mlsanityData to 7 Oct 2026

SimpleSafetyTests: a Test Suite for Identifying Critical Safety Risks in Large Language Models

arXiv 2311.08370 ↗First posted 14 Nov 2023cs.CLcited by 72

Not on the map. Why?

Cited by 33 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The past year has seen rapid acceleration in the development of large language models (LLMs). However, without proper steering and safeguards, LLMs will readily follow malicious instructions, provide unsafe advice, and generate toxic content. We introduce SimpleSafetyTests (SST) as a new test suite for rapidly and systematically identifying such critical safety risks. The test suite comprises 100 test prompts across five harm areas that LLMs, for the vast majority of applications, should refuse to comply with. We test 11 open-access and open-source LLMs and four closed-source LLMs, and find critical safety weaknesses. While some of the models do not give a single unsafe response, most give unsafe responses to more than 20% of the prompts, with over 50% unsafe responses in the extreme. Prepending a safety-emphasising system prompt substantially reduces the occurrence of unsafe responses, but does not completely stop them from happening. Trained annotators labelled every model response to SST (n = 3,000). We use these annotations to evaluate five AI safety filters (which assess whether a models' response is unsafe given a prompt) as a way of automatically evaluating models' performance on SST. The filters' performance varies considerably. There are also differences across the five harm areas, and on the unsafe versus safe responses. The widely-used Perspective API has 72% accuracy and a newly-created zero-shot prompt to OpenAI's GPT-4 performs best with 89% accuracy. Content Warning: This paper contains prompts and responses that relate to child abuse, suicide, self-harm and eating disorders, scams and fraud, illegal items, and physical harm.

Key facts. Cited by 72 papers in the map (data through 7 Oct 2026). Builds on 15 of its 37 references that are in the map. First posted on arXiv 14 Nov 2023.

Builds on

15 of 37 references.

References · 15

  1. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  2. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  3. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  4. 2021Ethical and social risks of harm from Language Modelscited by 957
  5. 2023The RefinedWeb Dataset for Falcon LLM: Outperforming Curated Corpora with Web Data, and Web Data Onlycited by 755
  6. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 630
  7. 2022Improving alignment of dialogue agents via targeted human judgementscited by 527
  8. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
  9. 2022ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and Implicit Hate Speech Detectioncited by 419
  10. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  11. 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 224
  12. 2021MultiVerS: Improving scientific claim verification with weak supervision and full-document contextcited by 140
3 more
  1. 2023Safety-Gymnasium: A Unified Safe Reinforcement Learning Benchmarkcited by 135
  2. 2023Harms from Increasingly Agentic Algorithmic Systemscited by 134
  3. 2023Safety and Fairness for Content Moderation in Generative Modelscited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 18; 2025: 24; 2026: 28.

72 papers.

Sort:

By area:

  1. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  2. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  3. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 224
  4. 2024An Introduction to Vision-Language Modelingcited by 175
  5. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 158
  6. 2024AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Expertscited by 126
  7. 2025Qwen3Guard Technical Reportcited by 125
  8. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
  9. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 103
  10. 2025GuardReasoner: Towards Reasoning-based LLM Safeguardscited by 89
  11. 2024SafetyPrompts: a Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safetycited by 75
  12. 2025STAR-1: Safer Alignment of Reasoning LLMs with 1K Datacited by 67
38 more
  1. 2024Introducing v0.5 of the AI Safety Benchmark from MLCommonscited by 60
  2. 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
  3. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 38
  4. 2024Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirementscited by 35
  5. 2024Backtracking Improves Generation Safetycited by 31
  6. 2025o3-mini vs DeepSeek-R1: Which One is Safer?cited by 24
  7. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 22
  8. 2024On Calibration of LLM-based Guard Models for Reliable Content Moderationcited by 21
  9. 2025CASE-Bench: Context-Aware SafEty Benchmark for Large Language Modelscited by 17
  10. 2025Investigating the Impact of Quantization Methods on the Safety and Reliability of Large Language Modelscited by 17
  11. 2024CantTalkAboutThis: Aligning Language Models to Stay on Topic in Dialoguescited by 15
  12. 2025Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Modelscited by 14
  13. 2025SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identificationcited by 14
  14. 2026YuFeng-XGuard: A Reasoning-Centric, Interpretable, and Flexible Guardrail Model for Large Language Modelscited by 14
  15. 2025Early External Safety Testing of OpenAI's o3-mini: Insights from the Pre-Deployment Evaluationcited by 13
  16. 2024The Responsible Foundation Model Development Cheatsheet: A Review of Tools & Resourcescited by 11
  17. 2025K2-Think: A Parameter-Efficient Reasoning Systemcited by 11
  18. 2025Think Twice, Generate Once: Safeguarding by Progressive Self-Reflectioncited by 11
  19. 2024SafetyAnalyst: Interpretable, Transparent, and Steerable Safety Moderation for AI Behaviorcited by 10
  20. 2024How Are LLMs Mitigating Stereotyping Harms? Learning from Search Engine Studiescited by 9
  21. 2025ASTRAL: Automated Safety Testing of Large Language Modelscited by 7
  22. 2023In Generative AI we Trust: Can Chatbots Effectively Verify Political Information?cited by 6
  23. 2024FRACTURED-SORRY-Bench: Framework for Revealing Attacks in Conversational Turns Undermining Refusal Efficacy and Defenses over SORRY-Bench (Automated Multi-shot Jailbreaks)cited by 6
  24. 2026Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMscited by 6
  25. 2025Efficient Safety Retrofitting Against Jailbreaking for LLMscited by 4
  26. 2025Efficient LLM Moderation with Multi-Layer Latent Prototypescited by 4
  27. 2026Beyond Simulations: What 20,000 Real Conversations Reveal About Mental Health AI Safetycited by 4
  28. 2026GLiGuard: Schema-Conditioned Classification for LLM Safeguardcited by 4
  29. 2026SingGuard: A Policy-Adaptive Multimodal LLM Guardrail with Dynamic Reasoningcited by 4
  30. 2025Societal Impacts Research Requires Benchmarks for Creative Composition Taskscited by 3
  31. 2025Calibrated Predictive Lower Bounds on Time-to-Unsafe-Sampling in LLMscited by 3
  32. 2026NExT-Guard: Training-Free Streaming Safeguard without Token-Level Labelscited by 3
  33. 2025Fact-checking with Generative AI: A Systematic Cross-Topic Examination of LLMs Capacity to Detect Veracity of Political Informationcited by 2
  34. 2025Interpreting LLM-as-a-Judge Policies via Verifiable Global Explanationscited by 2
  35. 2025Taxonomy-Adaptive Moderation Model with Robust Guardrails for Large Language Modelscited by 2
  36. 2025AprielGuardcited by 2
  37. 2025ProGuard: Towards Proactive Multimodal Safeguardcited by 2
  38. 2026Predict, Don't React: Value-Based Safety Forecasting for LLM Streamingcited by 2

50 most cited of 72 All 72 (JSON)