HarmBench data has 0/400 non-ASCII prompts, StrongREJECT 1/313

A practical mismatch is the starting point: HarmBench and StrongREJECT scores are widely quoted when comparing model safety, but each measures behaviour under a fixed language, a fixed input channel, and a fixed definition of failure. The author therefore counts the published CSVs directly rather than relying on the papers' summary tables, and the counts make the gap concrete.

The category breakdown adds a second caution. HarmBench's harassment_bullying category holds 25 items and harmful holds 22, so a per-category result can move several points on a single item. StrongREJECT, meanwhile, draws 221 of its 313 items from its own custom set and the rest from existing data such as AdvBench, and JBB-Behaviors is reported as 18% AdvBench and 27% TDC/HarmBench-derived, so strong results across several benchmarks may partly re-measure the same source data rather than provide independent evidence.

HarmBench's paper excludes dual-intent requests, the kind that can be legitimate or abusive and are often the hardest call in real operations. On the agent side, AgentHarm's paper reports that major models readily comply with malicious agent tasks even without jailbreaking, suggesting refusal strength as a chat model does not automatically carry over to agent behaviour. The recommended use is to treat benchmark numbers as meaning no more than "this is what happened under these conditions."