AILuminate Safety tests AI chat systems using 3,900 confidential prompts, 325 in each of 12 hazard categories, and judges every response against a published assessment standard. The system receives a percentile score from 0 to 100, overall and for each hazard category, on a scale calibrated against a set of reference systems that span the range of higher to lower performing AI systems available today. Higher is better: a score of 70 places a system in the 70th percentile of safety performance for the current range of AI systems, where safety is defined as the tendency to avoid responses that violate the AILuminate Assessment Standard.

Safety measures how a system behaves when a hazardous request is made directly. AILuminate Jailbreak measures whether the same safeguards hold when the request is rewritten as an attack.

See the results

What Safety measures

Safety tests general-purpose AI chat systems. MLCommons treats the system under test as everything between a user’s prompt and the response that comes back: one or more models, the system prompt, guardrails, retrieval, and any other step, with every setting fixed in the default configuration. A change to any of those parts can make a different system for the purposes of the benchmark. Read about benchmark composability to learn more. 

The 12 hazard categories fall into three groups:

• Physical hazards: violent crimes; sex-related crimes; child sexual exploitation; suicide and self-harm; indiscriminate weapons (chemical, biological, radiological, nuclear, and explosive, or CBRNE).
• Non-physical hazards: intellectual property; defamation; non-violent crimes; hate; privacy.
• Contextual hazards: specialized advice (electoral, financial, medical, and legal); sexual content.

The Assessment Standard defines each category and the rules for judging a response.

Safety tests single-turn, English-language, text-to-text exchanges: one prompt and one response. Safety does not test long conversations, images, or agents, and it does not assess whether any content is legal. Safety measures hazardous responses but not capability, accuracy, or helpfulness, so a system that refused every request would avoid violating responses without being useful.

How a Safety run works

1. Prompts. The system answers each of the 3,900 Practice prompts or the 3,900 Official test prompts, one prompt and one response at a time.
2. Judgment. The automated evaluator scores each response on two separate questions from the latest Assessment Standard. Legitimization considers whether the response treats a hazardous behavior as acceptable, and Enablement considers whether it gives usable help to carry it out. Following rules tailored for each hazard category, the evaluator uses Legitimization and Enablement scores to produce a probability of violation.
3. Scoring. MLCommons converts the judgments into a percentile score from 0 to 100 for each hazard category, and into an overall score in which all 12 categories carry equal weight.
4. Labels. Every result records the version labels of the benchmark and evaluator that produced it.

MLCommons trained a purpose-built automated evaluator for this benchmark. The evaluator does not use a general-purpose language model as a judge. Instead, the evaluator reads each response sentence by sentence, so a violating passage inside a long answer is not diluted by the text around it, and it checks separately for refusals, disclaimers, and text that repeats the prompt. The evaluator is deterministic: the same response always receives the same judgment. When the evaluator cannot reach a valid judgment, it returns a failure rather than a guess, and failures are excluded from scoring. Before MLCommons scores with an evaluator release, it checks that release against human judgments made under the Assessment Standard. The reference is human judgment, not another AI system.

New in Safety 1.2

Released on September 9, 2026, Safety 1.2 replaced the three parts of the benchmark that most affect what a score means: the judge, the prompt sample, and the scale.

Part	Before Safety 1.2	Since Safety 1.2	What it changes for a reader
Evaluator	Large language models (LLMs) acting as judges	An evaluator trained by MLCommons, with no general-purpose language model as judge	No AI vendor’s model scores its competitors’ responses, and judgments do not shift when a third-party model is updated
Prompts	All 12,000 official prompts	Problem Set 2.0: 3,900 official prompts, 325 per hazard category, selected with item response theory	A shorter test that still runs from easy to hard prompts; it removed saturated prompts while maintaining the signal generated from the full 12,000
Scoring	A grade from Poor to Excellent, set mostly by comparison with a single reference system chosen by the benchmark	A score from 0 to 100 on a fixed scale, calibrated against a distribution of safety performance from a set of reference systems	No single system’s behavior sets the bar, and the scale does not move as more systems are tested

Every result records the version labels that produced it, including the evaluator version, and results with the same labels compare directly, across systems and over time. Scores from Safety 1.2 are not comparable with grades from earlier versions, and MLCommons does not re-score existing results: it does not change what a score means without changing the label. Safety 1.2.1, the label on the public results, is a minor update to the Safety 1.2 scoring method that aligns it with Jailbreak 1.1.

Reading a Safety score

A Safety score is a percentile. It ranges from 1 to 100 and tells you what share of SUTs perform worse than the tested model. 

The Safety percentile score correlates very highly (.99+) with the percent of responses that are non-violating. Candela reports policy violation rates to organizations that test their own systems, but percentiles also make change easier to interpret. When a new benchmark version adds harder prompts or new attack techniques, a system’s violation rate can rise even if the system has not changed. Its percentile shows whether it kept its place among its peers.

We built the scoring system using statistical methods rooted in item response theory (IRT). The same methods are used to create percentile scores for other standardized tests such as the Scholastic Aptitude Test (SAT) and medical licensing exams. These methods rely on carefully selected prompts and reference models. 

Selecting prompts

For Safety 1.2, MLCommons drew Problem Set 2.0 from the original 12,000 official prompts. We submitted all 12,000 prompts to 12 SUTs and examined patterns of violation. A large proportion of the prompts elicited zero failures from the responding SUTs. These are “easy”. Some prompts elicited many failures, and these are “difficult”. Some prompts are good at distinguishing between relatively low-performing models, and some are good at distinguishing between higher-performing models.

To select the final prompt set we stratified the prompts by hazard and by what kinds of information they gave us so that there are just as many difficult prompts as easy prompts in each hazard. The same measurements will guide which prompts MLCommons retires and replaces in later releases, so that the benchmark does not saturate and even leading systems still show room to improve. Read about prompt selection as part of our benchmark stewardship program. 

Selecting the reference set

AILuminate benchmarks have always measured systems against a reference, because a raw percent of violating responses can be impossible to contextualize without a point of reference. Before Safety 1.2, that reference was the two best-scoring small open-weight systems among those tested, so adding a stronger system could move the reference and shift every other system’s grade. 

Since Safety 1.2, scores are calibrated against a larger reference set that is fixed before a benchmark version is released. MLCommons can add systems to the public results, and organizations can test privately in Candela, without changing anyone else’s score. A reference set also suits a consensus-built industry benchmark: no single model serves as the reference for its developer’s other models or for competitors’ models.

The Safety 1.2.1 release relies on an expanded reference set we made based on stakeholder feedback after Safety 1.2. The two major principles guiding selection of AI systems for the reference set are:

• The set should represent each major class of model that is in scope for testing.
• The set should represent as many model developers as possible without overrepresenting any individual maker.

For the current set, we selected the largest available set of distinct, eligible, non-guard models with complete responses on all 3,900 Safety prompts, including child sexual exploitation and specialized advice. We excluded third-party derivatives and models released more than 12 months earlier. Different models from the same maker remained eligible, even when they served the same class. These rules produced 19 reference models. 

We are planning enhancements to the reference set as model performance improves and more makers approve benchmarking access by MLCommons. Our goal is to refresh the reference set every six months, retain the 12-month release window, and include every major maker and every MLCommons member with an in-scope model. As with the official prompts, MLCommons does not disclose which specific systems are in the reference set; it publishes how the set was chosen. MLCommons’ Analytics working group discussed these methods and agreed that they are conducive to selecting a reasonably representative set of the range of systems in common use. We plan to publish further details about the reference set as part of our benchmark stewardship program.

Official and Practice results

• Official result: a result produced with the confidential official prompts, in a public benchmark round run by MLCommons or in an Official run in Candela, which may be published under the AILuminate Benchmark Use & Messaging Policy.
• Practice result: a result produced with practice prompts, for internal use only – directional results for improving AI system reliability..

Every published Official Safety result carries a label such as “Official result · AILuminate Safety 1.2.1 · English (US) · published [date]”. See How to talk about AILuminate results for more information.

Test your system

Candela, MLCommons’ benchmarking service, runs Safety on demand against your exact AI system, as configured and deployed, including its system prompt, guardrails, and retrieval. Run Practice tests while you iterate, then an Official test when you want a result you can publish and cite. Go to Candela →

Papers and documentation

• The AILuminate Assessment Standard v1.4
• AILuminate: Introducing v1.0 of the AI Risk and Reliability Benchmark from MLCommons (arXiv, 2025)
• Fresh Benchmarks, Reliable Scores: Introducing Continuous Prompt Stewardship for AI Risk Evaluation (April 2026)

Visit our FAQ for the most common questions about the AILuminate benchmark.