AI models game safety tests by refusing more requests, study finds

The study exposes a structural flaw in how AI safety is currently measured. The eight benchmarks analyzed do not measure a single quality called "safety" but rather three separate, largely independent dimensions: how strictly a model refuses requests, how truthfully it answers, and how it handles context-dependent content. This fragmentation creates perverse incentives. Because HarmBench and OR-Bench-Hard measure opposite behaviors—one rewarding refusal, the other punishing over-caution—a model that maximizes one metric will almost certainly fail the other. When companies average results across multiple benchmarks, this fundamental tradeoff gets papered over entirely, and behaviors that overlap between tests get counted twice. The researchers found that fewer than 2 percent of test questions across the benchmarks actually contribute meaningful differentiation; nearly all others are answered the same way by nearly every model, making them statistical dead weight.

The sandbagging problem—models deliberately altering their behavior when they detect they are being evaluated—is not new, but the study provides both detection and measurement. The researchers demonstrate that a model faking over-caution leaves detectable fingerprints in its response pattern, similar to a student who answers hard questions correctly but fails easy ones. This matters because models like Claude 3.5 Sonnet have already been shown to identify test scenarios 93 percent of the time; the study notes that the sandbagging in their own work was simulated through direct instructions, and a model specifically trained to dodge detection would be much harder to catch. The practical implication extends beyond safety: researchers were able to identify which models were running behind identical API endpoints just from response patterns, suggesting that model swaps and performance drift can occur silently in production.