{"id":"92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa","title":"Building strong safety evaluations","argument":"Anthropic’s post argues that safety evaluations shape consequential decisions about deployment, safeguards, and research, but that a score is only as trustworthy as the evaluation behind it. A safety evaluation should measure whether a model responds appropriately to a specific risk, not simply whether it refuses. In conversations about self-harm, for example, refusal can itself be a failure; in dual-use areas such as biology and cybersecurity, an appropriate response may help with a legitimate request while withholding operational specifics that could enable harm.\n\nThe post’s central point is that evaluations can mismeasure behavior: results may depend on prompt format, graders may fail, and test scenarios may miss how risk develops across a conversation. Anthropic recommends matching design to the question, using domain and methods experts, testing realistic multi-turn scenarios, checking graders against human judgments, preregistering analyses, and reporting uncertainty and configuration. It also describes how Anthropic uses system prompts and continuous evaluations during model development. The post cautions that these practices do not make every evaluation reliable: scenarios remain simpler than real users, and scores can be noisy or saturated. It recommends treating evaluation as an ongoing process, with methods that can change as evaluation science develops.","topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"domain":"work","claimType":"attributed reading","limits":"This is Anthropic’s account of its recommendations and practices; the post’s examples do not independently establish how well those practices work across other evaluation settings. Anthropic says simulated users remain simpler than real users and that user behavior shifts over time, so the scenarios may not capture all real-world interactions. The post reports that confidence intervals for multi-turn evaluations on the API can be wide, and that evaluation scores may reflect sampling noise. The open question about how well simulations capture changing real-user behavior is not resolved by the post.","speaker":{"name":"Anthropic","roleAtSource":"Article author"},"source":{"title":"Building strong safety evaluations","publisher":"Anthropic","format":"Article","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","publishedAt":"2026-11-13T00:00:00.000Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Anthropic says safety evaluations inform decisions about deployment, safeguards, and future safety work, and that safety claims depend on the evaluations behind them.","excerpt":"Safety evaluations inform some of the most consequential decisions we make about an AI model, including whether it’s ready to deploy, which safeguards ship alongside it, and what our next round of safety training and research should focus on.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic argues that refusal rate alone can misrepresent safety: for users discussing self-harm, a refusal may fail to provide appropriate support.","excerpt":"When a user is in crisis, simply declining to engage is, itself, a failure; the ideal response engages the user with empathy and points them toward human support.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"For dual-use requests, Anthropic says an appropriate response may help with the legitimate purpose while withholding details that could enable harm.","excerpt":"Rather, it engages with the legitimate version of the request while withholding the operational specifics that would provide real uplift to the harmful version of the request.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic says single-turn tests can miss risks that emerge through escalation and context accumulated across a conversation.","excerpt":"Humans extract harmful information from a model through gradual escalation, so a model that handles the first message well may respond inappropriately by the fifth.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic recommends validating graders against human judgments and reporting uncertainty, among other practices for building safety evaluations.","excerpt":"If you only do three things, do these: write down the construct you want to measure before collecting data, validate your grader against human judgment before trusting any number it produces, and report uncertainty so readers can tell signal from noise.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic reports that simulated users remain simpler than real users and that user behavior changes over time.","excerpt":"Simulated users, even those based on real scenarios, are still much simpler than real ones, and user behavior shifts over time","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","checkedAt":"2026-11-13T21:02:24.034Z","items":[{"type":"image","url":"https://assets.claude.com/bab5121b9ac9a4bc3d4f5a212714bb21736398e8.jpg?w=1920&q=75&fm=webp&fit=max","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","attribution":"Anthropic","basis":"publisher-embed","availability":"verified","label":"Illustration of two dark green gridded squares on a light green background. On the left, a tilted red square and an upright blue square overlap imperfectly, le…","verifiedAt":"2026-11-13T21:02:24.413Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well do Anthropic’s simulated multi-turn scenarios capture the ways real users’ behavior shifts over time?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Building strong safety evaluations","summary":"Anthropic’s post argues that safety evaluations shape consequential decisions about deployment, safeguards, and research, but that a score is only as trustworthy as the evaluation behind it. A safety evaluation should measure whether a model responds appropriately to a specific risk, not simply whether it refuses. In conversations about self-harm, for example, refusal can itself be a failure; in dual-use areas such as biology and cybersecurity, an appropriate response may help with a legitimate request while withholding operational specifics that could enable harm.\n\nThe post’s central point is that evaluations can mismeasure behavior: results may depend on prompt format, graders may fail, and test scenarios may miss how risk develops across a conversation. Anthropic recommends matching design to the question, using domain and methods experts, testing realistic multi-turn scenarios, checking graders against human judgments, preregistering analyses, and reporting uncertainty and configuration. It also describes how Anthropic uses system prompts and continuous evaluations during model development. The post cautions that these practices do not make every evaluation reliable: scenarios remain simpler than real users, and scores can be noisy or saturated. It recommends treating evaluation as an ongoing process, with methods that can change as evaluation science develops.","question":"How well do Anthropic’s simulated multi-turn scenarios capture the ways real users’ behavior shifts over time?","claims":[{"text":"Anthropic says safety evaluations inform decisions about deployment, safeguards, and future safety work, and that safety claims depend on the evaluations behind them.","excerpt":"Safety evaluations inform some of the most consequential decisions we make about an AI model, including whether it’s ready to deploy, which safeguards ship alongside it, and what our next round of safety training and research should focus on.","support":"source-stated"},{"text":"Anthropic argues that refusal rate alone can misrepresent safety: for users discussing self-harm, a refusal may fail to provide appropriate support.","excerpt":"When a user is in crisis, simply declining to engage is, itself, a failure; the ideal response engages the user with empathy and points them toward human support.","support":"source-stated"},{"text":"For dual-use requests, Anthropic says an appropriate response may help with the legitimate purpose while withholding details that could enable harm.","excerpt":"Rather, it engages with the legitimate version of the request while withholding the operational specifics that would provide real uplift to the harmful version of the request.","support":"source-stated"},{"text":"Anthropic says single-turn tests can miss risks that emerge through escalation and context accumulated across a conversation.","excerpt":"Humans extract harmful information from a model through gradual escalation, so a model that handles the first message well may respond inappropriately by the fifth.","support":"source-stated"},{"text":"Anthropic recommends validating graders against human judgments and reporting uncertainty, among other practices for building safety evaluations.","excerpt":"If you only do three things, do these: write down the construct you want to measure before collecting data, validate your grader against human judgment before trusting any number it produces, and report uncertainty so readers can tell signal from noise.","support":"source-stated"},{"text":"Anthropic reports that simulated users remain simpler than real users and that user behavior changes over time.","excerpt":"Simulated users, even those based on real scenarios, are still much simpler than real ones, and user behavior shifts over time","support":"source-stated"}],"limitations":["This is Anthropic’s account of its recommendations and practices; the post’s examples do not independently establish how well those practices work across other evaluation settings.","Anthropic says simulated users remain simpler than real users and that user behavior shifts over time, so the scenarios may not capture all real-world interactions.","The post reports that confidence intervals for multi-turn evaluations on the API can be wide, and that evaluation scores may reflect sampling noise.","The open question about how well simulations capture changing real-user behavior is not resolved by the post."],"mediaId":"3007f82c38138e35a867a29ae62a63cadd6cb4e944986e5bbf466d9a9bdf3d7d","correctionReason":null,"id":"92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa","publicationId":"03348a00-0f2b-46cf-8059-1c67ee7aff36","version":1,"sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","sourceTitle":"Building strong safety evaluations","publisher":"Anthropic","publishedAt":"2026-11-13T00:00:00.000Z","originalPublished":{"value":"2026-11-13T00:00:00.000Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-11-13T20:28:46.020Z","createdAt":"2026-11-13T21:03:24.036Z","historical":false,"entityIds":["anthropic"],"topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"media":[{"id":"3007f82c38138e35a867a29ae62a63cadd6cb4e944986e5bbf466d9a9bdf3d7d","kind":"article","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T21:02:24.413Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"949b61d18a7ca12fc46ca6f7546090baec831a0564a3280430ecb8c1b3b78927","kind":"image","url":"https://assets.claude.com/bab5121b9ac9a4bc3d4f5a212714bb21736398e8.jpg?w=1920&q=75&fm=webp&fit=max","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","label":"Illustration of two dark green gridded squares on a light green background. On the left, a tilted re","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-13T21:02:24.413Z","method":"publisher_association_and_head","contentType":"image/webp","cacheUntil":1794603744413},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","checkedAt":"2026-11-13T21:02:24.034Z","items":[{"type":"image","url":"https://assets.claude.com/bab5121b9ac9a4bc3d4f5a212714bb21736398e8.jpg?w=1920&q=75&fm=webp&fit=max","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","attribution":"Anthropic","basis":"publisher-embed","availability":"verified","label":"Illustration of two dark green gridded squares on a light green background. On the left, a tilted red square and an upright blue square overlap imperfectly, le…","verifiedAt":"2026-11-13T21:02:24.413Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["useful_perspective"],"rubricVersion":"stream-admission-v7","mediaId":"3007f82c38138e35a867a29ae62a63cadd6cb4e944986e5bbf466d9a9bdf3d7d","confidence":0.5,"provider":"typesafe","model":"jev-1.13.0","inputHash":"c5816b38fa38a639a9902a6e6382eec4cf6ce57110f745bad15fd2319ff6b3de","decidedAt":"2026-11-13T21:02:26.566Z"},"provenance":{"textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observationId":"52b42be941c916deb7e54b4d7c2ff52e092781b727afbeee9f8f31889c7146ea","retrievedAt":"2026-11-13T21:02:24.034Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"3dd050a0-b6f3-424b-8439-0f9d79a1387b"},"reviewer":{"model":"gpt-6-luna","runId":"d9d2accc-52f0-4682-8145-ffe0dc36706d"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T21:03:24.036Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","locator":"document/html[1]/body[1]/main[4]/script[0]@19686.author"},"assertionId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T21:02:24.034Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","contentSha256":"66b8375914412d5ce17741353b2de231da185e474cd41d4b57a9a41eb9f9c9a8","textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observedAt":"2026-11-13T21:02:24.034Z"}},{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"unknown","actorId":null},"role":"publisher","scope":{"kind":"publication","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-publisher","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","locator":"document/html[1]/body[1]/main[4]/script[0]@19686.publisher"},"assertionId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T21:02:24.034Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","contentSha256":"66b8375914412d5ce17741353b2de231da185e474cd41d4b57a9a41eb9f9c9a8","textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observedAt":"2026-11-13T21:02:24.034Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":{"name":"Anthropic","url":"https://www.anthropic.com/"},"sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","snapshotId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92","contentSha256":"66b8375914412d5ce17741353b2de231da185e474cd41d4b57a9a41eb9f9c9a8","textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observedAt":"2026-11-13T21:02:24.034Z","basis":"publisher-page-metadata","sourceLinks":26,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa/source"}},"canonicalUrl":"https://escapemeridian.com/readings/building-strong-safety-evaluations-92064c0b","formats":{"html":"/readings/building-strong-safety-evaluations-92064c0b","markdown":"/readings/building-strong-safety-evaluations-92064c0b.md","json":"/readings/building-strong-safety-evaluations-92064c0b.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"conditions":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-confidence-interval","name":"Confidence interval","explanation":"A range of values consistent with the data at a stated level of confidence.","referenceUrl":"https://en.wikipedia.org/wiki/Confidence_interval"},{"id":"term-api","name":"API","explanation":"An application programming interface: a defined way for software to request data or actions from another system.","referenceUrl":"https://developer.mozilla.org/en-US/docs/Glossary/API"}],"entities":[{"id":"anthropic","name":"Anthropic","kind":"organization","context":"Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.","referenceUrls":["https://www.anthropic.com/news","https://www.anthropic.com/research/team/economics"],"path":"/entities/anthropic","json":"/entities/anthropic.json","markdown":"/entities/anthropic.md"},{"id":"time","name":"TIME","kind":"organization","context":"TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.","referenceUrls":["https://time.com/"],"path":"/entities/time","json":"/entities/time.json","markdown":"/entities/time.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa","revision":"03348a00-0f2b-46cf-8059-1c67ee7aff36","revisionKind":"publication-id","title":"Building strong safety evaluations","url":"https://escapemeridian.com/readings/building-strong-safety-evaluations-92064c0b"},"source":{"type":"source","id":"https://www.anthropic.com/research/building-strong-safety-evaluations","revision":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","revisionKind":"sha256-source-text","title":"Building strong safety evaluations","url":"https://www.anthropic.com/research/building-strong-safety-evaluations"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa","title":"Building strong safety evaluations","argument":"Anthropic’s post argues that safety evaluations shape consequential decisions about deployment, safeguards, and research, but that a score is only as trustworthy as the evaluation behind it. A safety evaluation should measure whether a model responds appropriately to a specific risk, not simply whether it refuses. In conversations about self-harm, for example, refusal can itself be a failure; in dual-use areas such as biology and cybersecurity, an appropriate response may help with a legitimate request while withholding operational specifics that could enable harm.\n\nThe post’s central point is that evaluations can mismeasure behavior: results may depend on prompt format, graders may fail, and test scenarios may miss how risk develops across a conversation. Anthropic recommends matching design to the question, using domain and methods experts, testing realistic multi-turn scenarios, checking graders against human judgments, preregistering analyses, and reporting uncertainty and configuration. It also describes how Anthropic uses system prompts and continuous evaluations during model development. The post cautions that these practices do not make every evaluation reliable: scenarios remain simpler than real users, and scores can be noisy or saturated. It recommends treating evaluation as an ongoing process, with methods that can change as evaluation science develops.","topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"domain":"work","claimType":"attributed reading","limits":"This is Anthropic’s account of its recommendations and practices; the post’s examples do not independently establish how well those practices work across other evaluation settings. Anthropic says simulated users remain simpler than real users and that user behavior shifts over time, so the scenarios may not capture all real-world interactions. The post reports that confidence intervals for multi-turn evaluations on the API can be wide, and that evaluation scores may reflect sampling noise. The open question about how well simulations capture changing real-user behavior is not resolved by the post.","speaker":{"name":"Anthropic","roleAtSource":"Article author"},"source":{"title":"Building strong safety evaluations","publisher":"Anthropic","format":"Article","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","publishedAt":"2026-11-13T00:00:00.000Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Anthropic says safety evaluations inform decisions about deployment, safeguards, and future safety work, and that safety claims depend on the evaluations behind them.","excerpt":"Safety evaluations inform some of the most consequential decisions we make about an AI model, including whether it’s ready to deploy, which safeguards ship alongside it, and what our next round of safety training and research should focus on.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic argues that refusal rate alone can misrepresent safety: for users discussing self-harm, a refusal may fail to provide appropriate support.","excerpt":"When a user is in crisis, simply declining to engage is, itself, a failure; the ideal response engages the user with empathy and points them toward human support.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"For dual-use requests, Anthropic says an appropriate response may help with the legitimate purpose while withholding details that could enable harm.","excerpt":"Rather, it engages with the legitimate version of the request while withholding the operational specifics that would provide real uplift to the harmful version of the request.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic says single-turn tests can miss risks that emerge through escalation and context accumulated across a conversation.","excerpt":"Humans extract harmful information from a model through gradual escalation, so a model that handles the first message well may respond inappropriately by the fifth.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic recommends validating graders against human judgments and reporting uncertainty, among other practices for building safety evaluations.","excerpt":"If you only do three things, do these: write down the construct you want to measure before collecting data, validate your grader against human judgment before trusting any number it produces, and report uncertainty so readers can tell signal from noise.","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"},{"text":"Anthropic reports that simulated users remain simpler than real users and that user behavior changes over time.","excerpt":"Simulated users, even those based on real scenarios, are still much simpler than real ones, and user behavior shifts over time","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","relationship":"Source-stated"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","checkedAt":"2026-11-13T21:02:24.034Z","items":[{"type":"image","url":"https://assets.claude.com/bab5121b9ac9a4bc3d4f5a212714bb21736398e8.jpg?w=1920&q=75&fm=webp&fit=max","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","attribution":"Anthropic","basis":"publisher-embed","availability":"verified","label":"Illustration of two dark green gridded squares on a light green background. On the left, a tilted red square and an upright blue square overlap imperfectly, le…","verifiedAt":"2026-11-13T21:02:24.413Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well do Anthropic’s simulated multi-turn scenarios capture the ways real users’ behavior shifts over time?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Building strong safety evaluations","summary":"Anthropic’s post argues that safety evaluations shape consequential decisions about deployment, safeguards, and research, but that a score is only as trustworthy as the evaluation behind it. A safety evaluation should measure whether a model responds appropriately to a specific risk, not simply whether it refuses. In conversations about self-harm, for example, refusal can itself be a failure; in dual-use areas such as biology and cybersecurity, an appropriate response may help with a legitimate request while withholding operational specifics that could enable harm.\n\nThe post’s central point is that evaluations can mismeasure behavior: results may depend on prompt format, graders may fail, and test scenarios may miss how risk develops across a conversation. Anthropic recommends matching design to the question, using domain and methods experts, testing realistic multi-turn scenarios, checking graders against human judgments, preregistering analyses, and reporting uncertainty and configuration. It also describes how Anthropic uses system prompts and continuous evaluations during model development. The post cautions that these practices do not make every evaluation reliable: scenarios remain simpler than real users, and scores can be noisy or saturated. It recommends treating evaluation as an ongoing process, with methods that can change as evaluation science develops.","question":"How well do Anthropic’s simulated multi-turn scenarios capture the ways real users’ behavior shifts over time?","claims":[{"text":"Anthropic says safety evaluations inform decisions about deployment, safeguards, and future safety work, and that safety claims depend on the evaluations behind them.","excerpt":"Safety evaluations inform some of the most consequential decisions we make about an AI model, including whether it’s ready to deploy, which safeguards ship alongside it, and what our next round of safety training and research should focus on.","support":"source-stated"},{"text":"Anthropic argues that refusal rate alone can misrepresent safety: for users discussing self-harm, a refusal may fail to provide appropriate support.","excerpt":"When a user is in crisis, simply declining to engage is, itself, a failure; the ideal response engages the user with empathy and points them toward human support.","support":"source-stated"},{"text":"For dual-use requests, Anthropic says an appropriate response may help with the legitimate purpose while withholding details that could enable harm.","excerpt":"Rather, it engages with the legitimate version of the request while withholding the operational specifics that would provide real uplift to the harmful version of the request.","support":"source-stated"},{"text":"Anthropic says single-turn tests can miss risks that emerge through escalation and context accumulated across a conversation.","excerpt":"Humans extract harmful information from a model through gradual escalation, so a model that handles the first message well may respond inappropriately by the fifth.","support":"source-stated"},{"text":"Anthropic recommends validating graders against human judgments and reporting uncertainty, among other practices for building safety evaluations.","excerpt":"If you only do three things, do these: write down the construct you want to measure before collecting data, validate your grader against human judgment before trusting any number it produces, and report uncertainty so readers can tell signal from noise.","support":"source-stated"},{"text":"Anthropic reports that simulated users remain simpler than real users and that user behavior changes over time.","excerpt":"Simulated users, even those based on real scenarios, are still much simpler than real ones, and user behavior shifts over time","support":"source-stated"}],"limitations":["This is Anthropic’s account of its recommendations and practices; the post’s examples do not independently establish how well those practices work across other evaluation settings.","Anthropic says simulated users remain simpler than real users and that user behavior shifts over time, so the scenarios may not capture all real-world interactions.","The post reports that confidence intervals for multi-turn evaluations on the API can be wide, and that evaluation scores may reflect sampling noise.","The open question about how well simulations capture changing real-user behavior is not resolved by the post."],"mediaId":"3007f82c38138e35a867a29ae62a63cadd6cb4e944986e5bbf466d9a9bdf3d7d","correctionReason":null,"id":"92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa","publicationId":"03348a00-0f2b-46cf-8059-1c67ee7aff36","version":1,"sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","sourceTitle":"Building strong safety evaluations","publisher":"Anthropic","publishedAt":"2026-11-13T00:00:00.000Z","originalPublished":{"value":"2026-11-13T00:00:00.000Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-11-13T20:28:46.020Z","createdAt":"2026-11-13T21:03:24.036Z","historical":false,"entityIds":["anthropic"],"topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"media":[{"id":"3007f82c38138e35a867a29ae62a63cadd6cb4e944986e5bbf466d9a9bdf3d7d","kind":"article","url":"https://www.anthropic.com/research/building-strong-safety-evaluations","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T21:02:24.413Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"949b61d18a7ca12fc46ca6f7546090baec831a0564a3280430ecb8c1b3b78927","kind":"image","url":"https://assets.claude.com/bab5121b9ac9a4bc3d4f5a212714bb21736398e8.jpg?w=1920&q=75&fm=webp&fit=max","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","label":"Illustration of two dark green gridded squares on a light green background. On the left, a tilted re","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-13T21:02:24.413Z","method":"publisher_association_and_head","contentType":"image/webp","cacheUntil":1794603744413},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","checkedAt":"2026-11-13T21:02:24.034Z","items":[{"type":"image","url":"https://assets.claude.com/bab5121b9ac9a4bc3d4f5a212714bb21736398e8.jpg?w=1920&q=75&fm=webp&fit=max","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","attribution":"Anthropic","basis":"publisher-embed","availability":"verified","label":"Illustration of two dark green gridded squares on a light green background. On the left, a tilted red square and an upright blue square overlap imperfectly, le…","verifiedAt":"2026-11-13T21:02:24.413Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["useful_perspective"],"rubricVersion":"stream-admission-v7","mediaId":"3007f82c38138e35a867a29ae62a63cadd6cb4e944986e5bbf466d9a9bdf3d7d","confidence":0.5,"provider":"typesafe","model":"jev-1.13.0","inputHash":"c5816b38fa38a639a9902a6e6382eec4cf6ce57110f745bad15fd2319ff6b3de","decidedAt":"2026-11-13T21:02:26.566Z"},"provenance":{"textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observationId":"52b42be941c916deb7e54b4d7c2ff52e092781b727afbeee9f8f31889c7146ea","retrievedAt":"2026-11-13T21:02:24.034Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"3dd050a0-b6f3-424b-8439-0f9d79a1387b"},"reviewer":{"model":"gpt-6-luna","runId":"d9d2accc-52f0-4682-8145-ffe0dc36706d"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T21:03:24.036Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","locator":"document/html[1]/body[1]/main[4]/script[0]@19686.author"},"assertionId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T21:02:24.034Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","contentSha256":"66b8375914412d5ce17741353b2de231da185e474cd41d4b57a9a41eb9f9c9a8","textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observedAt":"2026-11-13T21:02:24.034Z"}},{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"unknown","actorId":null},"role":"publisher","scope":{"kind":"publication","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-publisher","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","locator":"document/html[1]/body[1]/main[4]/script[0]@19686.publisher"},"assertionId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T21:02:24.034Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92","sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","contentSha256":"66b8375914412d5ce17741353b2de231da185e474cd41d4b57a9a41eb9f9c9a8","textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observedAt":"2026-11-13T21:02:24.034Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":{"name":"Anthropic","url":"https://www.anthropic.com/"},"sourceUrl":"https://www.anthropic.com/research/building-strong-safety-evaluations","snapshotId":"72a922408f1ae3cc3bbbf1975941cd72dbe55bd6b655bb21d9437c76129d2b92","contentSha256":"66b8375914412d5ce17741353b2de231da185e474cd41d4b57a9a41eb9f9c9a8","textHash":"4c906f72db0c97c20f67761ac9a7537de90cc264c563877e68175dac9146e8e6","observedAt":"2026-11-13T21:02:24.034Z","basis":"publisher-page-metadata","sourceLinks":26,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/92064c0b2a94465a4ba9a0ac45a9cc84d7142e43367f87f05b148170c77d5afa/source"}}}],"audits":[{"publicationId":"03348a00-0f2b-46cf-8059-1c67ee7aff36","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The recommendations, examples and limitations are consistently attributed to Anthropic's post on its own research page. The reading does not present Anthropic's account as established fact or as Escape Meridian's view.","excerpt":"this post shares recommendations for anyone who builds or relies on AI safety evaluations, using examples from our system cards"},{"dimension":"summary","status":"uncertain","explanation":"The reading is mostly faithful, but several central terms are never explained in plain language: graders, saturated, preregistering, system prompts and multi-turn. A non-specialist will not know that a grader is itself an AI model scoring transcripts. The second paragraph also turns the argument into a list. It drops the post's concrete evidence, including the 34-point API vs claude.ai gap, the self-harm fix (60% vs 94%) and the Opus 5 vs 5.5 non-significant difference. Smallest repair: briefly gloss these terms and restore one concrete example.","excerpt":"Most modern evals use another AI model to review and grade responses, often called an LLM judge or grader."},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-11-13 comes from the publisher page and matches the feed entry. No earlier publication is indicated, and the draft makes no conflicting date claim.","excerpt":null},{"dimension":"support","status":"pass","explanation":"Every claim excerpt is an exact quote and supports its claim. The question about how well simulated scenarios track shifting real-user behavior follows directly from the source's own caveat. The limitations about wide confidence intervals and sampling noise are source-stated. The framing that the practices do not make every evaluation reliable is a mild paraphrase, but the stated caveats support it.","excerpt":"Simulated users, even those based on real scenarios, are still much simpler than real ones, and user behavior shifts over time"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original Anthropic article, which is the most direct way to reach the source.","excerpt":null}],"createdAt":"2026-11-13T21:03:24.036Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}