S-Eval: Towards Automated and Comprehensive Safety Evaluation for Large Language Models
Not on the map. Why?
Abstract (arXiv)
Generative large language models (LLMs) have revolutionized natural language processing with their transformative and emergent capabilities. However, recent evidence indicates that LLMs can produce harmful content that violates social norms, raising significant concerns regarding the safety and ethical ramifications of deploying these advanced models. Thus, it is both critical and imperative to perform a rigorous and comprehensive safety evaluation of LLMs before deployment. Despite this need, owing to the extensiveness of LLM generation space, it still lacks a unified and standardized risk taxonomy to systematically reflect the LLM content safety, as well as automated safety assessment techniques to explore the potential risk efficiently. To bridge the striking gap, we propose S-Eval, a novel LLM-based automated Safety Evaluation framework with a newly defined comprehensive risk taxonomy. S-Eval incorporates two key components, i.e., an expert testing LLM Mt and a novel safety critique LLM Mc. Mt is responsible for automatically generating test cases in accordance with the proposed risk taxonomy. Mc can provide quantitative and explainable safety evaluations for better risk awareness of LLMs. In contrast to prior works, S-Eval is efficient and effective in test generation and safety evaluation. Moreover, S-Eval can be flexibly configured and adapted to the rapid evolution of LLMs and accompanying new safety threats, test generation methods and safety critique methods thanks to the LLM-based architecture. S-Eval has been deployed in our industrial partner for the automated safety evaluation of multiple LLMs serving millions of users, demonstrating its effectiveness in real-world scenarios. Our benchmark is publicly available at https://github.com/IS2Lab/S-Eval.
Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). Builds on 34 of its 58 references that are in the map. First posted on arXiv 23 May 2024.
Builds on
34 of 58 references.
References · 34
- 2017Attention Is All You Needcited by 59,932
- 2023GPT-4 Technical Reportcited by 18,132
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2023Qwen Technical Reportcited by 3,273
- 2023Mistral 7Bcited by 3,065
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2021Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processingcited by 2,222
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
- 2021GLM: General Language Model Pretraining with Autoregressive Blank Infillingcited by 1,026
- 2023A Multitask, Multilingual, Multimodal Evaluation of ChatGPT on Reasoning, Hallucination, and Interactivitycited by 888
22 more
- 2020Aligning AI With Shared Human Valuescited by 706
- 2024Yi: Open Foundation Models by 01.AIcited by 706
- 2021BBQ: A Hand-Built Bias Benchmark for Question Answeringcited by 683
- 2023Baichuan 2: Open Large-scale Language Modelscited by 664
- 2023A Prompt Pattern Catalog to Enhance Prompt Engineering with ChatGPTcited by 612
- 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
- 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
- 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
- 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
- 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 337
- 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
- 2024R-Judge: Benchmarking Safety Risk Awareness for LLM Agentscited by 268
- 2020AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Promptscited by 246
- 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 225
- 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 213
- 2021Societal Biases in Language Generation: Progress and Challengescited by 201
- 2023Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMscited by 176
- 2023Does Synthetic Data Generation of LLMs Help Clinical Text Mining?cited by 151
- 2023CValues: Measuring the Values of Chinese Large Language Models from Safety to Responsibilitycited by 80
- 2023Prompt Packer: Deceiving LLMs through Compositional Instruction with Hidden Attackscited by 30
- 2023Language Model Unalignment: Parametric Red-Teaming to Expose Hidden Harms and Biasescited by 21
- 2023Beyond Classification: Financial Reasoning in State-of-the-Art Language Modelscited by 18
Built on by
Citing papers per year: 2024: 4; 2025: 14; 2026: 10.
28 papers.
Sort:
By area:
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
- 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
- 2025o3-mini vs DeepSeek-R1: Which One is Safer?cited by 24
- 2025Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findingscited by 24
- 2024Eureka: Evaluating and Understanding Large Foundation Modelscited by 18
- 2025Personalized Safety in LLMs: A Benchmark and A Planning-Based Agent Approachcited by 14
- 2025Early External Safety Testing of OpenAI's o3-mini: Insights from the Pre-Deployment Evaluationcited by 13
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Trainingcited by 7
- 2025Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awarenesscited by 7
- 2025LLM Content Moderation and User Satisfaction: Evidence from Response Refusals in Chatbot Arenacited by 6
- 2025Red Teaming Contemporary AI Models: Insights from Spanish and Basque Perspectivescited by 6
- 2025ORFuzz: Fuzzing the "Other Side" of LLM Safety -- Testing Over-Refusalcited by 6
16 more
- 2025Kelp: A Streaming Safeguard for Large Models via Latent Dynamics-Guided Risk Detectioncited by 6
- 2024Weak-to-Strong Generalization beyond Accuracy: a Pilot Study in Safety, Toxicity, and Legal Reasoningcited by 4
- 2025Controlling the Risk of Corrupted Contexts for Language Models via Early-Exitingcited by 3
- 2026Using LLM-as-a-Judge/Jury to Advance Scalable, Clinically-Validated Safety Evaluations of Model Responses to Users Demonstrating Psychosiscited by 3
- 2025DeepKnown-Guard: A Proprietary Model-Based Safety Response Framework for AI Agentscited by 2
- 2026ASEval: Automated Trajectory-Level Security Testing for Autonomous Agentscited by 2
- 2024Ollabench: Evaluating LLMs' Reasoning for Human-centric Interdependent Cybersecuritycited by 1
- 2026A Systematic Review of Algorithmic Red Teaming Methodologies for Assurance and Security of AI Applicationscited by 1
- 2024LeCov: Multi-level Testing Criteria for Large Language Modelscited by 0
- 2026Beyond Parameter Arithmetic: Sparse Complementary Fusion for Distribution-Aware Model Mergingcited by 0
- 2026MESA: Improving MoE Safety Alignment via Decentralized Expertisecited by 0
- 2026DDOR: Delta Debugging for Explainable Overrefusal Testing and Repaircited by 0
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Modelscited by 0
- 2026Expectation Alignment of Language Models for Real-World User Expectationscited by 0
- 2026When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Modelscited by 0
- 2026HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscationcited by 0
- 2026HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation1 Sep 2026
- 2026When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models4 Aug 2026
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Models3 Jul 2026
- 2026Expectation Alignment of Language Models for Real-World User Expectations2 Jun 2026
- 2026DDOR: Delta Debugging for Explainable Overrefusal Testing and Repair2 Jun 2026
- 2026MESA: Improving MoE Safety Alignment via Decentralized Expertise30 May 2026
- 2026ASEval: Automated Trajectory-Level Security Testing for Autonomous Agents21 May 2026
- 2026Using LLM-as-a-Judge/Jury to Advance Scalable, Clinically-Validated Safety Evaluations of Model Responses to Users Demonstrating Psychosis20 Mar 2026
- 2026A Systematic Review of Algorithmic Red Teaming Methodologies for Assurance and Security of AI Applications24 Feb 2026
- 2026Beyond Parameter Arithmetic: Sparse Complementary Fusion for Distribution-Aware Model Merging12 Feb 2026
- 2025DeepKnown-Guard: A Proprietary Model-Based Safety Response Framework for AI Agents5 Nov 2025
- 2025Kelp: A Streaming Safeguard for Large Models via Latent Dynamics-Guided Risk Detection9 Oct 2025
16 more
- 2025Controlling the Risk of Corrupted Contexts for Language Models via Early-Exiting2 Oct 2025
- 2025Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awareness30 Aug 2025
- 2025ORFuzz: Fuzzing the "Other Side" of LLM Safety -- Testing Over-Refusal15 Aug 2025
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Training12 Aug 2025
- 2025Large Language Models Often Know When They Are Being Evaluated28 May 2025
- 2025Personalized Safety in LLMs: A Benchmark and A Planning-Based Agent Approach24 May 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findings19 Mar 2025
- 2025Red Teaming Contemporary AI Models: Insights from Spanish and Basque Perspectives13 Mar 2025
- 2025o3-mini vs DeepSeek-R1: Which One is Safer?30 Jan 2025
- 2025Early External Safety Testing of OpenAI's o3-mini: Insights from the Pre-Deployment Evaluation29 Jan 2025
- 2025LLM Content Moderation and User Satisfaction: Evidence from Response Refusals in Chatbot Arena4 Jan 2025
- 2024Weak-to-Strong Generalization beyond Accuracy: a Pilot Study in Safety, Toxicity, and Legal Reasoning16 Oct 2024
- 2024Eureka: Evaluating and Understanding Large Foundation Models13 Sep 2024
- 2024LeCov: Multi-level Testing Criteria for Large Language Models20 Aug 2024
- 2024Ollabench: Evaluating LLMs' Reasoning for Human-centric Interdependent Cybersecurity11 Jun 2024
- 2025LLM Content Moderation and User Satisfaction: Evidence from Response Refusals in Chatbot Arenacited by 6
- 2025Red Teaming Contemporary AI Models: Insights from Spanish and Basque Perspectivescited by 6
- 2025ORFuzz: Fuzzing the "Other Side" of LLM Safety -- Testing Over-Refusalcited by 6
- 2025Kelp: A Streaming Safeguard for Large Models via Latent Dynamics-Guided Risk Detectioncited by 6
- 2026When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Modelscited by 0
- 2026HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscationcited by 0
- 2026HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation1 Sep 2026
- 2026When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models4 Aug 2026
- 2025Kelp: A Streaming Safeguard for Large Models via Latent Dynamics-Guided Risk Detection9 Oct 2025
- 2025ORFuzz: Fuzzing the "Other Side" of LLM Safety -- Testing Over-Refusal15 Aug 2025
- 2025Red Teaming Contemporary AI Models: Insights from Spanish and Basque Perspectives13 Mar 2025
- 2025LLM Content Moderation and User Satisfaction: Evidence from Response Refusals in Chatbot Arena4 Jan 2025
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Trainingcited by 7
- 2026MESA: Improving MoE Safety Alignment via Decentralized Expertisecited by 0
- 2026DDOR: Delta Debugging for Explainable Overrefusal Testing and Repaircited by 0
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Modelscited by 0
- 2026Expectation Alignment of Language Models for Real-World User Expectationscited by 0
- 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Models3 Jul 2026
- 2026Expectation Alignment of Language Models for Real-World User Expectations2 Jun 2026
- 2026DDOR: Delta Debugging for Explainable Overrefusal Testing and Repair2 Jun 2026
- 2026MESA: Improving MoE Safety Alignment via Decentralized Expertise30 May 2026
- 2025Efficient Switchable Safety Control in LLMs via Magic-Token-Guided Co-Training12 Aug 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
- 2025o3-mini vs DeepSeek-R1: Which One is Safer?cited by 24
- 2025Early External Safety Testing of OpenAI's o3-mini: Insights from the Pre-Deployment Evaluationcited by 13
- 2024Weak-to-Strong Generalization beyond Accuracy: a Pilot Study in Safety, Toxicity, and Legal Reasoningcited by 4
- 2024Ollabench: Evaluating LLMs' Reasoning for Human-centric Interdependent Cybersecuritycited by 1
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025o3-mini vs DeepSeek-R1: Which One is Safer?30 Jan 2025
- 2025Early External Safety Testing of OpenAI's o3-mini: Insights from the Pre-Deployment Evaluation29 Jan 2025
- 2024Weak-to-Strong Generalization beyond Accuracy: a Pilot Study in Safety, Toxicity, and Legal Reasoning16 Oct 2024
- 2024Ollabench: Evaluating LLMs' Reasoning for Human-centric Interdependent Cybersecurity11 Jun 2024
- 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
- 2025Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findingscited by 24
- 2024Eureka: Evaluating and Understanding Large Foundation Modelscited by 18
- 2025Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awarenesscited by 7
- 2026Using LLM-as-a-Judge/Jury to Advance Scalable, Clinically-Validated Safety Evaluations of Model Responses to Users Demonstrating Psychosiscited by 3
- 2026A Systematic Review of Algorithmic Red Teaming Methodologies for Assurance and Security of AI Applicationscited by 1
- 2024LeCov: Multi-level Testing Criteria for Large Language Modelscited by 0
- 2026Beyond Parameter Arithmetic: Sparse Complementary Fusion for Distribution-Aware Model Mergingcited by 0
- 2026Using LLM-as-a-Judge/Jury to Advance Scalable, Clinically-Validated Safety Evaluations of Model Responses to Users Demonstrating Psychosis20 Mar 2026
- 2026A Systematic Review of Algorithmic Red Teaming Methodologies for Assurance and Security of AI Applications24 Feb 2026
- 2026Beyond Parameter Arithmetic: Sparse Complementary Fusion for Distribution-Aware Model Merging12 Feb 2026
- 2025Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awareness30 Aug 2025
- 2025Large Language Models Often Know When They Are Being Evaluated28 May 2025
- 2025Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findings19 Mar 2025
- 2024Eureka: Evaluating and Understanding Large Foundation Models13 Sep 2024
- 2024LeCov: Multi-level Testing Criteria for Large Language Models20 Aug 2024