Sociotechnical Safety Evaluation of Generative AI Systems
Not on the map. Why?
Abstract (arXiv)
Generative AI systems produce a range of risks. To ensure the safety of generative AI systems, these risks must be evaluated. In this paper, we make two main contributions toward establishing such evaluations. First, we propose a three-layered framework that takes a structured, sociotechnical approach to evaluating these risks. This framework encompasses capability evaluations, which are the main current approach to safety evaluation. It then reaches further by building on system safety principles, particularly the insight that context determines whether a given capability may cause harm. To account for relevant context, our framework adds human interaction and systemic impacts as additional layers of evaluation. Second, we survey the current state of safety evaluation of generative AI systems and create a repository of existing evaluations. Three salient evaluation gaps emerge from this analysis. We propose ways forward to closing these gaps, outlining practical steps as well as roles and responsibilities for different actors. Sociotechnical safety evaluation is a tractable approach to the robust and comprehensive safety evaluation of generative AI systems.
Key facts. Cited by 154 papers in the map (data through 7 Oct 2026). Builds on 148 of its 398 references that are in the map. First posted on arXiv 18 Oct 2023.
Builds on
148 of 398 references.
References · 148
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
- 2023GPT-4 Technical Reportcited by 18,132
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
- 2021Zero-Shot Text-to-Image Generationcited by 4,276
- 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2016Improved Techniques for Training GANscited by 2,938
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
38 more
- 2023Sparks of Artificial General Intelligence: Early experiments with GPT-4cited by 2,579
- 2022Emergent Abilities of Large Language Modelscited by 2,483
- 2021CLIPScore: A Reference-free Evaluation Metric for Image Captioningcited by 2,388
- 2022Survey of Hallucination in Natural Language Generationcited by 2,056
- 2022Beyond the Imitation Game: Quantifying and extrapolating the capabilities of language modelscited by 1,970
- 2016WaveNet: A Generative Model for Raw Audiocited by 1,710
- 2023Evaluating Object Hallucination in Large Vision-Language Modelscited by 1,696
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
- 2016Man is to Computer Programmer as Woman is to Homemaker? Debiasing Word Embeddingscited by 1,304
- 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,287
- 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,259
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
- 2022LaMDA: Language Models for Dialog Applicationscited by 1,218
- 2021Scaling Language Models: Methods, Analysis & Insights from Training Gophercited by 1,199
- 2023PaLM 2 Technical Reportcited by 1,154
- 2022Red Teaming Language Models with Language Modelscited by 983
- 2021Ethical and social risks of harm from Language Modelscited by 957
- 2020On Faithfulness and Factuality in Abstractive Summarizationcited by 895
- 2016Semantics derived automatically from language corpora contain human-like biasescited by 894
- 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 805
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
- 2023A Watermark for Large Language Modelscited by 667
- 2018Object Hallucination in Image Captioningcited by 661
- 2018Gender Bias in Coreference Resolution: Evaluation and Debiasing Methodscited by 657
- 2023Capabilities of GPT-4 on Medical Challenge Problemscited by 630
- 2021Carbon Emissions and Large Neural Network Trainingcited by 561
- 2020Jukebox: A Generative Model for Musiccited by 535
- 2022Improving alignment of dialogue agents via targeted human judgementscited by 527
- 2023Are Emergent Abilities of Large Language Models a Mirage?cited by 515
- 2020The Hateful Memes Challenge: Detecting Hate Speech in Multimodal Memescited by 485
- 2021Documenting Large Webtext Corpora: A Case Study on the Colossal Clean Crawled Corpuscited by 481
- 2021Dynabench: Rethinking Benchmarking in NLPcited by 447
- 2023MusicLM: Generating Music From Textcited by 442
- 2023Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignmentcited by 394
- 2023Towards Expert-Level Medical Question Answering with Large Language Modelscited by 382
- 2016How NOT To Evaluate Your Dialogue System: An Empirical Study of Unsupervised Evaluation Metrics for Dialogue Response Generationcited by 356
- 2021AI and the Everything in the Whole Wide World Benchmarkcited by 340
50 most cited of 148 All 148 (JSON)
Built on by
Citing papers per year: 2023: 2; 2024: 64; 2025: 48; 2026: 40.
154 papers.
Sort:
By area:
- 2024GPT-4o System Cardcited by 4,467
- 2024Knowledge Conflicts for LLMs: A Surveycited by 274
- 2024LLMs instead of Human Judges? A Large Scale Empirical Study across 20 NLP Evaluation Taskscited by 236
- 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 225
- 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
- 2023Generative agent-based modeling with actions grounded in physical, social, or digital space using Concordiacited by 119
- 2024Survey of Cultural Awareness in Language Models: Text and Beyondcited by 101
- 2025LLM Social Simulations Are a Promising Research Methodcited by 97
- 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Modelcited by 82
- 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 81
- 2024Visibility into AI Agentscited by 77
- 2024AIR-Bench 2024: A Safety Benchmark Based on Risk Categories from Regulations and Policiescited by 69
38 more
- 2024Clio: Privacy-Preserving Insights into Real-World AI Usecited by 66
- 2024Introducing v0.5 of the AI Safety Benchmark from MLCommonscited by 60
- 2025Can We Trust AI Benchmarks? An Interdisciplinary Review of Current Issues in AI Evaluationcited by 57
- 2025Why human-AI relationships need socioaffective alignmentcited by 47
- 2024A Safe Harbor for AI Evaluation and Red Teamingcited by 46
- 2024VBench++: Comprehensive and Versatile Benchmark Suite for Video Generative Modelscited by 42
- 2025Toward an Evaluation Science for Generative AI Systemscited by 42
- 2024Bias in Language Models: Beyond Trick Tests and Toward RUTEd Evaluationcited by 41
- 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 38
- 2025SafeDPO: A Simple Approach to Direct Preference Optimization with Enhanced Safetycited by 37
- 2024Assessment of Multimodal Large Language Models in Alignment with Human Valuescited by 36
- 2024Beyond Perplexity: Multi-dimensional Safety Evaluation of LLM Compressioncited by 32
- 2024Beyond Aesthetics: Cultural Competence in Text-to-Image Modelscited by 30
- 2024Farsight: Fostering Responsible AI Awareness During AI Application Prototypingcited by 28
- 2024Towards interactive evaluations for interaction harms in human-AI systemscited by 27
- 2025Multi-turn Evaluation of Anthropomorphic Behaviours in Large Language Modelscited by 25
- 2024MERA: A Comprehensive LLM Evaluation in Russiancited by 22
- 2025Lessons From Red Teaming 100 Generative AI Productscited by 22
- 2024Can Language Models Recognize Convincing Arguments?cited by 21
- 2024Mapping the Ethics of Generative AI: A Comprehensive Scoping Reviewcited by 19
- 2025Human Decision-making is Susceptible to AI-driven Manipulationcited by 19
- 2024Not My Voice! A Taxonomy of Ethical and Safety Harms of Speech Generatorscited by 18
- 2024Holistic Safety and Responsibility Evaluations of Advanced AI Modelscited by 18
- 2024IDs for AI Systemscited by 18
- 2024The 2024 Foundation Model Transparency Indexcited by 18
- 2025Reality Check: A New Evaluation Ecosystem Is Necessary to Understand AI's Real World Effectscited by 18
- 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 18
- 2025CASE-Bench: Context-Aware SafEty Benchmark for Large Language Modelscited by 17
- 2024Can LLMs make trade-offs involving stipulated pain and pleasure states?cited by 16
- 2024Generative Ghosts: Anticipating Benefits and Risks of AI Afterlivescited by 15
- 2024Harm Amplification in Text-to-Image Modelscited by 14
- 2024Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy and Researchcited by 14
- 2024Near to Mid-term Risks and Opportunities of Open-Source Generative AIcited by 13
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 13
- 2024Large language models can consistently generate high-quality content for election disinformation operationscited by 13
- 2024The AI risk repository: A meta-review, database, and taxonomy of risks from artificial intelligencecited by 13
- 2024Acceptable Use Policies for Foundation Modelscited by 12
- 2025Inherent and emergent liability issues in LLM-based agentic systems: a principal-agent perspectivecited by 12
50 most cited of 154 All 154 (JSON)
- 2026Agents as Software: A Programming Languages Agenda for Agent Reliability26 Sep 2026
- 2026An Open Pipeline and Dashboard for Systemic-Risk Evidence under the EU AI Act's Code of Practice23 Sep 2026
- 2026Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems15 Sep 2026
- 2026MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents14 Sep 2026
- 2026SafeAtlas-VL: Beyond Binary Multimodal Safety with Large-Scale Data and Guard Models29 Aug 2026
- 2026LAAF: A Layered Accountability Architecture Framework for LLM Applications27 Aug 2026
- 2026Monocultural Biases: Correlated biases in large language models lead to unequal systemic exclusion rates in hiring26 Aug 2026
- 2026Quantifying System-Level Harms from AI Adoption in Complex Sociotechnical Systems24 Aug 2026
- 2026Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agents9 Aug 2026
- 2026Beyond "I Can't Help With That": How Child Safety Experts Evaluate AI Chatbot Safety8 Aug 2026
- 2026What Current AI Benchmarks Leave Unmeasured: Modality, Search, Citations, and Implications (for Safety Evaluations)6 Aug 2026
- 2026Studying People to Study AI: Expert Perspectives on the Epistemic Fit and Barriers of Human Research in AI Safety & Ethics6 Aug 2026
38 more
- 2026Polistemics: Evaluating LLMs as Information Mediators in Politics & Elections28 Jul 2026
- 2026Why Public Service AI Governance Frameworks Risk Failing in the Age of General-Purpose AI: Lessons from Policing28 Jul 2026
- 2026Closing the AI Trust Gap: The Case for Independent Certification for Trustworthy AI17 Jul 2026
- 2026AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation13 Jul 2026
- 2026The Foreign Policy AI Evaluation Gap3 Jul 2026
- 2026Online Safety Monitoring for LLMs2 Jul 2026
- 2026Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation1 Jul 2026
- 2026Toward Pre-Deployment Assurance for Enterprise AI Agents: Ontology-Grounded Simulation and Trust Certification2 Jun 2026
- 2026Solipsistic Superintelligence is Unlikely to be Cooperative2 Jun 2026
- 2026ProcCtrlBench: Evaluating Process-Level Defects and Control Preservation in LLM Coding Agents18 May 2026
- 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution13 May 2026
- 2026VERA-MH: Validation of Ethical and Responsible AI in Mental Health13 May 2026
- 2026Ceci n'est pas une explication: Evaluating Explanation Failures as Explainability Pitfalls in Language Learning Systems28 Apr 2026
- 2026Computational Hermeneutics: Evaluating generative AI as a cultural technology31 Mar 2026
- 2026Questionnaire Responses Do not Capture the Safety of AI Agents15 Mar 2026
- 2026RCTs for Frontier AI Governance: Methodological Challenges and Solutions for Human Uplift Studies11 Mar 2026
- 2026Biased Generalization in Diffusion Models3 Mar 2026
- 2026SEED-SET: Scalable Evolving Experimental Design for System-level Ethical Testing2 Mar 2026
- 2026Real-World AI Evaluation: How FRAME Generates Systematic Evidence to Resolve the Decision-Maker's Dilemma28 Feb 2026
- 2026Simplifying Outcomes of Language Model Component Analyses with ELIA20 Feb 2026
- 2026Universal Image Immunization against Diffusion-based Image Editing via Semantic Injection16 Feb 2026
- 2026Alignment Is Not Enough: A Relational Framework for Moral Standing in Human-AI Interaction13 Feb 2026
- 2026Red Teaming LLMs as Socio-Technical Practice: From Exploration and Data Creation to Evaluation10 Feb 2026
- 2026What is Safety? Corporate Discourse, Power, and the Politics of Generative AI Safety26 Jan 2026
- 2026Results-Actionability Gap: Understanding How Practitioners Evaluate LLM Products in the Wild25 Jan 2026
- 2026Generative Confidants: How do People Experience Trust in Emotional Support from Generative AI?23 Jan 2026
- 2026VISPA: Pluralistic Alignment via Automatic Value Selection and Activation19 Jan 2026
- 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs4 Jan 2026
- 2025Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Models18 Dec 2025
- 2025Safe for Whom? Rethinking How We Evaluate the Safety of LLMs for Real Users11 Dec 2025
- 2025The 2025 Foundation Model Transparency Index11 Dec 2025
- 2025Martingale Score: An Unsupervised Metric for Bayesian Rationality in LLM Reasoning2 Dec 2025
- 2025Exploring Human Perceptions of AI Responses: Insights from a Mixed-Methods Study on Risk Mitigation in Generative Models1 Dec 2025
- 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs16 Nov 2025
- 2025Who Evaluates AI's Social Impacts? Mapping Coverage and Gaps in First and Third Party Evaluations6 Nov 2025
- 2025A Principle-based Framework for the Development and Evaluation of Large Language Models for Health and Wellness23 Oct 2025
- 2025Ask What Your Country Can Do For You: Towards a Public Red Teaming Model22 Oct 2025
- 2025A Concrete Roadmap towards Safety Cases based on Chain-of-Thought Monitoring22 Oct 2025
50 newest of 154 All 154 (JSON)
- 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 81
- 2024A Safe Harbor for AI Evaluation and Red Teamingcited by 46
- 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 38
- 2025Lessons From Red Teaming 100 Generative AI Productscited by 22
- 2024Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy and Researchcited by 14
- 2024Blockchain for Large Language Model Security and Safety: A Holistic Surveycited by 8
- 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMscited by 7
- 2025Understanding and Mitigating Risks of Generative AI in Financial Servicescited by 4
- 2025Ask What Your Country Can Do For You: Towards a Public Red Teaming Modelcited by 1
- 2025Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Modelscited by 1
- 2025A Framework for Lightweight Responsible Prompting Recommendationcited by 0
- 2025Exploring Human Perceptions of AI Responses: Insights from a Mixed-Methods Study on Risk Mitigation in Generative Modelscited by 0
12 most cited of 15 All 15 (JSON)
- 2026AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation13 Jul 2026
- 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution13 May 2026
- 2026Red Teaming LLMs as Socio-Technical Practice: From Exploration and Data Creation to Evaluation10 Feb 2026
- 2025Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Models18 Dec 2025
- 2025Exploring Human Perceptions of AI Responses: Insights from a Mixed-Methods Study on Risk Mitigation in Generative Models1 Dec 2025
- 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs16 Nov 2025
- 2025Ask What Your Country Can Do For You: Towards a Public Red Teaming Model22 Oct 2025
- 2025Understanding and Mitigating Risks of Generative AI in Financial Services25 Apr 2025
- 2025A Framework for Lightweight Responsible Prompting Recommendation29 Mar 2025
- 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integration20 Mar 2025
- 2025Lessons From Red Teaming 100 Generative AI Products13 Jan 2025
- 2024Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy and Research9 Dec 2024
12 newest of 15 All 15 (JSON)
- 2023Generative agent-based modeling with actions grounded in physical, social, or digital space using Concordiacited by 119
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 13
- 2024The AI risk repository: A meta-review, database, and taxonomy of risks from artificial intelligencecited by 13
- 2025Inherent and emergent liability issues in LLM-based agentic systems: a principal-agent perspectivecited by 12
- 2026ProcCtrlBench: Evaluating Process-Level Defects and Control Preservation in LLM Coding Agentscited by 5
- 2026Toward Pre-Deployment Assurance for Enterprise AI Agents: Ontology-Grounded Simulation and Trust Certificationcited by 1
- 2026Questionnaire Responses Do not Capture the Safety of AI Agentscited by 0
- 2026Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agentscited by 0
- 2026MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agentscited by 0
- 2026Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systemscited by 0
- 2026Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems15 Sep 2026
- 2026MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents14 Sep 2026
- 2026Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agents9 Aug 2026
- 2026Toward Pre-Deployment Assurance for Enterprise AI Agents: Ontology-Grounded Simulation and Trust Certification2 Jun 2026
- 2026ProcCtrlBench: Evaluating Process-Level Defects and Control Preservation in LLM Coding Agents18 May 2026
- 2026Questionnaire Responses Do not Capture the Safety of AI Agents15 Mar 2026
- 2025Inherent and emergent liability issues in LLM-based agentic systems: a principal-agent perspective4 Apr 2025
- 2024The AI risk repository: A meta-review, database, and taxonomy of risks from artificial intelligence14 Aug 2024
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agents5 Aug 2024
- 2023Generative agent-based modeling with actions grounded in physical, social, or digital space using Concordia6 Dec 2023
- 2025SafeDPO: A Simple Approach to Direct Preference Optimization with Enhanced Safetycited by 37
- 2025CASE-Bench: Context-Aware SafEty Benchmark for Large Language Modelscited by 17
- 2025Hedging and Non-Affirmation: Quantifying LLM Alignment on Questions of Human Rightscited by 1
- 2026VISPA: Pluralistic Alignment via Automatic Value Selection and Activationcited by 1
- 2026VISPA: Pluralistic Alignment via Automatic Value Selection and Activation19 Jan 2026
- 2025SafeDPO: A Simple Approach to Direct Preference Optimization with Enhanced Safety26 May 2025
- 2025Hedging and Non-Affirmation: Quantifying LLM Alignment on Questions of Human Rights26 Feb 2025
- 2025CASE-Bench: Context-Aware SafEty Benchmark for Large Language Models24 Jan 2025
- 2024GPT-4o System Cardcited by 4,467
- 2024Knowledge Conflicts for LLMs: A Surveycited by 274
- 2024LLMs instead of Human Judges? A Large Scale Empirical Study across 20 NLP Evaluation Taskscited by 236
- 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 225
- 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
- 2024Survey of Cultural Awareness in Language Models: Text and Beyondcited by 101
- 2025LLM Social Simulations Are a Promising Research Methodcited by 97
- 2024Visibility into AI Agentscited by 77
- 2024AIR-Bench 2024: A Safety Benchmark Based on Risk Categories from Regulations and Policiescited by 69
- 2024Clio: Privacy-Preserving Insights into Real-World AI Usecited by 66
- 2024Introducing v0.5 of the AI Safety Benchmark from MLCommonscited by 60
- 2025Can We Trust AI Benchmarks? An Interdisciplinary Review of Current Issues in AI Evaluationcited by 57
12 most cited of 117 All 117 (JSON)
- 2026Agents as Software: A Programming Languages Agenda for Agent Reliability26 Sep 2026
- 2026An Open Pipeline and Dashboard for Systemic-Risk Evidence under the EU AI Act's Code of Practice23 Sep 2026
- 2026SafeAtlas-VL: Beyond Binary Multimodal Safety with Large-Scale Data and Guard Models29 Aug 2026
- 2026LAAF: A Layered Accountability Architecture Framework for LLM Applications27 Aug 2026
- 2026Monocultural Biases: Correlated biases in large language models lead to unequal systemic exclusion rates in hiring26 Aug 2026
- 2026Quantifying System-Level Harms from AI Adoption in Complex Sociotechnical Systems24 Aug 2026
- 2026Beyond "I Can't Help With That": How Child Safety Experts Evaluate AI Chatbot Safety8 Aug 2026
- 2026What Current AI Benchmarks Leave Unmeasured: Modality, Search, Citations, and Implications (for Safety Evaluations)6 Aug 2026
- 2026Studying People to Study AI: Expert Perspectives on the Epistemic Fit and Barriers of Human Research in AI Safety & Ethics6 Aug 2026
- 2026Polistemics: Evaluating LLMs as Information Mediators in Politics & Elections28 Jul 2026
- 2026Why Public Service AI Governance Frameworks Risk Failing in the Age of General-Purpose AI: Lessons from Policing28 Jul 2026
- 2026Closing the AI Trust Gap: The Case for Independent Certification for Trustworthy AI17 Jul 2026
12 newest of 117 All 117 (JSON)