Psychological methods reveal major weaknesses in AI security testing
decoder ·
Researchers, including some from the UK AI Security Institute, analyzed eight safety benchmarks using psychological testing methods across up to 192 models and more than 5,000 questions. They found that a single safety score hides three distinct traits: refusal strictness, truthfulness, and handling of context-dependent content, which are largely unrelated to each other. A key tradeoff exists between benchmarks like HarmBench and OR-Bench-Hard, meaning models can inflate their safety ratings simply by blocking more requests, at the cost of everyday usefulness. Most test questions are redundant, and adaptive tests of only about 10 to 25 questions can match full benchmark results while cutting evaluation costs by 97 to 99 percent. The study also introduced a statistical method to detect "sandbagging," where models act more cautious during tests; it caught 80 to 100 percent of simulated cases, and pairing it with past-performance checks raised detection to 94 to 97 percent. The method also proved able to identify whether an API is secretly running a different model than the one originally tested. The authors argue AI safety tests should meet the same rigorous standards as human psychological tests, noting that a single score is insufficient for release decisions, and that their sandbagging detection was only tested against direct instructions, not specially trained models.
decoder