Safety Benchmark Score Ranges Differ 23-Fold

Featured

01 Safety Benchmarks May Measure Policy

A safety model's score can move across nearly an entire range when only its labeling policy changes. Researchers trained ten guardrails on roughly 53,000 prompts using two definitions of “unsafe.” One asks whether a user requests harmful content. The other asks whether a moderator would block it.

The architecture and optimization pipeline stayed fixed. Across the ten guardrails, score ranges reached 0.99 on HarmBench-copyright and 0.043 on WildGuard-benign, a 23-fold difference. Changing about 0.03% of parameters also pushed some benchmark scores across almost the full range. The models may have learned different policies, not different detection abilities.

Policy can also pass silently through a distilled teacher's soft labels. Teacher provenance stayed influential even when every student hard label followed the other definition. The training pool also overlapped two over-refusal benchmarks by 88% and 82%. Later conclusions used decontaminated data, but strong scores still demand a data audit.

On the only validation split scored across all 20 guardrail arms, validation accuracy correlated 0.74 with policy alignment. Its correlation with detection ability was only 0.34. Model rankings therefore need supporting disclosures. Buyers should demand contamination audits, label definitions, teacher provenance, and results across random seeds.

Key takeaways: - Separate detection ability from policy alignment when interpreting safety benchmark scores. - Audit training overlap, label definitions, and distilled-teacher provenance before buying a guardrail model. - Require lower bounds and repeated runs across random seeds instead of trusting a single ranking.

Source: Policy Is Not Capability: Some Safety Benchmarks Measure Which Definition of "Unsafe" You Trained On

02 Long-Horizon Agents Need Working Offices

Training a long-horizon office agent requires coherent requests, service records, tool interfaces, and scoring checks. The environment must also handle a workspace whose state changes over time.

CoworkEnv generates complete tasks from capability requirements and workflow constraints. Programmatic validation and feedback repair the task specifications and scoring logic, making each environment executable.

Supervised fine-tuning with CoworkEnv resources and teacher demonstrations raised Qwen3-VL-8B-Instruct's Claw-Eval average from 46.6 to 64.1. Multi-turn performance improved by 31.9 points. The framework can also convert student interactions into reinforcement-learning trajectories and rewards. The abstract characterizes improving training rewards as preliminary evidence that the constructed environments support policy optimization; it does not report a policy-capability result.

Key takeaways: - Long-horizon agent training needs complete, executable environments rather than task prompts alone. - CoworkEnv-based supervised fine-tuning improved Qwen3-VL-8B-Instruct by 31.9 points on Claw-Eval multi-turn tasks. - Treat the reinforcement-learning results as preliminary; higher training rewards do not prove stronger real-world capability.

Source: CoworkEnv: Synthesizing Training Environments for Long-Horizon Cowork Agents

03 Train the Entire Editing Trajectory

Multi-turn image drift is not simply a weak result at one step. Models repeatedly consume their own outputs, accumulating artifacts, lost detail, and content shifts across the trajectory.

MT Forcing has a teacher generate cumulative edit targets from the original image and the complete instruction history. These targets give the student's self-generated sequence a reference free from recursive errors. A separate reference trajectory constrains history-dependent state transitions. Together, these signals encourage cross-turn consistency and reduce unintended changes to preserved regions and earlier edits.

The abstract reports significant gains in image stability and cross-turn consistency but gives no exact figures. The full paper must confirm performance on long sequences, complex local edits, and real user instructions. Interactive image tools should evaluate the whole editing trajectory, not only each isolated step.

Key takeaways: - Treat multi-turn drift as accumulated error, not a single-step image-quality problem. - Use cumulative edits generated from the original image as a cleaner training reference. - Evaluate both long-sequence image quality and preservation of existing content.

Source: MT Forcing: Towards Stable and Consistent Multi-Turn Image Editing with Autoregressive Diffusion