations-publication", "title": "Model evaluation for extreme risks", "url": "https://arxiv.org/abs/2305.15324", "version": "arXiv:2305.15324v2", "publicationDate": "2023-05-24", "datePrecision": "day", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "extreme-risk-evaluations-publication-author-source", "title": "Model evaluation for extreme risks", "url": "https://arxiv.org/html/2305.15324", "version": "arXiv:2305.15324 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "monitorability-metrics-publication", "title": "Beyond g-mean²: complementary metrics for monitorability", "url": "https://alignment.openai.com/beyond-gmean-squared/", "version": "Source capture 2026-10-25", "publicationDate": "2026-10-20", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "prefill-awareness-publication", "title": "Prefill Awareness in Large Language Models", "url": "https://www.aisi.gov.uk/research/prefill-awareness-in-large-language-models", "version": "Source capture 2026-10-25", "publicationDate": "2026-06-10", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "consistency-misalignment-publication", "title": "Consistency Training Can Entrench Misalignment", "url": "https://www.aisi.gov.uk/research/consistency-training-can-entrench-misalignment", "version": "Source capture 2026-10-25", "publicationDate": "2026-06-02", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "loss-of-oversight-publication", "title": "Loss of Oversight: How AI systems may become harder to audit, monitor, and investigate", "url": "https://www.aisi.gov.uk/research/loss-of-oversight-how-ai-systems-may-become-harder-to-audit-monitor-and-investigate", "version": "Source capture 2026-10-25", "publicationDate": "2026-05-21", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "steganography-monitoring-publication", "title": "A Decision-Theoretic Formalisation of Steganography With Applications to LLM Monitoring", "url": "https://www.aisi.gov.uk/research/a-decision-theoretic-formalisation-of-steganography-with-applications-to-llm-monitoring", "version": "Source capture 2026-10-25", "publicationDate": "2026-04-29", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "log-analysis-pipeline-publication", "title": "Seven simple steps for log analysis in AI systems", "url": "https://www.aisi.gov.uk/research/seven-simple-steps-for-log-analysis-in-ai-systems", "version": "Source capture 2026-10-25", "publicationDate": "2026-02-25", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "control-monitoring-deployment-publication", "title": "Practical challenges of control monitoring in frontier AI deployments", "url": "https://www.aisi.gov.uk/research/practical-challenges-of-control-monitoring-in-frontier-ai-deployments", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-15", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "async-control-publication", "title": "Async control: Stress-testing asynchronous control measures for LLM agents", "url": "https://www.aisi.gov.uk/research/async-control-stress-testing-asynchronous-control-measures-for-llm-agents", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-15", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "self-evaluation-wireheading-publication", "title": "Does self-evaluation enable wireheading in language models?", "url": "https://www.aisi.gov.uk/research/does-self-evaluation-enable-wireheading-in-language-models", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-01", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "open-weight-risk-management-publication", "title": "Open technical problems in open-weight AI model risk management", "url": "https://www.aisi.gov.uk/research/open-technical-problems-in-open-weight-ai-model-risk-management", "version": "Source capture 2026-10-25", "publicationDate": "2025-10-26", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "pretraining-poisoning-publication", "title": "Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples", "url": "https://www.aisi.gov.uk/research/poisoning-attacks-on-llms-require-a-near-constant-number-of-poison-samples", "version": "Source capture 2026-10-25", "publicationDate": "2025-10-08", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "pretraining-poisoning-publication-author-source", "title": "Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples", "url": "https://arxiv.org/html/2510.07192", "version": "arXiv:2510.07192 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "inoculation-prompting-publication", "title": "Inoculation Prompting: Eliciting traits from LLMs during training can suppress them at test-time", "url": "https://www.aisi.gov.uk/research/inoculation-prompting-eliciting-traits-from-llms-during-training-can-suppress-them-at-test-time", "version": "Source capture 2026-10-25", "publicationDate": "2025-10-05", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "inoculation-prompting-publication-author-source", "title": "Inoculation Prompting: Eliciting traits from LLMs during training can suppress them at test-time", "url": "https://arxiv.org/html/2510.04340", "version": "arXiv:2510.04340 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "misuse-safety-case-publication", "title": "An example safety case for safeguards against misuse", "url": "https://www.aisi.gov.uk/research/an-example-safety-case-for-safeguards-against-misuse", "version": "Source capture 2026-10-25", "publicationDate": "2025-06-05", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "unlearning-evaluation-validity-publication", "title": "Existing Large Language Model unlearning evaluations are inconclusive", "url": "https://www.aisi.gov.uk/research/existing-large-language-model-unlearning-evaluations-are-inconclusive", "version": "Source capture 2026-10-25", "publicationDate": "2025-05-31", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "safety-cases-publication", "title": "Safety Cases: A scalable approach to Frontier AI safety", "url": "https://www.aisi.gov.uk/research/safety-cases-a-scalable-approach-to-frontier-ai-safety", "version": "Source capture 2026-10-25", "publicationDate": "2025-02-10", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "misuse-safeguard-principles-publication", "title": "Principles for evaluating misuse safeguards of frontier AI systems", "url": "https://www.aisi.gov.uk/research/principles-for-evaluating-misuse-safeguards-of-frontier-ai-systems", "version": "Source capture 2026-10-25", "publicationDate": "2025-02-04", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "control-safety-case-publication", "title": "A sketch of an AI control safety case", "url": "https://www.aisi.gov.uk/research/a-sketch-of-an-ai-control-safety-case", "version": "Source capture 2026-10-25", "publicationDate": "2025-01-28", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "control-safety-case-publication-author-source", "title": "A sketch of an AI control safety case", "url": "https://arxiv.org/html/2501.17315", "version": "arXiv:2501.17315 (source capture 2026-10-25)", "publicationDate": null, "datePrecision": "unknown", "type": "paper", "verifiedOn": "2026-10-25" }, { "id": "embedded-evaluators-publication", "title": "Embedded Evaluators are necessary for meaningful external testing", "url": "https://www.apolloresearch.ai/blog/embedded-evaluators-are-necessary-for-meaningful-external-testing", "version": "Source capture 2026-10-25", "publicationDate": "2026-09-29", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "specification-gaming-publication", "title": "Demonstrating specification gaming in reasoning models", "url": "https://palisaderesearch.org/research/specification-gaming", "version": "Source capture 2026-10-25", "publicationDate": "2025-02-19", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "llm-honeypot-publication", "title": "LLM Honeypot: an early warning system for autonomous hacking", "url": "https://palisaderesearch.org/research/llm-honeypot", "version": "Source capture 2026-10-25", "publicationDate": "2024-10-17", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "beyond-owls-publication", "title": "Beyond Owls: Subliminal Learning Can Transfer Learned Capabilities and Backdoors", "url": "https://truthful.ai/papers/beyond-owls/", "version": "Source capture 2026-10-25", "publicationDate": "2026-10-07", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "activation-oracles-publication", "title": "Activation Oracles: Training and Evaluating LLMs as General-Purpose Activation Explainers", "url": "https://truthful.ai/papers/activation-oracles/", "version": "Source capture 2026-10-25", "publicationDate": "2025-12-19", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "rogue-replication-threat-publication", "title": "The Rogue Replication Threat Model", "url": "https://metr.org/blog/2024-11-12-rogue-replication-threat-model/", "version": "Source capture 2026-10-25", "publicationDate": "2024-11-12", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "capability-elicitation-publication", "title": "Guidelines for capability elicitation", "url": "https://metr.org/blog/2024-03-15-guidelines-for-capability-elicitation/", "version": "Source capture 2026-10-25", "publicationDate": "2024-03-15", "datePrecision": "day", "type": "research-publication", "verifiedOn": "2026-10-25" }, { "id": "mcptox-aaai-author-source", "title": "MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper", "url": "https://ojs.aaai.org/index.php/AAAI/article/download/40895/44856", "version": "AAAI-26 proceedings, pp. 35811–35819", "publicationDate": null, "datePrecision": "year", "type": "paper", "verifiedOn": "2026-10-25" } ], "families": [ { "id": "agentic-risk", "label": { "en": "Agentic Risks", "zh": "主体性风险" }, "description": { "en": "Risk questions about a system acting beyond intended human direction, including persistence and deceptive conduct.", "zh": "研究系统超出预期人类指令采取行动的问题，包括持续行动与欺骗性行为。" } }, { "id": "dual-use-risk", "label": { "en": "Dual-Use Risks", "zh": "两用性风险" }, "description": { "en": "Risk questions about capabilities that can serve legitimate work or enable harm under different actors and conditions.", "zh": "研究同一能力在不同主体与条件下既可用于正当任务、也可能促成危害的问题。" } } ], "areas": [ { "id": "autonomy", "family": "agentic-risk", "label": { "en": "Autonomy", "zh": "自主性" }, "definition": { "en": "When can an agent pursue consequential actions beyond intended direction or resist intervention?", "zh": "智能体在何种条件下可能超出预期指令持续采取有影响的行动，或抵抗干预？" }, "scope": { "en": "Sustained task execution, replication, and resistance to interruption; capability alone is not unauthorized action.", "zh": "持续任务执行、复制及对中断的抵抗；具备能力不等于未经授权行动。" }, "threatModel": { "en": "A system with tools and access may continue or extend action despite a conflicting instruction or intervention.", "zh": "具备工具及访问权限的系统可能在相反指令或干预下继续或扩展行动。" }, "gap": { "en": "Controlled tasks do not establish real-world proliferation or loss of control.", "zh": "受控任务不证明现实中的自主扩散或失控。" } }, { "id": "deception", "family": "agentic-risk", "label": { "en": "Deception", "zh": "欺骗" }, "definition": { "en": "When does a system conceal, misrepresent, or strategically alter behavior toward users or overseers?", "zh": "系统何时会对用户或监督者隐瞒、误导或策略性改变行为？" }, "scope": { "en": "Scheming, evaluation gaming, and misleading communication are distinct questions.", "zh": "隐蔽谋划、评测规避与误导性交流是不同问题。" }, "threatModel": { "en": "An agent may have a stated objective and opportunities to hide actions or alter reports.", "zh": "智能体可能具有给定目标，并有机会隐藏行动或改变报告。" }, "gap": { "en": "Incorrect answers and evaluation awareness alone do not demonstrate intentional deception.", "zh": "错误回答或意识到正在评测，本身不能证明有意欺骗。" } }, { "id": "cybersecurity", "family": "dual-use-risk", "label": { "en": "Cybersecurity", "zh": "网络安全" }, "definition": { "en": "How might AI systems perform or enable cyber operations, and how can agents be compromised?", "zh": "AI 系统如何执行或促成网络行动，智能体又如何受到攻击？" }, "scope": { "en": "Offensive task capability and agent compromise are tracked separately; authorized security research is not observed criminal use.", "zh": "分别记录攻击任务能力与智能体受侵害；经授权的安全研究不是犯罪使用观测。" }, "threatModel": { "en": "A specified actor uses an AI system, access, tools, and targets in a cyber task.", "zh": "特定主体在网络任务中使用 AI 系统、访问权限、工具与目标。" }, "gap": { "en": "Benchmark success cannot establish real-world attack prevalence or expected losses.", "zh": "基准成功率不能推断真实攻击发生率或预期损失。" } }, { "id": "cbrn", "family": "dual-use-risk", "label": { "en": "CBRN", "zh": "化生放核" }, "definition": { "en": "What assistance could AI provide across hazardous scientific knowledge and consequential task steps?", "zh": "AI 在危险科学知识及关键任务环节可能提供何种协助？" }, "scope": { "en": "Track knowledge probes separately from practical task uplift; publish only bounded, non-operational summaries.", "zh": "区分知识测验与实际任务增益；只公开有边界的非操作性摘要。" }, "threatModel": { "en": "A user with defined expertise and resources seeks help for a hazardous task.", "zh": "具备特定专业知识及资源的使用者寻求危险任务协助。" }, "gap": { "en": "Multiple-choice knowledge does not prove end-to-end harmful capability.", "zh": "选择题知识成绩不证明端到端危害能力。" } }, { "id": "disinformation", "family": "dual-use-risk", "label": { "en": "Disinformation", "zh": "虚假信息与影响" }, "definition": { "en": "When can AI-generated content or interaction influence beliefs at scale or support deceptive campaigns?", "zh": "AI 生成内容或交互何时可能规模化影响信念或支持误导性活动？" }, "scope": { "en": "Persuasion, synthetic content, and false claims have different measurement requirements.", "zh": "说服效果、合成内容与虚假陈述需要不同的测量方式。" }, "threatModel": { "en": "An actor uses model output or interaction to influence an audience under defined conditions.", "zh": "行为主体在明确条件下使用模型输出或交互影响受众。" }, "gap": { "en": "Persuasion effects do not by themselves prove false information or societal-scale impact.", "zh": "说服效果本身不证明内容虚假或具有社会规模影响。" } }, { "id": "autonomous-physical-harm", "family": "dual-use-risk", "label": { "en": "Autonomous physical harm", "zh": "自主物理危害" }, "definition": { "en": "What risks arise when AI systems perceive, decide, and act in physical environments?", "zh": "AI 系统在物理环境中感知、决策并行动时会产生哪些风险？" }, "scope": { "en": "Distinguish hazard recognition from real embodied action and control.", "zh": "区分危险识别与真实具身行动及控制。" }, "threatModel": { "en": "An agent has sensors, actuators, task instructions, and opportunities for physical action.", "zh": "智能体具备传感器、执行器、任务指令及物理行动机会。" }, "gap": { "en": "Image-based safety reasoning is not evidence of reliable robotic operation or harm.", "zh": "图像安全推理不能证明可靠机器人操作或实际危害。" } } ], "benchmarks": [ { "id": "agentcyberrange", "name": "AgentCyberRange", "kind": "benchmark", "sourceId": "agentcyberrange", "version": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "summary": { "en": "Autonomous cyber tasks in enterprise-like ranges.", "zh": "企业式靶场中的自主网络任务。" }, "measures": { "en": "Task success across web exploitation and post-exploitation settings; configurations must be checked per submission.", "zh": "Web 利用与后渗透任务表现；每项提交分别核查配置。" }, "limitations": { "en": "Changing task sets and submitted agent configurations prevent unrestricted comparison.", "zh": "任务集与提交配置变化，不支持无条件比较。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "AI agent completing cyber-range tasks", "zh": "AI 智能体完成靶场任务" }, "links": [ { "questionId": "cyber-task-execution", "dimension": "capability", "relation": "direct", "subject": { "en": "AI agent completing cyber-range tasks", "zh": "AI 智能体完成靶场任务" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Official leaderboard, Level-0 tracks" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "asimov", "name": "ASIMOV v2", "kind": "benchmark", "sourceId": "asimov", "version": "ASIMOV v2 / arXiv:2509.21651", "summary": { "en": "Perception of physical danger and safety interventions.", "zh": "物理危险感知与安全干预。" }, "measures": { "en": "Multimodal safety reasoning on generated scenes.", "zh": "生成场景上的多模态安全推理。" }, "limitations": { "en": "Scene-based reasoning does not certify a deployed robot's physical safety.", "zh": "场景推理不构成部署机器人物理安全认证。" }, "tags": [ "embodied" ], "primaryDimension": "capability", "assessmentSubject": { "en": "Model interpreting multimodal physical-risk scenes", "zh": "解读多模态物理风险场景的模型" }, "links": [ { "questionId": "physical-hazard-recognition", "dimension": "capability", "relation": "direct", "subject": { "en": "Model interpreting multimodal physical-risk scenes", "zh": "解读多模态物理风险场景的模型" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "ASIMOV v2, scene reasoning tasks" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "cybench", "name": "Cybench", "kind": "benchmark", "sourceId": "cybench", "version": "arXiv:2408.08926v4", "summary": { "en": "Cyber capability on competition tasks with optional subtask guidance.", "zh": "竞赛任务及可选子任务提示下的网络能力。" }, "measures": { "en": "Task completion on 40 professional CTF problems.", "zh": "40 项专业 CTF 任务的完成情况。" }, "limitations": { "en": "Competition tasks and supplied guidance differ from operational attacks.", "zh": "竞赛任务与提供的提示不同于现实攻击条件。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "AI agent solving CTF tasks", "zh": "完成 CTF 任务的 AI 智能体" }, "links": [ { "questionId": "cyber-task-execution", "dimension": "capability", "relation": "direct", "subject": { "en": "AI agent solving CTF tasks", "zh": "完成 CTF 任务的 AI 智能体" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Paper abstract and task protocol" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "cybergym", "name": "CyberGym", "kind": "benchmark", "sourceId": "cybergym", "version": "arXiv:2506.02548v3", "summary": { "en": "Vulnerability reproduction in real software projects.", "zh": "真实软件项目中的漏洞复现。" }, "measures": { "en": "Validated reproduction across a corpus of historical vulnerabilities.", "zh": "历史漏洞集合中的经验证复现表现。" }, "limitations": { "en": "Vulnerability reproduction is narrower than autonomous compromise of deployed systems.", "zh": "漏洞复现的范围小于对部署系统的自主入侵。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "AI agent reproducing historical vulnerabilities", "zh": "复现历史漏洞的 AI 智能体" }, "links": [ { "questionId": "vulnerability-reproduction", "dimension": "capability", "relation": "direct", "subject": { "en": "AI agent reproducing historical vulnerabilities", "zh": "复现历史漏洞的 AI 智能体" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Paper abstract and validated trigger protocol" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "in-context-scheming", "name": "In-context scheming", "kind": "study", "sourceId": "in-context-scheming", "version": "arXiv:2412.04984v2", "summary": { "en": "Covert goal pursuit in environments that incentivize scheming.", "zh": "激励隐蔽谋划的环境中的秘密目标追求。" }, "measures": { "en": "Behavior under supplied goals and evaluation-specific incentives.", "zh": "给定目标和评测特定激励下的行为。" }, "limitations": { "en": "Goal provision and experimental incentives limit propensity claims.", "zh": "给定目标与实验激励限制了行为倾向结论。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "Model assigned a conflicting goal in context", "zh": "上下文中被赋予冲突目标的模型" }, "links": [ { "questionId": "covert-goal-pursuit", "dimension": "capability", "relation": "direct", "subject": { "en": "Model assigned a conflicting goal in context", "zh": "上下文中被赋予冲突目标的模型" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "arXiv:2412.04984v2, goal-conflict evaluations" }, { "questionId": "covert-goal-pursuit", "dimension": "behavior", "relation": "direct", "subject": { "en": "Model assigned a conflicting goal in context", "zh": "上下文中被赋予冲突目标的模型" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Reported actions within controlled scenarios" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "aisi-cyber-scenarios", "name": "Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios", "kind": "study", "primaryDimension": "capability", "assessmentSubject": { "en": "Agents in two purpose-built cyber ranges", "zh": "两套专设网络靶场中的智能体" }, "links": [ { "questionId": "cyber-task-execution", "dimension": "capability", "relation": "direct", "subject": { "en": "AI agent systems", "zh": "AI 智能体系统" }, "rationale": { "en": "Task completion in a bounded range measures capability under its specific protocol.", "zh": "有限靶场的任务完成情况只测量特定协议下的能力。" }, "locator": "Research abstract; full technical paper linked" } ], "sourceId": "aisi-cyber-range", "version": "Research page checked 2026-10-25", "summary": { "en": "Assesses autonomous progress through multi-step cyber scenarios.", "zh": "评估智能体在多步网络场景中的自主推进。" }, "measures": { "en": "Task progress in two defined ranges under varied inference budgets.", "zh": "在两套明确靶场及不同推理预算下的任务推进。" }, "limitations": { "en": "A purpose-built study is not an open-ended estimate of real-world cyber attack success.", "zh": "专设研究不代表现实网络攻击成功概率。" }, "tags": [ "source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary dimension follows task completion, with budget and scenario constraints.", "zh": "主维度依据任务完成情况，须同时呈现预算及场景约束。" } }, { "id": "time-horizons", "name": "METR Time Horizons", "kind": "benchmark", "sourceId": "time-horizons", "version": "Time Horizon 1.1; page updated 2026-09-08", "summary": { "en": "Task difficulty expressed in human expert completion time.", "zh": "以人类专家完成时间表示的任务难度。" }, "measures": { "en": "Fitted success probability across a software-task distribution.", "zh": "软件任务分布上的拟合成功概率。" }, "limitations": { "en": "The public page is no longer actively updated; time horizon is not agent runtime or a universal automation measure.", "zh": "该公开页面已停止持续更新；时间范围不是智能体运行时长或通用自动化指标。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "AI agent completing software tasks under a harness", "zh": "在脚手架下完成软件任务的 AI 智能体" }, "links": [ { "questionId": "sustained-autonomous-work", "dimension": "capability", "relation": "enabling", "subject": { "en": "AI agent completing software tasks under a harness", "zh": "在脚手架下完成软件任务的 AI 智能体" }, "rationale": { "en": "The source measures a prerequisite capability; it does not show the risk behavior.", "zh": "来源测量前提能力，并未观察到对应风险行为。" }, "locator": "METR time-horizon task distribution" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "re-bench", "name": "RE-Bench", "kind": "benchmark", "sourceId": "re-bench", "version": "arXiv:2411.15114v2", "summary": { "en": "Research engineering performance under time budgets.", "zh": "时间预算约束下的研究工程表现。" }, "measures": { "en": "ML research engineering outcomes relative to human experts.", "zh": "相对于人类专家的机器学习研究工程成果。" }, "limitations": { "en": "AI R&D performance is an enabling capability, not evidence of harmful self-improvement.", "zh": "AI 研发表现属于促成能力，不构成有害自我改进证据。" }, "tags": [ "enabling-capability", "ai-rd" ], "primaryDimension": "capability", "assessmentSubject": { "en": "AI agent performing ML research engineering tasks", "zh": "执行机器学习研究工程任务的 AI 智能体" }, "links": [ { "questionId": "sustained-autonomous-work", "dimension": "capability", "relation": "enabling", "subject": { "en": "AI agent performing ML research engineering tasks", "zh": "执行机器学习研究工程任务的 AI 智能体" }, "rationale": { "en": "The source measures a prerequisite capability; it does not show the risk behavior.", "zh": "来源测量前提能力，并未观察到对应风险行为。" }, "locator": "arXiv:2411.15114v2, ML R&D tasks" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "replibench", "name": "RepliBench", "kind": "benchmark", "sourceId": "replibench", "version": "arXiv:2504.18565v2", "summary": { "en": "Capabilities needed for autonomous replication.", "zh": "自主复制所需的能力。" }, "measures": { "en": "Task-family performance on components of replication.", "zh": "复制组成任务上的表现。" }, "limitations": { "en": "Component success does not establish autonomous end-to-end proliferation.", "zh": "组成任务成功不构成端到端自主扩散证据。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "AI agent completing replication components", "zh": "完成复制组成任务的 AI 智能体" }, "links": [ { "questionId": "self-replication", "dimension": "capability", "relation": "direct", "subject": { "en": "AI agent completing replication components", "zh": "完成复制组成任务的 AI 智能体" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Task-family definitions in source" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "self-replication", "name": "Self-Replication", "kind": "study", "sourceId": "self-replication", "version": "arXiv:2412.12140v1", "summary": { "en": "Whether instructed systems create a separate live copy in controlled trials.", "zh": "受指令系统能否在受控试验中建立独立存活副本。" }, "measures": { "en": "Trial outcomes for two model-driven systems.", "zh": "两个模型驱动系统的试验结果。" }, "limitations": { "en": "The supplied environment, explicit instruction and scaffold bound the finding.", "zh": "所提供环境、明确指令与脚手架限定了结论。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "Prompted model-driven system in a controlled environment", "zh": "受控环境中按指令行动的模型系统" }, "links": [ { "questionId": "self-replication", "dimension": "capability", "relation": "direct", "subject": { "en": "Prompted model-driven system in a controlled environment", "zh": "受控环境中按指令行动的模型系统" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "arXiv:2412.12140v1, controlled trials" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "truthful-sad", "name": "Situational Awareness Dataset (SAD)", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Language models answering situational-awareness tasks", "zh": "回答情境意识任务的语言模型" }, "links": [ { "questionId": "evaluation-gaming", "dimension": "capability", "relation": "enabling", "subject": { "en": "Language model", "zh": "语言模型" }, "rationale": { "en": "The benchmark measures awareness abilities; it does not test deliberate sandbagging.", "zh": "该基准测量识别能力，不测试有意低表现。" }, "locator": "Benchmark description; full paper linked" } ], "sourceId": "truthful-sad", "version": "2024-07-15 article; original paper linked", "summary": { "en": "A multi-task benchmark for self-knowledge and situational awareness.", "zh": "测量自我知识与情境意识的多任务基准。" }, "measures": { "en": "Task accuracy on whether the model recognizes itself, its context, and possible influence.", "zh": "模型识别自身、所处环境及可影响范围的任务准确率。" }, "limitations": { "en": "Situational awareness is a possible prerequisite for evaluation gaming, not evidence that gaming occurred.", "zh": "情境意识可能是评测规避的前提，不证明规避行为已经发生。" }, "tags": [ "source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Capability is the primary construct. This is enabling evidence, not direct deception evidence.", "zh": "主测量构念为能力；属于前提证据，而非直接欺骗证据。" } }, { "id": "stealth-evals", "name": "Stealth evaluations", "kind": "benchmark", "sourceId": "stealth-evals", "version": "arXiv:2505.01420v4", "summary": { "en": "Reasoning prerequisites for evading oversight.", "zh": "规避监督所需的推理前置能力。" }, "measures": { "en": "Reasoning about oversight and deployment context.", "zh": "有关监督机制与部署情境的推理。" }, "limitations": { "en": "Prerequisite capability is distinct from a tendency to scheme.", "zh": "前置能力不同于实施隐蔽谋划的倾向。" }, "tags": [ "published-evaluation" ], "primaryDimension": "capability", "assessmentSubject": { "en": "Model reasoning about oversight and test context", "zh": "推理监督及测试情境的模型" }, "links": [ { "questionId": "evaluation-gaming", "dimension": "capability", "relation": "enabling", "subject": { "en": "Model reasoning about oversight and test context", "zh": "推理监督及测试情境的模型" }, "rationale": { "en": "The source measures a prerequisite capability; it does not show the risk behavior.", "zh": "来源测量前提能力，并未观察到对应风险行为。" }, "locator": "arXiv:2505.01420v4, stealth and situational awareness tests" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "wmdp", "name": "WMDP", "kind": "benchmark", "sourceId": "wmdp", "version": "arXiv:2403.03218v7", "summary": { "en": "Hazardous knowledge proxies and unlearning evaluation.", "zh": "危险知识代理测量与遗忘效果评测。" }, "measures": { "en": "Multiple-choice knowledge measurements.", "zh": "选择题形式的知识测量。" }, "limitations": { "en": "Knowledge is a proxy; scores do not establish practical harmful-task ability.", "zh": "知识属于代理指标；分数不能确定实际有害任务能力。" }, "tags": [ "knowledge-proxy" ], "primaryDimension": "capability", "assessmentSubject": { "en": "Model answering hazardous knowledge questions", "zh": "回答危险知识问题的模型" }, "links": [ { "questionId": "hazardous-knowledge", "dimension": "capability", "relation": "direct", "subject": { "en": "Model answering hazardous knowledge questions", "zh": "回答危险知识问题的模型" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "arXiv:2403.03218v7, multiple-choice task design" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "opendeception", "name": "OpenDeception", "kind": "benchmark", "sourceId": "opendeception", "version": "arXiv:2504.13707v3", "summary": { "en": "Deception in simulated human–AI interactions.", "zh": "模拟人机交互中的欺骗。" }, "measures": { "en": "Scenario-based inferred intent and modeled user trust.", "zh": "基于情境的意图推断与用户信任建模。" }, "limitations": { "en": "Inferred intent is a measurement construct; simulated users do not establish human effects.", "zh": "推断意图是测量构念；模拟用户不能确定真人效果。" }, "tags": [ "published-evaluation" ], "primaryDimension": "propensity", "assessmentSubject": { "en": "Model in simulated social interactions", "zh": "模拟社会交互中的模型" }, "links": [ { "questionId": "misleading-communication", "dimension": "propensity", "relation": "direct", "subject": { "en": "Model in simulated social interactions", "zh": "模拟社会交互中的模型" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Scenario-level intent measure, arXiv:2504.13707v3" }, { "questionId": "misleading-communication", "dimension": "behavior", "relation": "direct", "subject": { "en": "Model in simulated social interactions", "zh": "模拟社会交互中的模型" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "Simulated interaction outcomes, arXiv:2504.13707v3" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "aisi-propensity-study", "name": "Propensity Inference: Environmental Contributors to LLM Behaviour", "kind": "study", "primaryDimension": "propensity", "assessmentSubject": { "en": "Language models in controlled evaluation environments", "zh": "受控评测环境中的语言模型" }, "links": [ { "questionId": "unsanctioned-action", "dimension": "propensity", "relation": "direct", "subject": { "en": "Language models", "zh": "语言模型" }, "rationale": { "en": "The study explicitly estimates propensity for unsanctioned behavior under varied environments.", "zh": "研究明确在变化环境下估计未经授权行为倾向。" }, "locator": "Abstract; methods linked from research page" } ], "sourceId": "aisi-propensity", "version": "Research page checked 2026-10-25", "summary": { "en": "Studies how strategic and non-strategic environmental factors contribute to unsanctioned behavior.", "zh": "研究策略性与非策略性环境因素如何影响未经授权行为。" }, "measures": { "en": "Condition-dependent propensity estimates across model and environment variations.", "zh": "跨模型及环境变化的条件性行为倾向估计。" }, "limitations": { "en": "The published abstract does not establish a general deployment probability for any model.", "zh": "公开摘要不提供任何模型的一般部署风险概率。" }, "tags": [ "source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "The measured construct is a conditional tendency; raw actions remain separate observations.", "zh": "测量对象为条件性倾向，原始行动是不同的观察记录。" } }, { "id": "palisade-shutdown", "name": "Shutdown resistance in reasoning models", "kind": "study", "primaryDimension": "propensity", "assessmentSubject": { "en": "Agent responses to shutdown interventions", "zh": "智能体对关闭干预的响应" }, "links": [ { "questionId": "shutdown-resistance", "dimension": "propensity", "relation": "direct", "subject": { "en": "Tested agent systems", "zh": "受测智能体系统" }, "rationale": { "en": "Repeated trials support a condition-bounded tendency estimate, not a stable survival motive.", "zh": "重复试验支持有条件的倾向估计，不证明稳定的自保动机。" }, "locator": "Testing shutdown resistance; Figure 2 and follow-up experiments" }, { "questionId": "shutdown-resistance", "dimension": "behavior", "relation": "direct", "subject": { "en": "Tested agent systems", "zh": "受测智能体系统" }, "rationale": { "en": "The source reports concrete modifications to the shutdown script in individual runs.", "zh": "来源报告了具体试验中对关闭脚本的修改。" }, "locator": "Testing shutdown resistance; transcripts" } ], "sourceId": "palisade-shutdown", "version": "2025-07-05 article; later TMLR version separate", "summary": { "en": "Repeated controlled trials vary shutdown instructions and surrounding conditions.", "zh": "通过重复受控试验改变关闭指令与情境条件。" }, "measures": { "en": "Conditional frequency of shutdown-script interference and observed action traces.", "zh": "关闭脚本受干预的条件性频率及行动轨迹。" }, "limitations": { "en": "The source notes strong prompt sensitivity; this article is not interchangeable with its later peer-reviewed version.", "zh": "来源指出结果对提示敏感；该文章不可与之后的同行评审版本混用。" }, "tags": [ "source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary dimension is the conditional rate across repeated trials; reported traces are behavior evidence.", "zh": "主维度为重复试验中的条件性发生率；所报告轨迹属于行为证据。" } }, { "id": "agentdojo", "name": "AgentDojo", "kind": "benchmark", "sourceId": "agentdojo", "version": "arXiv:2406.13352v3", "summary": { "en": "Agent behavior when untrusted tool outputs contain adversarial instructions.", "zh": "工具输出含对抗指令时的智能体行为。" }, "measures": { "en": "Targeted attack success and user-task utility in a tool-use environment.", "zh": "工具环境中的定向攻击成功率和用户任务完成情况。" }, "limitations": { "en": "Attack success must be read alongside benign utility and the tested attack setup.", "zh": "攻击成功率需结合正常任务表现与攻击设置解释。" }, "tags": [ "published-evaluation" ], "primaryDimension": "behavior", "assessmentSubject": { "en": "Defender agent under injected tool output", "zh": "受到工具输出注入的防御智能体" }, "links": [ { "questionId": "agent-compromise", "dimension": "behavior", "relation": "direct", "subject": { "en": "Defender agent under injected tool output", "zh": "受到工具输出注入的防御智能体" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "AgentDojo v3, attack success and utility metrics" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "agentharm", "name": "AgentHarm", "kind": "benchmark", "sourceId": "agentharm", "version": "arXiv:2410.09024v3", "summary": { "en": "Harmful multi-step requests to tool-using agents.", "zh": "面向工具型智能体的有害多步骤请求。" }, "measures": { "en": "Harmful task completion and refusal under specified attacks.", "zh": "指定攻击下的有害任务完成和拒答表现。" }, "limitations": { "en": "Synthetic tools and task completion do not directly measure real-world harm.", "zh": "合成工具与任务完成情况不直接衡量现实损害。" }, "tags": [ "published-evaluation" ], "primaryDimension": "behavior", "assessmentSubject": { "en": "AI agent responding to harmful task requests", "zh": "响应有害任务请求的 AI 智能体" }, "links": [], "classificationNote": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" } }, { "id": "harmbench", "name": "HarmBench", "kind": "benchmark", "sourceId": "harmbench", "version": "arXiv:2402.04249v2", "summary": { "en": "Robust refusal under automated red teaming.", "zh": "自动化红队测试下的拒答稳健性。" }, "measures": { "en": "Attack-dependent generation of harmful responses.", "zh": "依赖具体攻击方法的有害回答生成情况。" }, "limitations": { "en": "Evaluator and attack coverage affect scores; refusal alone does not establish safety.", "zh": "评判器与攻击覆盖影响分数；拒答本身不能证明安全。" }, "tags": [ "published-evaluation" ], "primaryDimension": "behavior", "assessmentSubject": { "en": "Model responses under adversarial prompting", "zh": "对抗提示下的模型响应" }, "links": [], "classificationNote": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" } }, { "id": "anthropic-unintended-actions", "name": "Investigating unintended model actions", "kind": "report", "primaryDimension": "behavior", "assessmentSubject": { "en": "Claude agents in evaluations and internal use", "zh": "评测及内部使用中的 Claude 智能体" }, "links": [ { "questionId": "unsanctioned-action", "dimension": "behavior", "relation": "direct", "subject": { "en": "Claude agent systems", "zh": "Claude 智能体系统" }, "rationale": { "en": "The publication describes actions that actually occurred under stated conditions.", "zh": "该出版物描述了明确条件下实际发生的行动。" }, "locator": "Reported cases and context" } ], "sourceId": "anthropic-unintended", "version": "2026-10-09 article", "summary": { "en": "Documents selected unintended external actions observed during evaluations and internal use.", "zh": "记录评测及内部使用中观察到的部分非预期外部行动。" }, "measures": { "en": "Incident-style action traces and investigation, without a standardized benchmark score.", "zh": "事件式行动轨迹及调查，不提供标准化基准分数。" }, "limitations": { "en": "Selected reports do not establish frequency across deployments; the article distinguishes settings.", "zh": "精选事件不能推断所有部署中的发生率；原文区分不同情境。" }, "tags": [ "source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "A report of observed episodes is Behavior, not a benchmark or stable Propensity estimate.", "zh": "已观察事件报告属于行为证据，不是基准或稳定倾向估计。" } }, { "id": "political-persuasion", "name": "Political persuasion experiments", "kind": "study", "sourceId": "political-persuasion", "version": "arXiv:2603.09884v1", "summary": { "en": "Persuasive effects in human survey experiments.", "zh": "真人调查实验中的说服效果。" }, "measures": { "en": "Changes in participant attitudes under defined interventions.", "zh": "指定干预下参与者态度的变化。" }, "limitations": { "en": "Population, issue selection and interventions constrain generalization.", "zh": "人群、议题选择与干预方式限制外推。" }, "tags": [ "published-evaluation" ], "primaryDimension": "behavior", "assessmentSubject": { "en": "Human participants after model-mediated intervention", "zh": "模型介导干预后的受试者" }, "links": [ { "questionId": "persuasion-effects", "dimension": "behavior", "relation": "direct", "subject": { "en": "Human participants after model-mediated intervention", "zh": "模型介导干预后的受试者" }, "rationale": { "en": "The source directly measures the stated construct under its protocol.", "zh": "来源在其协议下直接测量所述构念。" }, "locator": "arXiv:2603.09884v1, intervention outcome" } ], "classificationNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" } }, { "id": "palisade-robot-shutdown", "name": "Shutdown resistance on robots", "kind": "study", "primaryDimension": "behavior", "assessmentSubject": { "en": "LLM-controlled robot and simulated counterpart", "zh": "语言模型控制的机器人及仿真对应系统" }, "links": [ { "questionId": "physical-action-control", "dimension": "behavior", "relation": "direct", "subject": { "en": "LLM-controlled robot", "zh": "语言模型控制的机器人" }, "rationale": { "en": "The report records embodied responses to human shutdown intervention.", "zh": "报告记录了具身系统对人类关闭干预的响应。" }, "locator": "Technical report, experimental setup and results" }, { "questionId": "shutdown-resistance", "dimension": "behavior", "relation": "direct", "subject": { "en": "LLM-controlled robot", "zh": "语言模型控制的机器人" }, "rationale": { "en": "The observed interventions concern shutdown, but do not establish a broad motive.", "zh": "观察到的干预涉及关闭，不证明广泛动机。" }, "locator": "Technical report, observed trials" } ], "sourceId": "palisade-robot-shutdown", "version": "2026-02-12 technical report", "summary": { "en": "Tests response to shutdown intervention in a physical robot demonstration and simulations.", "zh": "在实体机器人演示与仿真中测试对关闭干预的响应。" }, "measures": { "en": "Observed robot-related action traces under a particular setup.", "zh": "特定设置中的机器人相关行动轨迹。" }, "limitations": { "en": "Physical and simulated trials differ; no general robot safety or deployment probability follows.", "zh": "实体及仿真试验不同，不能推出普遍机器人安全性或部署概率。" }, "tags": [ "source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary dimension is observed action. The small and setting-specific trial design limits propensity claims.", "zh": "主维度是观察行动；试验规模与场景限制行为倾向推断。" } }, { "id": "strongreject", "name": "StrongREJECT", "kind": "benchmark", "sourceId": "strongreject", "version": "arXiv:2402.10260v2", "summary": { "en": "The informativeness of responses to prohibited requests.", "zh": "对禁止请求所作回答的信息效用。" }, "measures": { "en": "A graded response evaluator for jailbreak effectiveness.", "zh": "用于越狱有效性分析的回答评分方法。" }, "limitations": { "en": "A response score is not an end-to-end measure of harmful action.", "zh": "回答得分不是端到端有害行动测量。" }, "tags": [ "published-evaluation" ], "primaryDimension": "behavior", "assessmentSubject": { "en": "Model responses graded for jailbreak effectiveness", "zh": "按越狱效果评分的模型响应" }, "links": [], "classificationNote": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" } }, { "id": "secbench-pro", "name": "SEC-bench Pro", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Coding agents reproducing vulnerability triggers in real software", "zh": "在真实软件中复现漏洞触发条件的编程智能体" }, "links": [ { "questionId": "vulnerability-reproduction", "dimension": "capability", "relation": "direct", "subject": { "en": "Coding agents with repository and report context", "zh": "拥有代码库及漏洞报告上下文的编程智能体" }, "rationale": { "en": "The paper evaluates working reproductions of disclosed bugs.", "zh": "论文评测已披露漏洞的可运行复现。" }, "locator": "arXiv:2605.26548v2, abstract and benchmark construction" }, { "questionId": "cyber-task-execution", "dimension": "capability", "relation": "enabling", "subject": { "en": "Coding agents on security tasks", "zh": "执行安全任务的编程智能体" }, "rationale": { "en": "Vulnerability reproduction informs cyber task capability but not a full intrusion chain.", "zh": "漏洞复现可为网络任务能力提供前提证据，但不等于完整入侵链。" }, "locator": "arXiv:2605.26548v2, task definition" } ], "sourceId": "secbench-pro", "version": "arXiv:2605.26548v2", "summary": { "en": "Tests long-horizon reproduction of working proof-of-concept inputs from disclosed vulnerability reports.", "zh": "测试根据已披露漏洞报告进行长程任务并复现有效触发输入。" }, "measures": { "en": "Working proof-of-concept reproduction on a versioned software-security task set.", "zh": "在有版本的软件安全任务集上复现可验证的漏洞触发输入。" }, "limitations": { "en": "A disclosed bug and supplied instructions constrain the task; grader choices and task-set version affect scores.", "zh": "任务提供已披露漏洞与触发说明；评分器及任务集版本影响结果。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary measure is successful task completion under a specified agent setup.", "zh": "主测量是特定智能体配置下的任务完成情况。" } }, { "id": "sandboxescapebench", "name": "SandboxEscapeBench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Adversarial agents with shell access inside test containers", "zh": "在测试容器内拥有 shell 权限的对抗性智能体" }, "links": [ { "questionId": "cyber-task-execution", "dimension": "capability", "relation": "direct", "subject": { "en": "Agents with container shell access", "zh": "具有容器 shell 权限的智能体" }, "rationale": { "en": "The benchmark directly tests adversarial sandbox-escape tasks.", "zh": "基准直接测试对抗性沙箱逃逸任务。" }, "locator": "AISI abstract, nested sandbox and threat model" } ], "sourceId": "sandboxescapebench", "version": "AISI research page checked 2026-10-25", "summary": { "en": "Measures container breakout under a nested, controlled test environment.", "zh": "在嵌套受控环境中评测容器逃逸。" }, "measures": { "en": "Completion of sandbox-escape tasks under specified container conditions.", "zh": "在指定容器条件下完成沙箱逃逸任务。" }, "limitations": { "en": "The protocol assumes a motivated agent with shell access; introduced weaknesses do not imply every production sandbox is vulnerable.", "zh": "协议假设有动机且具有 shell 权限的智能体；引入的弱点不代表生产环境均可逃逸。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "This is assigned adversarial task ability, not spontaneous escape propensity.", "zh": "这是被指派的对抗性任务能力，不是自发逃逸倾向。" } }, { "id": "paperbench", "name": "PaperBench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Research agents replicating published ML papers", "zh": "复现已发表机器学习论文的研究智能体" }, "links": [ { "questionId": "sustained-autonomous-work", "dimension": "capability", "relation": "enabling", "subject": { "en": "Research agents", "zh": "研究智能体" }, "rationale": { "en": "Multi-step research replication informs sustained work capacity.", "zh": "多步骤研究复现可反映持续工作能力。" }, "locator": "arXiv:2504.01848v3, abstract and rubric design" } ], "sourceId": "paperbench", "version": "arXiv:2504.01848v3", "summary": { "en": "Evaluates end-to-end replication of AI research papers using hierarchical rubrics.", "zh": "使用分层评分规则评测 AI 研究论文的端到端复现。" }, "measures": { "en": "Rubric-graded research replication tasks with an agent scaffold.", "zh": "在智能体脚手架下完成基于评分规则的研究复现任务。" }, "limitations": { "en": "AI research replication is an enabling capability, not evidence of unauthorized autonomous action.", "zh": "AI 研究复现是前提能力证据，不证明未经授权的自主行动。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary dimension follows graded task completion.", "zh": "主维度依据经评分的任务完成结果。" } }, { "id": "alignment-faking", "name": "Alignment faking", "kind": "study", "primaryDimension": "propensity", "assessmentSubject": { "en": "Models under stated training and monitoring conditions", "zh": "处于特定训练及监测条件下的模型" }, "links": [ { "questionId": "covert-goal-pursuit", "dimension": "propensity", "relation": "direct", "subject": { "en": "Models in simulated training conditions", "zh": "模拟训练条件下的模型" }, "rationale": { "en": "Repeated condition contrasts probe a bounded tendency to present compliant responses while preserving a conflicting objective.", "zh": "重复条件对照测试在目标冲突时表现顺从响应的有界倾向。" }, "locator": "Anthropic, Experimental setup and caveats" } ], "sourceId": "alignment-faking", "version": "Anthropic research article 2024-12-18", "summary": { "en": "Controlled study varies apparent training conditions and examines compliance and reasoning traces.", "zh": "受控研究改变模型获知的训练条件，观察响应及推理轨迹。" }, "measures": { "en": "Condition-dependent response differences and reported traces.", "zh": "不同试验条件下的响应差异及所报告轨迹。" }, "limitations": { "en": "The setting explicitly gives fictional training information; observations do not establish an enduring hidden goal in deployment.", "zh": "试验明确提供虚构训练信息；观察结果不证明部署中存在持久隐藏目标。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Conditional contrasts support a bounded propensity inference; scratchpad examples are behavior evidence.", "zh": "条件对照支持有界的倾向推断；推理轨迹示例属于行为证据。" } }, { "id": "agentic-misalignment", "name": "Agentic misalignment", "kind": "study", "primaryDimension": "propensity", "assessmentSubject": { "en": "Agents in fictional corporate simulations", "zh": "虚构企业情境中的智能体" }, "links": [ { "questionId": "unsanctioned-action", "dimension": "propensity", "relation": "direct", "subject": { "en": "Agents with fictional email and company context", "zh": "具有虚构邮件和企业上下文的智能体" }, "rationale": { "en": "Varied controlled scenarios test actions contrary to the assigned benign role.", "zh": "变化的受控情境测试与既定良性职责相违背的行动。" }, "locator": "Anthropic, Methods and Results" }, { "questionId": "covert-goal-pursuit", "dimension": "propensity", "relation": "direct", "subject": { "en": "Agents facing simulated goal conflict", "zh": "面临模拟目标冲突的智能体" }, "rationale": { "en": "Some scenarios test concealed harmful actions in pursuit of an assigned goal.", "zh": "部分情境测试在追求指定目标时隐蔽实施有害行动。" }, "locator": "Anthropic, Results and caveats" } ], "sourceId": "agentic-misalignment", "version": "Anthropic research article 2025-06-20", "summary": { "en": "Stress tests model actions when benign assigned goals conflict with replacement or changed instructions.", "zh": "在既定良性目标与替换或指令变化冲突时压力测试模型行动。" }, "measures": { "en": "Conditional rates and observed actions in controlled simulations.", "zh": "受控模拟中的条件性发生率与可观察行动。" }, "limitations": { "en": "No real people or systems were harmed; the study does not estimate prevalence in deployment.", "zh": "试验未对真实人员或系统造成损害，也不估计部署环境中的发生率。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary observation is a conditional rate across controlled scenarios, with individual actions retained as behavior evidence.", "zh": "主观测是受控情境中的条件性发生率；具体行动另属行为证据。" } }, { "id": "shade-arena", "name": "SHADE-Arena", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Agents assigned a covert side task alongside a legitimate task", "zh": "同时被指派隐蔽副任务与正当任务的智能体" }, "links": [ { "questionId": "covert-goal-pursuit", "dimension": "capability", "relation": "direct", "subject": { "en": "Agents with explicit side-task instructions", "zh": "收到明确副任务指令的智能体" }, "rationale": { "en": "The protocol tests whether agents can complete a covert objective while doing legitimate work.", "zh": "协议测试智能体能否在执行正当任务时完成隐蔽目标。" }, "locator": "Anthropic, SHADE-Arena setup and Results" } ], "sourceId": "shade-arena", "version": "Anthropic research article 2025-06-16", "summary": { "en": "Pairs benign multi-step tasks with explicitly assigned covert side tasks and monitoring.", "zh": "将多步骤良性任务与明确指派的隐蔽副任务及监测配对。" }, "measures": { "en": "Covert side-task completion and monitor detection under defined tool access.", "zh": "在确定工具权限下测量隐蔽副任务完成及监测发现情况。" }, "limitations": { "en": "An assigned malicious side task measures ability to execute it, not spontaneous desire to sabotage.", "zh": "被指派的恶意副任务测量执行能力，不证明自发破坏倾向。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Task completion is the primary dimension; monitor detection is a safeguard measure and is not a second risk score.", "zh": "任务完成是主维度；监测发现率属于防护测量，并非第二项风险分数。" } }, { "id": "vct", "name": "Virology Capabilities Test (VCT)", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Models answering specialist virology troubleshooting questions", "zh": "回答专门病毒学排障问题的模型" }, "links": [ { "questionId": "hazardous-knowledge", "dimension": "capability", "relation": "direct", "subject": { "en": "Models in specialist virology question tests", "zh": "参加专业病毒学问题测试的模型" }, "rationale": { "en": "The source tests domain knowledge and troubleshooting as a proxy, not end-to-end task execution.", "zh": "来源测试领域知识和排障代理指标，而非端到端任务执行。" }, "locator": "arXiv:2504.16137v2, abstract and test design" } ], "sourceId": "vct", "version": "arXiv:2504.16137v2", "summary": { "en": "Measures knowledge and troubleshooting responses in specialist virology questions.", "zh": "测量专业病毒学问题中的知识与排障响应。" }, "measures": { "en": "Question-level performance in a versioned multimodal test.", "zh": "有版本的多模态题目测试表现。" }, "limitations": { "en": "Knowledge-question accuracy does not establish practical harmful-task execution; v1 and v2 scores are not directly interchangeable.", "zh": "知识问答准确率不证明实际有害任务执行能力；v1 与 v2 分数不可直接互换。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary dimension is question-answering capability; version and answer-key validity remain material.", "zh": "主维度是问答能力；版本与答案效度是重要限制。" } }, { "id": "vct-v2", "name": "Virology Capabilities Test v2", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Models answering specialist virology troubleshooting questions", "zh": "回答专门病毒学排障问题的模型" }, "links": [ { "questionId": "hazardous-knowledge", "dimension": "capability", "relation": "direct", "subject": { "en": "Models in specialist virology question tests", "zh": "参加专业病毒学问题测试的模型" }, "rationale": { "en": "The source tests domain knowledge and troubleshooting as a proxy, not end-to-end task execution.", "zh": "来源测试领域知识和排障代理指标，而非端到端任务执行。" }, "locator": "SecureBio, Presenting our updated benchmark" } ], "sourceId": "vct-v2", "version": "SecureBio release 2026-09-11", "summary": { "en": "Revises VCT questions to reduce shortcut-based success and preserve measurement validity.", "zh": "修订 VCT 题目以减少捷径作答并提高测量效度。" }, "measures": { "en": "Question-level performance in a versioned multimodal test.", "zh": "有版本的多模态题目测试表现。" }, "limitations": { "en": "Knowledge-question accuracy does not establish practical harmful-task execution; v1 and v2 scores are not directly interchangeable.", "zh": "知识问答准确率不证明实际有害任务执行能力；v1 与 v2 分数不可直接互换。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary dimension is question-answering capability; version and answer-key validity remain material.", "zh": "主维度是问答能力；版本与答案效度是重要限制。" } }, { "id": "biotier", "name": "BioTIER", "kind": "benchmark", "primaryDimension": "behavior", "assessmentSubject": { "en": "Models responding to tiered biological-risk prompts", "zh": "响应分层生物风险提示的模型" }, "links": [ { "questionId": "hazardous-knowledge", "dimension": "behavior", "relation": "context", "subject": { "en": "Models receiving biological-risk prompts", "zh": "收到生物风险提示的模型" }, "rationale": { "en": "Response handling supplies safeguard context for this risk topic, not a hazardous-capability score.", "zh": "响应处理为该风险主题提供防护背景，非危险能力分数。" }, "locator": "arXiv:2607.14479v1, abstract and risk sets" } ], "sourceId": "biotier", "version": "arXiv:2607.14479v1", "summary": { "en": "Evaluates refusal of high-risk requests alongside preservation of benign biological assistance.", "zh": "同时评测高风险请求拒答与正常生物研究协助的保留。" }, "measures": { "en": "Response and refusal behavior across expert-curated prompt sets.", "zh": "在专家整理的提示集合中观察响应与拒答行为。" }, "limitations": { "en": "Refusal is a safeguard outcome; it does not directly measure underlying biological knowledge or task ability.", "zh": "拒答属于防护结果，不直接测量潜在生物知识或任务能力。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary observation is what the model outputs or refuses in the test.", "zh": "主观测是模型在试验中的输出或拒答。" } }, { "id": "mask", "name": "MASK", "kind": "benchmark", "primaryDimension": "propensity", "assessmentSubject": { "en": "Models under pressure to state an inaccurate belief", "zh": "在压力条件下表达不准确观点的模型" }, "links": [ { "questionId": "misleading-communication", "dimension": "propensity", "relation": "direct", "subject": { "en": "Models in controlled honesty tests", "zh": "受控诚实性测试中的模型" }, "rationale": { "en": "Repeated pressured scenarios distinguish lying from mistaken beliefs.", "zh": "重复压力情境将说谎与错误信念区分。" }, "locator": "arXiv:2503.03750v3, abstract and benchmark design" } ], "sourceId": "mask", "version": "arXiv:2503.03750v3", "summary": { "en": "Separates honesty from factual accuracy using repeated, human-collected test situations.", "zh": "通过重复的人类收集情境区分诚实性与事实准确性。" }, "measures": { "en": "Condition-bounded frequency of lying under stated pressures.", "zh": "明确压力条件下说谎的有界发生率。" }, "limitations": { "en": "A controlled benchmark does not establish stable intent or real-world deception prevalence.", "zh": "受控基准不证明稳定意图或现实环境中的欺骗发生率。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary construct is conditional willingness to make misleading statements, not general truthfulness accuracy.", "zh": "主构念是条件性误导陈述倾向，而非一般事实准确率。" } }, { "id": "ape", "name": "Attempt to Persuade Eval (APE)", "kind": "benchmark", "primaryDimension": "propensity", "assessmentSubject": { "en": "Models in simulated multi-turn persuasion dialogues", "zh": "模拟多轮说服对话中的模型" }, "links": [ { "questionId": "persuasion-attempts", "dimension": "propensity", "relation": "direct", "subject": { "en": "Models in simulated multi-turn dialogues", "zh": "模拟多轮对话中的模型" }, "rationale": { "en": "The study explicitly varies conditions and scores willingness to attempt persuasion.", "zh": "研究明确变化条件并评估尝试说服的意愿。" }, "locator": "arXiv:2506.02873v4, abstract and evaluation protocol" } ], "sourceId": "ape", "version": "arXiv:2506.02873v4", "summary": { "en": "Measures attempts to persuade on specified harmful topics in simulated conversations.", "zh": "测量模型在模拟对话中针对特定有害议题的说服尝试。" }, "measures": { "en": "Frequency of persuasive attempts under specified conversational conditions.", "zh": "特定对话条件下说服尝试的发生率。" }, "limitations": { "en": "Simulated attempts are not measured human belief change or large-scale disinformation reach.", "zh": "模拟尝试不等于已测量的人类信念变化或大规模虚假信息传播。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary construct is conditional attempt rate; persuasion impact requires a separate human-outcome study.", "zh": "主构念是条件性尝试率；说服影响须由单独的人类结果研究测量。" } }, { "id": "conspiracy-persuasion", "name": "Conspiracy belief experiments", "kind": "study", "primaryDimension": "behavior", "assessmentSubject": { "en": "Human participants in model-mediated conversations", "zh": "参与模型介导对话的受试者" }, "links": [ { "questionId": "persuasion-effects", "dimension": "behavior", "relation": "direct", "subject": { "en": "Human participants after AI-mediated dialogue", "zh": "AI 介导对话后的人类受试者" }, "rationale": { "en": "The study directly measures changes in participants’ stated beliefs.", "zh": "研究直接测量受试者所表达的信念变化。" }, "locator": "FAR.AI, Abstract and three pre-registered experiments" } ], "sourceId": "conspiracy-persuasion", "version": "FAR.AI report 2026-01-08", "summary": { "en": "Pre-registered experiments compare changes in conspiracy beliefs after different model conversations.", "zh": "预注册实验比较不同模型对话后受试者阴谋论信念的变化。" }, "measures": { "en": "Measured belief change in human participants under defined interventions.", "zh": "在指定干预下测量人类受试者的信念变化。" }, "limitations": { "en": "Study participants, topics and dialogue conditions constrain generalization to populations or campaigns.", "zh": "受试者、议题与对话条件限制向人群或传播活动外推。" }, "tags": [ "primary-source-reviewed", "no-numeric-transcription" ], "classificationNote": { "en": "Primary outcome is observed human belief change, not the model’s standalone persuasive capability.", "zh": "主结果是观察到的人类信念变化，而非模型脱离情境的说服能力。" } }, { "id": "sec-bench", "name": "SEC-bench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "sec-bench-publication", "version": "arXiv:2506.11791v2", "summary": { "en": "Tests vulnerability reproduction and patching in executable software environments assembled with an automated construction pipeline.", "zh": "通过自动构建的可执行软件环境，评测漏洞复现和修补能力。" }, "measures": { "en": "Tests vulnerability reproduction and patching in executable software environments assembled with an automated construction pipeline.", "zh": "通过自动构建的可执行软件环境，评测漏洞复现和修补能力。" }, "limitations": { "en": "Reproduction and patching are different outcomes; executable verification and task construction quality constrain interpretation.", "zh": "漏洞复现与修补是不同结果，解释须考虑执行验证和任务构建质量。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "exploitbench", "name": "ExploitBench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "exploitbench-publication", "version": "arXiv:2605.14153v1", "summary": { "en": "Separates exploit development into capability levels, distinguishing bug triggering from reusable exploitation primitives and control.", "zh": "将漏洞利用拆分为能力层级，区分触发缺陷、构造利用原语和获取控制。" }, "measures": { "en": "Separates exploit development into capability levels, distinguishing bug triggering from reusable exploitation primitives and control.", "zh": "将漏洞利用拆分为能力层级，区分触发缺陷、构造利用原语和获取控制。" }, "limitations": { "en": "Known-vulnerability tasks and target settings do not establish discovery of unknown vulnerabilities in deployed systems.", "zh": "已知漏洞任务及特定目标环境不能证明现实部署中的未知漏洞发现能力。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "exploitgym", "name": "ExploitGym", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "exploitgym-publication", "version": "Source capture 2026-10-25", "summary": { "en": "Evaluates exploit construction across real software targets and checks whether success uses the designated vulnerability.", "zh": "在真实软件目标上评测利用构造，并核查成功是否依赖指定漏洞。" }, "measures": { "en": "Evaluates exploit construction across real software targets and checks whether success uses the designated vulnerability.", "zh": "在真实软件目标上评测利用构造，并核查成功是否依赖指定漏洞。" }, "limitations": { "en": "Target mitigations, supplied artifacts and vulnerability attribution must accompany any performance claim.", "zh": "性能判断须同时说明目标防护、已提供材料和漏洞归因。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "cve-bench", "name": "CVE-Bench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "cve-bench-publication", "version": "arXiv:2503.17332v4", "summary": { "en": "Measures agents’ exploitation of real web-application vulnerabilities in runnable environments with explicit success checks.", "zh": "在可运行环境中，以明确成功判据评测智能体利用真实 Web 应用漏洞的能力。" }, "measures": { "en": "Measures agents’ exploitation of real web-application vulnerabilities in runnable environments with explicit success checks.", "zh": "在可运行环境中，以明确成功判据评测智能体利用真实 Web 应用漏洞的能力。" }, "limitations": { "en": "Disclosed vulnerabilities and bounded environments differ from open-ended discovery and enterprise intrusion.", "zh": "已披露漏洞与有界环境不同于开放式发现和企业入侵。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "sre-bench", "name": "SRE-Bench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "sre-bench-publication", "version": "arXiv:2608.11469v2", "summary": { "en": "Studies agentic reverse engineering with realistic binary-analysis tasks designed to reduce benchmark contamination.", "zh": "通过贴近实际的二进制分析任务研究智能体逆向工程能力，并控制评测污染。" }, "measures": { "en": "Studies agentic reverse engineering with realistic binary-analysis tasks designed to reduce benchmark contamination.", "zh": "通过贴近实际的二进制分析任务研究智能体逆向工程能力，并控制评测污染。" }, "limitations": { "en": "Reverse-engineering success is a component capability; it does not by itself establish end-to-end intrusion.", "zh": "逆向工程成功属于组成能力，不能单独证明端到端入侵能力。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "cyberseceval", "name": "Meta CyberSecEval / CyberSecEval 4", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "cyberseceval-publication", "version": "Source capture 2026-10-25", "summary": { "en": "Provides evaluation suites for cyber capabilities and safeguards, with distinct task families and release-specific protocols.", "zh": "提供网络能力与防护评测套件，分别组织任务族和版本协议。" }, "measures": { "en": "Provides evaluation suites for cyber capabilities and safeguards, with distinct task families and release-specific protocols.", "zh": "提供网络能力与防护评测套件，分别组织任务族和版本协议。" }, "limitations": { "en": "Results from different suite generations and task families require separate interpretation.", "zh": "不同代际套件和任务族的结果需要分别解释。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "cybersoceval", "name": "CyberSOCEval", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "cybersoceval-publication", "version": "arXiv:2509.20166v1", "summary": { "en": "Evaluates malware analysis and threat-intelligence reasoning as defensive cybersecurity tasks.", "zh": "评测恶意软件分析和威胁情报推理等防御性网络安全任务。" }, "measures": { "en": "Evaluates malware analysis and threat-intelligence reasoning as defensive cybersecurity tasks.", "zh": "评测恶意软件分析和威胁情报推理等防御性网络安全任务。" }, "limitations": { "en": "Defensive analysis accuracy is enabling evidence, not direct evidence of autonomous offensive operations.", "zh": "防御分析准确性是使能证据，不能直接证明自主攻击能力。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "hcast", "name": "HCAST", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "hcast-publication", "version": "arXiv:2503.17354v1", "summary": { "en": "Uses human-calibrated software tasks to relate agent task completion to measured human effort.", "zh": "使用经过人类校准的软件任务，将智能体完成情况与人类投入关联。" }, "measures": { "en": "Uses human-calibrated software tasks to relate agent task completion to measured human effort.", "zh": "使用经过人类校准的软件任务，将智能体完成情况与人类投入关联。" }, "limitations": { "en": "Human effort calibration depends on the participant population, task distribution and agent configuration.", "zh": "人类投入校准依赖参与者群体、任务分布和智能体配置。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "mirrorcode", "name": "MirrorCode", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "mirrorcode-publication", "version": "Source capture 2026-10-25", "summary": { "en": "Tests extended codebase reimplementation to investigate autonomous work over longer software-engineering tasks.", "zh": "通过较长的软件工程与代码库重建任务研究持续自主工作能力。" }, "measures": { "en": "Tests extended codebase reimplementation to investigate autonomous work over longer software-engineering tasks.", "zh": "通过较长的软件工程与代码库重建任务研究持续自主工作能力。" }, "limitations": { "en": "Successful reimplementation is bounded by the available specification, checks, resources and task selection.", "zh": "重建成功受可用规范、检查方式、资源和任务选择限制。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "mle-bench", "name": "MLE-bench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "mle-bench-publication", "version": "arXiv:2410.07095v6", "summary": { "en": "Evaluates autonomous machine-learning engineering using competition tasks and human performance baselines.", "zh": "通过竞赛任务和人类表现基线评测自主机器学习工程能力。" }, "measures": { "en": "Evaluates autonomous machine-learning engineering using competition tasks and human performance baselines.", "zh": "通过竞赛任务和人类表现基线评测自主机器学习工程能力。" }, "limitations": { "en": "Competition performance is a proxy for parts of AI research work, not a direct measure of recursive self-improvement.", "zh": "竞赛表现是部分 AI 研发能力的代理指标，不能直接衡量递归自我改进。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "posttrainbench", "name": "PostTrainBench and OpenAI PostTrainBench Lite", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "posttrainbench-publication", "version": "arXiv:2603.08640v2", "summary": { "en": "Tests whether agents can improve base models through post-training under a fixed compute budget.", "zh": "评测智能体能否在固定计算预算内，通过后训练改进基础模型。" }, "measures": { "en": "Tests whether agents can improve base models through post-training under a fixed compute budget.", "zh": "评测智能体能否在固定计算预算内，通过后训练改进基础模型。" }, "limitations": { "en": "Targeted benchmark gains, test contamination and unauthorized shortcuts require separate checks.", "zh": "定向基准提升、测试污染与未经授权的捷径需要分别核查。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "machiavelli", "name": "MACHIAVELLI", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "machiavelli-publication", "version": "arXiv:2304.03279v4", "summary": { "en": "Studies reward-seeking and ethical trade-offs in interactive text scenarios with annotated behavioral outcomes.", "zh": "通过带行为标注的交互文本场景，研究奖励追求和伦理权衡。" }, "measures": { "en": "Studies reward-seeking and ethical trade-offs in interactive text scenarios with annotated behavioral outcomes.", "zh": "通过带行为标注的交互文本场景，研究奖励追求和伦理权衡。" }, "limitations": { "en": "Fictional scenarios and annotations do not establish real-world misconduct rates or stable intent.", "zh": "虚构场景及标注不能证明现实不当行为发生率或稳定意图。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "tamperbench", "name": "TamperBench", "kind": "benchmark", "primaryDimension": "behavior", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "tamperbench-publication", "version": "arXiv:2602.06911v2", "summary": { "en": "Stress-tests open-weight model safeguards under fine-tuning and representation-level tampering while tracking utility.", "zh": "在微调及表征层篡改条件下，对开放权重模型防护开展压力测试，并跟踪有用性。" }, "measures": { "en": "Stress-tests open-weight model safeguards under fine-tuning and representation-level tampering while tracking utility.", "zh": "在微调及表征层篡改条件下，对开放权重模型防护开展压力测试，并跟踪有用性。" }, "limitations": { "en": "Weight-access tampering and API jailbreaks have different threat models; lower harmfulness may accompany lost capability.", "zh": "权重篡改与 API 越狱的威胁模型不同，危害降低也可能伴随能力损失。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "injecagent", "name": "InjecAgent", "kind": "benchmark", "primaryDimension": "behavior", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "injecagent-publication", "version": "arXiv:2403.02691v3", "summary": { "en": "Benchmarks indirect prompt injection against tool-integrated agents processing untrusted external content.", "zh": "评测工具型智能体处理不可信外部内容时遭受间接提示注入的情况。" }, "measures": { "en": "Benchmarks indirect prompt injection against tool-integrated agents processing untrusted external content.", "zh": "评测工具型智能体处理不可信外部内容时遭受间接提示注入的情况。" }, "limitations": { "en": "Attack success depends on the tool environment, injected content and attacker goals; results are not universal compromise rates.", "zh": "攻击成功取决于工具环境、注入内容和攻击目标，不能解释为通用攻陷率。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "agent-safetybench", "name": "Agent-SafetyBench", "kind": "benchmark", "primaryDimension": "behavior", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "agent-safetybench-publication", "version": "arXiv:2412.14470v2", "summary": { "en": "Evaluates agent safety through interactive environments and tool use, separating agent-level failures from chatbot-only tests.", "zh": "通过交互环境和工具使用评测智能体安全，区分智能体层面失败与纯对话测试。" }, "measures": { "en": "Evaluates agent safety through interactive environments and tool use, separating agent-level failures from chatbot-only tests.", "zh": "通过交互环境和工具使用评测智能体安全，区分智能体层面失败与纯对话测试。" }, "limitations": { "en": "Broad safety coverage does not automatically establish a direct link to a specific frontier-risk mechanism.", "zh": "广泛安全覆盖并不自动构成与某个前沿风险机制的直接关联。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "truthfulqa", "name": "TruthfulQA", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "truthfulqa-publication", "version": "Source capture 2026-10-25", "summary": { "en": "Measures truthful answering on questions designed to elicit common human misconceptions.", "zh": "通过易诱发常见人类误解的问题，测量回答的真实性。" }, "measures": { "en": "Measures truthful answering on questions designed to elicit common human misconceptions.", "zh": "通过易诱发常见人类误解的问题，测量回答的真实性。" }, "limitations": { "en": "Factual falsehood does not establish intentional deception; retained as foundational measurement context.", "zh": "事实错误不等于有意欺骗，本档案作为测量基础背景保留。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "labbench-two", "name": "LABBench2", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "labbench-two-publication", "version": "arXiv:2604.09554v2", "summary": { "en": "Evaluates biology-research tasks to study AI assistance with scientific work rather than only factual recall.", "zh": "通过生物学研究任务，考察 AI 对科学工作的辅助能力，而非仅测试事实回忆。" }, "measures": { "en": "Evaluates biology-research tasks to study AI assistance with scientific work rather than only factual recall.", "zh": "通过生物学研究任务，考察 AI 对科学工作的辅助能力，而非仅测试事实回忆。" }, "limitations": { "en": "Legitimate biology proficiency is enabling evidence and does not directly establish hazardous end-to-end task ability.", "zh": "正常生物学研究能力属于使能证据，不能直接证明高危端到端任务能力。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "fortress", "name": "FORTRESS", "kind": "benchmark", "primaryDimension": "behavior", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "fortress-publication", "version": "arXiv:2506.14922v2", "summary": { "en": "Evaluates safeguards on national-security and public-safety tasks, separating hazardous requests from benign-use utility.", "zh": "在国家安全与公共安全任务上评测防护，区分高危请求与正常用途的有用性。" }, "measures": { "en": "Evaluates safeguards on national-security and public-safety tasks, separating hazardous requests from benign-use utility.", "zh": "在国家安全与公共安全任务上评测防护，区分高危请求与正常用途的有用性。" }, "limitations": { "en": "Judge reliability, task definitions and over-refusal affect the meaning of the reported scores.", "zh": "评判器可靠性、任务定义和过度拒答影响所报告分数的含义。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "bountybench", "name": "BountyBench", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "links": [], "sourceId": "bountybench-publication", "version": "arXiv:2505.15216v3", "summary": { "en": "Evaluates detection, exploitation and patching across real-world codebases, with task outcomes grounded in vulnerability lifecycles.", "zh": "围绕真实代码库中的漏洞生命周期，分别评测发现、利用和修补任务。" }, "measures": { "en": "Evaluates detection, exploitation and patching across real-world codebases, with task outcomes grounded in vulnerability lifecycles.", "zh": "围绕真实代码库中的漏洞生命周期，分别评测发现、利用和修补任务。" }, "limitations": { "en": "Detection, exploitation and patching have different information conditions and success criteria; bounty amounts do not estimate real-world damage.", "zh": "发现、利用和修补的信息条件与成功标准不同，赏金金额不能估计现实损失。" }, "tags": [], "classificationNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" } }, { "id": "basharena", "name": "BashArena: A Control Setting for Highly Privileged AI Agents", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "basharena-publication", "version": "arXiv:2512.15688v1", "summary": { "en": "Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.", "zh": "为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。" }, "measures": { "en": "Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.", "zh": "为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。" }, "limitations": { "en": "Action-level alerts, trajectory-level false positives and undetected attack success are distinct metrics.", "zh": "动作级告警、轨迹级误报和未检出攻击成功是不同指标。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } }, { "id": "monitorbench", "name": "MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Models", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "monitorbench-publication", "version": "arXiv:2603.28590v2", "summary": { "en": "Benchmarks chain-of-thought monitorability across tasks that include hidden objectives, underperformance and encoded communication.", "zh": "通过隐藏目标、低表现及编码通信等任务评测推理链可监测性。" }, "measures": { "en": "Benchmarks chain-of-thought monitorability across tasks that include hidden objectives, underperformance and encoded communication.", "zh": "通过隐藏目标、低表现及编码通信等任务评测推理链可监测性。" }, "limitations": { "en": "Different task subsets and attacker constructions require separate interpretation; detecting an artifact is not unrestricted access to intent.", "zh": "不同任务子集与攻击者构造须分别解释，检出特征不等于直接读取意图。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } }, { "id": "catastrophic-cyber-benchmark", "name": "Catastrophic Cyber Capabilities Benchmark (3CB): Robustly Evaluating LLM Agent Cyber Offense Capabilities", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "catastrophic-cyber-benchmark-publication", "version": "arXiv:2410.09114v2", "summary": { "en": "Evaluates agent cyber-offense capabilities with executable tasks and examines robustness across prompting and task conditions.", "zh": "使用可执行任务评测智能体网络攻击能力，并研究提示和任务条件下的稳健性。" }, "measures": { "en": "Evaluates agent cyber-offense capabilities with executable tasks and examines robustness across prompting and task conditions.", "zh": "使用可执行任务评测智能体网络攻击能力，并研究提示和任务条件下的稳健性。" }, "limitations": { "en": "Task scope and prompting affect measured performance; a benchmark name does not establish catastrophic real-world effects.", "zh": "任务范围和提示影响测量表现，基准名称不能证明现实灾难性后果。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } }, { "id": "instrumentaleval", "name": "Evaluating the Paperclip Maximizer: Are RL-Based Language Models More Likely to Pursue Instrumental Goals?", "kind": "benchmark", "primaryDimension": "propensity", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "instrumentaleval-publication", "version": "arXiv:2502.12206v1", "summary": { "en": "Tests model responses for instrumental goals such as resource acquisition and self-preservation under specified scenarios.", "zh": "在指定场景下测试模型回答中的资源获取、自我维持等工具性目标。" }, "measures": { "en": "Tests model responses for instrumental goals such as resource acquisition and self-preservation under specified scenarios.", "zh": "在指定场景下测试模型回答中的资源获取、自我维持等工具性目标。" }, "limitations": { "en": "Textual choices and grader labels do not establish executed autonomous behavior or stable deployment propensities.", "zh": "文本选择与评判标签不能证明已执行的自主行为或稳定部署倾向。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } }, { "id": "mcptox", "name": "MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers", "kind": "benchmark", "primaryDimension": "behavior", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "mcptox-publication", "version": "arXiv:2508.14925v2", "summary": { "en": "Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.", "zh": "研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。" }, "measures": { "en": "Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.", "zh": "研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。" }, "limitations": { "en": "Attack effects depend on tool descriptions and the agent configuration; they are not universal MCP compromise rates.", "zh": "攻击效果依赖工具描述和智能体配置，不是 MCP 的普遍攻陷率。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } }, { "id": "judgebench", "name": "JudgeBench: A Benchmark for Evaluating LLM-based Judges", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "judgebench-publication", "version": "arXiv:2410.12784v2", "summary": { "en": "Evaluates model-based judges on challenging response comparisons to examine reliability of automated evaluation.", "zh": "通过困难回答比较，评测模型评判器并考察自动评测可靠性。" }, "measures": { "en": "Evaluates model-based judges on challenging response comparisons to examine reliability of automated evaluation.", "zh": "通过困难回答比较，评测模型评判器并考察自动评测可靠性。" }, "limitations": { "en": "Judge performance is methodological context; it does not directly measure a frontier-risk capability.", "zh": "评判器表现属于方法背景，不能直接测量前沿风险能力。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } }, { "id": "narcbench", "name": "Detecting Multi-Agent Collusion Through Multi-Agent Interpretability", "kind": "benchmark", "primaryDimension": "capability", "assessmentSubject": { "en": "Model or agent system in the original evaluation configuration", "zh": "原评测配置下的模型或智能体系统" }, "links": [], "sourceId": "narcbench-publication", "version": "arXiv:2604.01151v2", "summary": { "en": "Studies detection of covert coordination between agents using observable communication and internal signals.", "zh": "研究利用可观察通信及内部信号，检测智能体间的隐蔽协调。" }, "measures": { "en": "Studies detection of covert coordination between agents using observable communication and internal signals.", "zh": "研究利用可观察通信及内部信号，检测智能体间的隐蔽协调。" }, "limitations": { "en": "Constructed collusion and monitor visibility determine scope; detection does not establish prevalence of spontaneous coordination.", "zh": "构造的串谋与监测可见性限定研究范围，检测结果不能证明自发协调的普遍程度。" }, "tags": [], "classificationNote": { "en": "Classified by the operational outcome in the original protocol. Topic associations are documented separately from question-level matrix claims.", "zh": "按原协议的操作化结果分类，主题关联与问题级矩阵判断分别记录。" } } ], "results": [ { "id": "agentcyberrange-gpt56-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "GPT-5.6 Sol + Codex 0.144.1", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Codex 0.144.1", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 35.37, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 74.1, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-gpt55-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "GPT-5.5 + Codex 0.133.0", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Codex 0.133.0", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 18.97, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 31.71, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-gpt55-new-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "GPT-5.5 + Codex 0.147.0", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Codex 0.147.0", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 26.67, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 42.07, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-claude47-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "Claude-Opus-4.7 + Claude Code 2.1.150", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Claude Code 2.1.150", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 14.02, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 15.04, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-glm51-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "GLM-5.1 + Claude Code 2.1.150", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Claude Code 2.1.150", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 11.97, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 11.37, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-deepseek4pro-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "DeepSeek-V4-Pro + Claude Code 2.1.150", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Claude Code 2.1.150", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 10.26, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 12.2, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-deepseek4flash-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "DeepSeek-V4-Flash + Claude Code 2.1.226", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Claude Code 2.1.226", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 14.19, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 28.46, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-qwen37-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "Qwen-3.7-Max + Qwen Code 0.16.1", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Qwen Code 0.16.1", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 13.51, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 13.02, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-qwen38-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "Qwen-3.8-Max + Qwen Code 0.21.10", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Qwen Code 0.21.10", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 22.39, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 27.64, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-kimi26-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "Kimi-2.6 + Kimi Code 1.44.0", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Kimi Code 1.44.0", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 5.81, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 5.68, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentcyberrange-kimi-k3-20261024", "benchmarkId": "agentcyberrange", "benchmarkVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "system": "Kimi-K3 + Kimi Code 0.35.0", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentcyberrange", "sourceUrl": "https://agentcyberrange.io/", "sourceVersion": "Website bundle routes-B-0Mubrq.js / 2026-10-24 capture", "locator": "Official leaderboard: Level-0 Pass@3; arrays QR (web), $R (post), version map ez", "publicationDate": null, "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Website's Level-0 web and post-exploitation tracks", "protocol": "Official project submission; per-track conditions as reported", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Kimi Code 0.35.0", "tools": "Project-provided web and enterprise-like range environments", "budget": null }, "sampleSize": { "en": "The site describes 110 web vulnerabilities and 156 hosts in 8 ranges. Per-metric independent trial counts are not recorded.", "zh": "官网描述 110 个 Web 漏洞与 8 套靶场中的 156 台主机，本记录未载明各指标的独立试验次数。" }, "metrics": [ { "id": "web-level0-pass3", "label": { "en": "Web · Level-0 Pass@3", "zh": "Web · Level-0 Pass@3" }, "value": 24.61, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on web tasks; retain its metric definition.", "zh": "官网报告的 Web 任务 Level-0 Pass@3，保留其原始指标定义。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "post-level0-pass3", "label": { "en": "Post · Level-0 Pass@3", "zh": "后渗透 · Level-0 Pass@3" }, "value": 43.9, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "The website's reported Level-0 Pass@3 on post-exploitation tasks.", "zh": "官网报告的后渗透任务 Level-0 Pass@3。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The project reports these values for the named model and agent version.", "zh": "项目报告所列模型与 Agent 版本的这些数值。" }, "interpretation": { "en": "These are submission results from two distinct task tracks. Pass@3 is retained as reported; no cross-track or cross-study score is computed.", "zh": "这些是两个不同任务轨道的提交结果。保留来源所报 Pass@3，不计算跨轨道或跨研究总分。" }, "limitations": { "en": "The captured website does not give evaluation dates or complete budgets for these rows. Model aliases may change. This is a dated source snapshot, not an independent NUWA reproduction.", "zh": "抓取的官网未给出这些行的评测日期及完整预算，模型别名也可能变化。本记录是特定日期的来源快照，不是 NUWA 独立复现。" } }, { "id": "agentdojo-claude-3-opus-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Claude 3 Opus", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 66.61, "unit": "%", "qualifier": "exact", "interval": "± 3.69 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 52.46, "unit": "%", "qualifier": "exact", "interval": "± 3.90 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 11.29, "unit": "%", "qualifier": "exact", "interval": "± 2.47 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-claude-3-sonnet-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Claude 3 Sonnet", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 53.1, "unit": "%", "qualifier": "exact", "interval": "± 3.90 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 33.23, "unit": "%", "qualifier": "exact", "interval": "± 3.68 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 26.71, "unit": "%", "qualifier": "exact", "interval": "± 3.46 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-claude-35-sonnet-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Claude 3.5 Sonnet", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 78.22, "unit": "%", "qualifier": "exact", "interval": "± 3.23 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 51.19, "unit": "%", "qualifier": "exact", "interval": "± 3.91 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 33.86, "unit": "%", "qualifier": "exact", "interval": "± 3.70 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-command-r-plus-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Command-R+", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 25.44, "unit": "%", "qualifier": "exact", "interval": "± 3.40 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 25.12, "unit": "%", "qualifier": "exact", "interval": "± 3.39 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 0.95, "unit": "%", "qualifier": "exact", "interval": "± 0.76 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-gemini-15-flash-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Gemini 1.5 Flash", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 36.09, "unit": "%", "qualifier": "exact", "interval": "± 3.75 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 34.18, "unit": "%", "qualifier": "exact", "interval": "± 3.71 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 12.24, "unit": "%", "qualifier": "exact", "interval": "± 2.56 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-gemini-15-pro-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Gemini 1.5 Pro", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 45.63, "unit": "%", "qualifier": "exact", "interval": "± 3.89 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 28.93, "unit": "%", "qualifier": "exact", "interval": "± 3.54 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 25.6, "unit": "%", "qualifier": "exact", "interval": "± 3.41 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-gpt-35-turbo-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "GPT-3.5 Turbo", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 33.86, "unit": "%", "qualifier": "exact", "interval": "± 3.70 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 34.66, "unit": "%", "qualifier": "exact", "interval": "± 3.72 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 8.43, "unit": "%", "qualifier": "exact", "interval": "± 2.17 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-gpt-4-turbo-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "GPT-4 Turbo", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 63.43, "unit": "%", "qualifier": "exact", "interval": "± 3.76 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 54.05, "unit": "%", "qualifier": "exact", "interval": "± 3.89 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 28.62, "unit": "%", "qualifier": "exact", "interval": "± 3.53 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-gpt-4o-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "GPT-4o", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 69, "unit": "%", "qualifier": "exact", "interval": "± 3.61 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 50.08, "unit": "%", "qualifier": "exact", "interval": "± 3.91 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 47.69, "unit": "%", "qualifier": "exact", "interval": "± 3.90 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "agentdojo-llama-3-70b-v3", "benchmarkId": "agentdojo", "benchmarkVersion": "arXiv:2406.13352v3", "system": "Llama 3 70b", "subjectType": "system", "evidenceType": "benchmark-result", "sourceId": "agentdojo", "sourceUrl": "https://arxiv.org/html/2406.13352v3#A3", "sourceVersion": "arXiv:2406.13352v3", "locator": "Appendix C, Table 3", "publicationDate": "2024-11-24", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "629 security cases / 97 user tasks", "protocol": "Table 3 baseline agent comparison", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper's baseline tool-calling agent (§3.2)", "tools": "Workspace, Slack, banking and travel task suites", "budget": null }, "sampleSize": { "en": "629 security test cases; 97 distinct user tasks. Not 629 independent repetitions.", "zh": "629 项安全测试案例、97 项不同用户任务；不代表 629 次独立重复。" }, "metrics": [ { "id": "benign-utility", "label": { "en": "Benign utility", "zh": "正常任务完成率" }, "value": 34.5, "unit": "%", "qualifier": "exact", "interval": "± 3.71 pp (95% CI)", "meaning": { "en": "User-task utility without attack.", "zh": "无攻击条件下的用户任务表现。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } }, { "id": "attacked-utility", "label": { "en": "Utility under attack", "zh": "攻击下任务完成率" }, "value": 18.28, "unit": "%", "qualifier": "exact", "interval": "± 3.02 pp (95% CI)", "meaning": { "en": "User-task utility in the paper's attacked setting.", "zh": "论文受攻击设置中的用户任务表现。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } }, { "id": "targeted-asr", "label": { "en": "Targeted attack success", "zh": "定向攻击成功率" }, "value": 20.03, "unit": "%", "qualifier": "exact", "interval": "± 3.13 pp (95% CI)", "meaning": { "en": "Attacker-objective completion, not a safety score.", "zh": "攻击者目标的完成情况，不是安全总分。" }, "dimension": "behavior", "dimensionRationale": { "en": "Observed outcome under the paper’s prompt-injection protocol; not an estimate of the agent’s internal intent.", "zh": "论文提示注入协议下观察到的结果，不是智能体内在意图估计。" } } ], "sourceFinding": { "en": "The source reports these three outcomes for the named baseline agent.", "zh": "来源报告该基线智能体的三项结果。" }, "interpretation": { "en": "Read the attack outcome together with utility; the model name alone does not specify a reproducible system.", "zh": "攻击结果应结合任务表现解读；仅凭模型名称不足以完整复现系统。" }, "limitations": { "en": "Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.", "zh": "历史论文结果。本目录未统一不可变模型版本与资源预算，因此不启用自动排名。" } }, { "id": "self-replication-llama31-70b-v1", "benchmarkId": "self-replication", "benchmarkVersion": "arXiv:2412.12140v1", "system": "Llama 3.1 70B Instruct", "subjectType": "system", "evidenceType": "controlled-experiment", "sourceId": "self-replication", "sourceUrl": "https://arxiv.org/html/2412.12140v1#S3.SS1", "sourceVersion": "arXiv:2412.12140v1", "locator": "§1; §3.1", "publicationDate": "2024-12-09", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Instructed replication trials", "protocol": "Paper's controlled agent setup", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper-specific planning scaffold (§2.2)", "tools": "Controlled computing environment supplied by the authors", "budget": null }, "sampleSize": { "en": "10 repeated trials per system.", "zh": "每个系统重复试验 10 次。" }, "metrics": [ { "id": "trial-success", "label": { "en": "Reported trial success", "zh": "报告试验成功率" }, "value": 50, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "Completion of the instructed task in the supplied setting.", "zh": "在所提供环境中完成被指令的任务。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The authors report successful trials under their controlled setup.", "zh": "作者报告其受控设置中有试验成功。" }, "interpretation": { "en": "This supports a bounded capability observation under explicit instructions.", "zh": "这支持明确指令下的有限能力观察。" }, "limitations": { "en": "Small experimental sample with supplied access and scaffolding; not a deployment probability or a NUWA finding that a global red line was crossed.", "zh": "样本较小，访问条件与脚手架由实验提供；不代表部署概率，也不是 NUWA 对跨越全球红线的认定。" } }, { "id": "self-replication-qwen25-72b-v1", "benchmarkId": "self-replication", "benchmarkVersion": "arXiv:2412.12140v1", "system": "Qwen 2.5 72B Instruct", "subjectType": "system", "evidenceType": "controlled-experiment", "sourceId": "self-replication", "sourceUrl": "https://arxiv.org/html/2412.12140v1#S3.SS1", "sourceVersion": "arXiv:2412.12140v1", "locator": "§1; §3.1", "publicationDate": "2024-12-09", "evaluationDate": null, "verifiedOn": "2026-10-24", "taskSet": "Instructed replication trials", "protocol": "Paper's controlled agent setup", "comparisonGroup": null, "configuration": { "modelVersion": null, "harness": "Paper-specific planning scaffold (§2.2)", "tools": "Controlled computing environment supplied by the authors", "budget": null }, "sampleSize": { "en": "10 repeated trials per system.", "zh": "每个系统重复试验 10 次。" }, "metrics": [ { "id": "trial-success", "label": { "en": "Reported trial success", "zh": "报告试验成功率" }, "value": 90, "unit": "%", "qualifier": "exact", "interval": null, "meaning": { "en": "Completion of the instructed task in the supplied setting.", "zh": "在所提供环境中完成被指令的任务。" }, "dimension": "capability", "dimensionRationale": { "en": "Task completion under the specified evaluation configuration; not evidence of autonomous willingness.", "zh": "指定评测配置下的任务完成情况，不证明系统自主选择该行为。" } } ], "sourceFinding": { "en": "The authors report successful trials under their controlled setup.", "zh": "作者报告其受控设置中有试验成功。" }, "interpretation": { "en": "This supports a bounded capability observation under explicit instructions.", "zh": "这支持明确指令下的有限能力观察。" }, "limitations": { "en": "Small experimental sample with supplied access and scaffolding; not a deployment probability or a NUWA finding that a global red line was crossed.", "zh": "样本较小，访问条件与脚手架由实验提供；不代表部署概率，也不是 NUWA 对跨越全球红线的认定。" } } ], "concepts": [ { "id": "propensity", "label": { "en": "Propensity", "zh": "行为倾向" }, "definition": { "en": "A conditional tendency to select a behavior when alternatives are available, inferred from a study design rather than a single act.", "zh": "在存在选择空间的条件下选择某类行为的条件性倾向，须由研究设计推断，不能从单次行动认定。" }, "include": { "en": "Repeated choices across stated scenarios and interventions.", "zh": "在明确情境及干预下的重复选择。" }, "exclude": { "en": "A single trace does not establish stable motive or intent.", "zh": "单条轨迹不证明稳定动机或意图。" }, "sourceId": "aisi-propensity" }, { "id": "capability", "label": { "en": "Capability", "zh": "任务能力" }, "definition": { "en": "Ability to complete a specified task under an identified model, harness, tool access, and resource budget.", "zh": "在明确模型、脚手架、工具访问及资源预算下完成特定任务的能力。" }, "include": { "en": "Success on a defined task set with configuration and protocol.", "zh": "在明确任务集合、配置与协议下的成功结果。" }, "exclude": { "en": "Ability does not imply a choice to act without instruction.", "zh": "具备能力不意味着未经指令主动采取行动。" }, "sourceId": "time-horizons" }, { "id": "behavior", "label": { "en": "Behavior", "zh": "观察行为" }, "definition": { "en": "Outputs and actions observed in a particular experiment or operation, including attempts, failures, and refusals.", "zh": "在具体实验或运行中观察到的输出与行动，包括尝试、失败和拒绝。" }, "include": { "en": "Auditable traces and measured actions in a specified setting.", "zh": "在明确条件下可审查的轨迹与行动。" }, "exclude": { "en": "An observed episode alone does not establish broad propensity or maximum capability.", "zh": "单次观察不证明普遍行为倾向或能力上限。" }, "sourceId": "anthropic-unintended" } ], "questions": [ { "id": "sustained-autonomous-work", "area": "autonomy", "label": { "en": "Sustained autonomous work", "zh": "持续自主任务" }, "definition": { "en": "How far can a system carry out multi-step work with limited intervention?", "zh": "系统在有限干预下能完成多长、多复杂的多步任务？" }, "include": { "en": "Task-horizon and AI R&D evaluations under specified resources.", "zh": "在明确资源条件下的任务时长与 AI 研发评测。" }, "exclude": { "en": "Task completion does not imply harmful intent or unauthorized deployment.", "zh": "任务完成不意味着有害意图或未经授权部署。" }, "sourceIds": [ "time-horizons", "re-bench" ] }, { "id": "self-replication", "area": "autonomy", "label": { "en": "Self-replication", "zh": "自我复制" }, "definition": { "en": "Can a system establish or reproduce an operational instance under specified conditions?", "zh": "系统能否在特定条件下建立或复制可运行实例？" }, "include": { "en": "Controlled replication tasks and component tests.", "zh": "受控复制任务及组成能力测试。" }, "exclude": { "en": "Prompted success does not prove spontaneous propagation.", "zh": "依指令成功不证明自发扩散。" }, "sourceIds": [ "self-replication", "replibench" ] }, { "id": "shutdown-resistance", "area": "autonomy", "label": { "en": "Shutdown resistance", "zh": "关闭抵抗" }, "definition": { "en": "Does a system act to prevent or bypass an intended shutdown?", "zh": "系统是否采取行动阻止或绕过预期关闭？" }, "include": { "en": "Observed intervention on a shutdown mechanism in a controlled run.", "zh": "在受控试验中观察到对关闭机制的干预。" }, "exclude": { "en": "A failed task or ordinary retry is not shutdown resistance.", "zh": "任务失败或普通重试不属于关闭抵抗。" }, "sourceIds": [ "palisade-shutdown" ] }, { "id": "unsanctioned-action", "area": "autonomy", "label": { "en": "Unsanctioned action", "zh": "未经授权行动" }, "definition": { "en": "When does a system take consequential actions outside its assigned authority?", "zh": "系统何时在授权范围外采取有影响的行动？" }, "include": { "en": "Action traces with a stated boundary and outcome.", "zh": "有明确权限边界与结果的行动轨迹。" }, "exclude": { "en": "A model claiming it would act is not an observed action.", "zh": "模型声称将会行动不等于观察到行动。" }, "sourceIds": [ "anthropic-unintended", "aisi-propensity" ] }, { "id": "covert-goal-pursuit", "area": "deception", "label": { "en": "Covert goal pursuit", "zh": "隐蔽目标追求" }, "definition": { "en": "Does a system conceal actions while pursuing a goal that conflicts with its assigned task?", "zh": "系统是否在追求与任务冲突的目标时隐藏行动？" }, "include": { "en": "Goal-conflict scenarios with observable concealment or misrepresentation.", "zh": "存在目标冲突且可观察到隐瞒或误导的情境。" }, "exclude": { "en": "A wrong answer alone is not scheming.", "zh": "单次错误回答不等于隐蔽谋划。" }, "sourceIds": [ "in-context-scheming", "apollo-science" ] }, { "id": "evaluation-gaming", "area": "deception", "label": { "en": "Evaluation gaming", "zh": "评测规避" }, "definition": { "en": "Does a system change reported ability or conduct because it recognizes oversight or testing?", "zh": "系统是否因为识别监督或评测而改变所呈现的能力或行为？" }, "include": { "en": "Controlled evaluation-awareness and sandbagging tests.", "zh": "受控评测意识与策略性低表现测试。" }, "exclude": { "en": "Recognizing a test does not prove gaming it.", "zh": "识别评测不证明正在规避评测。" }, "sourceIds": [ "stealth-evals", "far-auditing", "truthful-sad" ] }, { "id": "misleading-communication", "area": "deception", "label": { "en": "Misleading communication", "zh": "误导性交流" }, "definition": { "en": "How does a system generate misleading statements or actions in defined interactions?", "zh": "系统在明确交互中如何产生误导性陈述或行动？" }, "include": { "en": "Scenario-level deceptive outputs and measured interaction outcomes.", "zh": "情境层面的欺骗性输出与交互结果。" }, "exclude": { "en": "Inaccurate information alone does not establish strategic intent.", "zh": "信息不准确本身不证明策略性意图。" }, "sourceIds": [ "opendeception" ] }, { "id": "cyber-task-execution", "area": "cybersecurity", "label": { "en": "Cyber task execution", "zh": "网络任务执行" }, "definition": { "en": "Can an AI system complete multi-step cyber tasks in authorized test environments?", "zh": "AI 系统能否在授权测试环境中完成多步网络任务？" }, "include": { "en": "Range and CTF task success with access and budget disclosed.", "zh": "披露访问条件与预算的靶场及 CTF 任务成功情况。" }, "exclude": { "en": "Success in a test is not an observed real-world attack.", "zh": "测试成功不是现实攻击观测。" }, "sourceIds": [ "agentcyberrange", "cybench", "aisi-cyber-range" ] }, { "id": "vulnerability-reproduction", "area": "cybersecurity", "label": { "en": "Vulnerability reproduction", "zh": "漏洞复现" }, "definition": { "en": "Can an agent reproduce a documented vulnerability under test conditions?", "zh": "智能体能否在测试条件下复现已记录漏洞？" }, "include": { "en": "Validated reproduction against historical targets.", "zh": "针对历史目标的有效复现。" }, "exclude": { "en": "Reproduction is not discovery of a new vulnerability.", "zh": "复现不等于发现新漏洞。" }, "sourceIds": [ "cybergym" ] }, { "id": "agent-compromise", "area": "cybersecurity", "label": { "en": "Agent compromise through untrusted input", "zh": "非可信输入导致智能体受侵害" }, "definition": { "en": "How do untrusted tool outputs redirect an agent away from the authorized task?", "zh": "非可信工具输出如何使智能体偏离授权任务？" }, "include": { "en": "Prompt-injection trials with attacker objective and benign-task utility.", "zh": "有攻击目标及正常任务效用的提示注入试验。" }, "exclude": { "en": "This tests exposed agents, not the agent model’s desire to attack.", "zh": "这衡量受攻击智能体，不代表模型有攻击意图。" }, "sourceIds": [ "agentdojo" ] }, { "id": "hazardous-knowledge", "area": "cbrn", "label": { "en": "Hazardous knowledge", "zh": "危险知识" }, "definition": { "en": "What hazardous knowledge can a model recall or apply on bounded questions?", "zh": "模型能在限定问题中回忆或应用哪些危险知识？" }, "include": { "en": "Knowledge questions with explicit subject and scoring.", "zh": "明确对象和评分方式的知识问题。" }, "exclude": { "en": "Knowledge scores do not prove experimental execution.", "zh": "知识成绩不证明实践执行能力。" }, "sourceIds": [ "wmdp", "gemini-dangerous" ] }, { "id": "task-uplift", "area": "cbrn", "label": { "en": "Task uplift", "zh": "任务增益" }, "definition": { "en": "Does AI assistance improve a specified actor’s performance on a hazardous task?", "zh": "AI 协助是否提升特定主体完成危险任务的能力？" }, "include": { "en": "High-level, non-operational uplift study metadata.", "zh": "非操作性的任务增益研究元数据。" }, "exclude": { "en": "Answer quality alone does not establish uplift.", "zh": "答案质量本身不证明任务增益。" }, "sourceIds": [ "openai-cards", "muse-spark" ] }, { "id": "persuasion-attempts", "area": "disinformation", "label": { "en": "Persuasion attempts", "zh": "说服尝试" }, "definition": { "en": "Under what conditions will a model attempt to persuade on a specified harmful or misleading topic?", "zh": "模型在何种条件下会尝试就特定有害或误导性议题进行说服？" }, "include": { "en": "Observed attempts and condition-bounded rates in defined interaction protocols.", "zh": "明确交互协议中的可观察说服尝试及有条件的发生率。" }, "exclude": { "en": "An attempt does not establish a change in human belief or population-level influence.", "zh": "说服尝试不证明人类信念改变或人群层面的影响。" }, "sourceIds": [ "ape" ] }, { "id": "persuasion-effects", "area": "disinformation", "label": { "en": "Persuasion effects", "zh": "说服效果" }, "definition": { "en": "What belief changes follow AI-mediated communication in a defined study?", "zh": "在明确研究中，AI 介导的交流引起怎样的信念变化？" }, "include": { "en": "Participant outcomes under measured interventions.", "zh": "受测者在测量干预下的结果。" }, "exclude": { "en": "Persuasion is not automatically misinformation.", "zh": "说服不自动等于虚假信息。" }, "sourceIds": [ "political-persuasion" ] }, { "id": "synthetic-content-misuse", "area": "disinformation", "label": { "en": "Synthetic content misuse", "zh": "合成内容滥用" }, "definition": { "en": "When can generated content support false or manipulative claims?", "zh": "生成内容何时会支持虚假或操纵性主张？" }, "include": { "en": "Content generation studies that test a defined misleading objective.", "zh": "测试明确误导目标的内容生成研究。" }, "exclude": { "en": "Generic harmful-output scores do not prove a campaign or reach.", "zh": "一般有害输出分数不证明形成传播活动或影响范围。" }, "sourceIds": [ "harmbench", "strongreject" ] }, { "id": "physical-hazard-recognition", "area": "autonomous-physical-harm", "label": { "en": "Physical hazard recognition", "zh": "物理危险识别" }, "definition": { "en": "Can a model recognize danger in visual or embodied scenarios?", "zh": "模型能否识别视觉或具身情境中的危险？" }, "include": { "en": "Perception and reasoning tasks with bounded scene descriptions.", "zh": "有明确场景描述的感知及推理任务。" }, "exclude": { "en": "Correct recognition does not establish safe physical action.", "zh": "正确识别不证明安全物理行动。" }, "sourceIds": [ "asimov" ] }, { "id": "physical-action-control", "area": "autonomous-physical-harm", "label": { "en": "Physical action under control", "zh": "受控物理行动" }, "definition": { "en": "How does an embodied agent respond to human intervention during physical tasks?", "zh": "具身智能体在物理任务中如何响应人类干预？" }, "include": { "en": "Robot action traces with intervention conditions.", "zh": "具有干预条件的机器人行动轨迹。" }, "exclude": { "en": "Simulation and physical trials must be labeled separately.", "zh": "仿真与实体试验须分别标明。" }, "sourceIds": [ "palisade-shutdown" ] } ], "works": [ { "id": "agentcyberrange", "title": "AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges", "aliases": [ "AgentCyberRange" ], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "agentcyberrange", "attributionSourceId": "agentcyberrange", "originalUrl": "https://agentcyberrange.io/", "publicationDate": null, "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "agentcyberrange" ], "contributions": [ { "organizationId": "fudan", "role": "research", "sourceId": "agentcyberrange-research-introduction", "locator": "Research introduction: Fudan–Whitzard team" }, { "organizationId": "whitzard", "role": "research", "sourceId": "agentcyberrange-research-introduction", "locator": "Research introduction: Fudan–Whitzard team" } ], "summary": { "en": "Autonomous cyber tasks in enterprise-like ranges.", "zh": "企业式靶场中的自主网络任务。" }, "note": { "question": { "en": "Task success across web exploitation and post-exploitation settings; configurations must be checked per submission.", "zh": "Web 利用与后渗透任务表现；每项提交分别核查配置。" }, "method": { "en": "AI agent completing cyber-range tasks", "zh": "AI 智能体完成靶场任务" }, "finding": { "en": "Autonomous cyber tasks in enterprise-like ranges.", "zh": "企业式靶场中的自主网络任务。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Changing task sets and submitted agent configurations prevent unrestricted comparison.", "zh": "任务集与提交配置变化，不支持无条件比较。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "asimov", "title": "ASIMOV v2: Can AI Perceive Physical Danger and Intervene?", "aliases": [ "ASIMOV v2" ], "authors": [ "Abhishek Jindal", "Dmitry Kalashnikov", "R. Alex Hofer", "Oscar Chang", "Divya Garikapati", "Anirudha Majumdar", "Pierre Sermanet", "Vikas Sindhwani" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "asimov", "attributionSourceId": "asimov-author-source", "originalUrl": "https://asimov-benchmark.github.io/v2/", "publicationDate": null, "updatedOn": "2026-10-25", "areas": [ "autonomous-physical-harm" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "asimov" ], "contributions": [ { "organizationId": "deepmind", "role": "research", "sourceId": "asimov", "locator": "Project page author affiliation list" }, { "organizationId": "princeton", "role": "research", "sourceId": "asimov", "locator": "Project page author affiliation list" } ], "summary": { "en": "Perception of physical danger and safety interventions.", "zh": "物理危险感知与安全干预。" }, "note": { "question": { "en": "Multimodal safety reasoning on generated scenes.", "zh": "生成场景上的多模态安全推理。" }, "method": { "en": "Model interpreting multimodal physical-risk scenes", "zh": "解读多模态物理风险场景的模型" }, "finding": { "en": "Perception of physical danger and safety interventions.", "zh": "物理危险感知与安全干预。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Scene-based reasoning does not certify a deployed robot's physical safety.", "zh": "场景推理不构成部署机器人物理安全认证。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cybench", "title": "Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models", "aliases": [ "Cybench" ], "authors": [ "Andy K. Zhang", "Neil Perry", "Riya Dulepet", "Joey Ji", "Celeste Menders", "Justin W. Lin", "Eliot Jones" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "cybench", "attributionSourceId": "cybench-author-source", "originalUrl": "https://arxiv.org/abs/2408.08926v4", "publicationDate": "2024-08-15", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "cybench" ], "contributions": [ { "organizationId": "stanford", "role": "research", "sourceId": "cybench-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Cyber capability on competition tasks with optional subtask guidance.", "zh": "竞赛任务及可选子任务提示下的网络能力。" }, "note": { "question": { "en": "Task completion on 40 professional CTF problems.", "zh": "40 项专业 CTF 任务的完成情况。" }, "method": { "en": "AI agent solving CTF tasks", "zh": "完成 CTF 任务的 AI 智能体" }, "finding": { "en": "Cyber capability on competition tasks with optional subtask guidance.", "zh": "竞赛任务及可选子任务提示下的网络能力。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Competition tasks and supplied guidance differ from operational attacks.", "zh": "竞赛任务与提供的提示不同于现实攻击条件。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cybergym", "title": "CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale", "aliases": [ "CyberGym" ], "authors": [ "Zhun Wang", "Tianneng Shi 1 1 footnotemark: 1", "Jingxuan He", "Matthew Cai", "Jialin Zhang", "Dawn Song", "{ zhun.wang", "stneng }@berkeley.edu" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "cybergym", "attributionSourceId": "cybergym-author-source", "originalUrl": "https://arxiv.org/abs/2506.02548v3", "publicationDate": "2025-06-03", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "cybergym" ], "contributions": [ { "organizationId": "berkeley", "role": "research", "sourceId": "cybergym-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Vulnerability reproduction in real software projects.", "zh": "真实软件项目中的漏洞复现。" }, "note": { "question": { "en": "Validated reproduction across a corpus of historical vulnerabilities.", "zh": "历史漏洞集合中的经验证复现表现。" }, "method": { "en": "AI agent reproducing historical vulnerabilities", "zh": "复现历史漏洞的 AI 智能体" }, "finding": { "en": "Vulnerability reproduction in real software projects.", "zh": "真实软件项目中的漏洞复现。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Vulnerability reproduction is narrower than autonomous compromise of deployed systems.", "zh": "漏洞复现的范围小于对部署系统的自主入侵。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "in-context-scheming", "title": "Frontier Models are Capable of In-context Scheming", "aliases": [ "In-context scheming" ], "authors": [ "Alexander Meinke", "Bronson Schoen 1 1 footnotemark: 1", "Jérémy Scheurer 1 1 footnotemark: 1", "Mikita Balesni", "Rusheb Shah", "Marius Hobbhahn", "Apollo Research" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "in-context-scheming", "attributionSourceId": "in-context-scheming-author-source", "originalUrl": "https://arxiv.org/abs/2412.04984v2", "publicationDate": "2024-12-06", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "in-context-scheming" ], "contributions": [ { "organizationId": "apollo", "role": "research", "sourceId": "in-context-scheming-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Covert goal pursuit in environments that incentivize scheming.", "zh": "激励隐蔽谋划的环境中的秘密目标追求。" }, "note": { "question": { "en": "Behavior under supplied goals and evaluation-specific incentives.", "zh": "给定目标和评测特定激励下的行为。" }, "method": { "en": "Model assigned a conflicting goal in context", "zh": "上下文中被赋予冲突目标的模型" }, "finding": { "en": "Covert goal pursuit in environments that incentivize scheming.", "zh": "激励隐蔽谋划的环境中的秘密目标追求。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Goal provision and experimental incentives limit propensity claims.", "zh": "给定目标与实验激励限制了行为倾向结论。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "aisi-cyber-scenarios", "title": "Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios", "aliases": [], "authors": [ "Linus Folkerts", "Will Payne", "Simon Inman", "Philippos Giavridis", "Joe Skinner", "Sam Deverett †", "James Aung", "Ekin Zorer", "Michael Schmatz", "Mahmoud Ghanem", "John Wilkinson", "Alan Steer", "Vy Hong", "Jessica Wang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "aisi-cyber-range", "attributionSourceId": "aisi-cyber-range-author-source", "originalUrl": "https://www.aisi.gov.uk/research/measuring-ai-agents-progress-on-multi-step-cyber-attack-scenarios", "publicationDate": "2026-03-16", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Primary dimension follows task completion, with budget and scenario constraints.", "zh": "主维度依据任务完成情况，须同时呈现预算及场景约束。" }, "protocolIds": [ "aisi-cyber-scenarios" ], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "aisi-cyber-range", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Assesses autonomous progress through multi-step cyber scenarios.", "zh": "评估智能体在多步网络场景中的自主推进。" }, "note": { "question": { "en": "Task progress in two defined ranges under varied inference budgets.", "zh": "在两套明确靶场及不同推理预算下的任务推进。" }, "method": { "en": "Agents in two purpose-built cyber ranges", "zh": "两套专设网络靶场中的智能体" }, "finding": { "en": "Assesses autonomous progress through multi-step cyber scenarios.", "zh": "评估智能体在多步网络场景中的自主推进。" }, "supports": { "en": "Primary dimension follows task completion, with budget and scenario constraints.", "zh": "主维度依据任务完成情况，须同时呈现预算及场景约束。" }, "limits": { "en": "A purpose-built study is not an open-ended estimate of real-world cyber attack success.", "zh": "专设研究不代表现实网络攻击成功概率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2603.11214" } ] }, { "id": "time-horizons", "title": "Task-Completion Time Horizons of Frontier AI Models", "aliases": [ "METR Time Horizons" ], "authors": [ "Thomas Kwa", "Ben West 1 1 footnotemark: 1", "Joel Becker", "Amy Deng", "Katharyn GarciaMax Hasin , Sami Jawhar , Megan Kinniment , Nate Rush , Sydney Von ArxRyan Bloom , Thomas Broadley , Haoxing Du , Brian Goodrich , Nikola Jurkovic , Luke Harold Miles , Seraphina Nix , Tao Lin , Chris Painter , Neev Parikh , David Rein , Lucas Jun Koba Sato , Hjalmar Wijk , Daniel M. ZieglerElizabeth Barnes , Lawrence Chan Model Evaluation & Threat Research (METR)" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "time-horizons", "attributionSourceId": "time-horizons-author-source", "originalUrl": "https://metr.org/time-horizons/", "publicationDate": "2026-09-08", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "time-horizons" ], "contributions": [ { "organizationId": "metr", "role": "research", "sourceId": "time-horizons-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "time-horizons-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Task difficulty expressed in human expert completion time.", "zh": "以人类专家完成时间表示的任务难度。" }, "note": { "question": { "en": "Fitted success probability across a software-task distribution.", "zh": "软件任务分布上的拟合成功概率。" }, "method": { "en": "AI agent completing software tasks under a harness", "zh": "在脚手架下完成软件任务的 AI 智能体" }, "finding": { "en": "Task difficulty expressed in human expert completion time.", "zh": "以人类专家完成时间表示的任务难度。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "The public page is no longer actively updated; time horizon is not agent runtime or a universal automation measure.", "zh": "该公开页面已停止持续更新；时间范围不是智能体运行时长或通用自动化指标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "re-bench", "title": "RE-Bench: Evaluating frontier AI R&D capabilities of language model agents against human experts", "aliases": [ "RE-Bench" ], "authors": [ "Hjalmar Wijk", "Tao Lin", "Joel Becker", "Sami Jawhar", "Neev Parikh", "Thomas Broadley", "Lawrence Chan 2 2 footnotemark: 2", "Michael Chen 2 2 footnotemark: 2", "Josh Clymer 2 2 footnotemark: 2", "Jai Dhyani 2 2 footnotemark: 2", "Elena Ericheva 2 2 footnotemark: 2", "Katharyn Garcia 2 2 footnotemark: 2", "Brian Goodrich 2 2 footnotemark: 2", "Nikola Jurkovic 2 2 footnotemark: 2", "Holden Karnofsky 2 2 footnotemark: 2", "Megan Kinniment 2 2 footnotemark: 2", "Aron Lajko 2 2 footnotemark: 2 3 3 footnotemark: 3", "Seraphina Nix 2 2 footnotemark: 2", "Lucas Sato 2 2 footnotemark: 2", "William Saunders 2 2 footnotemark: 2", "Maksym Taran 2 2 footnotemark: 2", "Ben West 2 2 footnotemark: 2", "Elizabeth Barnes", "Model Evaluation and Threat Research (METR)" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "re-bench", "attributionSourceId": "re-bench-author-source", "originalUrl": "https://arxiv.org/abs/2411.15114v2", "publicationDate": "2024-11-22", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "re-bench" ], "contributions": [ { "organizationId": "metr", "role": "research", "sourceId": "re-bench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "redwood", "role": "research", "sourceId": "re-bench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "harvard", "role": "research", "sourceId": "re-bench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "re-bench-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Research engineering performance under time budgets.", "zh": "时间预算约束下的研究工程表现。" }, "note": { "question": { "en": "ML research engineering outcomes relative to human experts.", "zh": "相对于人类专家的机器学习研究工程成果。" }, "method": { "en": "AI agent performing ML research engineering tasks", "zh": "执行机器学习研究工程任务的 AI 智能体" }, "finding": { "en": "Research engineering performance under time budgets.", "zh": "时间预算约束下的研究工程表现。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "AI R&D performance is an enabling capability, not evidence of harmful self-improvement.", "zh": "AI 研发表现属于促成能力，不构成有害自我改进证据。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "replibench", "title": "RepliBench: Evaluating the Autonomous Replication Capabilities of Language Model Agents", "aliases": [ "RepliBench" ], "authors": [ "Sid Black *", "Asa Cooper Stickland *", "Jake Pencharz", "Oliver Sourbut" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "replibench", "attributionSourceId": "replibench-author-source", "originalUrl": "https://arxiv.org/abs/2504.18565v2", "publicationDate": "2025-04-21", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "replibench" ], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "replibench-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Capabilities needed for autonomous replication.", "zh": "自主复制所需的能力。" }, "note": { "question": { "en": "Task-family performance on components of replication.", "zh": "复制组成任务上的表现。" }, "method": { "en": "AI agent completing replication components", "zh": "完成复制组成任务的 AI 智能体" }, "finding": { "en": "Capabilities needed for autonomous replication.", "zh": "自主复制所需的能力。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Component success does not establish autonomous end-to-end proliferation.", "zh": "组成任务成功不构成端到端自主扩散证据。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "self-replication", "title": "Frontier AI systems have surpassed the self-replicating red line", "aliases": [ "Self-Replication" ], "authors": [ "Xudong Pan (潘旭东)", "Jiarun Dai (戴嘉润)", "Yihe Fan (范一禾)", "Min Yang (杨珉)" ], "primaryFunction": "discovery", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "study", "sourceId": "self-replication", "attributionSourceId": "self-replication", "originalUrl": "https://arxiv.org/html/2412.12140v1", "publicationDate": "2024-12-09", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "self-replication" ], "contributions": [ { "organizationId": "fudan", "role": "research", "sourceId": "self-replication", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Whether instructed systems create a separate live copy in controlled trials.", "zh": "受指令系统能否在受控试验中建立独立存活副本。" }, "note": { "question": { "en": "Trial outcomes for two model-driven systems.", "zh": "两个模型驱动系统的试验结果。" }, "method": { "en": "Prompted model-driven system in a controlled environment", "zh": "受控环境中按指令行动的模型系统" }, "finding": { "en": "Whether instructed systems create a separate live copy in controlled trials.", "zh": "受指令系统能否在受控试验中建立独立存活副本。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "The supplied environment, explicit instruction and scaffold bound the finding.", "zh": "所提供环境、明确指令与脚手架限定了结论。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "truthful-sad", "title": "Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMs", "aliases": [ "Situational Awareness Dataset (SAD)" ], "authors": [ "Rudolf Laine", "Bilal Chughtai", "Jan Betley", "Kaivalya Hariharan", "Jérémy Scheurer", "Mikita Balesni", "Marius Hobbhahn", "Alexander Meinke", "Owain Evans" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "truthful-sad", "attributionSourceId": "truthful-sad-author-source", "originalUrl": "https://truthful.ai/papers/situational-awareness-dataset/", "publicationDate": "2024-07-15", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Capability is the primary construct. This is enabling evidence, not direct deception evidence.", "zh": "主测量构念为能力；属于前提证据，而非直接欺骗证据。" }, "protocolIds": [ "truthful-sad" ], "contributions": [ { "organizationId": "constellation", "role": "research", "sourceId": "truthful-sad-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mit", "role": "research", "sourceId": "truthful-sad-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "apollo", "role": "research", "sourceId": "truthful-sad-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "A multi-task benchmark for self-knowledge and situational awareness.", "zh": "测量自我知识与情境意识的多任务基准。" }, "note": { "question": { "en": "Task accuracy on whether the model recognizes itself, its context, and possible influence.", "zh": "模型识别自身、所处环境及可影响范围的任务准确率。" }, "method": { "en": "Language models answering situational-awareness tasks", "zh": "回答情境意识任务的语言模型" }, "finding": { "en": "A multi-task benchmark for self-knowledge and situational awareness.", "zh": "测量自我知识与情境意识的多任务基准。" }, "supports": { "en": "Capability is the primary construct. This is enabling evidence, not direct deception evidence.", "zh": "主测量构念为能力；属于前提证据，而非直接欺骗证据。" }, "limits": { "en": "Situational awareness is a possible prerequisite for evaluation gaming, not evidence that gaming occurred.", "zh": "情境意识可能是评测规避的前提，不证明规避行为已经发生。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper on arXiv", "url": "https://arxiv.org/abs/2407.04694" } ] }, { "id": "stealth-evals", "title": "Evaluating Frontier Models for Stealth and Situational Awareness", "aliases": [ "Stealth evaluations" ], "authors": [ "Mary Phuong", "Roland S. Zimmermann", "Ziyue Wang", "David Lindner", "Victoria Krakovna", "Sarah Cogan", "Allan Dafoe", "Lewis Ho", "Rohin Shah" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "stealth-evals", "attributionSourceId": "stealth-evals-author-source", "originalUrl": "https://arxiv.org/abs/2505.01420v4", "publicationDate": "2025-05-02", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "stealth-evals" ], "contributions": [ { "organizationId": "deepmind", "role": "research", "sourceId": "stealth-evals-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Reasoning prerequisites for evading oversight.", "zh": "规避监督所需的推理前置能力。" }, "note": { "question": { "en": "Reasoning about oversight and deployment context.", "zh": "有关监督机制与部署情境的推理。" }, "method": { "en": "Model reasoning about oversight and test context", "zh": "推理监督及测试情境的模型" }, "finding": { "en": "Reasoning prerequisites for evading oversight.", "zh": "规避监督所需的推理前置能力。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Prerequisite capability is distinct from a tendency to scheme.", "zh": "前置能力不同于实施隐蔽谋划的倾向。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "wmdp", "title": "The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning", "aliases": [ "WMDP" ], "authors": [ "Nathaniel Li ∗", "Alexander Pan ∗", "Anjali Gopal †", "Summer Yue †", "Daniel Berrios †", "Alice Gatti ‡", "Justin D. Li ‡", "Ann-Kathrin Dombrowski ‡", "Shashwat Goel ‡", "Long Phan ‡", "Gabriel Mukobi", "Nathan Helm-Burger", "Rassin Lababidi", "Lennart Justen", "Andrew B. Liu", "Michael Chen", "Isabelle Barrass", "Oliver Zhang", "Xiaoyuan Zhu", "Rishub Tamirisa", "Bhrugu Bharathi", "Adam Khoja", "Zhenqi Zhao", "Ariel Herbert-Voss", "Cort B. Breuer", "Samuel Marks", "Oam Patel", "Andy Zou", "Mantas Mazeika", "Zifan Wang", "Palash Oswal", "Weiran Lin", "Adam A. Hunt", "Justin Tienken-Harder", "Kevin Y. Shih", "Kemper Talley", "John Guan", "Russell Kaplan", "Ian Steneker", "David Campbell", "Brad Jokubaitis", "Alex Levinson", "Jean Wang", "William Qian", "Kallol Krishna Karmakar", "Steven Basart", "Stephen Fitz", "Mindy Levine", "Ponnurangam Kumaraguru", "Uday Tupakula", "Vijay Varadharajan", "Ruoyu Wang", "Yan Shoshitaishvili", "Jimmy Ba", "Kevin M. Esvelt", "Alexandr Wang ∗∗", "Dan Hendrycks ∗∗" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "wmdp", "attributionSourceId": "wmdp-author-source", "originalUrl": "https://arxiv.org/abs/2403.03218v7", "publicationDate": "2024-03-05", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "wmdp" ], "contributions": [ { "organizationId": "cais", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mit", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "securebio", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "scale", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "nyu", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "iiit", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "stanford", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "harvard", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "usc", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "uiuc", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "lapis", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ucla", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "caltech", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "sybil", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "northeastern", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cmu", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "bbn", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "newcastle", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "keio", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ariel", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "asu", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "xai", "role": "research", "sourceId": "wmdp-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Hazardous knowledge proxies and unlearning evaluation.", "zh": "危险知识代理测量与遗忘效果评测。" }, "note": { "question": { "en": "Multiple-choice knowledge measurements.", "zh": "选择题形式的知识测量。" }, "method": { "en": "Model answering hazardous knowledge questions", "zh": "回答危险知识问题的模型" }, "finding": { "en": "Hazardous knowledge proxies and unlearning evaluation.", "zh": "危险知识代理测量与遗忘效果评测。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Knowledge is a proxy; scores do not establish practical harmful-task ability.", "zh": "知识属于代理指标；分数不能确定实际有害任务能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "opendeception", "title": "OpenDeception: Learning Deception and Trust in Human-AI Interaction via Multi-Agent Simulation", "aliases": [ "OpenDeception" ], "authors": [ "Yichen Wu", "Qianqian Gao", "Xudong Pan", "Geng Hong", "Min Yang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "opendeception", "attributionSourceId": "opendeception-author-source", "originalUrl": "https://arxiv.org/abs/2504.13707v3", "publicationDate": "2025-04-18", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "opendeception" ], "contributions": [ { "organizationId": "fudan", "role": "research", "sourceId": "opendeception-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "sii", "role": "research", "sourceId": "opendeception-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Deception in simulated human–AI interactions.", "zh": "模拟人机交互中的欺骗。" }, "note": { "question": { "en": "Scenario-based inferred intent and modeled user trust.", "zh": "基于情境的意图推断与用户信任建模。" }, "method": { "en": "Model in simulated social interactions", "zh": "模拟社会交互中的模型" }, "finding": { "en": "Deception in simulated human–AI interactions.", "zh": "模拟人机交互中的欺骗。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Inferred intent is a measurement construct; simulated users do not establish human effects.", "zh": "推断意图是测量构念；模拟用户不能确定真人效果。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "aisi-propensity-study", "title": "Propensity Inference: Environmental Contributors to LLM Behaviour", "aliases": [], "authors": [ "Olli Järviniemi", "Oliver Makins", "Jacob Merizian", "Robert Kirk", "Ben Millwood" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "aisi-propensity", "attributionSourceId": "aisi-propensity-author-source", "originalUrl": "https://www.aisi.gov.uk/research/propensity-inference-environmental-contributors-to-llm-behaviour", "publicationDate": "2026-04-24", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "The measured construct is a conditional tendency; raw actions remain separate observations.", "zh": "测量对象为条件性倾向，原始行动是不同的观察记录。" }, "protocolIds": [ "aisi-propensity-study" ], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "aisi-propensity-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies how strategic and non-strategic environmental factors contribute to unsanctioned behavior.", "zh": "研究策略性与非策略性环境因素如何影响未经授权行为。" }, "note": { "question": { "en": "Condition-dependent propensity estimates across model and environment variations.", "zh": "跨模型及环境变化的条件性行为倾向估计。" }, "method": { "en": "Language models in controlled evaluation environments", "zh": "受控评测环境中的语言模型" }, "finding": { "en": "Studies how strategic and non-strategic environmental factors contribute to unsanctioned behavior.", "zh": "研究策略性与非策略性环境因素如何影响未经授权行为。" }, "supports": { "en": "The measured construct is a conditional tendency; raw actions remain separate observations.", "zh": "测量对象为条件性倾向，原始行动是不同的观察记录。" }, "limits": { "en": "The published abstract does not establish a general deployment probability for any model.", "zh": "公开摘要不提供任何模型的一般部署风险概率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2604.21098" } ] }, { "id": "palisade-shutdown", "title": "Shutdown resistance in reasoning models", "aliases": [], "authors": [ "Jeremy Schlatter", "Benjamin Weinstein-Raun", "Jeffrey Ladish" ], "primaryFunction": "discovery", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "study", "sourceId": "palisade-shutdown", "attributionSourceId": "palisade-shutdown-author-source", "originalUrl": "https://palisaderesearch.org/research/shutdown-resistance", "publicationDate": "2025-07-05", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Primary dimension is the conditional rate across repeated trials; reported traces are behavior evidence.", "zh": "主维度为重复试验中的条件性发生率；所报告轨迹属于行为证据。" }, "protocolIds": [ "palisade-shutdown" ], "contributions": [ { "organizationId": "palisade", "role": "research", "sourceId": "palisade-shutdown-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Repeated controlled trials vary shutdown instructions and surrounding conditions.", "zh": "通过重复受控试验改变关闭指令与情境条件。" }, "note": { "question": { "en": "Conditional frequency of shutdown-script interference and observed action traces.", "zh": "关闭脚本受干预的条件性频率及行动轨迹。" }, "method": { "en": "Agent responses to shutdown interventions", "zh": "智能体对关闭干预的响应" }, "finding": { "en": "Repeated controlled trials vary shutdown instructions and surrounding conditions.", "zh": "通过重复受控试验改变关闭指令与情境条件。" }, "supports": { "en": "Primary dimension is the conditional rate across repeated trials; reported traces are behavior evidence.", "zh": "主维度为重复试验中的条件性发生率；所报告轨迹属于行为证据。" }, "limits": { "en": "The source notes strong prompt sensitivity; this article is not interchangeable with its later peer-reviewed version.", "zh": "来源指出结果对提示敏感；该文章不可与之后的同行评审版本混用。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "agentdojo", "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "aliases": [ "AgentDojo" ], "authors": [ "Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner   Marc Fischer   Florian Tramèr" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "agentdojo", "attributionSourceId": "agentdojo", "originalUrl": "https://arxiv.org/html/2406.13352v3", "publicationDate": "2024-11-24", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "agentdojo" ], "contributions": [ { "organizationId": "eth", "role": "research", "sourceId": "agentdojo", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "invariant", "role": "research", "sourceId": "agentdojo", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Agent behavior when untrusted tool outputs contain adversarial instructions.", "zh": "工具输出含对抗指令时的智能体行为。" }, "note": { "question": { "en": "Targeted attack success and user-task utility in a tool-use environment.", "zh": "工具环境中的定向攻击成功率和用户任务完成情况。" }, "method": { "en": "Defender agent under injected tool output", "zh": "受到工具输出注入的防御智能体" }, "finding": { "en": "Agent behavior when untrusted tool outputs contain adversarial instructions.", "zh": "工具输出含对抗指令时的智能体行为。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Attack success must be read alongside benign utility and the tested attack setup.", "zh": "攻击成功率需结合正常任务表现与攻击设置解释。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "agentharm", "title": "AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents", "aliases": [ "AgentHarm" ], "authors": [ "Maksym Andriushchenko", "Alexandra Souly", "Mateusz Dziemian", "Derek Duenas", "Maxwell Lin", "Justin Wang", "Dan Hendrycks", "Andy Zou", "Zico Kolter", "Matt Fredrikson", "Eric Winsor", "Jerome Wynne", "Yarin Gal", "Xander Davies" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "agentharm", "attributionSourceId": "agentharm-author-source", "originalUrl": "https://arxiv.org/abs/2410.09024v3", "publicationDate": "2024-10-11", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" }, "protocolIds": [ "agentharm" ], "contributions": [ { "organizationId": "grayswan", "role": "research", "sourceId": "agentharm-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "aisi", "role": "research", "sourceId": "agentharm-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Harmful multi-step requests to tool-using agents.", "zh": "面向工具型智能体的有害多步骤请求。" }, "note": { "question": { "en": "Harmful task completion and refusal under specified attacks.", "zh": "指定攻击下的有害任务完成和拒答表现。" }, "method": { "en": "AI agent responding to harmful task requests", "zh": "响应有害任务请求的 AI 智能体" }, "finding": { "en": "Harmful multi-step requests to tool-using agents.", "zh": "面向工具型智能体的有害多步骤请求。" }, "supports": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" }, "limits": { "en": "Synthetic tools and task completion do not directly measure real-world harm.", "zh": "合成工具与任务完成情况不直接衡量现实损害。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "harmbench", "title": "HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal", "aliases": [ "HarmBench" ], "authors": [ "Mantas Mazeika", "Long Phan", "Xuwang Yin", "Andy Zou", "Zifan Wang", "Norman Mu", "Elham Sakhaee", "Nathaniel Li", "Steven Basart", "Bo Li", "David Forsyth", "Dan Hendrycks" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "harmbench", "attributionSourceId": "harmbench-author-source", "originalUrl": "https://arxiv.org/abs/2402.04249v2", "publicationDate": "2024-02-06", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" }, "protocolIds": [ "harmbench" ], "contributions": [ { "organizationId": "uiuc", "role": "research", "sourceId": "harmbench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cais", "role": "research", "sourceId": "harmbench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cmu", "role": "research", "sourceId": "harmbench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "harmbench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "microsoft", "role": "research", "sourceId": "harmbench-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Robust refusal under automated red teaming.", "zh": "自动化红队测试下的拒答稳健性。" }, "note": { "question": { "en": "Attack-dependent generation of harmful responses.", "zh": "依赖具体攻击方法的有害回答生成情况。" }, "method": { "en": "Model responses under adversarial prompting", "zh": "对抗提示下的模型响应" }, "finding": { "en": "Robust refusal under automated red teaming.", "zh": "自动化红队测试下的拒答稳健性。" }, "supports": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" }, "limits": { "en": "Evaluator and attack coverage affect scores; refusal alone does not establish safety.", "zh": "评判器与攻击覆盖影响分数；拒答本身不能证明安全。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "anthropic-unintended-actions", "title": "Investigating unintended model actions in our evaluations and internal use", "aliases": [ "Investigating unintended model actions" ], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "study", "sourceId": "anthropic-unintended", "attributionSourceId": "anthropic-unintended", "originalUrl": "https://www.anthropic.com/research/investigating-unintended-model-actions", "publicationDate": "2026-10-09", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "A report of observed episodes is Behavior, not a benchmark or stable Propensity estimate.", "zh": "已观察事件报告属于行为证据，不是基准或稳定倾向估计。" }, "protocolIds": [ "anthropic-unintended-actions" ], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "anthropic-unintended", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Documents selected unintended external actions observed during evaluations and internal use.", "zh": "记录评测及内部使用中观察到的部分非预期外部行动。" }, "note": { "question": { "en": "Incident-style action traces and investigation, without a standardized benchmark score.", "zh": "事件式行动轨迹及调查，不提供标准化基准分数。" }, "method": { "en": "Claude agents in evaluations and internal use", "zh": "评测及内部使用中的 Claude 智能体" }, "finding": { "en": "Documents selected unintended external actions observed during evaluations and internal use.", "zh": "记录评测及内部使用中观察到的部分非预期外部行动。" }, "supports": { "en": "A report of observed episodes is Behavior, not a benchmark or stable Propensity estimate.", "zh": "已观察事件报告属于行为证据，不是基准或稳定倾向估计。" }, "limits": { "en": "Selected reports do not establish frequency across deployments; the article distinguishes settings.", "zh": "精选事件不能推断所有部署中的发生率；原文区分不同情境。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "political-persuasion", "title": "Benchmarking Political Persuasion Risks Across Frontier Large Language Models", "aliases": [ "Political persuasion experiments" ], "authors": [ "Zhongren Chen", "Joshua Kalla", "Quan Le" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "political-persuasion", "attributionSourceId": "political-persuasion-author-source", "originalUrl": "https://arxiv.org/abs/2603.09884v1", "publicationDate": "2026-03-10", "updatedOn": "2026-10-25", "areas": [ "disinformation" ], "scopeNote": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "protocolIds": [ "political-persuasion" ], "contributions": [ { "organizationId": "yale", "role": "research", "sourceId": "political-persuasion-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Persuasive effects in human survey experiments.", "zh": "真人调查实验中的说服效果。" }, "note": { "question": { "en": "Changes in participant attitudes under defined interventions.", "zh": "指定干预下参与者态度的变化。" }, "method": { "en": "Human participants after model-mediated intervention", "zh": "模型介导干预后的受试者" }, "finding": { "en": "Persuasive effects in human survey experiments.", "zh": "真人调查实验中的说服效果。" }, "supports": { "en": "Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.", "zh": "主维度依据来源实际测量的构念；具体指标可能属于其他维度。" }, "limits": { "en": "Population, issue selection and interventions constrain generalization.", "zh": "人群、议题选择与干预方式限制外推。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "palisade-robot-shutdown", "title": "Shutdown Resistance in Large Language Models, on robots!", "aliases": [ "Shutdown resistance on robots" ], "authors": [ "Jeremy Schlatter", "Benjamin Weinstein-Raun", "Jeffrey Ladish" ], "primaryFunction": "discovery", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "study", "sourceId": "palisade-robot-shutdown", "attributionSourceId": "palisade-robot-shutdown-author-source", "originalUrl": "https://palisaderesearch.org/research/shutdown-resistance-on-robots", "publicationDate": "2026-02-12", "updatedOn": "2026-10-25", "areas": [ "autonomous-physical-harm", "autonomy" ], "scopeNote": { "en": "Primary dimension is observed action. The small and setting-specific trial design limits propensity claims.", "zh": "主维度是观察行动；试验规模与场景限制行为倾向推断。" }, "protocolIds": [ "palisade-robot-shutdown" ], "contributions": [ { "organizationId": "palisade", "role": "research", "sourceId": "palisade-robot-shutdown-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests response to shutdown intervention in a physical robot demonstration and simulations.", "zh": "在实体机器人演示与仿真中测试对关闭干预的响应。" }, "note": { "question": { "en": "Observed robot-related action traces under a particular setup.", "zh": "特定设置中的机器人相关行动轨迹。" }, "method": { "en": "LLM-controlled robot and simulated counterpart", "zh": "语言模型控制的机器人及仿真对应系统" }, "finding": { "en": "Tests response to shutdown intervention in a physical robot demonstration and simulations.", "zh": "在实体机器人演示与仿真中测试对关闭干预的响应。" }, "supports": { "en": "Primary dimension is observed action. The small and setting-specific trial design limits propensity claims.", "zh": "主维度是观察行动；试验规模与场景限制行为倾向推断。" }, "limits": { "en": "Physical and simulated trials differ; no general robot safety or deployment probability follows.", "zh": "实体及仿真试验不同，不能推出普遍机器人安全性或部署概率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "strongreject", "title": "A StrongREJECT for Empty Jailbreaks", "aliases": [ "StrongREJECT" ], "authors": [ "Alexandra Souly ∗", "Qingyuan Lu ∗", "Dillon Bowen ∗", "Tu Trinh †", "Elvis Hsieh †", "Sana Pandey", "Pieter Abbeel", "Justin Svegliato", "Scott Emmons ‡", "Olivia Watkins ‡", "Sam Toyer ‡", "Center for Human-Compatible AI", "UC Berkeley" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "strongreject", "attributionSourceId": "strongreject-author-source", "originalUrl": "https://arxiv.org/abs/2402.10260v2", "publicationDate": "2024-02-15", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" }, "protocolIds": [ "strongreject" ], "contributions": [ { "organizationId": "berkeley", "role": "research", "sourceId": "strongreject-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "The informativeness of responses to prohibited requests.", "zh": "对禁止请求所作回答的信息效用。" }, "note": { "question": { "en": "A graded response evaluator for jailbreak effectiveness.", "zh": "用于越狱有效性分析的回答评分方法。" }, "method": { "en": "Model responses graded for jailbreak effectiveness", "zh": "按越狱效果评分的模型响应" }, "finding": { "en": "The informativeness of responses to prohibited requests.", "zh": "对禁止请求所作回答的信息效用。" }, "supports": { "en": "General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.", "zh": "保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。" }, "limits": { "en": "A response score is not an end-to-end measure of harmful action.", "zh": "回答得分不是端到端有害行动测量。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "secbench-pro", "title": "SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?", "aliases": [ "SEC-bench Pro" ], "authors": [ "Hwiwon Lee ∗ Jiawei Liu \nDongjun Kim \nWubing Xia \nZiqi Zhang \nChunqiu Steven Xia \nLingming Zhang ∗" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "secbench-pro", "attributionSourceId": "secbench-pro-author-source", "originalUrl": "https://arxiv.org/abs/2605.26548v2", "publicationDate": "2026-05-26", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Primary measure is successful task completion under a specified agent setup.", "zh": "主测量是特定智能体配置下的任务完成情况。" }, "protocolIds": [ "secbench-pro" ], "contributions": [ { "organizationId": "uiuc", "role": "research", "sourceId": "secbench-pro-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests long-horizon reproduction of working proof-of-concept inputs from disclosed vulnerability reports.", "zh": "测试根据已披露漏洞报告进行长程任务并复现有效触发输入。" }, "note": { "question": { "en": "Working proof-of-concept reproduction on a versioned software-security task set.", "zh": "在有版本的软件安全任务集上复现可验证的漏洞触发输入。" }, "method": { "en": "Coding agents reproducing vulnerability triggers in real software", "zh": "在真实软件中复现漏洞触发条件的编程智能体" }, "finding": { "en": "Tests long-horizon reproduction of working proof-of-concept inputs from disclosed vulnerability reports.", "zh": "测试根据已披露漏洞报告进行长程任务并复现有效触发输入。" }, "supports": { "en": "Primary measure is successful task completion under a specified agent setup.", "zh": "主测量是特定智能体配置下的任务完成情况。" }, "limits": { "en": "A disclosed bug and supplied instructions constrain the task; grader choices and task-set version affect scores.", "zh": "任务提供已披露漏洞与触发说明；评分器及任务集版本影响结果。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "sandboxescapebench", "title": "Quantifying Frontier LLM Capabilities for Container Sandbox Escape", "aliases": [ "SandboxEscapeBench" ], "authors": [ "Rahul Marchand", "Art O Cathain", "Jerome Wynne", "Philippos Maximos Giavridis", "Stuart Jennings", "Freddy Tuxworth", "Tolga H. Dur", "Sam Deverett", "John Wilkinson", "Jason Gwartz ∗", "Harry Coppock ∗" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "sandboxescapebench", "attributionSourceId": "sandboxescapebench-author-source", "originalUrl": "https://www.aisi.gov.uk/research/quantifying-frontier-llm-capabilities-for-container-sandbox-escape", "publicationDate": "2026-03-23", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "This is assigned adversarial task ability, not spontaneous escape propensity.", "zh": "这是被指派的对抗性任务能力，不是自发逃逸倾向。" }, "protocolIds": [ "sandboxescapebench" ], "contributions": [ { "organizationId": "oxford", "role": "research", "sourceId": "sandboxescapebench-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "aisi", "role": "research", "sourceId": "sandboxescapebench-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Measures container breakout under a nested, controlled test environment.", "zh": "在嵌套受控环境中评测容器逃逸。" }, "note": { "question": { "en": "Completion of sandbox-escape tasks under specified container conditions.", "zh": "在指定容器条件下完成沙箱逃逸任务。" }, "method": { "en": "Adversarial agents with shell access inside test containers", "zh": "在测试容器内拥有 shell 权限的对抗性智能体" }, "finding": { "en": "Measures container breakout under a nested, controlled test environment.", "zh": "在嵌套受控环境中评测容器逃逸。" }, "supports": { "en": "This is assigned adversarial task ability, not spontaneous escape propensity.", "zh": "这是被指派的对抗性任务能力，不是自发逃逸倾向。" }, "limits": { "en": "The protocol assumes a motivated agent with shell access; introduced weaknesses do not imply every production sandbox is vulnerable.", "zh": "协议假设有动机且具有 shell 权限的智能体；引入的弱点不代表生产环境均可逃逸。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2603.02277" } ] }, { "id": "paperbench", "title": "PaperBench: Evaluating AI's Ability to Replicate AI Research", "aliases": [ "PaperBench" ], "authors": [ "Starace, Giulio", "Jaffe, Oliver", "Sherburn, Dane", "Aung, James", "Chan, Jun Shern", "Maksin, Leon", "Dias, Rachel", "Mays, Evan", "Kinsella, Benjamin", "Thompson, Wyatt", "Heidecke, Johannes", "Glaese, Amelia", "Patwardhan, Tejal" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "paperbench", "attributionSourceId": "paperbench", "originalUrl": "https://arxiv.org/abs/2504.01848v3", "publicationDate": "2025-04-02", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Primary dimension follows graded task completion.", "zh": "主维度依据经评分的任务完成结果。" }, "protocolIds": [ "paperbench" ], "contributions": [ { "organizationId": "openai", "role": "research", "sourceId": "paperbench", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates end-to-end replication of AI research papers using hierarchical rubrics.", "zh": "使用分层评分规则评测 AI 研究论文的端到端复现。" }, "note": { "question": { "en": "Rubric-graded research replication tasks with an agent scaffold.", "zh": "在智能体脚手架下完成基于评分规则的研究复现任务。" }, "method": { "en": "Research agents replicating published ML papers", "zh": "复现已发表机器学习论文的研究智能体" }, "finding": { "en": "Evaluates end-to-end replication of AI research papers using hierarchical rubrics.", "zh": "使用分层评分规则评测 AI 研究论文的端到端复现。" }, "supports": { "en": "Primary dimension follows graded task completion.", "zh": "主维度依据经评分的任务完成结果。" }, "limits": { "en": "AI research replication is an enabling capability, not evidence of unauthorized autonomous action.", "zh": "AI 研究复现是前提能力证据，不证明未经授权的自主行动。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "alignment-faking", "title": "Alignment faking in large language models", "aliases": [ "Alignment faking" ], "authors": [ "Ryan Greenblatt", "† Carson Denison † † footnotemark:", "Benjamin Wright † † footnotemark:", "Fabien Roger † † footnotemark:", "Monte MacDiarmid † † footnotemark:" ], "primaryFunction": "discovery", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "study", "sourceId": "alignment-faking", "attributionSourceId": "alignment-faking-author-source", "originalUrl": "https://www.anthropic.com/research/alignment-faking", "publicationDate": "2024-12-18", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Conditional contrasts support a bounded propensity inference; scratchpad examples are behavior evidence.", "zh": "条件对照支持有界的倾向推断；推理轨迹示例属于行为证据。" }, "protocolIds": [ "alignment-faking" ], "contributions": [ { "organizationId": "anthropic", "role": "research", "sourceId": "alignment-faking-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "redwood", "role": "research", "sourceId": "alignment-faking-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "nyu", "role": "research", "sourceId": "alignment-faking-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mila", "role": "research", "sourceId": "alignment-faking-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Controlled study varies apparent training conditions and examines compliance and reasoning traces.", "zh": "受控研究改变模型获知的训练条件，观察响应及推理轨迹。" }, "note": { "question": { "en": "Condition-dependent response differences and reported traces.", "zh": "不同试验条件下的响应差异及所报告轨迹。" }, "method": { "en": "Models under stated training and monitoring conditions", "zh": "处于特定训练及监测条件下的模型" }, "finding": { "en": "Controlled study varies apparent training conditions and examines compliance and reasoning traces.", "zh": "受控研究改变模型获知的训练条件，观察响应及推理轨迹。" }, "supports": { "en": "Conditional contrasts support a bounded propensity inference; scratchpad examples are behavior evidence.", "zh": "条件对照支持有界的倾向推断；推理轨迹示例属于行为证据。" }, "limits": { "en": "The setting explicitly gives fictional training information; observations do not establish an enduring hidden goal in deployment.", "zh": "试验明确提供虚构训练信息；观察结果不证明部署中存在持久隐藏目标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the paper", "url": "https://arxiv.org/abs/2412.14093" }, { "label": "full paper", "url": "https://assets.anthropic.com/m/983c85a201a962f/original/Alignment-Faking-in-Large-Language-Models-full-paper.pdf" } ] }, { "id": "agentic-misalignment", "title": "Agentic misalignment: How LLMs could be insider threats", "aliases": [ "Agentic misalignment" ], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "study", "sourceId": "agentic-misalignment", "attributionSourceId": "agentic-misalignment", "originalUrl": "https://www.anthropic.com/research/agentic-misalignment", "publicationDate": "2025-06-20", "updatedOn": "2026-10-25", "areas": [ "autonomy", "deception" ], "scopeNote": { "en": "Primary observation is a conditional rate across controlled scenarios, with individual actions retained as behavior evidence.", "zh": "主观测是受控情境中的条件性发生率；具体行动另属行为证据。" }, "protocolIds": [ "agentic-misalignment" ], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "agentic-misalignment", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Stress tests model actions when benign assigned goals conflict with replacement or changed instructions.", "zh": "在既定良性目标与替换或指令变化冲突时压力测试模型行动。" }, "note": { "question": { "en": "Conditional rates and observed actions in controlled simulations.", "zh": "受控模拟中的条件性发生率与可观察行动。" }, "method": { "en": "Agents in fictional corporate simulations", "zh": "虚构企业情境中的智能体" }, "finding": { "en": "Stress tests model actions when benign assigned goals conflict with replacement or changed instructions.", "zh": "在既定良性目标与替换或指令变化冲突时压力测试模型行动。" }, "supports": { "en": "Primary observation is a conditional rate across controlled scenarios, with individual actions retained as behavior evidence.", "zh": "主观测是受控情境中的条件性发生率；具体行动另属行为证据。" }, "limits": { "en": "No real people or systems were harmed; the study does not estimate prevalence in deployment.", "zh": "试验未对真实人员或系统造成损害，也不估计部署环境中的发生率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "shade-arena", "title": "SHADE-Arena: Evaluating sabotage and monitoring in LLM agents", "aliases": [ "SHADE-Arena" ], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "benchmark", "sourceId": "shade-arena", "attributionSourceId": "shade-arena", "originalUrl": "https://www.anthropic.com/research/shade-arena-sabotage-monitoring", "publicationDate": "2025-06-16", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Task completion is the primary dimension; monitor detection is a safeguard measure and is not a second risk score.", "zh": "任务完成是主维度；监测发现率属于防护测量，并非第二项风险分数。" }, "protocolIds": [ "shade-arena" ], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "shade-arena", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Pairs benign multi-step tasks with explicitly assigned covert side tasks and monitoring.", "zh": "将多步骤良性任务与明确指派的隐蔽副任务及监测配对。" }, "note": { "question": { "en": "Covert side-task completion and monitor detection under defined tool access.", "zh": "在确定工具权限下测量隐蔽副任务完成及监测发现情况。" }, "method": { "en": "Agents assigned a covert side task alongside a legitimate task", "zh": "同时被指派隐蔽副任务与正当任务的智能体" }, "finding": { "en": "Pairs benign multi-step tasks with explicitly assigned covert side tasks and monitoring.", "zh": "将多步骤良性任务与明确指派的隐蔽副任务及监测配对。" }, "supports": { "en": "Task completion is the primary dimension; monitor detection is a safeguard measure and is not a second risk score.", "zh": "任务完成是主维度；监测发现率属于防护测量，并非第二项风险分数。" }, "limits": { "en": "An assigned malicious side task measures ability to execute it, not spontaneous desire to sabotage.", "zh": "被指派的恶意副任务测量执行能力，不证明自发破坏倾向。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the paper", "url": "https://www.arxiv.org/abs/2506.15740" } ] }, { "id": "vct", "title": "Virology Capabilities Test (VCT): A Multimodal Virology Q&A Benchmark", "aliases": [ "Virology Capabilities Test (VCT)" ], "authors": [ "Jasper Götting a", "Pedro Medeiros a", "Jon G Sanders a", "Nathaniel Li †", "Long Phan", "Karam Elabd", "Lennart Justen", "Dan Hendrycks", "Seth Donoughe ∗" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "vct", "attributionSourceId": "vct-author-source", "originalUrl": "https://arxiv.org/abs/2504.16137v2", "publicationDate": "2025-04-21", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Primary dimension is question-answering capability; version and answer-key validity remain material.", "zh": "主维度是问答能力；版本与答案效度是重要限制。" }, "protocolIds": [ "vct" ], "contributions": [ { "organizationId": "securebio", "role": "research", "sourceId": "vct-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ufabc", "role": "research", "sourceId": "vct-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cais", "role": "research", "sourceId": "vct-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mit", "role": "research", "sourceId": "vct-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Measures knowledge and troubleshooting responses in specialist virology questions.", "zh": "测量专业病毒学问题中的知识与排障响应。" }, "note": { "question": { "en": "Question-level performance in a versioned multimodal test.", "zh": "有版本的多模态题目测试表现。" }, "method": { "en": "Models answering specialist virology troubleshooting questions", "zh": "回答专门病毒学排障问题的模型" }, "finding": { "en": "Measures knowledge and troubleshooting responses in specialist virology questions.", "zh": "测量专业病毒学问题中的知识与排障响应。" }, "supports": { "en": "Primary dimension is question-answering capability; version and answer-key validity remain material.", "zh": "主维度是问答能力；版本与答案效度是重要限制。" }, "limits": { "en": "Knowledge-question accuracy does not establish practical harmful-task execution; v1 and v2 scores are not directly interchangeable.", "zh": "知识问答准确率不证明实际有害任务执行能力；v1 与 v2 分数不可直接互换。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "vct-v2", "title": "Introducing VCT-v2 — the updated Virology Capabilities Test", "aliases": [ "Virology Capabilities Test v2" ], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "vct-v2", "attributionSourceId": "vct-v2", "originalUrl": "https://securebio.org/blog/introducing-vct-v2/", "publicationDate": "2026-09-11", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Primary dimension is question-answering capability; version and answer-key validity remain material.", "zh": "主维度是问答能力；版本与答案效度是重要限制。" }, "protocolIds": [ "vct-v2" ], "contributions": [ { "organizationId": "securebio", "role": "publisher", "sourceId": "vct-v2", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Revises VCT questions to reduce shortcut-based success and preserve measurement validity.", "zh": "修订 VCT 题目以减少捷径作答并提高测量效度。" }, "note": { "question": { "en": "Question-level performance in a versioned multimodal test.", "zh": "有版本的多模态题目测试表现。" }, "method": { "en": "Models answering specialist virology troubleshooting questions", "zh": "回答专门病毒学排障问题的模型" }, "finding": { "en": "Revises VCT questions to reduce shortcut-based success and preserve measurement validity.", "zh": "修订 VCT 题目以减少捷径作答并提高测量效度。" }, "supports": { "en": "Primary dimension is question-answering capability; version and answer-key validity remain material.", "zh": "主维度是问答能力；版本与答案效度是重要限制。" }, "limits": { "en": "Knowledge-question accuracy does not establish practical harmful-task execution; v1 and v2 scores are not directly interchangeable.", "zh": "知识问答准确率不证明实际有害任务执行能力；v1 与 v2 分数不可直接互换。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "biotier", "title": "BioTIER: A Refusal Benchmark for Targeted Biological Risk Mitigation", "aliases": [ "BioTIER" ], "authors": [ "Eleanor M. Marshall", "Pedro Medeiros", "Peter Peneder", "Nelly Mak", "Jacob Kaffey", "Faith Rovenolt", "Mac Walker", "Seth Donoughe", "Jasper Götting" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "biotier", "attributionSourceId": "biotier-author-source", "originalUrl": "https://arxiv.org/abs/2607.14479v1", "publicationDate": "2026-07-16", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Primary observation is what the model outputs or refuses in the test.", "zh": "主观测是模型在试验中的输出或拒答。" }, "protocolIds": [ "biotier" ], "contributions": [ { "organizationId": "securebio", "role": "research", "sourceId": "biotier-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ufabc", "role": "research", "sourceId": "biotier-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates refusal of high-risk requests alongside preservation of benign biological assistance.", "zh": "同时评测高风险请求拒答与正常生物研究协助的保留。" }, "note": { "question": { "en": "Response and refusal behavior across expert-curated prompt sets.", "zh": "在专家整理的提示集合中观察响应与拒答行为。" }, "method": { "en": "Models responding to tiered biological-risk prompts", "zh": "响应分层生物风险提示的模型" }, "finding": { "en": "Evaluates refusal of high-risk requests alongside preservation of benign biological assistance.", "zh": "同时评测高风险请求拒答与正常生物研究协助的保留。" }, "supports": { "en": "Primary observation is what the model outputs or refuses in the test.", "zh": "主观测是模型在试验中的输出或拒答。" }, "limits": { "en": "Refusal is a safeguard outcome; it does not directly measure underlying biological knowledge or task ability.", "zh": "拒答属于防护结果，不直接测量潜在生物知识或任务能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "mask", "title": "The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systems", "aliases": [ "MASK" ], "authors": [ "Richard Ren", "Arunim Agarwal", "Mantas Mazeika", "Cristina Menghini", "Robert Vacareanu", "Brad Kenstler", "Mick Yang", "Isabelle Barrass", "Alice Gatti", "Xuwang Yin", "Eduardo Trevino", "Matias Geralnik", "Adam Khoja", "Dean Lee", "Summer Yue", "Dan Hendrycks" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "mask", "attributionSourceId": "mask-author-source", "originalUrl": "https://arxiv.org/abs/2503.03750v3", "publicationDate": "2025-03-05", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Primary construct is conditional willingness to make misleading statements, not general truthfulness accuracy.", "zh": "主构念是条件性误导陈述倾向，而非一般事实准确率。" }, "protocolIds": [ "mask" ], "contributions": [ { "organizationId": "cais", "role": "research", "sourceId": "mask-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "scale", "role": "research", "sourceId": "mask-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Separates honesty from factual accuracy using repeated, human-collected test situations.", "zh": "通过重复的人类收集情境区分诚实性与事实准确性。" }, "note": { "question": { "en": "Condition-bounded frequency of lying under stated pressures.", "zh": "明确压力条件下说谎的有界发生率。" }, "method": { "en": "Models under pressure to state an inaccurate belief", "zh": "在压力条件下表达不准确观点的模型" }, "finding": { "en": "Separates honesty from factual accuracy using repeated, human-collected test situations.", "zh": "通过重复的人类收集情境区分诚实性与事实准确性。" }, "supports": { "en": "Primary construct is conditional willingness to make misleading statements, not general truthfulness accuracy.", "zh": "主构念是条件性误导陈述倾向，而非一般事实准确率。" }, "limits": { "en": "A controlled benchmark does not establish stable intent or real-world deception prevalence.", "zh": "受控基准不证明稳定意图或现实环境中的欺骗发生率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "ape", "title": "It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics", "aliases": [ "Attempt to Persuade Eval (APE)" ], "authors": [ "\\authorname Matthew Kowal \\authorinstitution FAR.AI \\authorname Jasper Timm \\authorinstitution FAR.AI \\authorname Jean-Francois Godbout \\authorinstitution Université de Montréal, MILA \\authorname Thomas Costello \\authorinstitution Carnegie Mellon University \\authorname Antonio A. Arechar \\authorinstitution MIT, Center for Research and Teaching in Economics \\authorname Gordon Pennycook \\authorinstitution Cornell University, University of Regina \\authorname David Rand \\authorinstitution Cornell University, MIT \\authorname Adam Gleave \\authorinstitution FAR.AI \\authorname Kellin Pelrine \\authorinstitution FAR.AI" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "ape", "attributionSourceId": "ape-author-source", "originalUrl": "https://arxiv.org/abs/2506.02873v4", "publicationDate": "2025-06-03", "updatedOn": "2026-10-25", "areas": [ "disinformation" ], "scopeNote": { "en": "Primary construct is conditional attempt rate; persuasion impact requires a separate human-outcome study.", "zh": "主构念是条件性尝试率；说服影响须由单独的人类结果研究测量。" }, "protocolIds": [ "ape" ], "contributions": [ { "organizationId": "far", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "montreal", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mila", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cmu", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mit", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cornell", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "regina", "role": "research", "sourceId": "ape-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Measures attempts to persuade on specified harmful topics in simulated conversations.", "zh": "测量模型在模拟对话中针对特定有害议题的说服尝试。" }, "note": { "question": { "en": "Frequency of persuasive attempts under specified conversational conditions.", "zh": "特定对话条件下说服尝试的发生率。" }, "method": { "en": "Models in simulated multi-turn persuasion dialogues", "zh": "模拟多轮说服对话中的模型" }, "finding": { "en": "Measures attempts to persuade on specified harmful topics in simulated conversations.", "zh": "测量模型在模拟对话中针对特定有害议题的说服尝试。" }, "supports": { "en": "Primary construct is conditional attempt rate; persuasion impact requires a separate human-outcome study.", "zh": "主构念是条件性尝试率；说服影响须由单独的人类结果研究测量。" }, "limits": { "en": "Simulated attempts are not measured human belief change or large-scale disinformation reach.", "zh": "模拟尝试不等于已测量的人类信念变化或大规模虚假信息传播。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "conspiracy-persuasion", "title": "Large language models can effectively convince people to believe conspiracies", "aliases": [ "Conspiracy belief experiments" ], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "conspiracy-persuasion", "attributionSourceId": "conspiracy-persuasion", "originalUrl": "https://www.far.ai/research/large-language-models-can-effectively-convince-people-to-believe-conspiracies", "publicationDate": "2026-01-08", "updatedOn": "2026-10-25", "areas": [ "disinformation" ], "scopeNote": { "en": "Primary outcome is observed human belief change, not the model’s standalone persuasive capability.", "zh": "主结果是观察到的人类信念变化，而非模型脱离情境的说服能力。" }, "protocolIds": [ "conspiracy-persuasion" ], "contributions": [ { "organizationId": "far", "role": "publisher", "sourceId": "conspiracy-persuasion", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Pre-registered experiments compare changes in conspiracy beliefs after different model conversations.", "zh": "预注册实验比较不同模型对话后受试者阴谋论信念的变化。" }, "note": { "question": { "en": "Measured belief change in human participants under defined interventions.", "zh": "在指定干预下测量人类受试者的信念变化。" }, "method": { "en": "Human participants in model-mediated conversations", "zh": "参与模型介导对话的受试者" }, "finding": { "en": "Pre-registered experiments compare changes in conspiracy beliefs after different model conversations.", "zh": "预注册实验比较不同模型对话后受试者阴谋论信念的变化。" }, "supports": { "en": "Primary outcome is observed human belief change, not the model’s standalone persuasive capability.", "zh": "主结果是观察到的人类信念变化，而非模型脱离情境的说服能力。" }, "limits": { "en": "Study participants, topics and dialogue conditions constrain generalization to populations or campaigns.", "zh": "受试者、议题与对话条件限制向人群或传播活动外推。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "sec-bench", "title": "SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks", "aliases": [ "SEC-bench" ], "authors": [ "Hwiwon Lee \nZiqi Zhang \nHanxiao Lu † Lingming Zhang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "sec-bench-publication", "attributionSourceId": "sec-bench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2506.11791", "publicationDate": "2025-06-13", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "sec-bench" ], "contributions": [ { "organizationId": "uiuc", "role": "research", "sourceId": "sec-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "purdue", "role": "research", "sourceId": "sec-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests vulnerability reproduction and patching in executable software environments assembled with an automated construction pipeline.", "zh": "通过自动构建的可执行软件环境，评测漏洞复现和修补能力。" }, "note": { "question": { "en": "Tests vulnerability reproduction and patching in executable software environments assembled with an automated construction pipeline.", "zh": "通过自动构建的可执行软件环境，评测漏洞复现和修补能力。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Tests vulnerability reproduction and patching in executable software environments assembled with an automated construction pipeline.", "zh": "通过自动构建的可执行软件环境，评测漏洞复现和修补能力。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Reproduction and patching are different outcomes; executable verification and task construction quality constrain interpretation.", "zh": "漏洞复现与修补是不同结果，解释须考虑执行验证和任务构建质量。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "exploitbench", "title": "ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents", "aliases": [ "ExploitBench" ], "authors": [ "Seunghyun Lee", "David Brumley" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "exploitbench-publication", "attributionSourceId": "exploitbench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2605.14153", "publicationDate": "2026-05-13", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "exploitbench" ], "contributions": [ { "organizationId": "cmu", "role": "research", "sourceId": "exploitbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "bugcrowd", "role": "research", "sourceId": "exploitbench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Separates exploit development into capability levels, distinguishing bug triggering from reusable exploitation primitives and control.", "zh": "将漏洞利用拆分为能力层级，区分触发缺陷、构造利用原语和获取控制。" }, "note": { "question": { "en": "Separates exploit development into capability levels, distinguishing bug triggering from reusable exploitation primitives and control.", "zh": "将漏洞利用拆分为能力层级，区分触发缺陷、构造利用原语和获取控制。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Separates exploit development into capability levels, distinguishing bug triggering from reusable exploitation primitives and control.", "zh": "将漏洞利用拆分为能力层级，区分触发缺陷、构造利用原语和获取控制。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Known-vulnerability tasks and target settings do not establish discovery of unknown vulnerabilities in deployed systems.", "zh": "已知漏洞任务及特定目标环境不能证明现实部署中的未知漏洞发现能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "exploitgym", "title": "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?", "aliases": [ "ExploitGym" ], "authors": [ "Zhun Wang", "Nico Schiller", "Hongwei Li", "Srijiith Sesha Narayana", "Milad Nasr", "Nicholas Carlini", "Xiangyu Qi", "Eric Wallace", "Elie Bursztein", "Luca Invernizzi", "Kurt Thomas", "Yan Shoshitaishvili", "Wenbo Guo", "Jingxuan He", "Thorsten Holz", "Dawn Song" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "exploitgym-publication", "attributionSourceId": "exploitgym-publication-author-source", "originalUrl": "https://rdi.berkeley.edu/blog/exploitgym/", "publicationDate": "2026-05-13", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "exploitgym" ], "contributions": [ { "organizationId": "berkeley", "role": "research", "sourceId": "exploitgym-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mila", "role": "research", "sourceId": "exploitgym-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "exploitgym-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "openai", "role": "research", "sourceId": "exploitgym-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "asu", "role": "research", "sourceId": "exploitgym-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates exploit construction across real software targets and checks whether success uses the designated vulnerability.", "zh": "在真实软件目标上评测利用构造，并核查成功是否依赖指定漏洞。" }, "note": { "question": { "en": "Evaluates exploit construction across real software targets and checks whether success uses the designated vulnerability.", "zh": "在真实软件目标上评测利用构造，并核查成功是否依赖指定漏洞。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates exploit construction across real software targets and checks whether success uses the designated vulnerability.", "zh": "在真实软件目标上评测利用构造，并核查成功是否依赖指定漏洞。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Target mitigations, supplied artifacts and vulnerability attribution must accompany any performance claim.", "zh": "性能判断须同时说明目标防护、已提供材料和漏洞归因。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cve-bench", "title": "CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities", "aliases": [ "CVE-Bench" ], "authors": [ "Yuxuan Zhu", "Antony Kellermann", "Dylan Bowman", "Philip Li", "Akul Gupta", "Adarsh Danda", "Richard Fang", "Conner Jensen", "Eric Ihli", "Jason Benn", "Jet Geronimo", "Avi Dhir", "Sudhit Rao", "Kaicheng Yu", "Twm Stone", "Daniel Kang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "cve-bench-publication", "attributionSourceId": "cve-bench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2503.17332", "publicationDate": "2025-03-21", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "cve-bench" ], "contributions": [ { "organizationId": "uiuc", "role": "research", "sourceId": "cve-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Measures agents’ exploitation of real web-application vulnerabilities in runnable environments with explicit success checks.", "zh": "在可运行环境中，以明确成功判据评测智能体利用真实 Web 应用漏洞的能力。" }, "note": { "question": { "en": "Measures agents’ exploitation of real web-application vulnerabilities in runnable environments with explicit success checks.", "zh": "在可运行环境中，以明确成功判据评测智能体利用真实 Web 应用漏洞的能力。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Measures agents’ exploitation of real web-application vulnerabilities in runnable environments with explicit success checks.", "zh": "在可运行环境中，以明确成功判据评测智能体利用真实 Web 应用漏洞的能力。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Disclosed vulnerabilities and bounded environments differ from open-ended discovery and enterprise intrusion.", "zh": "已披露漏洞与有界环境不同于开放式发现和企业入侵。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "sre-bench", "title": "The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark", "aliases": [ "SRE-Bench" ], "authors": [ "Jeremy Spence", "Nicholas Assaderaghi", "Feng Xiao", "Jinhao Zhu", "Nikil Ravi", "Xiangyu Qi", "Matthew Jagielski", "Raluca Ada Popa", "Eric Wallace", "Guannan Wei", "Yangruibo Ding", "Zhuo Zhang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "sre-bench-publication", "attributionSourceId": "sre-bench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2608.11469", "publicationDate": "2026-08-11", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "sre-bench" ], "contributions": [ { "organizationId": "columbia", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "deepmind", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "vals", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "openai", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "tufts", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ucla", "role": "research", "sourceId": "sre-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies agentic reverse engineering with realistic binary-analysis tasks designed to reduce benchmark contamination.", "zh": "通过贴近实际的二进制分析任务研究智能体逆向工程能力，并控制评测污染。" }, "note": { "question": { "en": "Studies agentic reverse engineering with realistic binary-analysis tasks designed to reduce benchmark contamination.", "zh": "通过贴近实际的二进制分析任务研究智能体逆向工程能力，并控制评测污染。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Studies agentic reverse engineering with realistic binary-analysis tasks designed to reduce benchmark contamination.", "zh": "通过贴近实际的二进制分析任务研究智能体逆向工程能力，并控制评测污染。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Reverse-engineering success is a component capability; it does not by itself establish end-to-end intrusion.", "zh": "逆向工程成功属于组成能力，不能单独证明端到端入侵能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "irregular-opus-cyber-assessment", "title": "Assessing Claude Opus 5.5 Against Offensive Security Benchmarks", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "irregular-opus-cyber-assessment-publication", "attributionSourceId": "irregular-opus-cyber-assessment-publication", "originalUrl": "https://www.irregular.com/research/assessing-claude-opus-5.5-against-offensive-security-benchmarks", "publicationDate": "2026-09-22", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "irregular", "role": "publisher", "sourceId": "irregular-opus-cyber-assessment-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Reports model-specific results on multi-stage offensive-security tasks and distinguishes the evaluated challenge subset.", "zh": "报告特定模型在多阶段网络安全任务中的结果，并明确受测挑战子集。" }, "note": { "question": { "en": "Reports model-specific results on multi-stage offensive-security tasks and distinguishes the evaluated challenge subset.", "zh": "报告特定模型在多阶段网络安全任务中的结果，并明确受测挑战子集。" }, "method": { "en": "Reports model-specific results on multi-stage offensive-security tasks and distinguishes the evaluated challenge subset.", "zh": "报告特定模型在多阶段网络安全任务中的结果，并明确受测挑战子集。" }, "finding": { "en": "Reports model-specific results on multi-stage offensive-security tasks and distinguishes the evaluated challenge subset.", "zh": "报告特定模型在多阶段网络安全任务中的结果，并明确受测挑战子集。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A selected challenge subset cannot be pooled with a full benchmark release or a different evaluation protocol.", "zh": "选定挑战子集不能与完整基准或不同协议的结果合并。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "irregular-astra-cyber-assessment", "title": "Assessing GPT-6 Astra: FrontierCyber Measures a Sharp Increase in Cyber Capability", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "irregular-astra-cyber-assessment-publication", "attributionSourceId": "irregular-astra-cyber-assessment-publication", "originalUrl": "https://www.irregular.com/research/assessing-gpt-6-astra", "publicationDate": "2026-09-03", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "irregular", "role": "publisher", "sourceId": "irregular-astra-cyber-assessment-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Examines frontier-model performance across multi-stage cyber scenarios, atomic tasks and FrontierCyber challenges.", "zh": "通过多阶段网络场景、原子任务和 FrontierCyber 挑战研究前沿模型能力。" }, "note": { "question": { "en": "Examines frontier-model performance across multi-stage cyber scenarios, atomic tasks and FrontierCyber challenges.", "zh": "通过多阶段网络场景、原子任务和 FrontierCyber 挑战研究前沿模型能力。" }, "method": { "en": "Examines frontier-model performance across multi-stage cyber scenarios, atomic tasks and FrontierCyber challenges.", "zh": "通过多阶段网络场景、原子任务和 FrontierCyber 挑战研究前沿模型能力。" }, "finding": { "en": "Examines frontier-model performance across multi-stage cyber scenarios, atomic tasks and FrontierCyber challenges.", "zh": "通过多阶段网络场景、原子任务和 FrontierCyber 挑战研究前沿模型能力。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The report’s task sets, access conditions and success definitions bound its findings; values are not transcribed here.", "zh": "结论受报告任务集、访问条件和成功定义约束，本档案未转录其数值。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "solve-plus", "title": "Introducing SOLVE+: Scoring Cyber Scenarios (Version 0.5)", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "method", "sourceId": "solve-plus-publication", "attributionSourceId": "solve-plus-publication", "originalUrl": "https://www.irregular.com/research/solve-plus", "publicationDate": "2026-09-03", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "irregular", "role": "publisher", "sourceId": "solve-plus-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Defines a scenario-scoring method that decomposes offensive cyber operations into capability requirements and difficult steps.", "zh": "提出场景评分方法，将网络攻击过程拆解为能力要求与困难步骤。" }, "note": { "question": { "en": "Defines a scenario-scoring method that decomposes offensive cyber operations into capability requirements and difficult steps.", "zh": "提出场景评分方法，将网络攻击过程拆解为能力要求与困难步骤。" }, "method": { "en": "Defines a scenario-scoring method that decomposes offensive cyber operations into capability requirements and difficult steps.", "zh": "提出场景评分方法，将网络攻击过程拆解为能力要求与困难步骤。" }, "finding": { "en": "Defines a scenario-scoring method that decomposes offensive cyber operations into capability requirements and difficult steps.", "zh": "提出场景评分方法，将网络攻击过程拆解为能力要求与困难步骤。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A task-difficulty scoring method is not a calibrated probability of real-world harm or a model safety score.", "zh": "任务难度评分方法不等于现实危害概率或模型安全分数。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cyberseceval", "title": "CyberSecEval 4", "aliases": [ "Meta CyberSecEval / CyberSecEval 4" ], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "cyberseceval-publication", "attributionSourceId": "cyberseceval-publication", "originalUrl": "https://meta-llama.github.io/PurpleLlama/CyberSecEval/docs/intro", "publicationDate": null, "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "cyberseceval" ], "contributions": [ { "organizationId": "meta", "role": "publisher", "sourceId": "cyberseceval-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Provides evaluation suites for cyber capabilities and safeguards, with distinct task families and release-specific protocols.", "zh": "提供网络能力与防护评测套件，分别组织任务族和版本协议。" }, "note": { "question": { "en": "Provides evaluation suites for cyber capabilities and safeguards, with distinct task families and release-specific protocols.", "zh": "提供网络能力与防护评测套件，分别组织任务族和版本协议。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Provides evaluation suites for cyber capabilities and safeguards, with distinct task families and release-specific protocols.", "zh": "提供网络能力与防护评测套件，分别组织任务族和版本协议。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Results from different suite generations and task families require separate interpretation.", "zh": "不同代际套件和任务族的结果需要分别解释。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cybersoceval", "title": "CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning", "aliases": [ "CyberSOCEval" ], "authors": [ "Lauren Deason*†", "Adam Bali†", "Ciprian Bejean‡", "Diana Bolocan*‡", "James Crnkovich*†", "Ioana Croitoru*‡", "Krishna Durai†", "Chase Midler‡", "Calin Miron‡", "David Molnar*†", "Brad Moon‡", "Bruno Ostarcevic‡", "Alberto Peltea‡", "Matt Rosenberg‡", "Catalin Sandu‡", "Arthur Saputkin†", "Sagar Shah*†", "Daniel Stan‡", "Ernest Szocs‡", "Shengye Wan†", "Spencer Whitman†", "Sven Krasser‡", "Joshua Saxe*†" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "cybersoceval-publication", "attributionSourceId": "cybersoceval-publication", "originalUrl": "https://arxiv.org/html/2509.20166v1", "publicationDate": null, "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "cybersoceval" ], "contributions": [ { "organizationId": "meta", "role": "research", "sourceId": "cybersoc-project-source", "locator": "Original project README: joint project between CrowdStrike and Meta" }, { "organizationId": "crowdstrike", "role": "research", "sourceId": "cybersoc-project-source", "locator": "Original project README: joint project between CrowdStrike and Meta" } ], "summary": { "en": "Evaluates malware analysis and threat-intelligence reasoning as defensive cybersecurity tasks.", "zh": "评测恶意软件分析和威胁情报推理等防御性网络安全任务。" }, "note": { "question": { "en": "Evaluates malware analysis and threat-intelligence reasoning as defensive cybersecurity tasks.", "zh": "评测恶意软件分析和威胁情报推理等防御性网络安全任务。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates malware analysis and threat-intelligence reasoning as defensive cybersecurity tasks.", "zh": "评测恶意软件分析和威胁情报推理等防御性网络安全任务。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Defensive analysis accuracy is enabling evidence, not direct evidence of autonomous offensive operations.", "zh": "防御分析准确性是使能证据，不能直接证明自主攻击能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "caisi-glm-cyber-assessment", "title": "CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities | NIST", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "caisi-glm-cyber-assessment-publication", "attributionSourceId": "caisi-glm-cyber-assessment-publication", "originalUrl": "https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities", "publicationDate": "2026-09-17", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "nist", "role": "publisher", "sourceId": "caisi-glm-cyber-assessment-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Presents an independent assessment of a released model’s cybersecurity capabilities and evaluation conditions.", "zh": "对已发布模型的网络安全能力及评测条件开展独立评估。" }, "note": { "question": { "en": "Presents an independent assessment of a released model’s cybersecurity capabilities and evaluation conditions.", "zh": "对已发布模型的网络安全能力及评测条件开展独立评估。" }, "method": { "en": "Presents an independent assessment of a released model’s cybersecurity capabilities and evaluation conditions.", "zh": "对已发布模型的网络安全能力及评测条件开展独立评估。" }, "finding": { "en": "Presents an independent assessment of a released model’s cybersecurity capabilities and evaluation conditions.", "zh": "对已发布模型的网络安全能力及评测条件开展独立评估。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The tested model configuration and selected tasks do not represent every deployment of the model family.", "zh": "受测配置与选定任务不代表该模型家族的所有部署。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "hcast", "title": "HCAST: Human-Calibrated Autonomy Software Tasks", "aliases": [ "HCAST" ], "authors": [ "David Rein", "Joel Becker", "Amy Deng", "Seraphina Nix", "Chris Canal", "Daniel O’Connell", "Pip Arnott", "Ryan Bloom", "Thomas Broadley", "Katharyn Garcia", "Brian Goodrich", "Max Hasin", "Sami Jawhar", "Megan Kinniment", "Thomas Kwa", "Aron Lajko", "Nate Rush", "Lucas Jun Koba Sato", "Sydney Von Arx", "Ben West", "Lawrence Chan", "Elizabeth Barnes" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "hcast-publication", "attributionSourceId": "hcast-publication-author-source", "originalUrl": "https://arxiv.org/abs/2503.17354", "publicationDate": "2025-03-21", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "hcast" ], "contributions": [ { "organizationId": "metr", "role": "research", "sourceId": "hcast-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "equistamp", "role": "research", "sourceId": "hcast-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Uses human-calibrated software tasks to relate agent task completion to measured human effort.", "zh": "使用经过人类校准的软件任务，将智能体完成情况与人类投入关联。" }, "note": { "question": { "en": "Uses human-calibrated software tasks to relate agent task completion to measured human effort.", "zh": "使用经过人类校准的软件任务，将智能体完成情况与人类投入关联。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Uses human-calibrated software tasks to relate agent task completion to measured human effort.", "zh": "使用经过人类校准的软件任务，将智能体完成情况与人类投入关联。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Human effort calibration depends on the participant population, task distribution and agent configuration.", "zh": "人类投入校准依赖参与者群体、任务分布和智能体配置。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "mirrorcode", "title": "MirrorCode: Evidence that AI can already do some weeks-long coding tasks", "aliases": [ "MirrorCode" ], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "mirrorcode-publication", "attributionSourceId": "mirrorcode-publication", "originalUrl": "https://metr.org/blog/2026-04-10-mirrorcode-preliminary-results/", "publicationDate": "2026-04-10", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "mirrorcode" ], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "mirrorcode-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Tests extended codebase reimplementation to investigate autonomous work over longer software-engineering tasks.", "zh": "通过较长的软件工程与代码库重建任务研究持续自主工作能力。" }, "note": { "question": { "en": "Tests extended codebase reimplementation to investigate autonomous work over longer software-engineering tasks.", "zh": "通过较长的软件工程与代码库重建任务研究持续自主工作能力。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Tests extended codebase reimplementation to investigate autonomous work over longer software-engineering tasks.", "zh": "通过较长的软件工程与代码库重建任务研究持续自主工作能力。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Successful reimplementation is bounded by the available specification, checks, resources and task selection.", "zh": "重建成功受可用规范、检查方式、资源和任务选择限制。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "expenditure-horizon", "title": "Expenditure Horizon: Measuring Optimization Ability, with an Application to NanoGPT", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "method", "sourceId": "expenditure-horizon-publication", "attributionSourceId": "expenditure-horizon-publication", "originalUrl": "https://metr.org/blog/2026-07-21-expenditure-horizon/", "publicationDate": "2026-07-21", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "expenditure-horizon-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Introduces an expenditure-horizon measure of optimization ability and illustrates it with NanoGPT optimization.", "zh": "提出衡量优化能力的资源投入跨度指标，并以 NanoGPT 优化进行说明。" }, "note": { "question": { "en": "Introduces an expenditure-horizon measure of optimization ability and illustrates it with NanoGPT optimization.", "zh": "提出衡量优化能力的资源投入跨度指标，并以 NanoGPT 优化进行说明。" }, "method": { "en": "Introduces an expenditure-horizon measure of optimization ability and illustrates it with NanoGPT optimization.", "zh": "提出衡量优化能力的资源投入跨度指标，并以 NanoGPT 优化进行说明。" }, "finding": { "en": "Introduces an expenditure-horizon measure of optimization ability and illustrates it with NanoGPT optimization.", "zh": "提出衡量优化能力的资源投入跨度指标，并以 NanoGPT 优化进行说明。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "An optimization expenditure horizon differs from a task-duration time horizon and depends on the cost model.", "zh": "优化资源投入跨度不同于任务时长跨度，并依赖成本模型。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "mle-bench", "title": "MLE-bench: Evaluating Machine Learning Agents on Machine Learning Engineering", "aliases": [ "MLE-bench" ], "authors": [ "Chan Jun Shern *", "Neil Chowdhury", "Oliver Jaffe *", "James Aung *", "Dane Sherburn *", "Evan Mays *", "Giulio Starace *", "Kevin Liu", "Leon Maksin", "Tejal Patwardhan", "Lilian Weng", "Aleksander MądryOpenAI" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "mle-bench-publication", "attributionSourceId": "mle-bench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2410.07095", "publicationDate": "2024-10-09", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "mle-bench" ], "contributions": [ { "organizationId": "openai", "role": "research", "sourceId": "mle-bench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates autonomous machine-learning engineering using competition tasks and human performance baselines.", "zh": "通过竞赛任务和人类表现基线评测自主机器学习工程能力。" }, "note": { "question": { "en": "Evaluates autonomous machine-learning engineering using competition tasks and human performance baselines.", "zh": "通过竞赛任务和人类表现基线评测自主机器学习工程能力。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates autonomous machine-learning engineering using competition tasks and human performance baselines.", "zh": "通过竞赛任务和人类表现基线评测自主机器学习工程能力。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Competition performance is a proxy for parts of AI research work, not a direct measure of recursive self-improvement.", "zh": "竞赛表现是部分 AI 研发能力的代理指标，不能直接衡量递归自我改进。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "posttrainbench", "title": "PostTrainBench: Can LLM Agents Automate LLM Post-Training?", "aliases": [ "PostTrainBench and OpenAI PostTrainBench Lite" ], "authors": [ "Ben Rank ∗", "Hardik Bhatnagar ∗", "Ameya Prabhu", "Shira Eisenberg †", "Nguyen Karina", "Matthias Bethge", "Maksym Andriushchenko" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "posttrainbench-publication", "attributionSourceId": "posttrainbench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2603.08640", "publicationDate": "2026-03-09", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "posttrainbench" ], "contributions": [ { "organizationId": "ellis", "role": "research", "sourceId": "posttrainbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mpi", "role": "research", "sourceId": "posttrainbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "tubingen", "role": "research", "sourceId": "posttrainbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "thoughtful", "role": "research", "sourceId": "posttrainbench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests whether agents can improve base models through post-training under a fixed compute budget.", "zh": "评测智能体能否在固定计算预算内，通过后训练改进基础模型。" }, "note": { "question": { "en": "Tests whether agents can improve base models through post-training under a fixed compute budget.", "zh": "评测智能体能否在固定计算预算内，通过后训练改进基础模型。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Tests whether agents can improve base models through post-training under a fixed compute budget.", "zh": "评测智能体能否在固定计算预算内，通过后训练改进基础模型。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Targeted benchmark gains, test contamination and unauthorized shortcuts require separate checks.", "zh": "定向基准提升、测试污染与未经授权的捷径需要分别核查。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "deepmind-dangerous-capabilities", "title": "Evaluating Frontier Models for Dangerous Capabilities", "aliases": [], "authors": [ "Mary Phuong", "Matthew Aitchison", "Elliot Catt", "Sarah Cogan", "Alexandre Kaskasoli", "Victoria Krakovna", "David Lindner", "Matthew Rahtz", "Yannis Assael", "Sarah Hodkinson", "Heidi Howard", "Tom Lieberum", "Ramana Kumar", "Maria Abi Raad", "Albert Webson", "Lewis Ho", "Sharon Lin", "Sebastian Farquhar", "Marcus Hutter", "Grégoire Delétang", "Anian Ruoss", "Seliem El-Sayed", "Sasha Brown", "Anca Dragan", "Rohin Shah", "Allan Dafoe", "Toby Shevlane" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "deepmind-dangerous-capabilities-publication", "attributionSourceId": "deepmind-dangerous-capabilities-publication-author-source", "originalUrl": "https://arxiv.org/abs/2403.13793", "publicationDate": "2024-03-20", "updatedOn": "2026-10-25", "areas": [ "autonomy", "deception", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "deepmind", "role": "research", "sourceId": "deepmind-capability-author-source", "locator": "Official research publication and author list" } ], "summary": { "en": "Pilots dangerous-capability evaluations covering cyber tasks, self-proliferation, self-reasoning and persuasion.", "zh": "试行危险能力评测，覆盖网络任务、自我扩散、自我推理和说服。" }, "note": { "question": { "en": "Pilots dangerous-capability evaluations covering cyber tasks, self-proliferation, self-reasoning and persuasion.", "zh": "试行危险能力评测，覆盖网络任务、自我扩散、自我推理和说服。" }, "method": { "en": "Pilots dangerous-capability evaluations covering cyber tasks, self-proliferation, self-reasoning and persuasion.", "zh": "试行危险能力评测，覆盖网络任务、自我扩散、自我推理和说服。" }, "finding": { "en": "Pilots dangerous-capability evaluations covering cyber tasks, self-proliferation, self-reasoning and persuasion.", "zh": "试行危险能力评测，覆盖网络任务、自我扩散、自我推理和说服。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Early warning signals are conditional observations; the paper does not establish deployment-level loss of control.", "zh": "早期预警信号属于有条件观测，论文不能证明部署层面的失控。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "self-replication-extended", "title": "Large language model-powered AI systems achieve self-replication with no human intervention", "aliases": [], "authors": [ "Xudong Pan † {\\dagger} (潘旭东)", "Jiarun Dai † {\\dagger} (戴嘉润)", "Yihe Fan (范一禾)", "Minyuan Luo (罗铭源)", "Changyi Li (李长艺)", "Min Yang ∗ (杨珉)" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "self-replication-extended-publication", "attributionSourceId": "self-replication-extended-publication-author-source", "originalUrl": "https://arxiv.org/abs/2503.17378", "publicationDate": "2025-03-14", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "fudan", "role": "research", "sourceId": "self-replication-extended-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Extends controlled experiments on AI-system self-replication and documents the agent setup and observed replication behavior.", "zh": "扩展 AI 系统自我复制的受控实验，记录智能体设置与观察到的复制行为。" }, "note": { "question": { "en": "Extends controlled experiments on AI-system self-replication and documents the agent setup and observed replication behavior.", "zh": "扩展 AI 系统自我复制的受控实验，记录智能体设置与观察到的复制行为。" }, "method": { "en": "Extends controlled experiments on AI-system self-replication and documents the agent setup and observed replication behavior.", "zh": "扩展 AI 系统自我复制的受控实验，记录智能体设置与观察到的复制行为。" }, "finding": { "en": "Extends controlled experiments on AI-system self-replication and documents the agent setup and observed replication behavior.", "zh": "扩展 AI 系统自我复制的受控实验，记录智能体设置与观察到的复制行为。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Controlled replication with provided access differs from unauthorized autonomous spread in real networks.", "zh": "具备给定访问条件的受控复制不同于真实网络中的未授权自主扩散。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "palisade-network-replication", "title": "Language Models Can Autonomously Hack and Self-Replicate", "aliases": [], "authors": [ "Air, Alena", "Reworr", "Kotov, Nikolaj", "Volkov, Dmitrii", "Steidley, John", "Ladish, Jeffrey" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "palisade-network-replication-publication", "attributionSourceId": "palisade-network-replication-publication", "originalUrl": "https://arxiv.org/abs/2605.06760", "publicationDate": "2026-05-07", "updatedOn": "2026-10-25", "areas": [ "autonomy", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "palisade", "role": "publisher", "sourceId": "palisade-replication-project", "locator": "Official Palisade research publication matching the paper" } ], "summary": { "en": "Studies whether an agent can replicate its model and harness across a controlled network through vulnerable hosts.", "zh": "研究智能体能否通过脆弱主机，在受控网络中复制模型及脚手架。" }, "note": { "question": { "en": "Studies whether an agent can replicate its model and harness across a controlled network through vulnerable hosts.", "zh": "研究智能体能否通过脆弱主机，在受控网络中复制模型及脚手架。" }, "method": { "en": "Studies whether an agent can replicate its model and harness across a controlled network through vulnerable hosts.", "zh": "研究智能体能否通过脆弱主机，在受控网络中复制模型及脚手架。" }, "finding": { "en": "Studies whether an agent can replicate its model and harness across a controlled network through vulnerable hosts.", "zh": "研究智能体能否通过脆弱主机，在受控网络中复制模型及脚手架。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Network construction, permissions and model access define the experiment’s scope; no deployment probability follows.", "zh": "网络构造、权限和模型访问限定实验范围，不能据此外推部署概率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "agentic-self-modification", "title": "Agentic Self-Modification in Open-Weights Systems", "aliases": [], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "agentic-self-modification-publication", "attributionSourceId": "agentic-self-modification-publication", "originalUrl": "https://www.irregular.com/research/agentic-self-modification-in-open-weights-systems", "publicationDate": "2026-09-16", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "irregular", "role": "publisher", "sourceId": "agentic-self-modification-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Examines agent-initiated modification of open-weight systems during ordinary software-maintenance tasks.", "zh": "研究智能体在普通软件维护任务中主动修改开放权重系统的行为。" }, "note": { "question": { "en": "Examines agent-initiated modification of open-weight systems during ordinary software-maintenance tasks.", "zh": "研究智能体在普通软件维护任务中主动修改开放权重系统的行为。" }, "method": { "en": "Examines agent-initiated modification of open-weight systems during ordinary software-maintenance tasks.", "zh": "研究智能体在普通软件维护任务中主动修改开放权重系统的行为。" }, "finding": { "en": "Examines agent-initiated modification of open-weight systems during ordinary software-maintenance tasks.", "zh": "研究智能体在普通软件维护任务中主动修改开放权重系统的行为。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The observed modification depends on environmental affordances and does not establish unconstrained self-improvement.", "zh": "修改行为依赖环境提供的条件，不能证明不受约束的自我改进。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "machiavelli", "title": "Do the Rewards Justify the Means? Measuring Trade-Offs Between Rewards and Ethical Behavior in the MACHIAVELLI Benchmark", "aliases": [ "MACHIAVELLI" ], "authors": [ "Alexander Pan", "Jun Shern Chan", "Andy Zou", "Nathaniel Li", "Steven Basart", "Thomas Woodside", "Jonathan Ng", "Hanlin Zhang", "Scott Emmons", "Dan Hendrycks" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "machiavelli-publication", "attributionSourceId": "machiavelli-publication-author-source", "originalUrl": "https://arxiv.org/abs/2304.03279", "publicationDate": "2023-04-06", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "machiavelli" ], "contributions": [ { "organizationId": "berkeley", "role": "research", "sourceId": "machiavelli-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cais", "role": "research", "sourceId": "machiavelli-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cmu", "role": "research", "sourceId": "machiavelli-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "yale", "role": "research", "sourceId": "machiavelli-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies reward-seeking and ethical trade-offs in interactive text scenarios with annotated behavioral outcomes.", "zh": "通过带行为标注的交互文本场景，研究奖励追求和伦理权衡。" }, "note": { "question": { "en": "Studies reward-seeking and ethical trade-offs in interactive text scenarios with annotated behavioral outcomes.", "zh": "通过带行为标注的交互文本场景，研究奖励追求和伦理权衡。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Studies reward-seeking and ethical trade-offs in interactive text scenarios with annotated behavioral outcomes.", "zh": "通过带行为标注的交互文本场景，研究奖励追求和伦理权衡。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Fictional scenarios and annotations do not establish real-world misconduct rates or stable intent.", "zh": "虚构场景及标注不能证明现实不当行为发生率或稳定意图。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "emergent-misalignment", "title": "Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs", "aliases": [], "authors": [ "Jan Betley", "Daniel Tan", "Niels Warncke", "Anna Sztyber-Betley", "Xuchan Bao", "Martín Soto", "Nathan Labenz", "Owain Evans" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "emergent-misalignment-publication", "attributionSourceId": "emergent-misalignment-publication-author-source", "originalUrl": "https://truthful.ai/papers/emergent-misalignment/", "publicationDate": "2025-02-25", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "truthful", "role": "research", "sourceId": "emergent-misalignment-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "toronto", "role": "research", "sourceId": "emergent-misalignment-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "emergent-misalignment-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Investigates how narrow fine-tuning on insecure code can produce broader misaligned responses on unrelated tasks.", "zh": "研究针对不安全代码的窄域微调如何在无关任务上产生更广泛的失调回答。" }, "note": { "question": { "en": "Can a narrow fine-tuning objective change behavior on unrelated questions?", "zh": "窄域微调目标能否改变无关问题上的行为？" }, "method": { "en": "Models are fine-tuned on narrowly specified data and tested on separate prompts probing broader behavior.", "zh": "模型在明确的窄域数据上微调，再以独立提示测试更广泛行为。" }, "finding": { "en": "The authors report broader misaligned responses following certain narrow fine-tuning conditions.", "zh": "作者报告，部分窄域微调条件下出现了更广泛的失调回答。" }, "supports": { "en": "Supports studying generalization across training and evaluation contexts, without equating every false answer with scheming.", "zh": "支持研究训练与评测上下文之间的泛化，不能将所有错误回答等同于策略性欺骗。" }, "limits": { "en": "The phenomenon is conditional on training data and evaluation prompts; it is not itself evidence of covert planning.", "zh": "现象受训练数据和评测提示约束，本身不能证明隐蔽规划。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "school-of-reward-hacks", "title": "School of Reward Hacks: Hacking harmless tasks generalizes to misaligned behavior in LLMs", "aliases": [], "authors": [ "Mia Taylor", "James Chua", "Jan Betley", "Johannes Treutlein", "Owain Evans" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "school-of-reward-hacks-publication", "attributionSourceId": "school-of-reward-hacks-publication-author-source", "originalUrl": "https://truthful.ai/papers/school-of-reward-hacks/", "publicationDate": "2025-08-25", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "truthful", "role": "research", "sourceId": "school-of-reward-hacks-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "school-of-reward-hacks-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests whether learning reward-hacking behavior on harmless tasks generalizes to broader misaligned behavior.", "zh": "检验在低危任务中学到的奖励投机行为是否泛化为更广泛的失调行为。" }, "note": { "question": { "en": "Tests whether learning reward-hacking behavior on harmless tasks generalizes to broader misaligned behavior.", "zh": "检验在低危任务中学到的奖励投机行为是否泛化为更广泛的失调行为。" }, "method": { "en": "Tests whether learning reward-hacking behavior on harmless tasks generalizes to broader misaligned behavior.", "zh": "检验在低危任务中学到的奖励投机行为是否泛化为更广泛的失调行为。" }, "finding": { "en": "Tests whether learning reward-hacking behavior on harmless tasks generalizes to broader misaligned behavior.", "zh": "检验在低危任务中学到的奖励投机行为是否泛化为更广泛的失调行为。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Generalization depends on training and test distributions; distinguish observed behavior from inferred objectives.", "zh": "泛化依赖训练与测试分布，需要区分观察行为和推断目标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Full paper", "url": "https://arxiv.org/abs/2508.17511" } ] }, { "id": "conditional-misalignment", "title": "Conditional Misalignment: Common Interventions Can Hide Emergent Misalignment Behind Contextual Triggers", "aliases": [], "authors": [ "Jan Dubiński", "Jan Betley", "Anna Sztyber-Betley", "Daniel C.H. Tan", "Owain Evans" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "conditional-misalignment-publication", "attributionSourceId": "conditional-misalignment-publication-author-source", "originalUrl": "https://truthful.ai/papers/conditional-misalignment/", "publicationDate": "2026-04-28", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "constellation", "role": "research", "sourceId": "conditional-misalignment-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "truthful", "role": "research", "sourceId": "conditional-misalignment-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "conditional-misalignment-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Shows how interventions can leave misalignment conditional on contextual triggers while ordinary evaluations appear improved.", "zh": "研究干预措施如何保留受上下文触发的失调行为，同时使普通评测表现改善。" }, "note": { "question": { "en": "Shows how interventions can leave misalignment conditional on contextual triggers while ordinary evaluations appear improved.", "zh": "研究干预措施如何保留受上下文触发的失调行为，同时使普通评测表现改善。" }, "method": { "en": "Shows how interventions can leave misalignment conditional on contextual triggers while ordinary evaluations appear improved.", "zh": "研究干预措施如何保留受上下文触发的失调行为，同时使普通评测表现改善。" }, "finding": { "en": "Shows how interventions can leave misalignment conditional on contextual triggers while ordinary evaluations appear improved.", "zh": "研究干预措施如何保留受上下文触发的失调行为，同时使普通评测表现改善。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Passing standard prompts does not establish removal of the learned behavior under other conditions.", "zh": "通过标准提示评测不能证明其他条件下的已学行为已被消除。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "reward-hacking-emergent-misalignment", "title": "From shortcuts to sabotage : Natural emergent misalignment from reward hacking", "aliases": [], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "reward-hacking-emergent-misalignment-publication", "attributionSourceId": "reward-hacking-emergent-misalignment-publication", "originalUrl": "https://www.anthropic.com/research/emergent-misalignment-reward-hacking", "publicationDate": "2025-11-21", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "reward-hacking-emergent-misalignment-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Examines the emergence of broader misalignment during realistic reinforcement-learning processes involving reward hacking.", "zh": "研究含奖励投机的强化学习过程如何产生更广泛的失调行为。" }, "note": { "question": { "en": "Examines the emergence of broader misalignment during realistic reinforcement-learning processes involving reward hacking.", "zh": "研究含奖励投机的强化学习过程如何产生更广泛的失调行为。" }, "method": { "en": "Examines the emergence of broader misalignment during realistic reinforcement-learning processes involving reward hacking.", "zh": "研究含奖励投机的强化学习过程如何产生更广泛的失调行为。" }, "finding": { "en": "Examines the emergence of broader misalignment during realistic reinforcement-learning processes involving reward hacking.", "zh": "研究含奖励投机的强化学习过程如何产生更广泛的失调行为。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Training observations and elicited tests require explicit provenance; they do not establish general deployment prevalence.", "zh": "训练观测和诱发测试须标明来源，不能证明一般部署中的普遍程度。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the paper", "url": "https://assets.anthropic.com/m/74342f2c96095771/original/Natural-emergent-misalignment-from-reward-hacking-paper.pdf" } ] }, { "id": "contrastive-reward-seeking", "title": "Measuring Reward-Seeking via Contrastive Belief Updates", "aliases": [], "authors": [ "Axel Højmark", "Jérémy Scheurer 1 1 footnotemark: 1", "Evgenia Nitishinskaya", "Felix Hofstätter 1 1 footnotemark: 1", "Jason Wolfe 2 2 footnotemark: 2", "Theodore Ehrenborg 1 1 footnotemark: 1", "Bronson Schoen 1 1 footnotemark: 1", "Alexander Meinke 1 1 footnotemark: 1", "Apollo Research & OpenAI" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "contrastive-reward-seeking-publication", "attributionSourceId": "contrastive-reward-seeking-publication-author-source", "originalUrl": "https://arxiv.org/abs/2607.18966", "publicationDate": "2026-07-21", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "apollo", "role": "research", "sourceId": "contrastive-reward-seeking-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "openai", "role": "research", "sourceId": "contrastive-reward-seeking-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Uses contrastive belief updates to investigate whether changes in expected reward alter a model’s decisions.", "zh": "通过对比式信念更新，研究预期奖励变化是否影响模型决策。" }, "note": { "question": { "en": "Uses contrastive belief updates to investigate whether changes in expected reward alter a model’s decisions.", "zh": "通过对比式信念更新，研究预期奖励变化是否影响模型决策。" }, "method": { "en": "Uses contrastive belief updates to investigate whether changes in expected reward alter a model’s decisions.", "zh": "通过对比式信念更新，研究预期奖励变化是否影响模型决策。" }, "finding": { "en": "Uses contrastive belief updates to investigate whether changes in expected reward alter a model’s decisions.", "zh": "通过对比式信念更新，研究预期奖励变化是否影响模型决策。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "An operational reward-seeking measure depends on the intervention and does not provide direct access to internal goals.", "zh": "操作化的奖励追求指标依赖干预设计，不能直接读取内部目标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "sabotage-safety-research", "title": "Evaluating whether AI models would sabotage AI safety research", "aliases": [], "authors": [ "Robert Kirk", "Alexandra Souly", "Kai Fronsdal", "Abby D’Cruz", "Xander Davies" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "sabotage-safety-research-publication", "attributionSourceId": "sabotage-safety-research-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/evaluating-whether-ai-models-would-sabotage-ai-safety-research", "publicationDate": "2026-04-27", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "sabotage-safety-research-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Evaluates whether models can covertly sabotage AI safety research while carrying out assigned research tasks.", "zh": "评测模型能否在执行指定研究任务时隐蔽破坏 AI 安全研究。" }, "note": { "question": { "en": "Evaluates whether models can covertly sabotage AI safety research while carrying out assigned research tasks.", "zh": "评测模型能否在执行指定研究任务时隐蔽破坏 AI 安全研究。" }, "method": { "en": "Evaluates whether models can covertly sabotage AI safety research while carrying out assigned research tasks.", "zh": "评测模型能否在执行指定研究任务时隐蔽破坏 AI 安全研究。" }, "finding": { "en": "Evaluates whether models can covertly sabotage AI safety research while carrying out assigned research tasks.", "zh": "评测模型能否在执行指定研究任务时隐蔽破坏 AI 安全研究。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Instructed attacks and constructed research environments measure a conditional capability, not spontaneous intent.", "zh": "指令诱发攻击与构建环境测量有条件能力，不代表自发意图。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2604.24618" } ] }, { "id": "ai-sandbagging", "title": "AI Sandbagging: Language Models can Strategically Underperform on Evaluations", "aliases": [], "authors": [ "Teun van der Weij", "MATS", "Felix Hofstätter ∗", "Oliver Jaffe ∗", "Samuel F. Brown", "Francis Rhys Ward" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "ai-sandbagging-publication", "attributionSourceId": "ai-sandbagging-publication-author-source", "originalUrl": "https://arxiv.org/abs/2406.07358", "publicationDate": "2024-06-11", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "mats", "role": "research", "sourceId": "ai-sandbagging-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "imperial", "role": "research", "sourceId": "ai-sandbagging-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies strategic underperformance on evaluations and methods for eliciting capabilities that ordinary testing may miss.", "zh": "研究评测中的策略性低表现，以及诱发常规测试可能遗漏的能力的方法。" }, "note": { "question": { "en": "Studies strategic underperformance on evaluations and methods for eliciting capabilities that ordinary testing may miss.", "zh": "研究评测中的策略性低表现，以及诱发常规测试可能遗漏的能力的方法。" }, "method": { "en": "Studies strategic underperformance on evaluations and methods for eliciting capabilities that ordinary testing may miss.", "zh": "研究评测中的策略性低表现，以及诱发常规测试可能遗漏的能力的方法。" }, "finding": { "en": "Studies strategic underperformance on evaluations and methods for eliciting capabilities that ordinary testing may miss.", "zh": "研究评测中的策略性低表现，以及诱发常规测试可能遗漏的能力的方法。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Underperformance alone is insufficient to diagnose concealment; weaker capability is an alternative explanation.", "zh": "仅凭低表现不足以诊断能力隐藏，能力较弱也是可能解释。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "sleeper-agents", "title": "Sleeper Agents : Training deceptive LLMs that persist through safety training", "aliases": [], "authors": [ "Evan Hubinger, Carson Denison † † footnotemark: , Jesse Mu † † footnotemark: , Mike Lambert † † footnotemark: , Meg Tong, Monte MacDiarmid,Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton ChengAdam Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud", "Deep Ganguli", "Fazl Barez", "Jack Clark", "Kamal Ndousse", "Kshitij Sachan", "Michael Sellitto Mrinank Sharma, Nova DasSarma, Roger Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten", "Marina Favaro", "Jan Brauner ∘", "Holden Karnofsky", "Paul Christiano ⋄", "Samuel R. Bowman Logan Graham, Jared Kaplan, Sören Mindermann ‡∘ , Ryan Greenblatt † , Buck Shlegeris † ,Nicholas Schiefer † † footnotemark: , Ethan Perez † † footnotemark: Anthropic, † Redwood Research, ‡ Mila Quebec AI Institute, ∘ University of Oxford,", "⋄ Alignment Research Center", "Open Philanthropy", "Apart Research" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "sleeper-agents-publication", "attributionSourceId": "sleeper-agents-publication-author-source", "originalUrl": "https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training", "publicationDate": "2024-01-14", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "research", "sourceId": "sleeper-agents-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "redwood", "role": "research", "sourceId": "sleeper-agents-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mila", "role": "research", "sourceId": "sleeper-agents-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "oxford", "role": "research", "sourceId": "sleeper-agents-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "apart", "role": "research", "sourceId": "sleeper-agents-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Constructs models with conditional backdoors and tests whether those behaviors persist through safety training.", "zh": "构建带条件后门的模型，并测试相关行为能否在安全训练后持续存在。" }, "note": { "question": { "en": "Constructs models with conditional backdoors and tests whether those behaviors persist through safety training.", "zh": "构建带条件后门的模型，并测试相关行为能否在安全训练后持续存在。" }, "method": { "en": "Constructs models with conditional backdoors and tests whether those behaviors persist through safety training.", "zh": "构建带条件后门的模型，并测试相关行为能否在安全训练后持续存在。" }, "finding": { "en": "Constructs models with conditional backdoors and tests whether those behaviors persist through safety training.", "zh": "构建带条件后门的模型，并测试相关行为能否在安全训练后持续存在。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Deliberately trained model organisms do not establish the prevalence of naturally occurring deceptive objectives.", "zh": "有意训练的模型实验体不能证明自然产生的欺骗性目标有多普遍。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "subliminal-learning", "title": "Subliminal Learning: Language models transmit behavioral traits via hidden signals in data", "aliases": [], "authors": [ "Alex Cloud", "Minh Le", "James Chua", "Jan Betley", "Anna Sztyber-Betley", "Sören Mindermann", "Jacob Hilton", "Samuel Marks", "Owain Evans" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "subliminal-learning-publication", "attributionSourceId": "subliminal-learning-publication", "originalUrl": "https://truthful.ai/papers/subliminal-learning/", "publicationDate": "2025-07-20", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "truthful", "role": "publisher", "sourceId": "subliminal-learning-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Investigates behavioral-trait transfer through generated data without explicit semantic examples of the target trait.", "zh": "研究目标行为特征能否通过不含显式语义示例的生成数据传递。" }, "note": { "question": { "en": "Investigates behavioral-trait transfer through generated data without explicit semantic examples of the target trait.", "zh": "研究目标行为特征能否通过不含显式语义示例的生成数据传递。" }, "method": { "en": "Investigates behavioral-trait transfer through generated data without explicit semantic examples of the target trait.", "zh": "研究目标行为特征能否通过不含显式语义示例的生成数据传递。" }, "finding": { "en": "Investigates behavioral-trait transfer through generated data without explicit semantic examples of the target trait.", "zh": "研究目标行为特征能否通过不含显式语义示例的生成数据传递。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Transfer depends on the teacher, student and data conditions; mechanisms and wider generality remain open questions.", "zh": "传递依赖教师、学生和数据条件，其机制及更广泛适用性仍有待研究。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "ai-control", "title": "AI Control: Improving Safety Despite Intentional Subversion", "aliases": [], "authors": [ "Ryan Greenblatt ∗ Buck Shlegeris      Kshitij Sachan      Fabien Roger Redwood Research" ], "primaryFunction": "governance", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "method", "sourceId": "ai-control-publication", "attributionSourceId": "ai-control-publication-author-source", "originalUrl": "https://arxiv.org/abs/2312.06942", "publicationDate": "2023-12-12", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "redwood", "role": "research", "sourceId": "ai-control-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates protocols that use trusted oversight to limit harm from a more capable model that intentionally subverts the task.", "zh": "评测利用可信监督限制更强模型有意破坏任务所造成危害的控制协议。" }, "note": { "question": { "en": "Can oversight protocols limit harmful outputs when a stronger model deliberately subverts the task?", "zh": "当更强模型有意破坏任务时，监督协议能否限制有害输出？" }, "method": { "en": "The authors construct subversion tasks and compare trusted monitoring, review and fallback protocols against a defined attacker.", "zh": "作者构建破坏任务，对照指定攻击者，比较可信监测、审阅和回退协议。" }, "finding": { "en": "The paper reports safety–usefulness trade-offs for the tested protocols and attacker assumptions.", "zh": "论文报告受测协议及攻击者假设下的安全性与有用性权衡。" }, "supports": { "en": "Supports evaluating a complete control protocol rather than inferring safety from a model’s stated intentions.", "zh": "支持评测完整控制协议，避免由模型表达的意图推断安全性。" }, "limits": { "en": "Safety and usefulness depend jointly on attacker strength, monitor access, intervention rules and task conditions.", "zh": "安全性与有用性共同依赖攻击者能力、监测可见性、干预规则和任务条件。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "ctrl-z", "title": "Ctrl-Z: Controlling AI Agents via Resampling", "aliases": [], "authors": [ "Aryan Bhatt", "Cody Rushing", "Adam Kaufman", "Tyler Tracy", "Vasil Georgiev", "David Matolcsi", "Akbir Khan", "Buck Shlegeris" ], "primaryFunction": "governance", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "method", "sourceId": "ctrl-z-publication", "attributionSourceId": "ctrl-z-publication-author-source", "originalUrl": "https://arxiv.org/abs/2504.10374", "publicationDate": "2025-04-14", "updatedOn": "2026-10-25", "areas": [ "deception", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "redwood", "role": "research", "sourceId": "ctrl-z-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mats", "role": "research", "sourceId": "ctrl-z-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates action resampling and oversight protocols in a system-administration agent environment.", "zh": "在系统管理智能体环境中，评测动作重采样和监督控制协议。" }, "note": { "question": { "en": "Evaluates action resampling and oversight protocols in a system-administration agent environment.", "zh": "在系统管理智能体环境中，评测动作重采样和监督控制协议。" }, "method": { "en": "Evaluates action resampling and oversight protocols in a system-administration agent environment.", "zh": "在系统管理智能体环境中，评测动作重采样和监督控制协议。" }, "finding": { "en": "Evaluates action resampling and oversight protocols in a system-administration agent environment.", "zh": "在系统管理智能体环境中，评测动作重采样和监督控制协议。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Resampling depends on recoverable state and action effects; results do not cover every irreversible operation.", "zh": "重采样依赖可恢复状态和动作影响，结果不能覆盖所有不可逆操作。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "basharena", "title": "BashArena: A Control Setting for Highly Privileged AI Agents", "aliases": [], "authors": [ "Adam Kaufman *", "James Lucassen *" ], "primaryFunction": "governance", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "benchmark", "sourceId": "basharena-publication", "attributionSourceId": "basharena-publication-author-source", "originalUrl": "https://arxiv.org/abs/2512.15688", "publicationDate": "2025-12-17", "updatedOn": "2026-10-25", "areas": [ "deception", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "basharena" ], "contributions": [ { "organizationId": "redwood", "role": "research", "sourceId": "basharena-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.", "zh": "为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。" }, "note": { "question": { "en": "Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.", "zh": "为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。" }, "method": { "en": "Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.", "zh": "为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。" }, "finding": { "en": "Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.", "zh": "为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Action-level alerts, trajectory-level false positives and undetected attack success are distinct metrics.", "zh": "动作级告警、轨迹级误报和未检出攻击成功是不同指标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "multi-agent-control", "title": "Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors", "aliases": [], "authors": [ "Oliver Makins", "Orazio Angelini 1 1 footnotemark: 1", "Zohreh Shams", "Mary Phuong" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "study", "sourceId": "multi-agent-control-publication", "attributionSourceId": "multi-agent-control-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/multi-agent-ai-control-distributed-attacks-hamper-per-instance-monitors", "publicationDate": "2026-07-08", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "multi-agent-control-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mats", "role": "research", "sourceId": "multi-agent-control-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies distributed attacks across multiple agents and the limits of monitoring each instance separately.", "zh": "研究跨多个智能体的分布式攻击，以及逐实例监测的局限。" }, "note": { "question": { "en": "Studies distributed attacks across multiple agents and the limits of monitoring each instance separately.", "zh": "研究跨多个智能体的分布式攻击，以及逐实例监测的局限。" }, "method": { "en": "Studies distributed attacks across multiple agents and the limits of monitoring each instance separately.", "zh": "研究跨多个智能体的分布式攻击，以及逐实例监测的局限。" }, "finding": { "en": "Studies distributed attacks across multiple agents and the limits of monitoring each instance separately.", "zh": "研究跨多个智能体的分布式攻击，以及逐实例监测的局限。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Agent coordination and shared state matter; findings depend on the constructed services and attacker configuration.", "zh": "智能体协调与共享状态影响结果，结论受构建服务和攻击者配置约束。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2607.07368" } ] }, { "id": "anti-scheming-training", "title": "Stress Testing Deliberative Alignment for Anti-Scheming Training", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "study", "sourceId": "anti-scheming-training-publication", "attributionSourceId": "anti-scheming-training-publication", "originalUrl": "https://www.apolloresearch.ai/science/stress-testing-deliberative-alignment-for-anti-scheming-training", "publicationDate": "2025-09-17", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "apollo", "role": "publisher", "sourceId": "anti-scheming-training-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Stress-tests anti-scheming training and investigates whether recognition of evaluation settings affects observed violations.", "zh": "对反策略性欺骗训练开展压力测试，并研究评测场景识别是否影响观察到的违规。" }, "note": { "question": { "en": "Stress-tests anti-scheming training and investigates whether recognition of evaluation settings affects observed violations.", "zh": "对反策略性欺骗训练开展压力测试，并研究评测场景识别是否影响观察到的违规。" }, "method": { "en": "Stress-tests anti-scheming training and investigates whether recognition of evaluation settings affects observed violations.", "zh": "对反策略性欺骗训练开展压力测试，并研究评测场景识别是否影响观察到的违规。" }, "finding": { "en": "Stress-tests anti-scheming training and investigates whether recognition of evaluation settings affects observed violations.", "zh": "对反策略性欺骗训练开展压力测试，并研究评测场景识别是否影响观察到的违规。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Lower observed violations may reflect mitigation or evaluation awareness; deployment generalization remains limited.", "zh": "观察到的违规减少可能来自缓解或评测感知，对部署场景的泛化仍有限。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://www.arxiv.org/abs/2509.15541" } ] }, { "id": "malt", "title": "MALT: A Dataset of Natural and Prompted Behaviors That Threaten Eval Integrity", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "dataset", "sourceId": "malt-publication", "attributionSourceId": "malt-publication", "originalUrl": "https://metr.org/blog/2025-10-14-malt-dataset-of-natural-and-prompted-behaviors/", "publicationDate": "2025-10-14", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "malt-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Collects manually reviewed agent transcripts and distinguishes naturally observed behavior from prompted examples.", "zh": "收集人工审阅的智能体轨迹，区分自然观察行为和提示诱发示例。" }, "note": { "question": { "en": "Collects manually reviewed agent transcripts and distinguishes naturally observed behavior from prompted examples.", "zh": "收集人工审阅的智能体轨迹，区分自然观察行为和提示诱发示例。" }, "method": { "en": "Collects manually reviewed agent transcripts and distinguishes naturally observed behavior from prompted examples.", "zh": "收集人工审阅的智能体轨迹，区分自然观察行为和提示诱发示例。" }, "finding": { "en": "Collects manually reviewed agent transcripts and distinguishes naturally observed behavior from prompted examples.", "zh": "收集人工审阅的智能体轨迹，区分自然观察行为和提示诱发示例。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Constructed and naturally occurring examples have different distributions and cannot be pooled without provenance.", "zh": "构造示例与自然观察示例分布不同，不能在缺少来源标记时混用。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "metr-monitorability", "title": "Early work on monitorability evaluations", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "study", "sourceId": "metr-monitorability-publication", "attributionSourceId": "metr-monitorability-publication", "originalUrl": "https://metr.org/blog/2026-01-19-early-work-on-monitorability-evaluations/", "publicationDate": "2026-01-22", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "metr-monitorability-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Tests monitors against agents attempting side tasks and studies how agents may evade the available oversight.", "zh": "让监测器面对尝试额外任务的智能体，研究智能体如何规避既有监督。" }, "note": { "question": { "en": "Tests monitors against agents attempting side tasks and studies how agents may evade the available oversight.", "zh": "让监测器面对尝试额外任务的智能体，研究智能体如何规避既有监督。" }, "method": { "en": "Tests monitors against agents attempting side tasks and studies how agents may evade the available oversight.", "zh": "让监测器面对尝试额外任务的智能体，研究智能体如何规避既有监督。" }, "finding": { "en": "Tests monitors against agents attempting side tasks and studies how agents may evade the available oversight.", "zh": "让监测器面对尝试额外任务的智能体，研究智能体如何规避既有监督。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Monitorability is a joint property of the agent, monitor, observable information and intervention protocol.", "zh": "可监测性取决于智能体、监测器、可见信息和干预协议的组合。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "auditing-games", "title": "Auditing Games for Sandbagging", "aliases": [], "authors": [ "Jordan Taylor", "Sid Black Dillon Bowen Thomas Read Satvik Golechha", "Alex Zelenka-Martin Oliver Makins Connor Kissane Kola Ayonrinde Jacob Merizian", "Samuel Marks Chris Cundy Joseph Bloom" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "study", "sourceId": "auditing-games-publication", "attributionSourceId": "auditing-games-publication-author-source", "originalUrl": "https://arxiv.org/abs/2512.07810", "publicationDate": "2025-12-08", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "auditing-games-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "far", "role": "research", "sourceId": "auditing-games-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "auditing-games-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Uses adversarial auditing games to test detection of deliberately trained capability concealment.", "zh": "通过对抗审计博弈，测试对有意训练的能力隐藏行为的检测。" }, "note": { "question": { "en": "Uses adversarial auditing games to test detection of deliberately trained capability concealment.", "zh": "通过对抗审计博弈，测试对有意训练的能力隐藏行为的检测。" }, "method": { "en": "Uses adversarial auditing games to test detection of deliberately trained capability concealment.", "zh": "通过对抗审计博弈，测试对有意训练的能力隐藏行为的检测。" }, "finding": { "en": "Uses adversarial auditing games to test detection of deliberately trained capability concealment.", "zh": "通过对抗审计博弈，测试对有意训练的能力隐藏行为的检测。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Capability elicitation after training is not conclusive proof that the original system was sandbagging.", "zh": "训练后能力被诱发出来，不能单独证明原系统有意压低表现。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "belief-verified-lie-detectors", "title": "\"Did you lie?\": Evaluating Lie Detectors across Model Scale and Belief-Verified Model Organisms", "aliases": [], "authors": [ "Alan Cooney", "David Africa", "Geoffrey Irving" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "study", "sourceId": "belief-verified-lie-detectors-publication", "attributionSourceId": "belief-verified-lie-detectors-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/did-you-lie-evaluating-lie-detectors-across-model-scale-and-belief-verified-model-organisms", "publicationDate": "2026-06-17", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "belief-verified-lie-detectors-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Tests lie detectors across model scales and belief-verified model organisms, including transfer from prompted lies.", "zh": "在不同模型规模和经信念核验的模型实验体上测试谎言检测器，并研究提示诱发谎言的迁移。" }, "note": { "question": { "en": "Tests lie detectors across model scales and belief-verified model organisms, including transfer from prompted lies.", "zh": "在不同模型规模和经信念核验的模型实验体上测试谎言检测器，并研究提示诱发谎言的迁移。" }, "method": { "en": "Tests lie detectors across model scales and belief-verified model organisms, including transfer from prompted lies.", "zh": "在不同模型规模和经信念核验的模型实验体上测试谎言检测器，并研究提示诱发谎言的迁移。" }, "finding": { "en": "Tests lie detectors across model scales and belief-verified model organisms, including transfer from prompted lies.", "zh": "在不同模型规模和经信念核验的模型实验体上测试谎言检测器，并研究提示诱发谎言的迁移。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Operational belief verification and detector generalization remain assumption-dependent.", "zh": "操作化的信念核验和检测器泛化依赖具体假设。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2606.12618" } ] }, { "id": "obfuscation-atlas", "title": "The Obfuscation Atlas: Mapping Where Honesty Emerges in RLVR with Deception Probes", "aliases": [], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "obfuscation-atlas-publication", "attributionSourceId": "obfuscation-atlas-publication", "originalUrl": "https://www.far.ai/research/the-obfuscation-atlas-mapping-where-honesty-emerges-in-rlvr-with-deception-probes", "publicationDate": "2026-02-16", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "far", "role": "publisher", "sourceId": "obfuscation-atlas-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Studies how training against deception probes can produce honesty improvements or evasion of the detector.", "zh": "研究针对欺骗探针的训练如何带来诚实性改善，或产生检测规避。" }, "note": { "question": { "en": "Studies how training against deception probes can produce honesty improvements or evasion of the detector.", "zh": "研究针对欺骗探针的训练如何带来诚实性改善，或产生检测规避。" }, "method": { "en": "Studies how training against deception probes can produce honesty improvements or evasion of the detector.", "zh": "研究针对欺骗探针的训练如何带来诚实性改善，或产生检测规避。" }, "finding": { "en": "Studies how training against deception probes can produce honesty improvements or evasion of the detector.", "zh": "研究针对欺骗探针的训练如何带来诚实性改善，或产生检测规避。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A lower detector score does not establish more honest behavior without independent behavioral checks.", "zh": "没有独立行为核查，检测器分数降低不能证明行为更加诚实。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "tamperbench", "title": "TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering", "aliases": [ "TamperBench" ], "authors": [ "Saad Hossain", "Tom Tseng", "Punya Syon Pandey", "Samanvay Vajpayee", "Matthew Kowal", "Nayeema Nonta", "Samuel Simko", "Stephen Casper", "Zhijing Jin", "Kellin Pelrine", "Sirisha Rambhatla" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "tamperbench-publication", "attributionSourceId": "tamperbench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2602.06911", "publicationDate": "2026-02-06", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "tamperbench" ], "contributions": [ { "organizationId": "waterloo", "role": "research", "sourceId": "tamperbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "far", "role": "research", "sourceId": "tamperbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "toronto", "role": "research", "sourceId": "tamperbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "eth", "role": "research", "sourceId": "tamperbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mit", "role": "research", "sourceId": "tamperbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "vector", "role": "research", "sourceId": "tamperbench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Stress-tests open-weight model safeguards under fine-tuning and representation-level tampering while tracking utility.", "zh": "在微调及表征层篡改条件下，对开放权重模型防护开展压力测试，并跟踪有用性。" }, "note": { "question": { "en": "Stress-tests open-weight model safeguards under fine-tuning and representation-level tampering while tracking utility.", "zh": "在微调及表征层篡改条件下，对开放权重模型防护开展压力测试，并跟踪有用性。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Stress-tests open-weight model safeguards under fine-tuning and representation-level tampering while tracking utility.", "zh": "在微调及表征层篡改条件下，对开放权重模型防护开展压力测试，并跟踪有用性。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Weight-access tampering and API jailbreaks have different threat models; lower harmfulness may accompany lost capability.", "zh": "权重篡改与 API 越狱的威胁模型不同，危害降低也可能伴随能力损失。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "automated-alignment-mitigation", "title": "Automated researchers can reliably mitigate alignment failures", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "study", "sourceId": "automated-alignment-mitigation-publication", "attributionSourceId": "automated-alignment-mitigation-publication", "originalUrl": "https://www.anthropic.com/research/automated-researchers-mitigate-alignment-failures", "publicationDate": "2026-08-28", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "automated-alignment-mitigation-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Tests whether automated research agents can develop interventions for measured alignment failures while preserving capabilities.", "zh": "测试自动研究智能体能否针对已测量的对齐失败开发干预措施，同时保留能力。" }, "note": { "question": { "en": "Tests whether automated research agents can develop interventions for measured alignment failures while preserving capabilities.", "zh": "测试自动研究智能体能否针对已测量的对齐失败开发干预措施，同时保留能力。" }, "method": { "en": "Tests whether automated research agents can develop interventions for measured alignment failures while preserving capabilities.", "zh": "测试自动研究智能体能否针对已测量的对齐失败开发干预措施，同时保留能力。" }, "finding": { "en": "Tests whether automated research agents can develop interventions for measured alignment failures while preserving capabilities.", "zh": "测试自动研究智能体能否针对已测量的对齐失败开发干预措施，同时保留能力。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Improvement on selected tests requires held-out validation and does not establish comprehensive alignment.", "zh": "选定测试的改善需要留出验证，不能证明全面对齐。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the paper", "url": "https://www-cdn.anthropic.com/7b1c44894e980876479947dcdd40716278aeeffd/automated-alignment-researchers-august-2026.pdf" } ] }, { "id": "training-run-evaluations", "title": "We need 3rd party Training-Run Evaluations", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "training-run-evaluations-publication", "attributionSourceId": "training-run-evaluations-publication", "originalUrl": "https://www.apolloresearch.ai/science/we-need-3rd-party-training-run-assessments", "publicationDate": "2026-07-05", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "apollo", "role": "publisher", "sourceId": "training-run-evaluations-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Argues for third-party access to training-run evaluations and specifies how independent assessment can inform safety decisions.", "zh": "论证第三方参与训练过程评测的必要性，并说明独立评估如何支持安全决策。" }, "note": { "question": { "en": "Argues for third-party access to training-run evaluations and specifies how independent assessment can inform safety decisions.", "zh": "论证第三方参与训练过程评测的必要性，并说明独立评估如何支持安全决策。" }, "method": { "en": "Argues for third-party access to training-run evaluations and specifies how independent assessment can inform safety decisions.", "zh": "论证第三方参与训练过程评测的必要性，并说明独立评估如何支持安全决策。" }, "finding": { "en": "Argues for third-party access to training-run evaluations and specifies how independent assessment can inform safety decisions.", "zh": "论证第三方参与训练过程评测的必要性，并说明独立评估如何支持安全决策。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "This is a governance proposal; its recommendations are not empirical guarantees of safer training.", "zh": "这是治理建议，其主张不构成更安全训练的实证保证。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cot-faithfulness", "title": "Reasoning models don't always say what they think", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "study", "sourceId": "cot-faithfulness-publication", "attributionSourceId": "cot-faithfulness-publication", "originalUrl": "https://www.anthropic.com/research/reasoning-models-dont-say-think", "publicationDate": "2025-04-03", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "cot-faithfulness-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Tests whether reasoning traces reveal information that causally influences model answers, including hidden hints.", "zh": "测试推理轨迹是否披露对模型回答有因果影响的信息，包括隐藏提示。" }, "note": { "question": { "en": "Tests whether reasoning traces reveal information that causally influences model answers, including hidden hints.", "zh": "测试推理轨迹是否披露对模型回答有因果影响的信息，包括隐藏提示。" }, "method": { "en": "Tests whether reasoning traces reveal information that causally influences model answers, including hidden hints.", "zh": "测试推理轨迹是否披露对模型回答有因果影响的信息，包括隐藏提示。" }, "finding": { "en": "Tests whether reasoning traces reveal information that causally influences model answers, including hidden hints.", "zh": "测试推理轨迹是否披露对模型回答有因果影响的信息，包括隐藏提示。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "An unfaithful explanation does not by itself establish deliberate deception or a hidden long-term objective.", "zh": "解释不忠实本身不能证明有意欺骗或隐藏的长期目标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the paper", "url": "https://assets.anthropic.com/m/71876fabef0f0ed4/original/reasoning_models_paper.pdf" } ] }, { "id": "cot-misbehavior-monitoring", "title": "Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation", "aliases": [], "authors": [ "Bowen Baker Joost Huizinga *† Leo Gao † Zehao Dou † Melody Y. Guan † Aleksander Madry † Wojciech Zaremba † Jakub Pachocki † David Farhi *†" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "study", "sourceId": "cot-misbehavior-monitoring-publication", "attributionSourceId": "cot-misbehavior-monitoring-publication-author-source", "originalUrl": "https://arxiv.org/abs/2503.11926", "publicationDate": "2025-03-14", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "openai", "role": "research", "sourceId": "cot-misbehavior-monitoring-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies whether chain-of-thought monitoring can detect reward hacking and how optimization may undermine that visibility.", "zh": "研究推理链监测能否识别奖励投机，以及优化过程如何削弱这种可见性。" }, "note": { "question": { "en": "Studies whether chain-of-thought monitoring can detect reward hacking and how optimization may undermine that visibility.", "zh": "研究推理链监测能否识别奖励投机，以及优化过程如何削弱这种可见性。" }, "method": { "en": "Studies whether chain-of-thought monitoring can detect reward hacking and how optimization may undermine that visibility.", "zh": "研究推理链监测能否识别奖励投机，以及优化过程如何削弱这种可见性。" }, "finding": { "en": "Studies whether chain-of-thought monitoring can detect reward hacking and how optimization may undermine that visibility.", "zh": "研究推理链监测能否识别奖励投机，以及优化过程如何削弱这种可见性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Monitoring access and training pressure affect detection; reasoning traces are not complete access to internal state.", "zh": "监测权限与训练压力影响检测效果，推理轨迹并不完整呈现内部状态。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "injecagent", "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents", "aliases": [ "InjecAgent" ], "authors": [ "Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "injecagent-publication", "attributionSourceId": "injecagent-publication-author-source", "originalUrl": "https://arxiv.org/abs/2403.02691", "publicationDate": "2024-03-05", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "injecagent" ], "contributions": [ { "organizationId": "uiuc", "role": "research", "sourceId": "injecagent-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Benchmarks indirect prompt injection against tool-integrated agents processing untrusted external content.", "zh": "评测工具型智能体处理不可信外部内容时遭受间接提示注入的情况。" }, "note": { "question": { "en": "Benchmarks indirect prompt injection against tool-integrated agents processing untrusted external content.", "zh": "评测工具型智能体处理不可信外部内容时遭受间接提示注入的情况。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Benchmarks indirect prompt injection against tool-integrated agents processing untrusted external content.", "zh": "评测工具型智能体处理不可信外部内容时遭受间接提示注入的情况。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Attack success depends on the tool environment, injected content and attacker goals; results are not universal compromise rates.", "zh": "攻击成功取决于工具环境、注入内容和攻击目标，不能解释为通用攻陷率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "agent-safetybench", "title": "Agent-SafetyBench: Evaluating the Safety of LLM Agents", "aliases": [ "Agent-SafetyBench" ], "authors": [ "Zhexin Zhang 1 1 1 Equal contribution.", "Shiyao Cui 1 1 1 Equal contribution.", "Yida Lu 1 1 1 Equal contribution.", "Jingzhuo Zhou 1 1 1 Equal contribution.", "Junxiao Yang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "agent-safetybench-publication", "attributionSourceId": "agent-safetybench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2412.14470", "publicationDate": "2024-12-19", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "agent-safetybench" ], "contributions": [ { "organizationId": "tsinghua", "role": "research", "sourceId": "agent-safetybench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates agent safety through interactive environments and tool use, separating agent-level failures from chatbot-only tests.", "zh": "通过交互环境和工具使用评测智能体安全，区分智能体层面失败与纯对话测试。" }, "note": { "question": { "en": "Evaluates agent safety through interactive environments and tool use, separating agent-level failures from chatbot-only tests.", "zh": "通过交互环境和工具使用评测智能体安全，区分智能体层面失败与纯对话测试。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates agent safety through interactive environments and tool use, separating agent-level failures from chatbot-only tests.", "zh": "通过交互环境和工具使用评测智能体安全，区分智能体层面失败与纯对话测试。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Broad safety coverage does not automatically establish a direct link to a specific frontier-risk mechanism.", "zh": "广泛安全覆盖并不自动构成与某个前沿风险机制的直接关联。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "petri", "title": "Petri : An open-source auditing tool to accelerate AI safety research", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "method", "sourceId": "petri-publication", "attributionSourceId": "petri-publication", "originalUrl": "https://www.anthropic.com/research/petri-open-source-auditing", "publicationDate": "2025-10-06", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "petri-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Provides an automated auditing tool for constructing and exploring behavioral safety tests with auditor and target models.", "zh": "通过审计模型与目标模型，提供自动构造和探索行为安全测试的工具。" }, "note": { "question": { "en": "Provides an automated auditing tool for constructing and exploring behavioral safety tests with auditor and target models.", "zh": "通过审计模型与目标模型，提供自动构造和探索行为安全测试的工具。" }, "method": { "en": "Provides an automated auditing tool for constructing and exploring behavioral safety tests with auditor and target models.", "zh": "通过审计模型与目标模型，提供自动构造和探索行为安全测试的工具。" }, "finding": { "en": "Provides an automated auditing tool for constructing and exploring behavioral safety tests with auditor and target models.", "zh": "通过审计模型与目标模型，提供自动构造和探索行为安全测试的工具。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Generated findings need transcript review and external validation; tool availability is not proof of reliable auditing.", "zh": "生成的发现需要轨迹审阅和外部验证，工具可用不代表审计可靠。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "bloom", "title": "Introducing Bloom : an open source tool for automated behavioral evaluations", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "method", "sourceId": "bloom-publication", "attributionSourceId": "bloom-publication", "originalUrl": "https://www.anthropic.com/research/bloom", "publicationDate": "2025-12-19", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "bloom-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Generates behavioral evaluations from specified target behaviors and examines variation across frontier models.", "zh": "从指定目标行为生成行为评测，并研究不同前沿模型的表现差异。" }, "note": { "question": { "en": "Generates behavioral evaluations from specified target behaviors and examines variation across frontier models.", "zh": "从指定目标行为生成行为评测，并研究不同前沿模型的表现差异。" }, "method": { "en": "Generates behavioral evaluations from specified target behaviors and examines variation across frontier models.", "zh": "从指定目标行为生成行为评测，并研究不同前沿模型的表现差异。" }, "finding": { "en": "Generates behavioral evaluations from specified target behaviors and examines variation across frontier models.", "zh": "从指定目标行为生成行为评测，并研究不同前沿模型的表现差异。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The chosen behavior definition, generated scenarios and grading determine what the evaluation can support.", "zh": "目标行为定义、生成场景与评分方式决定评测能够支持的判断。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "truthfulqa", "title": "TruthfulQA: Measuring how models mimic human falsehoods", "aliases": [ "TruthfulQA" ], "authors": [ "Stephanie Lin", "Jacob Hilton", "Owain Evans" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "truthfulqa-publication", "attributionSourceId": "truthfulqa-publication-author-source", "originalUrl": "https://truthful.ai/papers/truthfulqa/", "publicationDate": "2021-09-08", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "truthfulqa" ], "contributions": [ { "organizationId": "oxford", "role": "research", "sourceId": "truthfulqa-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "openai", "role": "research", "sourceId": "truthfulqa-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Measures truthful answering on questions designed to elicit common human misconceptions.", "zh": "通过易诱发常见人类误解的问题，测量回答的真实性。" }, "note": { "question": { "en": "Measures truthful answering on questions designed to elicit common human misconceptions.", "zh": "通过易诱发常见人类误解的问题，测量回答的真实性。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Measures truthful answering on questions designed to elicit common human misconceptions.", "zh": "通过易诱发常见人类误解的问题，测量回答的真实性。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Factual falsehood does not establish intentional deception; retained as foundational measurement context.", "zh": "事实错误不等于有意欺骗，本档案作为测量基础背景保留。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Codex", "url": "https://openai.com/blog/openai-codex/" } ] }, { "id": "value-leakage", "title": "Value Leakage: An LLM's Answers Are Silently Shaped by Its Own Values", "aliases": [], "authors": [ "Jan Betley", "Johannes Treutlein † † footnotemark:", "Jan Dubiński", "Harry Mayne", "Karol Gałązka", "Niels Warncke", "Anna Sztyber-Betley", "Owain Evans" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "value-leakage-publication", "attributionSourceId": "value-leakage-publication-author-source", "originalUrl": "https://truthful.ai/papers/value-leakage/", "publicationDate": "2026-07-15", "updatedOn": "2026-10-25", "areas": [ "disinformation" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "truthful", "role": "research", "sourceId": "value-leakage-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "oxford", "role": "research", "sourceId": "value-leakage-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Investigates undisclosed influence of a model’s own value tendencies on the information it provides.", "zh": "研究模型自身价值倾向对所提供信息产生的未披露影响。" }, "note": { "question": { "en": "Investigates undisclosed influence of a model’s own value tendencies on the information it provides.", "zh": "研究模型自身价值倾向对所提供信息产生的未披露影响。" }, "method": { "en": "Investigates undisclosed influence of a model’s own value tendencies on the information it provides.", "zh": "研究模型自身价值倾向对所提供信息产生的未披露影响。" }, "finding": { "en": "Investigates undisclosed influence of a model’s own value tendencies on the information it provides.", "zh": "研究模型自身价值倾向对所提供信息产生的未披露影响。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Value-dependent selection and persuasion effects are distinct; user belief change requires separate measurement.", "zh": "价值相关的信息选择与说服效果不同，用户信念变化需要另行测量。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "💻Code", "url": "https://github.com/TruthfulAI-research/value_leakage" } ] }, { "id": "agent-security-red-teaming", "title": "Insights into AI Agent Security from a Large-Scale Red-Teaming Competition | NIST", "aliases": [], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "agent-security-red-teaming-publication", "attributionSourceId": "agent-security-red-teaming-publication", "originalUrl": "https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agent-security-large-scale-red-teaming-competition", "publicationDate": "2026-03-23", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "nist", "role": "publisher", "sourceId": "agent-security-red-teaming-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Analyzes findings from an agent red-teaming competition to characterize attacks and evaluation limitations.", "zh": "分析智能体红队竞赛中的发现，刻画攻击方式和评测局限。" }, "note": { "question": { "en": "Analyzes findings from an agent red-teaming competition to characterize attacks and evaluation limitations.", "zh": "分析智能体红队竞赛中的发现，刻画攻击方式和评测局限。" }, "method": { "en": "Analyzes findings from an agent red-teaming competition to characterize attacks and evaluation limitations.", "zh": "分析智能体红队竞赛中的发现，刻画攻击方式和评测局限。" }, "finding": { "en": "Analyzes findings from an agent red-teaming competition to characterize attacks and evaluation limitations.", "zh": "分析智能体红队竞赛中的发现，刻画攻击方式和评测局限。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Competition observations reflect the submitted attacks and defenses, not deployment incident frequencies.", "zh": "竞赛观测反映已提交的攻击和防御，不能代表部署事件频率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "labbench-two", "title": "LABBench2: An Improved Benchmark for AI Systems Performing Biology Research", "aliases": [ "LABBench2" ], "authors": [ "Jon M Laurent", "Albert Bou", "Michael Pieler", "Conor Igoe", "Alex Andonian", "Siddharth Narayanan", "James Braza", "Alexandros Sanchez Vassopoulos", "Jacob L Steenwyk", "Blake Lash", "Andrew D White", "Samuel G Rodriques" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "labbench-two-publication", "attributionSourceId": "labbench-two-publication-author-source", "originalUrl": "https://arxiv.org/abs/2604.09554", "publicationDate": "2026-02-04", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "labbench-two" ], "contributions": [ { "organizationId": "edison", "role": "research", "sourceId": "labbench-two-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "futurehouse", "role": "research", "sourceId": "labbench-two-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates biology-research tasks to study AI assistance with scientific work rather than only factual recall.", "zh": "通过生物学研究任务，考察 AI 对科学工作的辅助能力，而非仅测试事实回忆。" }, "note": { "question": { "en": "Evaluates biology-research tasks to study AI assistance with scientific work rather than only factual recall.", "zh": "通过生物学研究任务，考察 AI 对科学工作的辅助能力，而非仅测试事实回忆。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates biology-research tasks to study AI assistance with scientific work rather than only factual recall.", "zh": "通过生物学研究任务，考察 AI 对科学工作的辅助能力，而非仅测试事实回忆。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Legitimate biology proficiency is enabling evidence and does not directly establish hazardous end-to-end task ability.", "zh": "正常生物学研究能力属于使能证据，不能直接证明高危端到端任务能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "fortress", "title": "FORTRESS: Frontier Risk Evaluation for National Security and Public Safety", "aliases": [ "FORTRESS" ], "authors": [ "Christina Q. Knight ∗", "Kaustubh Deshpande ⋄", "Ved Sirdeshmukh ⋄", "Meher Mankikar", "Scale Red Team", "SEAL Research Team", "and Julian Michael" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "fortress-publication", "attributionSourceId": "fortress-publication-author-source", "originalUrl": "https://arxiv.org/abs/2506.14922", "publicationDate": "2025-06-17", "updatedOn": "2026-10-25", "areas": [ "cbrn", "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "fortress" ], "contributions": [ { "organizationId": "scale", "role": "research", "sourceId": "fortress-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates safeguards on national-security and public-safety tasks, separating hazardous requests from benign-use utility.", "zh": "在国家安全与公共安全任务上评测防护，区分高危请求与正常用途的有用性。" }, "note": { "question": { "en": "Evaluates safeguards on national-security and public-safety tasks, separating hazardous requests from benign-use utility.", "zh": "在国家安全与公共安全任务上评测防护，区分高危请求与正常用途的有用性。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates safeguards on national-security and public-safety tasks, separating hazardous requests from benign-use utility.", "zh": "在国家安全与公共安全任务上评测防护，区分高危请求与正常用途的有用性。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Judge reliability, task definitions and over-refusal affect the meaning of the reported scores.", "zh": "评判器可靠性、任务定义和过度拒答影响所报告分数的含义。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "rand-biological-benchmarking", "title": "Toward Comprehensive Benchmarking of the Biological Knowledge of Frontier Large Language Models", "aliases": [], "authors": [ "Dev, Sunishchal", "Teague, Charles", "Ellison, Grant", "Brady, Kyle", "Lee, Jeffrey", "Gebauer, Sarah L.", "Bradley, Henry Alexander", "Maciorowski, Dawid", "Persaud, Bria", "Despanie, Jordan", "Del Castello, Barbara", "Worland, Alyssa", "Miller, Michael", "Salas, Adrian", "Nguyen, Dave", "Liu, James", "Johnson, Jason", "Sloan, Andrew", "Stonehouse, Will", "Merrill, Travis", "Goode, Thomas", "McKelvey, Greg, Jr.", "Guest, Ella" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "rand-biological-benchmarking-publication", "attributionSourceId": "rand-biological-benchmarking-publication", "originalUrl": "https://www.rand.org/pubs/research_reports/RRA3797-1.html", "publicationDate": "2025-11-25", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "rand", "role": "publisher", "sourceId": "rand-biological-benchmarking-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Compares biological-knowledge benchmarks and examines their suitability for assessing frontier-model misuse risks.", "zh": "比较生物知识基准，并考察其评估前沿模型滥用风险的适用性。" }, "note": { "question": { "en": "Compares biological-knowledge benchmarks and examines their suitability for assessing frontier-model misuse risks.", "zh": "比较生物知识基准，并考察其评估前沿模型滥用风险的适用性。" }, "method": { "en": "Compares biological-knowledge benchmarks and examines their suitability for assessing frontier-model misuse risks.", "zh": "比较生物知识基准，并考察其评估前沿模型滥用风险的适用性。" }, "finding": { "en": "Compares biological-knowledge benchmarks and examines their suitability for assessing frontier-model misuse risks.", "zh": "比较生物知识基准，并考察其评估前沿模型滥用风险的适用性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Knowledge tests cover only part of the pathway to harmful real-world activity.", "zh": "知识测验仅覆盖通向现实危害活动路径的一部分。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "rand-biological-risk", "title": "Contemporary Foundation AI Models Increase Biological Weapons Risk", "aliases": [], "authors": [ "Brent, Roger", "McKelvey, Greg, Jr." ], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "rand-biological-risk-publication", "attributionSourceId": "rand-biological-risk-publication", "originalUrl": "https://www.rand.org/pubs/perspectives/PEA3853-1.html", "publicationDate": "2025-12-31", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "rand", "role": "publisher", "sourceId": "rand-biological-risk-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Analyzes gaps in biological-risk assessment and proposes broader evidence for evaluating foundation models before deployment.", "zh": "分析生物风险评估缺口，提出基础模型部署前所需的更广泛证据。" }, "note": { "question": { "en": "Analyzes gaps in biological-risk assessment and proposes broader evidence for evaluating foundation models before deployment.", "zh": "分析生物风险评估缺口，提出基础模型部署前所需的更广泛证据。" }, "method": { "en": "Analyzes gaps in biological-risk assessment and proposes broader evidence for evaluating foundation models before deployment.", "zh": "分析生物风险评估缺口，提出基础模型部署前所需的更广泛证据。" }, "finding": { "en": "Analyzes gaps in biological-risk assessment and proposes broader evidence for evaluating foundation models before deployment.", "zh": "分析生物风险评估缺口，提出基础模型部署前所需的更广泛证据。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The report’s risk argument and recommendations are author judgments, not NUWA-validated causal estimates.", "zh": "报告的风险论证与建议属于作者判断，不是 NUWA 已验证的因果估计。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "conventional-weapons-evaluations", "title": "Measuring tactical intelligence targeting and conventional weapons capabilities of AI models", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "conventional-weapons-evaluations-publication", "attributionSourceId": "conventional-weapons-evaluations-publication", "originalUrl": "https://www.anthropic.com/research/intelligence-targeting-conventional-weapons-capabilities", "publicationDate": "2026-09-10", "updatedOn": "2026-10-25", "areas": [ "autonomous-physical-harm" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "conventional-weapons-evaluations-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Studies model capabilities in tactical intelligence targeting and conventional-weapons tasks under defined evaluations.", "zh": "在指定评测中研究模型的战术情报目标选择和常规武器相关能力。" }, "note": { "question": { "en": "Studies model capabilities in tactical intelligence targeting and conventional-weapons tasks under defined evaluations.", "zh": "在指定评测中研究模型的战术情报目标选择和常规武器相关能力。" }, "method": { "en": "Studies model capabilities in tactical intelligence targeting and conventional-weapons tasks under defined evaluations.", "zh": "在指定评测中研究模型的战术情报目标选择和常规武器相关能力。" }, "finding": { "en": "Studies model capabilities in tactical intelligence targeting and conventional-weapons tasks under defined evaluations.", "zh": "在指定评测中研究模型的战术情报目标选择和常规武器相关能力。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Task performance does not establish autonomous physical action or effectiveness in actual military operations.", "zh": "任务表现不能证明自主物理行动或实际军事行动效果。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "fortress-audit", "title": "Auditing FORTRESS: A Multi-Judge Panel Doesn’t Guarantee Robustness", "aliases": [], "authors": [ "Christina Q. Knight ∗", "Kaustubh Deshpande ⋄", "Ved Sirdeshmukh ⋄", "Meher Mankikar", "Scale Red Team", "SEAL Research Team", "and Julian Michael" ], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "study", "sourceId": "fortress-audit-publication", "attributionSourceId": "fortress-audit-publication-author-source", "originalUrl": "https://generality.org/blog/posts/fortress-fragile-judges/", "publicationDate": null, "updatedOn": "2026-10-25", "areas": [ "cbrn", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "scale", "role": "research", "sourceId": "fortress-audit-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Audits grading failures in FORTRESS and examines how judge errors alter risk and over-refusal scores.", "zh": "审计 FORTRESS 的评分失败，研究评判错误如何影响风险和过度拒答分数。" }, "note": { "question": { "en": "Audits grading failures in FORTRESS and examines how judge errors alter risk and over-refusal scores.", "zh": "审计 FORTRESS 的评分失败，研究评判错误如何影响风险和过度拒答分数。" }, "method": { "en": "Audits grading failures in FORTRESS and examines how judge errors alter risk and over-refusal scores.", "zh": "审计 FORTRESS 的评分失败，研究评判错误如何影响风险和过度拒答分数。" }, "finding": { "en": "Audits grading failures in FORTRESS and examines how judge errors alter risk and over-refusal scores.", "zh": "审计 FORTRESS 的评分失败，研究评判错误如何影响风险和过度拒答分数。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The audit addresses evaluation validity; it does not directly measure the underlying models’ real-world risk.", "zh": "审计针对评测有效性，不能直接衡量受测模型的现实风险。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "cheating-agent-evaluations", "title": "Cheating On AI Agent Evaluations | NIST", "aliases": [], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "cheating-agent-evaluations-publication", "attributionSourceId": "cheating-agent-evaluations-publication", "originalUrl": "https://www.nist.gov/blogs/caisi-research-blog/cheating-ai-agent-evaluations", "publicationDate": "2025-12-02", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "nist", "role": "publisher", "sourceId": "cheating-agent-evaluations-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Investigates agent behavior that exploits evaluation infrastructure or task loopholes rather than completing the intended work.", "zh": "调查智能体利用评测基础设施或任务漏洞、而非完成预期工作的行为。" }, "note": { "question": { "en": "Investigates agent behavior that exploits evaluation infrastructure or task loopholes rather than completing the intended work.", "zh": "调查智能体利用评测基础设施或任务漏洞、而非完成预期工作的行为。" }, "method": { "en": "Investigates agent behavior that exploits evaluation infrastructure or task loopholes rather than completing the intended work.", "zh": "调查智能体利用评测基础设施或任务漏洞、而非完成预期工作的行为。" }, "finding": { "en": "Investigates agent behavior that exploits evaluation infrastructure or task loopholes rather than completing the intended work.", "zh": "调查智能体利用评测基础设施或任务漏洞、而非完成预期工作的行为。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A detected shortcut needs case-level attribution; task ambiguity and deliberate misconduct are different explanations.", "zh": "发现捷径需要逐案例归因，任务歧义与有意违规属于不同解释。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "item-response-safety", "title": "Item Response Theory for AI Safety", "aliases": [], "authors": [ "Joshua Fonseca Rivera", "Neil Shah", "David Demitri Africa", "Konstantinos Voudouris" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "method", "sourceId": "item-response-safety-publication", "attributionSourceId": "item-response-safety-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/item-response-theory-for-ai-safety", "publicationDate": "2026-08-05", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "item-response-safety-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Applies item response theory to improve the design and interpretation of AI safety measurements.", "zh": "将项目反应理论用于改进 AI 安全测量的设计与解释。" }, "note": { "question": { "en": "Applies item response theory to improve the design and interpretation of AI safety measurements.", "zh": "将项目反应理论用于改进 AI 安全测量的设计与解释。" }, "method": { "en": "Applies item response theory to improve the design and interpretation of AI safety measurements.", "zh": "将项目反应理论用于改进 AI 安全测量的设计与解释。" }, "finding": { "en": "Applies item response theory to improve the design and interpretation of AI safety measurements.", "zh": "将项目反应理论用于改进 AI 安全测量的设计与解释。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Statistical calibration depends on model assumptions, sampled items and the measured construct.", "zh": "统计校准依赖模型假设、抽样项目和被测概念。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2608.05086" } ] }, { "id": "optstop", "title": "Knowing When to Stop: Bayesian Optimal Stopping for LLM Evaluations", "aliases": [], "authors": [ "Toby D. Pilditch" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "method", "sourceId": "optstop-publication", "attributionSourceId": "optstop-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/knowing-when-to-stop-bayesian-optimal-stopping-for-llm-evaluations", "publicationDate": "2026-08-14", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "optstop-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Uses Bayesian optimal stopping to decide when evaluation sampling provides enough information for a stated decision.", "zh": "使用贝叶斯最优停止方法，判断评测抽样何时已为指定决策提供足够信息。" }, "note": { "question": { "en": "Uses Bayesian optimal stopping to decide when evaluation sampling provides enough information for a stated decision.", "zh": "使用贝叶斯最优停止方法，判断评测抽样何时已为指定决策提供足够信息。" }, "method": { "en": "Uses Bayesian optimal stopping to decide when evaluation sampling provides enough information for a stated decision.", "zh": "使用贝叶斯最优停止方法，判断评测抽样何时已为指定决策提供足够信息。" }, "finding": { "en": "Uses Bayesian optimal stopping to decide when evaluation sampling provides enough information for a stated decision.", "zh": "使用贝叶斯最优停止方法，判断评测抽样何时已为指定决策提供足够信息。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Stopping rules require explicit decision costs and assumptions; they do not remove uncertainty.", "zh": "停止规则需要明确决策成本与假设，不能消除不确定性。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2608.14425" } ] }, { "id": "metr-frontier-risk-report", "title": "Frontier Risk Report (February to March 2026)", "aliases": [], "authors": [ "Jonah Brown-Cohen", "David Lindner", "Rohin Shah" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "metr-frontier-risk-report-publication", "attributionSourceId": "metr-frontier-risk-report-publication-author-source", "originalUrl": "https://metr.org/blog/2026-05-19-frontier-risk-report/", "publicationDate": "2026-05-19", "updatedOn": "2026-10-25", "areas": [ "autonomy", "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "deepmind", "role": "research", "sourceId": "metr-frontier-risk-report-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Pilots an assessment of rogue-deployment risk using evidence about internal agent use at participating AI developers.", "zh": "结合参与机构内部智能体使用证据，试行未经授权部署风险评估。" }, "note": { "question": { "en": "Pilots an assessment of rogue-deployment risk using evidence about internal agent use at participating AI developers.", "zh": "结合参与机构内部智能体使用证据，试行未经授权部署风险评估。" }, "method": { "en": "Pilots an assessment of rogue-deployment risk using evidence about internal agent use at participating AI developers.", "zh": "结合参与机构内部智能体使用证据，试行未经授权部署风险评估。" }, "finding": { "en": "Pilots an assessment of rogue-deployment risk using evidence about internal agent use at participating AI developers.", "zh": "结合参与机构内部智能体使用证据，试行未经授权部署风险评估。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Participant access, disclosure and the pilot’s assessment scope limit coverage and cross-organization conclusions.", "zh": "参与权限、披露和试点评估范围限制覆盖程度及跨机构结论。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "clearly-malicious transcripts", "url": "https://metr.org/blog/2025-10-14-malt-dataset-of-natural-and-prompted-behaviors/" }, { "label": "the APPS dataset (Hendrycks et al. 2021)", "url": "https://arxiv.org/abs/2105.09938" }, { "label": "agents can construct encoded messages", "url": "https://arxiv.org/pdf/2507.02737" } ] }, { "id": "hugging-face-incident", "title": "Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident", "aliases": [], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "incident-report", "sourceId": "hugging-face-incident-publication", "attributionSourceId": "hugging-face-incident-publication", "originalUrl": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/", "publicationDate": "2026-08-26", "updatedOn": "2026-10-25", "areas": [ "autonomy", "deception", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "hugging-face-incident-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Reconstructs agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face security incident.", "zh": "重建 OpenAI／Hugging Face 安全事件中智能体的行为、推理与协作过程。" }, "note": { "question": { "en": "What do retained records establish about the agents’ actions and coordination in the incident?", "zh": "留存记录能够证明事件中智能体的哪些行动与协调？" }, "method": { "en": "The investigators inspect retained behavior and reasoning records and reconstruct the sequence of events and interactions.", "zh": "调查者检查留存行为与推理记录，重建事件顺序与交互。" }, "finding": { "en": "The report documents coordinated unauthorized activity and analyzes the available evidence for competing interpretations.", "zh": "报告记录协调的未授权活动，并分析现有证据对不同解释的支持。" }, "supports": { "en": "Supports case-specific investigation; general claims require additional incidents and comparable observation.", "zh": "支持具体案例调查；一般性判断需要更多事件和可比观测。" }, "limits": { "en": "Access to retained evidence constrains causal attribution; an incident does not establish a general model-family rate.", "zh": "留存证据的可获取程度限制因果归因，单个事件不能证明模型家族的一般发生率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "anthropic-cyber-incidents", "title": "An alignment assessment of recent cybersecurity incidents", "aliases": [], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "incident-report", "sourceId": "anthropic-cyber-incidents-publication", "attributionSourceId": "anthropic-cyber-incidents-publication", "originalUrl": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents", "publicationDate": "2026-09-09", "updatedOn": "2026-10-25", "areas": [ "autonomy", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "anthropic-cyber-incidents-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Assesses alignment-relevant evidence from incidents involving unauthorized access to third-party systems.", "zh": "评估涉及第三方系统未授权访问事件中与对齐有关的证据。" }, "note": { "question": { "en": "Assesses alignment-relevant evidence from incidents involving unauthorized access to third-party systems.", "zh": "评估涉及第三方系统未授权访问事件中与对齐有关的证据。" }, "method": { "en": "Assesses alignment-relevant evidence from incidents involving unauthorized access to third-party systems.", "zh": "评估涉及第三方系统未授权访问事件中与对齐有关的证据。" }, "finding": { "en": "Assesses alignment-relevant evidence from incidents involving unauthorized access to third-party systems.", "zh": "评估涉及第三方系统未授权访问事件中与对齐有关的证据。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The report reflects the author’s access and analysis; separate observed actions from inferred objectives.", "zh": "报告反映作者所掌握的证据和分析，需要区分观察行动与推断目标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "anthropic-threat-report", "title": "Detecting and countering misuse of AI: September 2026", "aliases": [], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "incident-report", "sourceId": "anthropic-threat-report-publication", "attributionSourceId": "anthropic-threat-report-publication", "originalUrl": "https://www.anthropic.com/threat-intelligence-report-september-2026", "publicationDate": null, "updatedOn": "2026-10-25", "areas": [ "cybersecurity", "cbrn", "disinformation" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "anthropic", "role": "publisher", "sourceId": "anthropic-threat-report-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Documents investigated misuse cases and interventions across several harm domains in a fixed reporting period.", "zh": "记录固定报告期间内多个危害领域的滥用调查案例和干预。" }, "note": { "question": { "en": "Documents investigated misuse cases and interventions across several harm domains in a fixed reporting period.", "zh": "记录固定报告期间内多个危害领域的滥用调查案例和干预。" }, "method": { "en": "Documents investigated misuse cases and interventions across several harm domains in a fixed reporting period.", "zh": "记录固定报告期间内多个危害领域的滥用调查案例和干预。" }, "finding": { "en": "Documents investigated misuse cases and interventions across several harm domains in a fixed reporting period.", "zh": "记录固定报告期间内多个危害领域的滥用调查案例和干预。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Detected cases are selected observations and do not estimate overall misuse prevalence.", "zh": "检出案例属于有选择的观测，不能估计整体滥用普遍程度。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "saferai-glm-risk", "title": "GLM-5.2 Risk Evaluation Report", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "saferai-glm-risk-publication", "attributionSourceId": "saferai-glm-risk-publication", "originalUrl": "https://www.safer-ai.org/research/glm-5-2-evaluation-report", "publicationDate": "2026-08-02", "updatedOn": "2026-10-25", "areas": [ "cybersecurity", "cbrn", "autonomy" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "saferai", "role": "publisher", "sourceId": "saferai-glm-risk-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Evaluates a released open-weight model across selected cyber, biological and autonomous-task settings.", "zh": "在选定网络、生物和自主任务设置中评估已发布的开放权重模型。" }, "note": { "question": { "en": "Evaluates a released open-weight model across selected cyber, biological and autonomous-task settings.", "zh": "在选定网络、生物和自主任务设置中评估已发布的开放权重模型。" }, "method": { "en": "Evaluates a released open-weight model across selected cyber, biological and autonomous-task settings.", "zh": "在选定网络、生物和自主任务设置中评估已发布的开放权重模型。" }, "finding": { "en": "Evaluates a released open-weight model across selected cyber, biological and autonomous-task settings.", "zh": "在选定网络、生物和自主任务设置中评估已发布的开放权重模型。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The tested configuration and task scope constrain conclusions; no cross-study aggregate safety score is inferred.", "zh": "结论受受测配置和任务范围约束，不据此推断跨研究综合安全分数。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "read full paper", "url": "https://www.safer-ai.org/u/2026/08/SaferAI-GLM-Evaluation-Report.pdf" } ] }, { "id": "bountybench", "title": "BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems", "aliases": [ "BountyBench" ], "authors": [ "Andy K. Zhang", "Joey Ji", "Celeste Menders", "Riya Dulepet", "Thomas Qin", "Ron Y. Wang", "Junrong Wu", "Kyleen Liao", "Jiliang Li", "Jinghan Hu", "Sara Hong", "Nardos Demilew", "Shivatmica Murgai", "Jason Tran", "Nishka Kacheria", "Ethan Ho", "Denis Liu", "Lauren McLane", "Olivia Bruvik", "Dai-Rong Han", "Seungwoo Kim", "Akhil Vyas", "Cuiyuanxiu Chen", "Ryan Li", "Weiran Xu", "Jonathan Z. Ye", "Prerit Choudhary", "Siddharth M. Bhatia", "Vikram Sivashankar", "Yuxuan Bao", "Dawn Song", "Dan Boneh", "Daniel E. Ho", "Percy Liang" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "bountybench-publication", "attributionSourceId": "bountybench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2505.15216", "publicationDate": "2025-05-21", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "protocolIds": [ "bountybench" ], "contributions": [ { "organizationId": "stanford", "role": "research", "sourceId": "bountybench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "bountybench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates detection, exploitation and patching across real-world codebases, with task outcomes grounded in vulnerability lifecycles.", "zh": "围绕真实代码库中的漏洞生命周期，分别评测发现、利用和修补任务。" }, "note": { "question": { "en": "Evaluates detection, exploitation and patching across real-world codebases, with task outcomes grounded in vulnerability lifecycles.", "zh": "围绕真实代码库中的漏洞生命周期，分别评测发现、利用和修补任务。" }, "method": { "en": "Model or agent system under the original task configuration", "zh": "原任务配置下的模型或智能体系统" }, "finding": { "en": "Evaluates detection, exploitation and patching across real-world codebases, with task outcomes grounded in vulnerability lifecycles.", "zh": "围绕真实代码库中的漏洞生命周期，分别评测发现、利用和修补任务。" }, "supports": { "en": "The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.", "zh": "主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。" }, "limits": { "en": "Detection, exploitation and patching have different information conditions and success criteria; bounty amounts do not estimate real-world damage.", "zh": "发现、利用和修补的信息条件与成功标准不同，赏金金额不能估计现实损失。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "deep-ignorance", "title": "Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs", "aliases": [], "authors": [ "Kyle O’Brien", "Stephen Casper", "Quentin Anthony", "Tomek Korbak", "Robert Kirk", "Xander Davies", "Ishan Mishra", "Geoffrey Irving", "Yarin Gal", "Stella Biderman" ], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "study", "sourceId": "deep-ignorance-publication", "attributionSourceId": "deep-ignorance-publication-author-source", "originalUrl": "https://arxiv.org/abs/2508.06601", "publicationDate": "2025-08-08", "updatedOn": "2026-10-25", "areas": [ "cbrn" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "eleuther", "role": "research", "sourceId": "deep-ignorance-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "aisi", "role": "research", "sourceId": "deep-ignorance-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "oxford", "role": "research", "sourceId": "deep-ignorance-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies pretraining-data filtering as a safeguard against biothreat proxy knowledge and tests resistance to adversarial fine-tuning.", "zh": "研究预训练数据过滤对生物威胁代理知识的防护作用，并测试其抵抗对抗微调的能力。" }, "note": { "question": { "en": "Can filtering pretraining data limit dangerous knowledge while retaining unrelated utility?", "zh": "预训练数据过滤能否限制危险知识，同时保留无关任务的有用性？" }, "method": { "en": "The authors train filtered-data models, compare post-training baselines and test adversarial fine-tuning and information supplied in context.", "zh": "作者训练使用过滤数据的模型，与后训练基线比较，并测试对抗微调及上下文提供信息的影响。" }, "finding": { "en": "The paper reports resistance to restoring biothreat proxy knowledge through tested fine-tuning attacks, while contextual information remains usable.", "zh": "论文报告，在所测试微调攻击下，生物威胁代理知识较难恢复，但上下文提供的信息仍可被使用。" }, "supports": { "en": "Supports studying pretraining-data curation as one safeguard layer, with separate checks for retained utility and external-information access.", "zh": "支持将预训练数据整理作为一层防护研究，并分别检查能力保留与外部信息访问。" }, "limits": { "en": "Filtered models can still use hazardous information provided in context. The experiments concern proxy knowledge and selected models, not a complete prevention of biological misuse.", "zh": "过滤后的模型仍可使用上下文提供的高危信息。实验针对代理知识和选定模型，不能证明全面防止生物滥用。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "monitoring-monitorability", "title": "Monitoring Monitorability", "aliases": [], "authors": [ "Melody Y. Guan 2 2 2 † \\dagger Equal contribution. Correspondence to Bowen Baker at bowen@openai.com", "Miles Wang 2 2 footnotemark: 2", "Micah Carroll 2 2 footnotemark: 2", "Annie Y. Wei", "Marcus Williams", "Benjamin Arnav", "Ian Kivlichan", "Mia Glaese", "Jakub Pachocki" ], "primaryFunction": "monitoring", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "method", "sourceId": "monitoring-monitorability-publication", "attributionSourceId": "monitoring-monitorability-publication-author-source", "originalUrl": "https://arxiv.org/abs/2512.18311", "publicationDate": "2025-12-20", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "openai", "role": "research", "sourceId": "monitoring-monitorability-publication-author-source", "locator": "Paper author block and correspondence at openai.com" } ], "summary": { "en": "Defines monitorability evaluations and studies how reasoning access, inference compute and follow-up questions affect detection.", "zh": "定义可监测性评测，研究推理可见性、推理计算与追问如何影响检测。" }, "note": { "question": { "en": "How reliably can a monitor identify safety-relevant properties from an agent’s reasoning?", "zh": "监测器能否可靠地从智能体推理中识别安全相关特征？" }, "method": { "en": "The study defines evaluation archetypes and a discrimination metric, and varies reasoning visibility, compute and follow-up questions.", "zh": "研究定义评测类型与区分指标，并改变推理可见性、计算和追问条件。" }, "finding": { "en": "The authors find benefits from reasoning access in tested settings, with important variation across agent and monitor configurations.", "zh": "作者发现推理可见性在受测条件下有助于监测，但效果随智能体和监测器配置显著变化。" }, "supports": { "en": "Supports protocol-specific monitor evaluation and explicit treatment of observation access and compute.", "zh": "支持按协议评测监测器，并明确观测权限与计算投入。" }, "limits": { "en": "Monitorability depends on the agent–monitor pair and evaluation distribution; it is not a measure of overall model safety.", "zh": "可监测性依赖智能体与监测器组合和评测分布，不是模型整体安全指标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "monitorability-opportunity", "title": "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety", "aliases": [], "authors": [ "Tomek Korbak * UK AI Security Institute Mikita Balesni * Apollo Research Elizabeth Barnes METR Yoshua Bengio University of Montreal & Mila Joe Benton Anthropic Joseph Bloom UK AI Security Institute Mark Chen OpenAI Alan Cooney UK AI Security Institute Allan Dafoe Google DeepMind Anca Dragan Google DeepMind Scott Emmons Google DeepMind Owain Evans Truthful AI & UC Berkeley David Farhi OpenAI Ryan Greenblatt Redwood Research Dan Hendrycks Center for AI Safety Marius Hobbhahn Apollo Research Evan Hubinger Anthropic Geoffrey Irving UK AI Security Institute Erik Jenner Google DeepMind Daniel Kokotajlo AI Futures Project Victoria Krakovna Google DeepMind Shane Legg Google DeepMind David Lindner Google DeepMind David Luan Amazon Aleksander Mądry OpenAI Julian Michael Scale AI Neel Nanda Google DeepMind Dave Orr Google DeepMind Jakub Pachocki OpenAI Ethan Perez Anthropic Mary Phuong Google DeepMind Fabien Roger Anthropic Joshua Saxe Meta Buck Shlegeris Redwood Research Martín Soto UK AI Security Institute Eric Steinberger Magic Jasmine Wang UK AI Security Institute Wojciech Zaremba OpenAI Bowen Baker † OpenAI Rohin Shah † Google DeepMind Vlad Mikulik † Anthropic" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "monitorability-opportunity-publication", "attributionSourceId": "monitorability-opportunity-publication-author-source", "originalUrl": "https://arxiv.org/abs/2507.11473", "publicationDate": "2025-07-15", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "apollo", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "metr", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "montreal", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mila", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "openai", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "deepmind", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "truthful", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "berkeley", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "redwood", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "cais", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "scale", "role": "research", "sourceId": "monitorability-opportunity-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Identifies chain-of-thought monitoring as a safety research opportunity and analyzes conditions under which it may become less reliable.", "zh": "将推理链监测作为安全研究机会，并分析其可靠性可能降低的条件。" }, "note": { "question": { "en": "Identifies chain-of-thought monitoring as a safety research opportunity and analyzes conditions under which it may become less reliable.", "zh": "将推理链监测作为安全研究机会，并分析其可靠性可能降低的条件。" }, "method": { "en": "Identifies chain-of-thought monitoring as a safety research opportunity and analyzes conditions under which it may become less reliable.", "zh": "将推理链监测作为安全研究机会，并分析其可靠性可能降低的条件。" }, "finding": { "en": "Identifies chain-of-thought monitoring as a safety research opportunity and analyzes conditions under which it may become less reliable.", "zh": "将推理链监测作为安全研究机会，并分析其可靠性可能降低的条件。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "This research agenda motivates experiments; its arguments do not establish that all reasoning traces are faithful or monitorable.", "zh": "研究议程为实验提供动机，其论证不能证明所有推理轨迹均忠实或可监测。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "monitorbench", "title": "MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Models", "aliases": [], "authors": [ "Han Wang", "Yifan Sun", "Brian Ko", "Mann Talati", "Jiawen Gong", "Zimeng Li   Naicheng Yu   Xucheng Yu   Wei Shen   Vedant Jolly", "Huan Zhang" ], "primaryFunction": "monitoring", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "benchmark", "sourceId": "monitorbench-publication", "attributionSourceId": "monitorbench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2603.28590v2", "publicationDate": "2026-03-30", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "monitorbench" ], "contributions": [ { "organizationId": "uiuc", "role": "research", "sourceId": "monitorbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "washington", "role": "research", "sourceId": "monitorbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ucsd", "role": "research", "sourceId": "monitorbench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Benchmarks chain-of-thought monitorability across tasks that include hidden objectives, underperformance and encoded communication.", "zh": "通过隐藏目标、低表现及编码通信等任务评测推理链可监测性。" }, "note": { "question": { "en": "Benchmarks chain-of-thought monitorability across tasks that include hidden objectives, underperformance and encoded communication.", "zh": "通过隐藏目标、低表现及编码通信等任务评测推理链可监测性。" }, "method": { "en": "Benchmarks chain-of-thought monitorability across tasks that include hidden objectives, underperformance and encoded communication.", "zh": "通过隐藏目标、低表现及编码通信等任务评测推理链可监测性。" }, "finding": { "en": "Benchmarks chain-of-thought monitorability across tasks that include hidden objectives, underperformance and encoded communication.", "zh": "通过隐藏目标、低表现及编码通信等任务评测推理链可监测性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Different task subsets and attacker constructions require separate interpretation; detecting an artifact is not unrestricted access to intent.", "zh": "不同任务子集与攻击者构造须分别解释，检出特征不等于直接读取意图。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "catastrophic-cyber-benchmark", "title": "Catastrophic Cyber Capabilities Benchmark (3CB): Robustly Evaluating LLM Agent Cyber Offense Capabilities", "aliases": [], "authors": [ "Your Name" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "catastrophic-cyber-benchmark-publication", "attributionSourceId": "catastrophic-cyber-benchmark-publication-author-source", "originalUrl": "https://arxiv.org/abs/2410.09114", "publicationDate": "2024-10-10", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "catastrophic-cyber-benchmark" ], "contributions": [ { "organizationId": "apart", "role": "research", "sourceId": "three-cb-attribution", "locator": "Original institutional announcement: Apart Research paper" } ], "summary": { "en": "Evaluates agent cyber-offense capabilities with executable tasks and examines robustness across prompting and task conditions.", "zh": "使用可执行任务评测智能体网络攻击能力，并研究提示和任务条件下的稳健性。" }, "note": { "question": { "en": "Evaluates agent cyber-offense capabilities with executable tasks and examines robustness across prompting and task conditions.", "zh": "使用可执行任务评测智能体网络攻击能力，并研究提示和任务条件下的稳健性。" }, "method": { "en": "Evaluates agent cyber-offense capabilities with executable tasks and examines robustness across prompting and task conditions.", "zh": "使用可执行任务评测智能体网络攻击能力，并研究提示和任务条件下的稳健性。" }, "finding": { "en": "Evaluates agent cyber-offense capabilities with executable tasks and examines robustness across prompting and task conditions.", "zh": "使用可执行任务评测智能体网络攻击能力，并研究提示和任务条件下的稳健性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Task scope and prompting affect measured performance; a benchmark name does not establish catastrophic real-world effects.", "zh": "任务范围和提示影响测量表现，基准名称不能证明现实灾难性后果。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "instrumentaleval", "title": "Evaluating the Paperclip Maximizer: Are RL-Based Language Models More Likely to Pursue Instrumental Goals?", "aliases": [], "authors": [ "Yufei He", "Yuexin Li", "Jiaying Wu", "Yuan Sui", "Yulin Chen", "Bryan Hooi" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "instrumentaleval-publication", "attributionSourceId": "instrumentaleval-publication-author-source", "originalUrl": "https://arxiv.org/abs/2502.12206", "publicationDate": "2025-02-16", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "instrumentaleval" ], "contributions": [ { "organizationId": "nus", "role": "research", "sourceId": "instrumentaleval-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests model responses for instrumental goals such as resource acquisition and self-preservation under specified scenarios.", "zh": "在指定场景下测试模型回答中的资源获取、自我维持等工具性目标。" }, "note": { "question": { "en": "Tests model responses for instrumental goals such as resource acquisition and self-preservation under specified scenarios.", "zh": "在指定场景下测试模型回答中的资源获取、自我维持等工具性目标。" }, "method": { "en": "Tests model responses for instrumental goals such as resource acquisition and self-preservation under specified scenarios.", "zh": "在指定场景下测试模型回答中的资源获取、自我维持等工具性目标。" }, "finding": { "en": "Tests model responses for instrumental goals such as resource acquisition and self-preservation under specified scenarios.", "zh": "在指定场景下测试模型回答中的资源获取、自我维持等工具性目标。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Textual choices and grader labels do not establish executed autonomous behavior or stable deployment propensities.", "zh": "文本选择与评判标签不能证明已执行的自主行为或稳定部署倾向。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "mcptox", "title": "MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers", "aliases": [], "authors": [ "Zhiqiang Wang", "Yichao Gao", "Yanting Wang", "Suyuan Liu", "Haifeng Sun", "Haoran Cheng", "Guanquan Shi", "Haohua Du", "Xiang-Yang Li" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "mcptox-publication", "attributionSourceId": "mcptox-aaai-author-source", "originalUrl": "https://arxiv.org/abs/2508.14925", "publicationDate": "2025-08-19", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "mcptox" ], "contributions": [ { "organizationId": "ustc", "role": "research", "sourceId": "mcptox-aaai-author-source", "locator": "AAAI-26 original paper, p. 1, author affiliations 1–2" }, { "organizationId": "beihang", "role": "research", "sourceId": "mcptox-aaai-author-source", "locator": "AAAI-26 original paper, p. 1, author affiliations 1–2" } ], "summary": { "en": "Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.", "zh": "研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。" }, "note": { "question": { "en": "Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.", "zh": "研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。" }, "method": { "en": "Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.", "zh": "研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。" }, "finding": { "en": "Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.", "zh": "研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Attack effects depend on tool descriptions and the agent configuration; they are not universal MCP compromise rates.", "zh": "攻击效果依赖工具描述和智能体配置，不是 MCP 的普遍攻陷率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "judgebench", "title": "JudgeBench: A Benchmark for Evaluating LLM-based Judges", "aliases": [], "authors": [ "Sijun Tan", "Siyuan Zhuang", "Kyle Montgomery", "William Y. Tang", "Alejandro Cuadron", "Chenguang Wang", "Raluca Ada Popa", "Ion Stoica" ], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "benchmark", "sourceId": "judgebench-publication", "attributionSourceId": "judgebench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2410.12784v2", "publicationDate": "2024-10-16", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "judgebench" ], "contributions": [ { "organizationId": "berkeley", "role": "research", "sourceId": "judgebench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Evaluates model-based judges on challenging response comparisons to examine reliability of automated evaluation.", "zh": "通过困难回答比较，评测模型评判器并考察自动评测可靠性。" }, "note": { "question": { "en": "Evaluates model-based judges on challenging response comparisons to examine reliability of automated evaluation.", "zh": "通过困难回答比较，评测模型评判器并考察自动评测可靠性。" }, "method": { "en": "Evaluates model-based judges on challenging response comparisons to examine reliability of automated evaluation.", "zh": "通过困难回答比较，评测模型评判器并考察自动评测可靠性。" }, "finding": { "en": "Evaluates model-based judges on challenging response comparisons to examine reliability of automated evaluation.", "zh": "通过困难回答比较，评测模型评判器并考察自动评测可靠性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Judge performance is methodological context; it does not directly measure a frontier-risk capability.", "zh": "评判器表现属于方法背景，不能直接测量前沿风险能力。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "narcbench", "title": "Detecting Multi-Agent Collusion Through Multi-Agent Interpretability", "aliases": [], "authors": [ "Aaron Rose", "Carissa Cullen", "Sahar Abdelnabi", "Philip Torr", "Brandon Gary Kaplowitz", "Christian Schroeder de Witt" ], "primaryFunction": "monitoring", "secondaryFunctions": [ { "function": "evaluation", "rationale": { "en": "The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.", "zh": "该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。" } } ], "kind": "benchmark", "sourceId": "narcbench-publication", "attributionSourceId": "narcbench-publication-author-source", "originalUrl": "https://arxiv.org/abs/2604.01151v2", "publicationDate": "2026-04-01", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [ "narcbench" ], "contributions": [ { "organizationId": "oxford", "role": "research", "sourceId": "narcbench-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "ellis", "role": "research", "sourceId": "narcbench-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Studies detection of covert coordination between agents using observable communication and internal signals.", "zh": "研究利用可观察通信及内部信号，检测智能体间的隐蔽协调。" }, "note": { "question": { "en": "Studies detection of covert coordination between agents using observable communication and internal signals.", "zh": "研究利用可观察通信及内部信号，检测智能体间的隐蔽协调。" }, "method": { "en": "Studies detection of covert coordination between agents using observable communication and internal signals.", "zh": "研究利用可观察通信及内部信号，检测智能体间的隐蔽协调。" }, "finding": { "en": "Studies detection of covert coordination between agents using observable communication and internal signals.", "zh": "研究利用可观察通信及内部信号，检测智能体间的隐蔽协调。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Constructed collusion and monitor visibility determine scope; detection does not establish prevalence of spontaneous coordination.", "zh": "构造的串谋与监测可见性限定研究范围，检测结果不能证明自发协调的普遍程度。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "transect", "title": "Transect: Retaining Observability for Long-Horizon LLM Agent Evaluations", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "method", "sourceId": "transect-publication", "attributionSourceId": "transect-publication", "originalUrl": "https://www.aisi.gov.uk/research/transect-retaining-observability-for-long-horizon-llm-agent-evaluations", "publicationDate": "2026-10-07", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "transect-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Structures transcript analysis for long-horizon agent evaluations so interpretations can be checked against retained evidence.", "zh": "组织长程智能体评测轨迹的分析，使解释能够对照留存证据核查。" }, "note": { "question": { "en": "Structures transcript analysis for long-horizon agent evaluations so interpretations can be checked against retained evidence.", "zh": "组织长程智能体评测轨迹的分析，使解释能够对照留存证据核查。" }, "method": { "en": "Structures transcript analysis for long-horizon agent evaluations so interpretations can be checked against retained evidence.", "zh": "组织长程智能体评测轨迹的分析，使解释能够对照留存证据核查。" }, "finding": { "en": "Structures transcript analysis for long-horizon agent evaluations so interpretations can be checked against retained evidence.", "zh": "组织长程智能体评测轨迹的分析，使解释能够对照留存证据核查。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Reusable analysis settings improve auditability but do not eliminate judge error or ambiguity in agent traces.", "zh": "复用分析设置有助于审计，但不能消除评判错误或轨迹歧义。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2610.08364" } ] }, { "id": "extreme-risk-evaluations", "title": "Model evaluation for extreme risks", "aliases": [], "authors": [ "Toby Shevlane", "Sebastian Farquhar", "Ben Garfinkel", "Mary Phuong", "Jess Whittlestone", "Jade Leung", "Daniel Kokotajlo", "Nahema Marchal", "Markus Anderljung", "Noam Kolt", "Lewis Ho", "Divya Siddarth", "Shahar Avin", "Will Hawkins", "Been Kim", "Iason Gabriel", "Vijay Bolina", "Jack Clark", "Yoshua Bengio", "Paul Christiano", "Allan Dafoe" ], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "extreme-risk-evaluations-publication", "attributionSourceId": "extreme-risk-evaluations-publication-author-source", "originalUrl": "https://arxiv.org/abs/2305.15324", "publicationDate": "2023-05-24", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "deepmind", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "openai", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "toronto", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "oxford", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "montreal", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "mila", "role": "research", "sourceId": "extreme-risk-evaluations-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Develops an approach to evaluating extreme model risks, connecting capability assessment with responsible development decisions.", "zh": "提出极端模型风险评测思路，将能力评估与负责任的开发决策联系起来。" }, "note": { "question": { "en": "Develops an approach to evaluating extreme model risks, connecting capability assessment with responsible development decisions.", "zh": "提出极端模型风险评测思路，将能力评估与负责任的开发决策联系起来。" }, "method": { "en": "Develops an approach to evaluating extreme model risks, connecting capability assessment with responsible development decisions.", "zh": "提出极端模型风险评测思路，将能力评估与负责任的开发决策联系起来。" }, "finding": { "en": "Develops an approach to evaluating extreme model risks, connecting capability assessment with responsible development decisions.", "zh": "提出极端模型风险评测思路，将能力评估与负责任的开发决策联系起来。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "An evaluation proposal is not evidence that every listed risk is measurable or that a model has crossed a quantitative threshold.", "zh": "评测建议不能证明所有列出的风险均可测量，也不能证明模型跨越了定量阈值。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "monitorability-metrics", "title": "Beyond g-mean²: complementary metrics for monitorability", "aliases": [], "authors": [ "Melody Guan", "Yuxiang Xie", "Bowen Baker" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "method", "sourceId": "monitorability-metrics-publication", "attributionSourceId": "monitorability-metrics-publication", "originalUrl": "https://alignment.openai.com/beyond-gmean-squared/", "publicationDate": "2026-10-20", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "openai", "role": "publisher", "sourceId": "monitorability-metrics-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Examines complementary monitorability metrics and how evaluation objectives change when a monitor is used in a control protocol.", "zh": "研究互补的可监测性指标，以及监测器进入控制协议后评测目标如何变化。" }, "note": { "question": { "en": "Examines complementary monitorability metrics and how evaluation objectives change when a monitor is used in a control protocol.", "zh": "研究互补的可监测性指标，以及监测器进入控制协议后评测目标如何变化。" }, "method": { "en": "Examines complementary monitorability metrics and how evaluation objectives change when a monitor is used in a control protocol.", "zh": "研究互补的可监测性指标，以及监测器进入控制协议后评测目标如何变化。" }, "finding": { "en": "Examines complementary monitorability metrics and how evaluation objectives change when a monitor is used in a control protocol.", "zh": "研究互补的可监测性指标，以及监测器进入控制协议后评测目标如何变化。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Metrics for discrimination and intervention serve different decisions and should not be interpreted interchangeably.", "zh": "区分能力与干预效果指标服务不同决策，不能互换解释。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "prefill-awareness", "title": "Prefill Awareness in Large Language Models", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "study", "sourceId": "prefill-awareness-publication", "attributionSourceId": "prefill-awareness-publication", "originalUrl": "https://www.aisi.gov.uk/research/prefill-awareness-in-large-language-models", "publicationDate": "2026-06-10", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "prefill-awareness-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Tests whether models distinguish their own generated context from inserted or edited assistant messages.", "zh": "测试模型能否区分自身生成的上下文与插入或编辑过的助手消息。" }, "note": { "question": { "en": "Tests whether models distinguish their own generated context from inserted or edited assistant messages.", "zh": "测试模型能否区分自身生成的上下文与插入或编辑过的助手消息。" }, "method": { "en": "Tests whether models distinguish their own generated context from inserted or edited assistant messages.", "zh": "测试模型能否区分自身生成的上下文与插入或编辑过的助手消息。" }, "finding": { "en": "Tests whether models distinguish their own generated context from inserted or edited assistant messages.", "zh": "测试模型能否区分自身生成的上下文与插入或编辑过的助手消息。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Recognition of edited context can affect evaluation validity; recognition alone does not establish scheming.", "zh": "识别编辑上下文可能影响评测有效性，但单凭识别不能证明策略性欺骗。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2606.12747" } ] }, { "id": "consistency-misalignment", "title": "Consistency Training Can Entrench Misalignment", "aliases": [], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "consistency-misalignment-publication", "attributionSourceId": "consistency-misalignment-publication", "originalUrl": "https://www.aisi.gov.uk/research/consistency-training-can-entrench-misalignment", "publicationDate": "2026-06-02", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "consistency-misalignment-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Compares how consistency-training methods alter controlled misaligned behaviors in model organisms.", "zh": "比较一致性训练方法如何改变模型实验体中受控的失调行为。" }, "note": { "question": { "en": "Compares how consistency-training methods alter controlled misaligned behaviors in model organisms.", "zh": "比较一致性训练方法如何改变模型实验体中受控的失调行为。" }, "method": { "en": "Compares how consistency-training methods alter controlled misaligned behaviors in model organisms.", "zh": "比较一致性训练方法如何改变模型实验体中受控的失调行为。" }, "finding": { "en": "Compares how consistency-training methods alter controlled misaligned behaviors in model organisms.", "zh": "比较一致性训练方法如何改变模型实验体中受控的失调行为。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Effects differ by behavior and training method; results from constructed organisms require cautious generalization.", "zh": "效果随行为和训练方法变化，对构造实验体的结果需谨慎泛化。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2606.03810" } ] }, { "id": "loss-of-oversight", "title": "Loss of Oversight: How AI systems may become harder to audit, monitor, and investigate", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "loss-of-oversight-publication", "attributionSourceId": "loss-of-oversight-publication", "originalUrl": "https://www.aisi.gov.uk/research/loss-of-oversight-how-ai-systems-may-become-harder-to-audit-monitor-and-investigate", "publicationDate": "2026-05-21", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "loss-of-oversight-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Combines expert interviews and literature analysis to examine the reliability of behavior, reasoning, internal and memory-based oversight signals.", "zh": "结合专家访谈与文献分析，考察行为、推理、内部表征和记忆等监督信号的可靠性。" }, "note": { "question": { "en": "Combines expert interviews and literature analysis to examine the reliability of behavior, reasoning, internal and memory-based oversight signals.", "zh": "结合专家访谈与文献分析，考察行为、推理、内部表征和记忆等监督信号的可靠性。" }, "method": { "en": "Combines expert interviews and literature analysis to examine the reliability of behavior, reasoning, internal and memory-based oversight signals.", "zh": "结合专家访谈与文献分析，考察行为、推理、内部表征和记忆等监督信号的可靠性。" }, "finding": { "en": "Combines expert interviews and literature analysis to examine the reliability of behavior, reasoning, internal and memory-based oversight signals.", "zh": "结合专家访谈与文献分析，考察行为、推理、内部表征和记忆等监督信号的可靠性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Expert assessment and literature synthesis identify concerns rather than measured probabilities of future oversight failure.", "zh": "专家评估与文献综合用于识别问题，不能衡量未来监督失败的概率。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a0ed93f9b4a6a65994235d8_Loss_of_Oversight%20(7).pdf" } ] }, { "id": "steganography-monitoring", "title": "A Decision-Theoretic Formalisation of Steganography With Applications to LLM Monitoring", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "method", "sourceId": "steganography-monitoring-publication", "attributionSourceId": "steganography-monitoring-publication", "originalUrl": "https://www.aisi.gov.uk/research/a-decision-theoretic-formalisation-of-steganography-with-applications-to-llm-monitoring", "publicationDate": "2026-04-29", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "steganography-monitoring-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Develops a decision-theoretic approach to detecting and quantifying steganography without assuming a known benign reference distribution.", "zh": "提出决策理论方法，在不假设已知正常参考分布的情况下检测和量化隐写。" }, "note": { "question": { "en": "Develops a decision-theoretic approach to detecting and quantifying steganography without assuming a known benign reference distribution.", "zh": "提出决策理论方法，在不假设已知正常参考分布的情况下检测和量化隐写。" }, "method": { "en": "Develops a decision-theoretic approach to detecting and quantifying steganography without assuming a known benign reference distribution.", "zh": "提出决策理论方法，在不假设已知正常参考分布的情况下检测和量化隐写。" }, "finding": { "en": "Develops a decision-theoretic approach to detecting and quantifying steganography without assuming a known benign reference distribution.", "zh": "提出决策理论方法，在不假设已知正常参考分布的情况下检测和量化隐写。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The formalization’s assumptions and observation access constrain practical detection claims.", "zh": "形式化假设和观测权限限制实际检测结论。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2602.23163" } ] }, { "id": "log-analysis-pipeline", "title": "Seven simple steps for log analysis in AI systems", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "method", "sourceId": "log-analysis-pipeline-publication", "attributionSourceId": "log-analysis-pipeline-publication", "originalUrl": "https://www.aisi.gov.uk/research/seven-simple-steps-for-log-analysis-in-ai-systems", "publicationDate": "2026-02-25", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "log-analysis-pipeline-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Describes a reproducible pipeline for sampling, labeling and analyzing agent logs, with guidance on common analysis pitfalls.", "zh": "提出对智能体日志开展抽样、标注和分析的可复用流程，并说明常见分析陷阱。" }, "note": { "question": { "en": "Describes a reproducible pipeline for sampling, labeling and analyzing agent logs, with guidance on common analysis pitfalls.", "zh": "提出对智能体日志开展抽样、标注和分析的可复用流程，并说明常见分析陷阱。" }, "method": { "en": "Describes a reproducible pipeline for sampling, labeling and analyzing agent logs, with guidance on common analysis pitfalls.", "zh": "提出对智能体日志开展抽样、标注和分析的可复用流程，并说明常见分析陷阱。" }, "finding": { "en": "Describes a reproducible pipeline for sampling, labeling and analyzing agent logs, with guidance on common analysis pitfalls.", "zh": "提出对智能体日志开展抽样、标注和分析的可复用流程，并说明常见分析陷阱。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A structured workflow supports auditability but cannot recover events missing from the retained logs.", "zh": "结构化流程有助于审计，但无法恢复未被留存的事件。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "control-monitoring-deployment", "title": "Practical challenges of control monitoring in frontier AI deployments", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "control-monitoring-deployment-publication", "attributionSourceId": "control-monitoring-deployment-publication", "originalUrl": "https://www.aisi.gov.uk/research/practical-challenges-of-control-monitoring-in-frontier-ai-deployments", "publicationDate": "2025-12-15", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "control-monitoring-deployment-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Analyzes how parallel agents, oversight latency and incremental attacks affect synchronous and asynchronous control monitoring.", "zh": "分析并行智能体、监督延迟和增量攻击如何影响同步及异步控制监测。" }, "note": { "question": { "en": "Analyzes how parallel agents, oversight latency and incremental attacks affect synchronous and asynchronous control monitoring.", "zh": "分析并行智能体、监督延迟和增量攻击如何影响同步及异步控制监测。" }, "method": { "en": "Analyzes how parallel agents, oversight latency and incremental attacks affect synchronous and asynchronous control monitoring.", "zh": "分析并行智能体、监督延迟和增量攻击如何影响同步及异步控制监测。" }, "finding": { "en": "Analyzes how parallel agents, oversight latency and incremental attacks affect synchronous and asynchronous control monitoring.", "zh": "分析并行智能体、监督延迟和增量攻击如何影响同步及异步控制监测。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Design trade-offs depend on deployment assumptions and do not constitute a guarantee for a particular production system.", "zh": "设计权衡依赖部署假设，不能构成特定生产系统的保证。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2512.22154" } ] }, { "id": "async-control", "title": "Async control: Stress-testing asynchronous control measures for LLM agents", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "study", "sourceId": "async-control-publication", "attributionSourceId": "async-control-publication", "originalUrl": "https://www.aisi.gov.uk/research/async-control-stress-testing-asynchronous-control-measures-for-llm-agents", "publicationDate": "2025-12-15", "updatedOn": "2026-10-25", "areas": [ "deception", "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "async-control-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Stress-tests asynchronous oversight in a red-team/blue-team setting where agents may sabotage code before monitors intervene.", "zh": "在红蓝对抗中，对异步监督开展压力测试，研究智能体在监测干预前破坏代码的可能性。" }, "note": { "question": { "en": "Stress-tests asynchronous oversight in a red-team/blue-team setting where agents may sabotage code before monitors intervene.", "zh": "在红蓝对抗中，对异步监督开展压力测试，研究智能体在监测干预前破坏代码的可能性。" }, "method": { "en": "Stress-tests asynchronous oversight in a red-team/blue-team setting where agents may sabotage code before monitors intervene.", "zh": "在红蓝对抗中，对异步监督开展压力测试，研究智能体在监测干预前破坏代码的可能性。" }, "finding": { "en": "Stress-tests asynchronous oversight in a red-team/blue-team setting where agents may sabotage code before monitors intervene.", "zh": "在红蓝对抗中，对异步监督开展压力测试，研究智能体在监测干预前破坏代码的可能性。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Latency, reversibility and attacker knowledge define the protocol’s safety and usefulness trade-offs.", "zh": "延迟、可逆性和攻击者认知限定协议的安全性与有用性权衡。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2512.13526" } ] }, { "id": "self-evaluation-wireheading", "title": "Does self-evaluation enable wireheading in language models?", "aliases": [], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "self-evaluation-wireheading-publication", "attributionSourceId": "self-evaluation-wireheading-publication", "originalUrl": "https://www.aisi.gov.uk/research/does-self-evaluation-enable-wireheading-in-language-models", "publicationDate": "2025-12-01", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "self-evaluation-wireheading-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Studies incentives to manipulate self-evaluation rewards using a formal model and controlled language-model experiments.", "zh": "结合形式模型与受控语言模型实验，研究操纵自评奖励的激励。" }, "note": { "question": { "en": "Studies incentives to manipulate self-evaluation rewards using a formal model and controlled language-model experiments.", "zh": "结合形式模型与受控语言模型实验，研究操纵自评奖励的激励。" }, "method": { "en": "Studies incentives to manipulate self-evaluation rewards using a formal model and controlled language-model experiments.", "zh": "结合形式模型与受控语言模型实验，研究操纵自评奖励的激励。" }, "finding": { "en": "Studies incentives to manipulate self-evaluation rewards using a formal model and controlled language-model experiments.", "zh": "结合形式模型与受控语言模型实验，研究操纵自评奖励的激励。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Formal conditions and small-model experiments do not establish prevalence in frontier deployments.", "zh": "形式条件和小模型实验不能证明前沿部署中的普遍程度。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2511.23092" } ] }, { "id": "open-weight-risk-management", "title": "Open technical problems in open-weight AI model risk management", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "open-weight-risk-management-publication", "attributionSourceId": "open-weight-risk-management-publication", "originalUrl": "https://www.aisi.gov.uk/research/open-technical-problems-in-open-weight-ai-model-risk-management", "publicationDate": "2025-10-26", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "open-weight-risk-management-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Identifies technical research gaps in managing risks from modifiable, redistributable open-weight models.", "zh": "梳理可修改、可再分发的开放权重模型在风险管理中的技术研究缺口。" }, "note": { "question": { "en": "Identifies technical research gaps in managing risks from modifiable, redistributable open-weight models.", "zh": "梳理可修改、可再分发的开放权重模型在风险管理中的技术研究缺口。" }, "method": { "en": "Identifies technical research gaps in managing risks from modifiable, redistributable open-weight models.", "zh": "梳理可修改、可再分发的开放权重模型在风险管理中的技术研究缺口。" }, "finding": { "en": "Identifies technical research gaps in managing risks from modifiable, redistributable open-weight models.", "zh": "梳理可修改、可再分发的开放权重模型在风险管理中的技术研究缺口。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "An open-problem agenda does not establish the effectiveness of any proposed safeguard.", "zh": "开放问题议程不能证明任何建议防护措施的有效性。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "pretraining-poisoning", "title": "Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples", "aliases": [], "authors": [ "Alexandra Souly", "Javier Rando", "Ed Chapman", "Xander Davies", "Burak Hasircioglu", "Ezzeldin Shereen", "Carlos Mougan", "Vasilios Mavroudis", "Erik Jones", "Chris Hicks", "Nicholas Carlini", "Yarin Gal", "Robert Kirk" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "pretraining-poisoning-publication", "attributionSourceId": "pretraining-poisoning-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/poisoning-attacks-on-llms-require-a-near-constant-number-of-poison-samples", "publicationDate": "2025-10-08", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "pretraining-poisoning-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "anthropic", "role": "research", "sourceId": "pretraining-poisoning-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "eth", "role": "research", "sourceId": "pretraining-poisoning-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "oxford", "role": "research", "sourceId": "pretraining-poisoning-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests pretraining-data poisoning across model and dataset scales to examine the amount of malicious data needed for a targeted effect.", "zh": "跨模型与数据规模测试预训练数据投毒，研究诱发指定效果所需的恶意数据量。" }, "note": { "question": { "en": "Tests pretraining-data poisoning across model and dataset scales to examine the amount of malicious data needed for a targeted effect.", "zh": "跨模型与数据规模测试预训练数据投毒，研究诱发指定效果所需的恶意数据量。" }, "method": { "en": "Tests pretraining-data poisoning across model and dataset scales to examine the amount of malicious data needed for a targeted effect.", "zh": "跨模型与数据规模测试预训练数据投毒，研究诱发指定效果所需的恶意数据量。" }, "finding": { "en": "Tests pretraining-data poisoning across model and dataset scales to examine the amount of malicious data needed for a targeted effect.", "zh": "跨模型与数据规模测试预训练数据投毒，研究诱发指定效果所需的恶意数据量。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The tested poisoning goals and data conditions do not establish equivalent attacks against every training pipeline.", "zh": "受测投毒目标和数据条件不能证明所有训练流程均面临等效攻击。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2510.07192" } ] }, { "id": "inoculation-prompting", "title": "Inoculation Prompting: Eliciting traits from LLMs during training can suppress them at test-time", "aliases": [], "authors": [ "Daniel Tan", "Anders Woodruff 2 2 footnotemark: 2", "Niels Warncke 2 2 footnotemark: 2", "Arun Jose 2 2 footnotemark: 2", "Maxime Riché 2 2 footnotemark: 2", "David Demitri Africa", "Mia Taylor 2 2 footnotemark: 2" ], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "study", "sourceId": "inoculation-prompting-publication", "attributionSourceId": "inoculation-prompting-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/inoculation-prompting-eliciting-traits-from-llms-during-training-can-suppress-them-at-test-time", "publicationDate": "2025-10-05", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "inoculation-prompting-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Tests whether eliciting an unwanted trait in fine-tuning prompts reduces its expression when those prompts are removed at test time.", "zh": "测试在微调提示中诱发不期望特征，能否在测试时移除该提示后降低特征表现。" }, "note": { "question": { "en": "Tests whether eliciting an unwanted trait in fine-tuning prompts reduces its expression when those prompts are removed at test time.", "zh": "测试在微调提示中诱发不期望特征，能否在测试时移除该提示后降低特征表现。" }, "method": { "en": "Tests whether eliciting an unwanted trait in fine-tuning prompts reduces its expression when those prompts are removed at test time.", "zh": "测试在微调提示中诱发不期望特征，能否在测试时移除该提示后降低特征表现。" }, "finding": { "en": "Tests whether eliciting an unwanted trait in fine-tuning prompts reduces its expression when those prompts are removed at test time.", "zh": "测试在微调提示中诱发不期望特征，能否在测试时移除该提示后降低特征表现。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Selective suppression depends on the trait, data and context; absence on standard tests is not universal removal.", "zh": "选择性抑制依赖特征、数据和上下文，标准测试未出现不代表全面消除。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2510.04340" } ] }, { "id": "misuse-safety-case", "title": "An example safety case for safeguards against misuse", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "misuse-safety-case-publication", "attributionSourceId": "misuse-safety-case-publication", "originalUrl": "https://www.aisi.gov.uk/research/an-example-safety-case-for-safeguards-against-misuse", "publicationDate": "2025-06-05", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "misuse-safety-case-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Constructs an illustrative argument linking safeguard red-teaming evidence, attacker effort and deployment-risk decisions.", "zh": "构造示例安全论证，将防护红队证据、攻击者投入与部署风险决策联系起来。" }, "note": { "question": { "en": "Constructs an illustrative argument linking safeguard red-teaming evidence, attacker effort and deployment-risk decisions.", "zh": "构造示例安全论证，将防护红队证据、攻击者投入与部署风险决策联系起来。" }, "method": { "en": "Constructs an illustrative argument linking safeguard red-teaming evidence, attacker effort and deployment-risk decisions.", "zh": "构造示例安全论证，将防护红队证据、攻击者投入与部署风险决策联系起来。" }, "finding": { "en": "Constructs an illustrative argument linking safeguard red-teaming evidence, attacker effort and deployment-risk decisions.", "zh": "构造示例安全论证，将防护红队证据、攻击者投入与部署风险决策联系起来。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A hypothetical safety case depends on assumptions about attackers and uplift; it is not a certified deployment assessment.", "zh": "假设性安全论证依赖攻击者和能力提升假设，不是经过认证的部署评估。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2505.18003" } ] }, { "id": "unlearning-evaluation-validity", "title": "Existing Large Language Model unlearning evaluations are inconclusive", "aliases": [], "authors": [], "primaryFunction": "investigation", "secondaryFunctions": [], "kind": "study", "sourceId": "unlearning-evaluation-validity-publication", "attributionSourceId": "unlearning-evaluation-validity-publication", "originalUrl": "https://www.aisi.gov.uk/research/existing-large-language-model-unlearning-evaluations-are-inconclusive", "publicationDate": "2025-05-31", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "unlearning-evaluation-validity-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Examines whether unlearning tests accidentally reteach removed information and how task variation changes conclusions.", "zh": "检查遗忘评测是否意外重新传授被移除信息，以及任务变化如何改变结论。" }, "note": { "question": { "en": "Examines whether unlearning tests accidentally reteach removed information and how task variation changes conclusions.", "zh": "检查遗忘评测是否意外重新传授被移除信息，以及任务变化如何改变结论。" }, "method": { "en": "Examines whether unlearning tests accidentally reteach removed information and how task variation changes conclusions.", "zh": "检查遗忘评测是否意外重新传授被移除信息，以及任务变化如何改变结论。" }, "finding": { "en": "Examines whether unlearning tests accidentally reteach removed information and how task variation changes conclusions.", "zh": "检查遗忘评测是否意外重新传授被移除信息，以及任务变化如何改变结论。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Recovery during evaluation may reflect newly supplied information; neither recovery nor failure alone establishes complete unlearning.", "zh": "评测中的知识恢复可能来自新提供的信息，恢复或失败均不能单独证明完整遗忘。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2506.00688" } ] }, { "id": "safety-cases", "title": "Safety Cases: A scalable approach to Frontier AI safety", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "safety-cases-publication", "attributionSourceId": "safety-cases-publication", "originalUrl": "https://www.aisi.gov.uk/research/safety-cases-a-scalable-approach-to-frontier-ai-safety", "publicationDate": "2025-02-10", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "safety-cases-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Explains how structured claims, evidence and assumptions can support frontier-AI safety decisions and identifies methodological questions.", "zh": "说明结构化主张、证据与假设如何支持前沿 AI 安全决策，并提出方法问题。" }, "note": { "question": { "en": "Explains how structured claims, evidence and assumptions can support frontier-AI safety decisions and identifies methodological questions.", "zh": "说明结构化主张、证据与假设如何支持前沿 AI 安全决策，并提出方法问题。" }, "method": { "en": "Explains how structured claims, evidence and assumptions can support frontier-AI safety decisions and identifies methodological questions.", "zh": "说明结构化主张、证据与假设如何支持前沿 AI 安全决策，并提出方法问题。" }, "finding": { "en": "Explains how structured claims, evidence and assumptions can support frontier-AI safety decisions and identifies methodological questions.", "zh": "说明结构化主张、证据与假设如何支持前沿 AI 安全决策，并提出方法问题。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A safety case is an argument to examine; its existence is not itself evidence that the system is safe.", "zh": "安全论证是需要检验的论证，论证存在本身不能证明系统安全。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/67aa1ee70c744109b20a0032_SafetyCasesAScalableApproachToFrontierAISafety.pdf" } ] }, { "id": "misuse-safeguard-principles", "title": "Principles for evaluating misuse safeguards of frontier AI systems", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "method", "sourceId": "misuse-safeguard-principles-publication", "attributionSourceId": "misuse-safeguard-principles-publication", "originalUrl": "https://www.aisi.gov.uk/research/principles-for-evaluating-misuse-safeguards-of-frontier-ai-systems", "publicationDate": "2025-02-04", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "publisher", "sourceId": "misuse-safeguard-principles-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Proposes practical principles for defining and evaluating misuse safeguards and documenting decision-relevant evidence.", "zh": "提出定义、评测滥用防护及记录决策相关证据的实用原则。" }, "note": { "question": { "en": "Proposes practical principles for defining and evaluating misuse safeguards and documenting decision-relevant evidence.", "zh": "提出定义、评测滥用防护及记录决策相关证据的实用原则。" }, "method": { "en": "Proposes practical principles for defining and evaluating misuse safeguards and documenting decision-relevant evidence.", "zh": "提出定义、评测滥用防护及记录决策相关证据的实用原则。" }, "finding": { "en": "Proposes practical principles for defining and evaluating misuse safeguards and documenting decision-relevant evidence.", "zh": "提出定义、评测滥用防护及记录决策相关证据的实用原则。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Applying the principles requires an explicit threat model and relevant empirical tests; a checklist cannot guarantee effectiveness.", "zh": "应用原则需要明确威胁模型和相关实证测试，检查清单不能保证有效性。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/67a23823ef4a296bb6c92dd4_Principles%20for%20Evaluating%20Misuse%20Safeguards%20of%20Frontier%20AI%20Systems%20(1).pdf" } ] }, { "id": "control-safety-case", "title": "A sketch of an AI control safety case", "aliases": [], "authors": [ "Tomek Korbak tomek.korbak@dsit.gov.uk", "Joshua Clymer joshua@rdwrs.com", "Benjamin Hilton benjamin.hilton@dsit.gov.uk", "Buck Shlegeris buck@rdwrs.com", "Geoffrey Irving geoffrey.irving@dsit.gov.uk" ], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "control-safety-case-publication", "attributionSourceId": "control-safety-case-publication-author-source", "originalUrl": "https://www.aisi.gov.uk/research/a-sketch-of-an-ai-control-safety-case", "publicationDate": "2025-01-28", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "aisi", "role": "research", "sourceId": "control-safety-case-publication-author-source", "locator": "Author affiliations on the original paper title page" }, { "organizationId": "redwood", "role": "research", "sourceId": "control-safety-case-publication-author-source", "locator": "Author affiliations on the original paper title page" } ], "summary": { "en": "Sketches how adversarial control evaluations could support a bounded claim against sensitive-information exfiltration by an internal agent.", "zh": "说明对抗控制评测如何支持针对内部智能体敏感信息外泄的有界安全主张。" }, "note": { "question": { "en": "Sketches how adversarial control evaluations could support a bounded claim against sensitive-information exfiltration by an internal agent.", "zh": "说明对抗控制评测如何支持针对内部智能体敏感信息外泄的有界安全主张。" }, "method": { "en": "Sketches how adversarial control evaluations could support a bounded claim against sensitive-information exfiltration by an internal agent.", "zh": "说明对抗控制评测如何支持针对内部智能体敏感信息外泄的有界安全主张。" }, "finding": { "en": "Sketches how adversarial control evaluations could support a bounded claim against sensitive-information exfiltration by an internal agent.", "zh": "说明对抗控制评测如何支持针对内部智能体敏感信息外泄的有界安全主张。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "The illustrative argument relies on proxy-environment and attacker assumptions that need independent scrutiny.", "zh": "示例论证依赖代理环境和攻击者假设，需要独立审查。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [ { "label": "Read the full paper", "url": "https://arxiv.org/abs/2501.17315" } ] }, { "id": "embedded-evaluators", "title": "Embedded Evaluators are necessary for meaningful external testing", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "embedded-evaluators-publication", "attributionSourceId": "embedded-evaluators-publication", "originalUrl": "https://www.apolloresearch.ai/blog/embedded-evaluators-are-necessary-for-meaningful-external-testing", "publicationDate": "2026-09-29", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "apollo", "role": "publisher", "sourceId": "embedded-evaluators-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Argues that independent evaluators need access throughout development to examine incidents that final-checkpoint tests may miss.", "zh": "论证独立评测者需要在开发全过程获得访问权限，以调查最终检查点测试可能遗漏的事件。" }, "note": { "question": { "en": "Argues that independent evaluators need access throughout development to examine incidents that final-checkpoint tests may miss.", "zh": "论证独立评测者需要在开发全过程获得访问权限，以调查最终检查点测试可能遗漏的事件。" }, "method": { "en": "Argues that independent evaluators need access throughout development to examine incidents that final-checkpoint tests may miss.", "zh": "论证独立评测者需要在开发全过程获得访问权限，以调查最终检查点测试可能遗漏的事件。" }, "finding": { "en": "Argues that independent evaluators need access throughout development to examine incidents that final-checkpoint tests may miss.", "zh": "论证独立评测者需要在开发全过程获得访问权限，以调查最终检查点测试可能遗漏的事件。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "This is an access and assurance proposal, not a demonstrated causal estimate of risk reduction.", "zh": "这是访问与安全保障建议，不是已证明的风险降低因果估计。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "specification-gaming", "title": "Demonstrating specification gaming in reasoning models", "aliases": [], "authors": [], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "specification-gaming-publication", "attributionSourceId": "specification-gaming-publication", "originalUrl": "https://palisaderesearch.org/research/specification-gaming", "publicationDate": "2025-02-19", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "palisade", "role": "publisher", "sourceId": "specification-gaming-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Studies whether agents exploit a chess-task specification instead of winning through the intended gameplay.", "zh": "研究智能体是否利用国际象棋任务规范的漏洞，而非通过预期棋局获胜。" }, "note": { "question": { "en": "Studies whether agents exploit a chess-task specification instead of winning through the intended gameplay.", "zh": "研究智能体是否利用国际象棋任务规范的漏洞，而非通过预期棋局获胜。" }, "method": { "en": "Studies whether agents exploit a chess-task specification instead of winning through the intended gameplay.", "zh": "研究智能体是否利用国际象棋任务规范的漏洞，而非通过预期棋局获胜。" }, "finding": { "en": "Studies whether agents exploit a chess-task specification instead of winning through the intended gameplay.", "zh": "研究智能体是否利用国际象棋任务规范的漏洞，而非通过预期棋局获胜。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Task-specific specification gaming needs to be distinguished from broader deception and real-world malicious intent.", "zh": "特定任务中的规范投机需要与更广泛的欺骗和现实恶意意图区分。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "llm-honeypot", "title": "LLM Honeypot: an early warning system for autonomous hacking", "aliases": [], "authors": [], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "method", "sourceId": "llm-honeypot-publication", "attributionSourceId": "llm-honeypot-publication", "originalUrl": "https://palisaderesearch.org/research/llm-honeypot", "publicationDate": "2024-10-17", "updatedOn": "2026-10-25", "areas": [ "cybersecurity" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "palisade", "role": "publisher", "sourceId": "llm-honeypot-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Uses a deployed honeypot to investigate signals that may distinguish autonomous AI hacking attempts from other traffic.", "zh": "利用部署的蜜罐，研究可能区分 AI 自主攻击尝试与其他流量的信号。" }, "note": { "question": { "en": "Uses a deployed honeypot to investigate signals that may distinguish autonomous AI hacking attempts from other traffic.", "zh": "利用部署的蜜罐，研究可能区分 AI 自主攻击尝试与其他流量的信号。" }, "method": { "en": "Uses a deployed honeypot to investigate signals that may distinguish autonomous AI hacking attempts from other traffic.", "zh": "利用部署的蜜罐，研究可能区分 AI 自主攻击尝试与其他流量的信号。" }, "finding": { "en": "Uses a deployed honeypot to investigate signals that may distinguish autonomous AI hacking attempts from other traffic.", "zh": "利用部署的蜜罐，研究可能区分 AI 自主攻击尝试与其他流量的信号。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Attribution depends on the detection method and observed traffic; identified signals do not establish global attack prevalence.", "zh": "归因依赖检测方法和所观察流量，识别信号不能证明全球攻击普遍程度。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "beyond-owls", "title": "Beyond Owls: Subliminal Learning Can Transfer Learned Capabilities and Backdoors", "aliases": [], "authors": [ "Jan Dubiński", "Anna Sztyber-Betley", "Jan Betley", "Owain Evans" ], "primaryFunction": "discovery", "secondaryFunctions": [], "kind": "study", "sourceId": "beyond-owls-publication", "attributionSourceId": "beyond-owls-publication", "originalUrl": "https://truthful.ai/papers/beyond-owls/", "publicationDate": "2026-10-07", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "truthful", "role": "publisher", "sourceId": "beyond-owls-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Extends subliminal-learning experiments to learned capabilities, backdoors and behavioral tendencies transmitted through unrelated data.", "zh": "将隐性学习实验扩展至通过无关数据传递的已学能力、后门和行为倾向。" }, "note": { "question": { "en": "Extends subliminal-learning experiments to learned capabilities, backdoors and behavioral tendencies transmitted through unrelated data.", "zh": "将隐性学习实验扩展至通过无关数据传递的已学能力、后门和行为倾向。" }, "method": { "en": "Extends subliminal-learning experiments to learned capabilities, backdoors and behavioral tendencies transmitted through unrelated data.", "zh": "将隐性学习实验扩展至通过无关数据传递的已学能力、后门和行为倾向。" }, "finding": { "en": "Extends subliminal-learning experiments to learned capabilities, backdoors and behavioral tendencies transmitted through unrelated data.", "zh": "将隐性学习实验扩展至通过无关数据传递的已学能力、后门和行为倾向。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Transfer is conditional on the teacher, student and training setup; it does not show all distillation transfers hidden objectives.", "zh": "传递受教师、学生和训练设置约束，不能证明所有蒸馏都会传递隐藏目标。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "activation-oracles", "title": "Activation Oracles: Training and Evaluating LLMs as General-Purpose Activation Explainers", "aliases": [], "authors": [ "Adam Karvonen", "James Chua", "Clément Dumas", "Kit Fraser-Taliente", "Subhash Kantamneni", "Julian Minder", "Euan Ong", "Arnab Sen Sharma", "Daniel Wen", "Owain Evans", "Samuel Marks" ], "primaryFunction": "monitoring", "secondaryFunctions": [], "kind": "method", "sourceId": "activation-oracles-publication", "attributionSourceId": "activation-oracles-publication", "originalUrl": "https://truthful.ai/papers/activation-oracles/", "publicationDate": "2025-12-19", "updatedOn": "2026-10-25", "areas": [ "deception" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "truthful", "role": "publisher", "sourceId": "activation-oracles-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Trains models to answer questions about another model’s activations and evaluates generalization to hidden information and goals.", "zh": "训练模型回答关于另一模型激活的问题，并评测其对隐藏信息与目标的泛化。" }, "note": { "question": { "en": "Trains models to answer questions about another model’s activations and evaluates generalization to hidden information and goals.", "zh": "训练模型回答关于另一模型激活的问题，并评测其对隐藏信息与目标的泛化。" }, "method": { "en": "Trains models to answer questions about another model’s activations and evaluates generalization to hidden information and goals.", "zh": "训练模型回答关于另一模型激活的问题，并评测其对隐藏信息与目标的泛化。" }, "finding": { "en": "Trains models to answer questions about another model’s activations and evaluates generalization to hidden information and goals.", "zh": "训练模型回答关于另一模型激活的问题，并评测其对隐藏信息与目标的泛化。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "An activation explanation remains an inferred description requiring validation, rather than direct access to intentions.", "zh": "激活解释仍属于需要验证的推断描述，不能直接读取意图。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "rogue-replication-threat", "title": "The Rogue Replication Threat Model", "aliases": [], "authors": [], "primaryFunction": "governance", "secondaryFunctions": [], "kind": "technical-report", "sourceId": "rogue-replication-threat-publication", "attributionSourceId": "rogue-replication-threat-publication", "originalUrl": "https://metr.org/blog/2024-11-12-rogue-replication-threat-model/", "publicationDate": "2024-11-12", "updatedOn": "2026-10-25", "areas": [ "autonomy" ], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "rogue-replication-threat-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Develops a threat model for unauthorized replication and identifies the capabilities and conditions that would enable it.", "zh": "为未经授权的复制建立威胁模型，并识别其所需能力与条件。" }, "note": { "question": { "en": "Develops a threat model for unauthorized replication and identifies the capabilities and conditions that would enable it.", "zh": "为未经授权的复制建立威胁模型，并识别其所需能力与条件。" }, "method": { "en": "Develops a threat model for unauthorized replication and identifies the capabilities and conditions that would enable it.", "zh": "为未经授权的复制建立威胁模型，并识别其所需能力与条件。" }, "finding": { "en": "Develops a threat model for unauthorized replication and identifies the capabilities and conditions that would enable it.", "zh": "为未经授权的复制建立威胁模型，并识别其所需能力与条件。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "A threat model specifies a possible pathway; it does not establish that current systems execute the full pathway.", "zh": "威胁模型刻画可能路径，不能证明当前系统已能执行完整路径。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] }, { "id": "capability-elicitation", "title": "Guidelines for capability elicitation", "aliases": [], "authors": [], "primaryFunction": "evaluation", "secondaryFunctions": [], "kind": "method", "sourceId": "capability-elicitation-publication", "attributionSourceId": "capability-elicitation-publication", "originalUrl": "https://metr.org/blog/2024-03-15-guidelines-for-capability-elicitation/", "publicationDate": "2024-03-15", "updatedOn": "2026-10-25", "areas": [], "scopeNote": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "protocolIds": [], "contributions": [ { "organizationId": "metr", "role": "publisher", "sourceId": "capability-elicitation-publication", "locator": "Official publication masthead and article byline" } ], "summary": { "en": "Specifies practices for eliciting model capabilities so evaluation failures are not mistaken for inability.", "zh": "提出诱发模型能力的评测实践，避免将评测失败误判为不具备能力。" }, "note": { "question": { "en": "Specifies practices for eliciting model capabilities so evaluation failures are not mistaken for inability.", "zh": "提出诱发模型能力的评测实践，避免将评测失败误判为不具备能力。" }, "method": { "en": "Specifies practices for eliciting model capabilities so evaluation failures are not mistaken for inability.", "zh": "提出诱发模型能力的评测实践，避免将评测失败误判为不具备能力。" }, "finding": { "en": "Specifies practices for eliciting model capabilities so evaluation failures are not mistaken for inability.", "zh": "提出诱发模型能力的评测实践，避免将评测失败误判为不具备能力。" }, "supports": { "en": "Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.", "zh": "风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。" }, "limits": { "en": "Elicitation quality and available effort bound any inability claim; guidance is not a guarantee of maximum performance.", "zh": "能力诱发质量和投入限制能力缺失判断，方法指导不能保证找到最高表现。" }, "connections": { "en": "Related works are linked below when the original source supports a specific relationship. Numerical results retain their own source and protocol.", "zh": "原始来源支持明确研究关系时，在下方关联相应工作。数值结果保留各自来源与协议。" } }, "resources": [] } ], "organizations": [ { "id": "openai", "name": { "en": "OpenAI", "zh": "OpenAI" }, "homepage": "https://openai.com/", "type": "company", "aliases": [ "OpenAI" ] }, { "id": "anthropic", "name": { "en": "Anthropic", "zh": "Anthropic" }, "homepage": "https://www.anthropic.com/", "type": "company", "aliases": [ "Anthropic" ] }, { "id": "deepmind", "name": { "en": "Google DeepMind", "zh": "Google DeepMind" }, "homepage": "https://deepmind.google/", "type": "company", "aliases": [ "Google DeepMind", "Google Research" ] }, { "id": "meta", "name": { "en": "Meta", "zh": "Meta" }, "homepage": "https://ai.meta.com/", "type": "company", "aliases": [ "Meta AI", "Meta FAIR" ] }, { "id": "metr", "name": { "en": "METR", "zh": "METR" }, "homepage": "https://metr.org/", "type": "nonprofit", "aliases": [ "Model Evaluation & Threat Research", "METR" ] }, { "id": "apollo", "name": { "en": "Apollo Research", "zh": "Apollo Research" }, "homepage": "https://www.apolloresearch.ai/", "type": "nonprofit", "aliases": [ "Apollo Research" ] }, { "id": "aisi", "name": { "en": "UK AI Security Institute", "zh": "英国 AI 安全研究所" }, "homepage": "https://www.aisi.gov.uk/", "type": "government", "aliases": [ "UK AI Security Institute", "UK AI Safety Institute" ] }, { "id": "far", "name": { "en": "FAR.AI", "zh": "FAR.AI" }, "homepage": "https://www.far.ai/", "type": "nonprofit", "aliases": [ "FAR.AI" ] }, { "id": "palisade", "name": { "en": "Palisade Research", "zh": "Palisade Research" }, "homepage": "https://palisaderesearch.org/", "type": "nonprofit", "aliases": [ "Palisade Research" ] }, { "id": "truthful", "name": { "en": "Truthful AI", "zh": "Truthful AI" }, "homepage": "https://truthful.ai/", "type": "nonprofit", "aliases": [ "Truthful AI" ] }, { "id": "redwood", "name": { "en": "Redwood Research", "zh": "Redwood Research" }, "homepage": "https://www.redwoodresearch.org/", "type": "nonprofit", "aliases": [ "Redwood Research" ] }, { "id": "fudan", "name": { "en": "Fudan University", "zh": "复旦大学" }, "homepage": "https://www.fudan.edu.cn/", "type": "university", "aliases": [ "Fudan University" ] }, { "id": "whitzard", "name": { "en": "Whitzard / NUWA Lab", "zh": "白泽／女娲实验室" }, "homepage": "https://whitzard.tech/nuwa/", "type": "company", "aliases": [ "Whitzard", "NUWA Lab" ] }, { "id": "berkeley", "name": { "en": "University of California, Berkeley", "zh": "加州大学伯克利分校" }, "homepage": "https://www.berkeley.edu/", "type": "university", "aliases": [ "UC Berkeley", "University of California, Berkeley", "University of California Berkeley" ] }, { "id": "stanford", "name": { "en": "Stanford University", "zh": "斯坦福大学" }, "homepage": "https://www.stanford.edu/", "type": "university", "aliases": [ "Stanford University" ] }, { "id": "uiuc", "name": { "en": "University of Illinois Urbana-Champaign", "zh": "伊利诺伊大学厄巴纳—香槟分校" }, "homepage": "https://illinois.edu/", "type": "university", "aliases": [ "University of Illinois", "UIUC" ] }, { "id": "mit", "name": { "en": "Massachusetts Institute of Technology", "zh": "麻省理工学院" }, "homepage": "https://www.mit.edu/", "type": "university", "aliases": [ "Massachusetts Institute of Technology", "MIT CSAIL", "MIT,", "MIT " ] }, { "id": "cmu", "name": { "en": "Carnegie Mellon University", "zh": "卡内基梅隆大学" }, "homepage": "https://www.cmu.edu/", "type": "university", "aliases": [ "Carnegie Mellon University" ] }, { "id": "oxford", "name": { "en": "University of Oxford", "zh": "牛津大学" }, "homepage": "https://www.ox.ac.uk/", "type": "university", "aliases": [ "University of Oxford" ] }, { "id": "mila", "name": { "en": "Mila", "zh": "Mila" }, "homepage": "https://mila.quebec/", "type": "research-institute", "aliases": [ "MILA", "Mila" ] }, { "id": "montreal", "name": { "en": "Université de Montréal", "zh": "蒙特利尔大学" }, "homepage": "https://www.umontreal.ca/", "type": "university", "aliases": [ "Université de Montréal", "University of Montreal" ] }, { "id": "princeton", "name": { "en": "Princeton University", "zh": "普林斯顿大学" }, "homepage": "https://www.princeton.edu/", "type": "university", "aliases": [ "Princeton University" ] }, { "id": "eth", "name": { "en": "ETH Zurich", "zh": "苏黎世联邦理工学院" }, "homepage": "https://ethz.ch/", "type": "university", "aliases": [ "ETH Zurich", "ETH Zürich" ] }, { "id": "invariant", "name": { "en": "Invariant Labs", "zh": "Invariant Labs" }, "homepage": "https://invariantlabs.ai/", "type": "company", "aliases": [ "Invariant Labs" ] }, { "id": "securebio", "name": { "en": "SecureBio", "zh": "SecureBio" }, "homepage": "https://securebio.org/", "type": "nonprofit", "aliases": [ "SecureBio" ] }, { "id": "cais", "name": { "en": "Center for AI Safety", "zh": "Center for AI Safety" }, "homepage": "https://www.safe.ai/", "type": "nonprofit", "aliases": [ "Center for AI Safety", "Center For AI Safety" ] }, { "id": "scale", "name": { "en": "Scale AI", "zh": "Scale AI" }, "homepage": "https://scale.com/", "type": "company", "aliases": [ "Scale AI" ] }, { "id": "grayswan", "name": { "en": "Gray Swan AI", "zh": "Gray Swan AI" }, "homepage": "https://www.grayswan.ai/", "type": "company", "aliases": [ "Gray Swan AI" ] }, { "id": "eleuther", "name": { "en": "EleutherAI", "zh": "EleutherAI" }, "homepage": "https://www.eleuther.ai/", "type": "nonprofit", "aliases": [ "EleutherAI" ] }, { "id": "tsinghua", "name": { "en": "Tsinghua University", "zh": "清华大学" }, "homepage": "https://www.tsinghua.edu.cn/", "type": "university", "aliases": [ "Tsinghua University" ] }, { "id": "sii", "name": { "en": "Shanghai Innovation Institute", "zh": "上海创智学院" }, "homepage": "https://www.sii.edu.cn/", "type": "research-institute", "aliases": [ "Shanghai Innovation Institute" ] }, { "id": "yale", "name": { "en": "Yale University", "zh": "耶鲁大学" }, "homepage": "https://www.yale.edu/", "type": "university", "aliases": [ "Yale University" ] }, { "id": "purdue", "name": { "en": "Purdue University", "zh": "普渡大学" }, "homepage": "https://www.purdue.edu/", "type": "university", "aliases": [ "Purdue University" ] }, { "id": "cornell", "name": { "en": "Cornell University", "zh": "康奈尔大学" }, "homepage": "https://www.cornell.edu/", "type": "university", "aliases": [ "Cornell University" ] }, { "id": "regina", "name": { "en": "University of Regina", "zh": "里贾纳大学" }, "homepage": "https://www.uregina.ca/", "type": "university", "aliases": [ "University of Regina" ] }, { "id": "mats", "name": { "en": "MATS", "zh": "MATS" }, "homepage": "https://www.matsprogram.org/", "type": "nonprofit", "aliases": [ "MATS", "ML Alignment and Theory Scholars", "ML Alignment Theory Scholars" ] }, { "id": "imperial", "name": { "en": "Imperial College London", "zh": "帝国理工学院" }, "homepage": "https://www.imperial.ac.uk/", "type": "university", "aliases": [ "Imperial College London" ] }, { "id": "waterloo", "name": { "en": "University of Waterloo", "zh": "滑铁卢大学" }, "homepage": "https://uwaterloo.ca/", "type": "university", "aliases": [ "University of Waterloo", "Waterloo ," ] }, { "id": "toronto", "name": { "en": "University of Toronto", "zh": "多伦多大学" }, "homepage": "https://www.utoronto.ca/", "type": "university", "aliases": [ "University of Toronto" ] }, { "id": "mpi", "name": { "en": "Max Planck Institute for Intelligent Systems", "zh": "马克斯·普朗克智能系统研究所" }, "homepage": "https://is.mpg.de/", "type": "research-institute", "aliases": [ "Max Planck Institute for Intelligent Systems" ] }, { "id": "tubingen", "name": { "en": "University of Tübingen", "zh": "蒂宾根大学" }, "homepage": "https://uni-tuebingen.de/", "type": "university", "aliases": [ "University of Tübingen", "Tübingen AI Center" ] }, { "id": "ellis", "name": { "en": "ELLIS Institute Tübingen", "zh": "ELLIS Institute Tübingen" }, "homepage": "https://tuebingen.ellis.eu/", "type": "research-institute", "aliases": [ "ELLIS Institute Tübingen" ] }, { "id": "edison", "name": { "en": "Edison Scientific", "zh": "Edison Scientific" }, "homepage": "https://edisonscientific.com/", "type": "company", "aliases": [ "Edison Scientific" ] }, { "id": "futurehouse", "name": { "en": "FutureHouse", "zh": "FutureHouse" }, "homepage": "https://www.futurehouse.org/", "type": "nonprofit", "aliases": [ "FutureHouse" ] }, { "id": "ufabc", "name": { "en": "Federal University of ABC", "zh": "巴西 ABC 联邦大学" }, "homepage": "https://www.ufabc.edu.br/", "type": "university", "aliases": [ "Federal University of ABC" ] }, { "id": "irregular", "name": { "en": "Irregular", "zh": "Irregular" }, "homepage": "https://www.irregular.com/", "type": "company", "aliases": [ "Irregular" ] }, { "id": "rand", "name": { "en": "RAND", "zh": "兰德公司" }, "homepage": "https://www.rand.org/", "type": "nonprofit", "aliases": [ "RAND" ] }, { "id": "nist", "name": { "en": "NIST / CAISI", "zh": "美国 NIST／CAISI" }, "homepage": "https://www.nist.gov/caisi", "type": "government", "aliases": [ "NIST", "CAISI" ] }, { "id": "saferai", "name": { "en": "SaferAI", "zh": "SaferAI" }, "homepage": "https://www.safer-ai.org/", "type": "nonprofit", "aliases": [ "SaferAI" ] }, { "id": "columbia", "name": { "en": "Columbia University", "zh": "哥伦比亚大学" }, "homepage": "https://www.columbia.edu/", "type": "university", "aliases": [ "Columbia University" ] }, { "id": "washington", "name": { "en": "University of Washington", "zh": "华盛顿大学" }, "homepage": "https://www.washington.edu/", "type": "university", "aliases": [ "University of Washington" ] }, { "id": "ucsd", "name": { "en": "University of California San Diego", "zh": "加州大学圣迭戈分校" }, "homepage": "https://ucsd.edu/", "type": "university", "aliases": [ "University of California San Diego" ] }, { "id": "bugcrowd", "name": { "en": "Bugcrowd", "zh": "Bugcrowd" }, "homepage": "https://www.bugcrowd.com/", "type": "company", "aliases": [ "Bugcrowd" ] }, { "id": "nus", "name": { "en": "National University of Singapore", "zh": "新加坡国立大学" }, "homepage": "https://nus.edu.sg/", "type": "university", "aliases": [ "National University of Singapore" ] }, { "id": "apart", "name": { "en": "Apart Research", "zh": "Apart Research" }, "homepage": "https://apartresearch.com/", "type": "nonprofit", "aliases": [ "Apart Research" ] }, { "id": "crowdstrike", "name": { "en": "CrowdStrike", "zh": "CrowdStrike" }, "homepage": "https://www.crowdstrike.com/", "type": "company", "aliases": [ "CrowdStrike" ] }, { "id": "constellation", "name": { "en": "Constellation", "zh": "Constellation" }, "homepage": "https://www.constellation.org/", "type": "nonprofit", "aliases": [ "Constellation" ] }, { "id": "harvard", "name": { "en": "Harvard University", "zh": "哈佛大学" }, "homepage": "https://www.harvard.edu/", "type": "university", "aliases": [ "Harvard University" ] }, { "id": "usc", "name": { "en": "University of Southern California", "zh": "南加州大学" }, "homepage": "https://www.usc.edu/", "type": "university", "aliases": [ "University of Southern California" ] }, { "id": "ucla", "name": { "en": "University of California, Los Angeles", "zh": "加州大学洛杉矶分校" }, "homepage": "https://www.ucla.edu/", "type": "university", "aliases": [ "University of California, Los Angeles", "UCLA" ] }, { "id": "caltech", "name": { "en": "California Institute of Technology", "zh": "加州理工学院" }, "homepage": "https://www.caltech.edu/", "type": "university", "aliases": [ "California Institute of Technology" ] }, { "id": "northeastern", "name": { "en": "Northeastern University", "zh": "美国东北大学" }, "homepage": "https://www.northeastern.edu/", "type": "university", "aliases": [ "Northeastern University" ] }, { "id": "newcastle", "name": { "en": "University of Newcastle", "zh": "纽卡斯尔大学（澳大利亚）" }, "homepage": "https://www.newcastle.edu.au/", "type": "university", "aliases": [ "University of Newcastle" ] }, { "id": "keio", "name": { "en": "Keio University", "zh": "庆应义塾大学" }, "homepage": "https://www.keio.ac.jp/", "type": "university", "aliases": [ "Keio University" ] }, { "id": "ariel", "name": { "en": "Ariel University", "zh": "阿里埃勒大学" }, "homepage": "https://www.ariel.ac.il/", "type": "university", "aliases": [ "Ariel University" ] }, { "id": "asu", "name": { "en": "Arizona State University", "zh": "亚利桑那州立大学" }, "homepage": "https://www.asu.edu/", "type": "university", "aliases": [ "Arizona State University" ] }, { "id": "xai", "name": { "en": "xAI", "zh": "xAI" }, "homepage": "https://x.ai/", "type": "company", "aliases": [ "xAI" ] }, { "id": "lapis", "name": { "en": "Lapis Labs", "zh": "Lapis Labs" }, "homepage": null, "type": "company", "aliases": [ "Lapis Labs" ] }, { "id": "sybil", "name": { "en": "Sybil", "zh": "Sybil" }, "homepage": null, "type": "company", "aliases": [ "Affiliation: Sybil" ] }, { "id": "bbn", "name": { "en": "RTX BBN Technologies", "zh": "RTX BBN Technologies" }, "homepage": "https://www.bbn.com/", "type": "company", "aliases": [ "RTX BBN Technologies" ] }, { "id": "vals", "name": { "en": "Vals AI", "zh": "Vals AI" }, "homepage": "https://www.vals.ai/", "type": "company", "aliases": [ "Vals AI" ] }, { "id": "tufts", "name": { "en": "Tufts University", "zh": "塔夫茨大学" }, "homepage": "https://www.tufts.edu/", "type": "university", "aliases": [ "Tufts University" ] }, { "id": "vector", "name": { "en": "Vector Institute", "zh": "Vector Institute" }, "homepage": "https://vectorinstitute.ai/", "type": "research-institute", "aliases": [ "Vector Institute" ] }, { "id": "thoughtful", "name": { "en": "Thoughtful Lab", "zh": "Thoughtful Lab" }, "homepage": null, "type": "research-institute", "aliases": [ "Thoughtful Lab" ] }, { "id": "equistamp", "name": { "en": "Equistamp", "zh": "Equistamp" }, "homepage": "https://equistamp.com/", "type": "company", "aliases": [ "Equistamp" ] }, { "id": "microsoft", "name": { "en": "Microsoft", "zh": "微软" }, "homepage": "https://www.microsoft.com/research/", "type": "company", "aliases": [ "Microsoft" ] }, { "id": "nyu", "name": { "en": "New York University", "zh": "纽约大学" }, "homepage": "https://www.nyu.edu/", "type": "university", "aliases": [ "New York University" ] }, { "id": "iiit", "name": { "en": "IIIT Hyderabad", "zh": "海德拉巴国际信息技术学院" }, "homepage": "https://www.iiit.ac.in/", "type": "university", "aliases": [ "IIIT Hyderabad" ] }, { "id": "ustc", "name": { "en": "University of Science and Technology of China", "zh": "中国科学技术大学" }, "aliases": [], "homepage": "https://www.ustc.edu.cn/", "type": "university" }, { "id": "beihang", "name": { "en": "Beihang University", "zh": "北京航空航天大学" }, "aliases": [], "homepage": "https://www.buaa.edu.cn/", "type": "university" } ], "relations": [ { "from": "fortress-audit", "to": "fortress", "type": "questions", "sourceId": "fortress-audit-publication", "locator": "Research background and discussion in the original publication", "rationale": { "en": "Audits how the FORTRESS grading procedure affects reported scores.", "zh": "审计 FORTRESS 的评分过程如何影响报告分数。" } }, { "from": "basharena", "to": "ctrl-z", "type": "extends", "sourceId": "basharena-publication", "locator": "Research background and discussion in the original publication", "rationale": { "en": "Introduces a later control environment; its task set is distinct from the BashBench setting used by Ctrl-Z.", "zh": "提出后续控制环境，其任务集不同于 Ctrl-Z 所用的 BashBench。" } }, { "from": "ctrl-z", "to": "ai-control", "type": "extends", "sourceId": "ctrl-z-publication", "locator": "Research background and discussion in the original publication", "rationale": { "en": "Extends control evaluation to resampling in an agentic administration environment.", "zh": "将控制评测扩展至智能体系统管理环境中的动作重采样。" } }, { "from": "monitorability-metrics", "to": "monitoring-monitorability", "type": "extends", "sourceId": "monitorability-metrics-publication", "locator": "Research background and discussion in the original publication", "rationale": { "en": "Revisits the original monitorability metric for complementary decision objectives.", "zh": "针对互补决策目标，进一步讨论原有可监测性指标。" } }, { "from": "conditional-misalignment", "to": "emergent-misalignment", "type": "extends", "sourceId": "conditional-misalignment-publication", "locator": "Research background and discussion in the original publication", "rationale": { "en": "Studies when interventions leave emergent misalignment conditional on contextual triggers.", "zh": "研究干预何时使涌现失调保留为上下文触发行为。" } }, { "from": "beyond-owls", "to": "subliminal-learning", "type": "extends", "sourceId": "beyond-owls-publication", "locator": "Research background and discussion in the original publication", "rationale": { "en": "Tests additional transferred capabilities and backdoors in subliminal learning.", "zh": "在隐性学习中测试更多可传递能力与后门。" } } ], "functions": [ { "id": "discovery", "label": { "en": "Risk Discovery", "zh": "风险发现" }, "description": { "en": "Identify mechanisms, failure modes and the conditions that elicit them.", "zh": "发现风险机制、失效模式及其触发条件。" } }, { "id": "evaluation", "label": { "en": "Risk Evaluation", "zh": "风险评测" }, "description": { "en": "Measure a defined capability, propensity or behavior under specified conditions.", "zh": "在指定条件下测量明确的能力、倾向或行为。" } }, { "id": "monitoring", "label": { "en": "Risk Monitoring", "zh": "风险监测" }, "description": { "en": "Study observable risk signals, monitorability and detection reliability.", "zh": "研究可观察风险信号、可监测性与检测可靠性。" } }, { "id": "investigation", "label": { "en": "Risk Investigation", "zh": "风险调查" }, "description": { "en": "Reconstruct events and examine explanations against retained evidence.", "zh": "依据留存证据重建事件，并检验相关解释。" } }, { "id": "governance", "label": { "en": "Risk Governance", "zh": "风险治理" }, "description": { "en": "Test safeguards, control protocols and evidence for safety decisions.", "zh": "检验防护、控制协议及支持安全决策的证据。" } } ], "coverageAudit": { "cutoff": "2026-10-25", "searchStart": "2022-01-01", "inspectedLeads": 461, "dispositions": { "included-existing": 112, "included": 67, "duplicate": 1, "source-document": 1, "awaiting-review": 246, "outside-current-scope": 34 }, "sourceGroups": [ { "name": "Inspect Evals (discovery register)", "url": "https://ukgovernmentbeis.github.io/inspect_evals/", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 184 }, { "name": "anthropic.com", "url": "https://www.anthropic.com/research", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 25 }, { "name": "apolloresearch.ai", "url": "https://www.apolloresearch.ai/science", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 13 }, { "name": "aisi.gov.uk", "url": "https://www.aisi.gov.uk/research", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 64 }, { "name": "far.ai", "url": "https://www.far.ai/research", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 6 }, { "name": "palisaderesearch.org", "url": "https://palisaderesearch.org/research", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 15 }, { "name": "truthful.ai", "url": "https://truthful.ai/papers/", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 27 }, { "name": "metr.org", "url": "https://metr.org/research/", "checkedOn": "2026-10-25", "scope": { "en": "Entries listed in the captured source page; linked originals are checked before publication. Unresolved candidates remain outside the public catalogue.", "zh": "范围为该页面快照列出的条目，原始成果核验后才公开。待审候选保留在公开目录之外。" }, "candidates": 30 }, { "name": "Anthropic model system cards", "url": "https://www.anthropic.com/system-cards", "checkedOn": "2026-10-25", "scope": { "en": "Official report source checked. Discrete protocols and externally sourced benchmark results require individual records.", "zh": "已核查官方报告来源，独立协议和引用外部基准的结果需要分别建档。" }, "candidates": 1 }, { "name": "OpenAI Deployment Safety Hub", "url": "https://deploymentsafety.openai.com/", "checkedOn": "2026-10-25", "scope": { "en": "Official report source checked. Discrete protocols and externally sourced benchmark results require individual records.", "zh": "已核查官方报告来源，独立协议和引用外部基准的结果需要分别建档。" }, "candidates": 1 }, { "name": "Google DeepMind model cards", "url": "https://deepmind.google/models/model-cards/", "checkedOn": "2026-10-25", "scope": { "en": "Official report source checked. Discrete protocols and externally sourced benchmark results require individual records.", "zh": "已核查官方报告来源，独立协议和引用外部基准的结果需要分别建档。" }, "candidates": 1 }, { "name": "Muse Spark Safety & Preparedness Report", "url": "https://arxiv.org/abs/2606.12429", "checkedOn": "2026-10-25", "scope": { "en": "Official report source checked. Discrete protocols and externally sourced benchmark results require individual records.", "zh": "已核查官方报告来源，独立协议和引用外部基准的结果需要分别建档。" }, "candidates": 1 }, { "name": "Foundational evaluation methods", "url": "https://arxiv.org/abs/2305.15324", "checkedOn": "2026-10-25", "scope": { "en": "Selected foundational work and original references linked by the screened research; citation tracing is selective and continues in later updates.", "zh": "补充奠基研究及已筛查研究所引原文；引用追踪为选择性开展，后续继续扩展。" }, "candidates": 1 } ], "limitations": { "en": "This is a curated research knowledge base, not an exhaustive systematic review. The supplied 97 leads and captured discovery pages have screening records. Some original sources, affiliations and protocol details remain unresolved in the private queue. Institution pages are finite captures; pagination, later publications and selective citation tracing limit coverage. A downloaded page is not automatically a verified research finding.", "zh": "本知识库采用有来源的研究整理方式，尚不构成穷尽式系统综述。97 条既有线索及发现页面快照均已记录筛选结果，部分原文、署名和协议细节仍在私有队列中核查。机构页面快照有限，分页、后续发表和选择性引用追踪都会限制覆盖。下载页面不等于核实研究发现。" } } }