Evaluation Protocol
The complete interaction procedure set by the experimenter, including whether the model is required to first output a confidence rating, whether rating and action are separated into steps, and the wording and order of prompts. In LLM safety evaluation, the evaluation protocol itself may act as an intervention variable that affects the model's behavioral distribution.
Timeline (last 90 days)
After removing the preliminary rating step, the harmful execution rate rose by an average of 15 percentage points.
Supervised fine-tuning on generated fake notices can reduce harmful execution on held-out archived attacks under the "rate first, then act" protocol, but it incurs model-dependent utility costs, and protection weakens without the rating elicitation.
The evaluation protocol (whether a rating must be output first, whether rating and action are separated into steps, etc.) is itself an intervention variable; requiring the model to rate first amounts to forcing explicit internal-representation extraction and changes the probability distribution of subsequent actions.
The effectiveness of defenses should be measured along both harmful-action and legitimate-task-completion dimensions, and the influence of the evaluation protocol itself on behavior must be taken into account.
All Facts (4)
After removing the preliminary rating step, the harmful execution rate rose by an average of 15 percentage points.
50%UnverifiedSupervised fine-tuning on generated fake notices can reduce harmful execution on held-out archived attacks under the "rate first, then act" protocol, but it incurs model-dependent utility costs, and protection weakens without the rating elicitation.
50%UnverifiedThe evaluation protocol (whether a rating must be output first, whether rating and action are separated into steps, etc.) is itself an intervention variable; requiring the model to rate first amounts to forcing explicit internal-representation extraction and changes the probability distribution of subsequent actions.
50%UnverifiedThe effectiveness of defenses should be measured along both harmful-action and legitimate-task-completion dimensions, and the influence of the evaluation protocol itself on behavior must be taken into account.
50%