BELLS: A Framework Towards Future Proof Benchmarks for the Evaluation of LLM Safeguards
Not on the map. Why?
Abstract (arXiv)
Input-output safeguards are used to detect anomalies in the traces produced by Large Language Models (LLMs) systems. These detectors are at the core of diverse safety-critical applications such as real-time monitoring, offline evaluation of traces, and content moderation. However, there is no widely recognized methodology to evaluate them. To fill this gap, we introduce the Benchmarks for the Evaluation of LLM Safeguards (BELLS), a structured collection of tests, organized into three categories: (1) established failure tests, based on already-existing benchmarks for well-defined failure modes, aiming to compare the performance of current input-output safeguards; (2) emerging failure tests, to measure generalization to never-seen-before failure modes and encourage the development of more general safeguards; (3) next-gen architecture tests, for more complex scaffolding (such as LLM-agents and multi-agent systems), aiming to foster the development of safeguards that could adapt to future applications for which no safeguard currently exists. Furthermore, we implement and share the first next-gen architecture test, using the MACHIAVELLI environment, along with an interactive visualization of the dataset.
Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Builds on 14 of its 30 references that are in the map. First posted on arXiv 3 Jun 2024.
Builds on
14 of 30 references.
References · 14
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,422
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2023GAIA: a benchmark for General AI Assistantscited by 1,084
- 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 805
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
- 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
- 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
- 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 224
- 2023An Overview of Catastrophic AI Riskscited by 214
- 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
- 2022A New Generation of Perspective API: Efficient Multilingual Character-level Transformerscited by 181
Built on by
Citing papers per year: 2024: 4; 2025: 6; 2026: 3.
13 papers.
Sort:
By area:
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
- 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
- 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMscited by 23
- 2025Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judgecited by 23
- 2025RealHarm: A Collection of Real-World Language Model Application Failurescited by 7
- 2025Is Reasoning All You Need? Probing Bias in the Age of Reasoning Language Modelscited by 4
- 2024Output Scouting: Auditing Large Language Models for Catastrophic Responsescited by 1
- 2026Risk-Adjusted Harm Scoring for Automated Red Teaming for LLMs in Financial Servicescited by 1
- 2026BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systemscited by 1
- 2025The bitter lesson of misuse detectioncited by 0
1 more
- 2026Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks14 Sep 2026
- 2026BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systems12 Jun 2026
- 2026Risk-Adjusted Harm Scoring for Automated Red Teaming for LLMs in Financial Services11 Mar 2026
- 2025The bitter lesson of misuse detection8 Jul 2025
- 2025Is Reasoning All You Need? Probing Bias in the Age of Reasoning Language Models3 Jul 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025RealHarm: A Collection of Real-World Language Model Application Failures14 Apr 2025
- 2025Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judge10 Apr 2025
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar 2025
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct 2024
- 2024Output Scouting: Auditing Large Language Models for Catastrophic Responses4 Oct 2024
- 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs13 Jun 2024
1 more
- 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
- 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMscited by 23
- 2025Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judgecited by 23
- 2024Output Scouting: Auditing Large Language Models for Catastrophic Responsescited by 1
- 2026Risk-Adjusted Harm Scoring for Automated Red Teaming for LLMs in Financial Servicescited by 1
- 2026BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systemscited by 1
- 2025The bitter lesson of misuse detectioncited by 0
- 2026BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systems12 Jun 2026
- 2026Risk-Adjusted Harm Scoring for Automated Red Teaming for LLMs in Financial Services11 Mar 2026
- 2025The bitter lesson of misuse detection8 Jul 2025
- 2025Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judge10 Apr 2025
- 2024Output Scouting: Auditing Large Language Models for Catastrophic Responses4 Oct 2024
- 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs13 Jun 2024
- 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs7 Jun 2024
Similar, not cited
Close in wording, no citation either way
- 2026Who Tests the Testers? Systematic Enumeration and Coverage Audit of LLM Agent Tool Call Safety
- 2026Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents
- 2025LLM-Safety Evaluations Lack Robustness
- 2024Current state of LLM Risks and AI Guardrails
- 2026LLM-enabled Applications Require System-Level Threat Monitoring
- 2026TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
- 2025SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks