Wang, Youting, Han, Xiao, Shang, Dingyan, Tang, Yuan, Liu, Bowen · Jul 30, 2026
arXiv cs.AI: Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks
Markdown · JSON · Original source
Youting Wang, Xiao Han, Dingyan Shang, Yuan Tang and Bowen Liu argue that agent-safety scores cannot be treated as interchangeable measures of an agent’s safety. They validate four benchmarks using their official implementations and scorers, and find that scoring choices and small model panels can distort comparisons. For example, on R-Judge, an “always positive” policy scores above five models that actually discriminate. The three broad-coverage benchmarks also rank the same models differently, while a reported trade-off between two measures changes with panel size. The paper’s central point is that validity depends on the outcome being measured: capability predicts task success but is negatively correlated with safety across 21 models. In a separate paired panel of 20 models, the contrast between these relationships is reported as significant. In an expanded panel, the misalignment correlation weakens, and neither change is significant. AgentHarm has the strongest reported held-out association with safety, but both instruments score harmful compliance; the authors therefore describe this as evidence of convergent validity, not general safety. Their practical conclusion is that a safety claim should name the benchmark, metric, target behavior and model panel.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Jul 30, 2026 (2026-07-30).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-10T02:33:13.512Z. First observed: 2026-11-05T05:00:27.965Z. Retrieved: 2026-11-10T02:25:36.188Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The evidence supplied is the paper’s abstract, not its full methods or results; details needed to assess the implementations and analyses are not included here. The reported findings concern four benchmarks and specific model panels; the abstract does not establish how broadly they generalize to other benchmarks, models or target behaviors.
Open question
How well do these relationships hold for other model panels and target behaviors?
Source-stated
The authors argue that scores from different agent-safety benchmarks should not be treated as interchangeable measures of an agent’s safety.
their scores get quoted interchangeably as an agent's safety
Source-stated
On R-Judge, an “always positive” policy scores above five of the 21 models that actually discriminate.
on R-Judge that is $0.690$, above five of the 21 models that actually discriminate.
Source-stated
The three broad-coverage benchmarks rank the same 18 models differently, and the reported relationship between R-Judge specificity and AgentHarm safety changes with panel size.
The three broad-coverage benchmarks then rank the same 18 models differently
Source-stated
In the paired panel, capability predicts task success but correlates negatively with misalignment safety; the misalignment correlation weakens in the expanded panel, and neither change is significant.
On an expanded 41-model panel, the misalignment correlation weakens to $-0.16$ (95% CI $[-0.54, +0.22]$) and jailbreak strengthens to $+0.34$, though neither change is significant.
Source-stated
The authors say AgentHarm’s association with jailbreak safety is evidence of convergent validity rather than general safety, because both instruments score harmful compliance.
But both instruments score harmful compliance, so this is evidence of convergent validity rather than general safety.
Source-stated
The authors conclude that a safety claim should identify the benchmark, metric, target behavior and model panel.
Naming the benchmark, metric, target behavior, and model panel is the minimum a safety claim needs.
Source and contributor context
Wang, Youting, Han, Xiao, Shang, Dingyan, Tang, Yuan, Liu, Bowen · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
AI alignment
Research and practice aimed at making AI systems pursue the goals their builders and users intend.
Jailbreak
A prompt written to trick an AI system into ignoring its safety rules.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 4789de76-1119-46a4-8717-667cc7487964.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T02:33:13.512Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: useful_perspective.
Observation: 1691b589dcbaecbfc851e1746b9e156d1c82c3b861a8e9f7bc75020fccadc80b. Source text hash: 93bc4e005ccdd82ee9b648e741e3f64031663742167445897b61167c3650aacf.
Revision and source-check history
Version 1 · 2026-11-10T02:33:13.512Z
arXiv cs.AI: Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks
Youting Wang, Xiao Han, Dingyan Shang, Yuan Tang and Bowen Liu argue that agent-safety scores cannot be treated as interchangeable measures of an agent’s safety. They validate four benchmarks using their official implementations and scorers, and find that scoring choices and small model panels can distort comparisons. For example, on R-Judge, an “always positive” policy scores above five models that actually discriminate. The three broad-coverage benchmarks also rank the same models differently, while a reported trade-off between two measures changes with panel size. The paper’s central point is that validity depends on the outcome being measured: capability predicts task success but is negatively correlated with safety across 21 models. In a separate paired panel of 20 models, the contrast between these relationships is reported as significant. In an expanded panel, the misalignment correlation weakens, and neither change is significant. AgentHarm has the strongest reported held-out association with safety, but both instruments score harmful compliance; the authors therefore describe this as evidence of convergent validity, not general safety. Their practical conclusion is that a safety claim should name the benchmark, metric, target behavior and model panel.
Original source
cs.AI · Article
Source details
Original source date: Jul 30, 2026 (2026-07-30).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-10T02:33:13.512Z. First observed: 2026-11-05T05:00:27.965Z. Retrieved: 2026-11-10T02:25:36.188Z.
Limits
The evidence supplied is the paper’s abstract, not its full methods or results; details needed to assess the implementations and analyses are not included here. The reported findings concern four benchmarks and specific model panels; the abstract does not establish how broadly they generalize to other benchmarks, models or target behaviors.
Open question
How well do these relationships hold for other model panels and target behaviors?
Source-stated
The authors argue that scores from different agent-safety benchmarks should not be treated as interchangeable measures of an agent’s safety.
their scores get quoted interchangeably as an agent's safety
Source-stated
On R-Judge, an “always positive” policy scores above five of the 21 models that actually discriminate.
on R-Judge that is $0.690$, above five of the 21 models that actually discriminate.
Source-stated
The three broad-coverage benchmarks rank the same 18 models differently, and the reported relationship between R-Judge specificity and AgentHarm safety changes with panel size.
The three broad-coverage benchmarks then rank the same 18 models differently
Source-stated
In the paired panel, capability predicts task success but correlates negatively with misalignment safety; the misalignment correlation weakens in the expanded panel, and neither change is significant.
On an expanded 41-model panel, the misalignment correlation weakens to $-0.16$ (95% CI $[-0.54, +0.22]$) and jailbreak strengthens to $+0.34$, though neither change is significant.
Source-stated
The authors say AgentHarm’s association with jailbreak safety is evidence of convergent validity rather than general safety, because both instruments score harmful compliance.
But both instruments score harmful compliance, so this is evidence of convergent validity rather than general safety.
Source-stated
The authors conclude that a safety claim should identify the benchmark, metric, target behavior and model panel.
Naming the benchmark, metric, target behavior, and model panel is the minimum a safety claim needs.
Source and contributor context
Wang, Youting, Han, Xiao, Shang, Dingyan, Tang, Yuan, Liu, Bowen · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
AI alignment
Research and practice aimed at making AI systems pursue the goals their builders and users intend.
Jailbreak
A prompt written to trick an AI system into ignoring its safety rules.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 4789de76-1119-46a4-8717-667cc7487964.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T02:33:13.512Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: useful_perspective.
Observation: 1691b589dcbaecbfc851e1746b9e156d1c82c3b861a8e9f7bc75020fccadc80b. Source text hash: 93bc4e005ccdd82ee9b648e741e3f64031663742167445897b61167c3650aacf.
uncertain · 2026-11-10T02:33:13.512Z · anthropic/claude-opus-5.5
Publication: 4789de76-1119-46a4-8717-667cc7487964
attribution — pass: The draft names the five listed authors (Wang, Han, Shang, Tang, Liu), attributes the arguments to them, and presents arXiv cs.AI as the venue. Findings are framed as reported or argued, not as established fact.
Authors:Youting Wang, Xiao Han, Dingyan Shang, Yuan Tang, Bowen Liu
summary — uncertain: Jargon blocks a non-specialist reader: agent, discriminate, specificity, held-out, misalignment safety, harmful compliance and convergent validity go unexplained. The always-positive example lacks its point: a trivial policy beats real models because of the F1 metric. The draft also blunts a key argument. It says the trade-off changes with panel size, but the authors call it a small-panel artifact. 'Neither change is significant' dangles because the jailbreak +0.34 shift is omitted. Calling outcome-dependence the paper's central point is EM framing. Smallest repairs: add tooltips or brief glosses, use 'artifact', and restore the jailbreak change.
the trade-off behind that disagreement is a small-panel artifact
date — pass: originalPublished 2026-07-30 matches the v1 submission date. It is not the 4 Nov 2026 v2 revision or the November feed date.
[Submitted on 30 Jul 2026 (v1), last revised 4 Nov 2026 (this version, v2)]
support — uncertain: Claim 4 places the capability correlations 'in the paired panel'. The source reports them at n=21 and reports only the contrast on the paired n=20 panel, so the scope should be corrected. Claim 3's excerpt supports only the ranking disagreement, not the panel-size change; the -0.64 at n=7 versus +0.02 at n=18 excerpt should be added. The other claims match their excerpts, and the limitations correctly note that only the abstract is available.
correlates negatively with misalignment safety ($\rho{=}{-}0.44$, $n{=}21$). On their paired $n{=}20$ panel
media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceResearch and practice aimed at making AI systems pursue the goals their builders and users intend.
Definition referenceA prompt written to trick an AI system into ignoring its safety rules.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceResearch and practice aimed at making AI systems pursue the goals their builders and users intend.
Definition referenceA prompt written to trick an AI system into ignoring its safety rules.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition reference