The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMs
Not on the map. Why?
Abstract (arXiv)
With the rapid advancement of artificial intelligence, Large Language Models (LLMs) have shown remarkable capabilities in Natural Language Processing (NLP), including content generation, human-computer interaction, machine translation, and code generation. However, their widespread deployment has also raised significant safety concerns. In particular, LLM-generated content can exhibit unsafe behaviors such as toxicity, bias, or misinformation, especially in adversarial contexts, which has attracted increasing attention from both academia and industry. Although numerous studies have attempted to evaluate these risks, a comprehensive and systematic survey on safety evaluation of LLMs is still lacking. This work aims to fill this gap by presenting a structured overview of recent advances in safety evaluation of LLMs. Specifically, we propose a four-dimensional taxonomy: (i) Why to evaluate, which explores the background of safety evaluation of LLMs, how they differ from general LLMs evaluation, and the significance of such evaluation; (ii) What to evaluate, which examines and categorizes existing safety evaluation tasks based on key capabilities, including dimensions such as toxicity, robustness, ethics, bias and fairness, truthfulness, and related aspects; (iii) Where to evaluate, which summarizes the evaluation metrics, datasets and benchmarks currently used in safety evaluations; (iv) How to evaluate, which reviews existing mainstream evaluation methods based on the roles of the evaluators and some evaluation frameworks that integrate the entire evaluation pipeline. Finally, we identify the challenges in safety evaluation of LLMs and propose promising research directions to promote further advancement in this field. We emphasize the necessity of prioritizing safety evaluation to ensure the reliable and responsible deployment of LLMs in real-world applications.
Key facts. Cited by 26 papers in the map (data through 14 Oct 2026). Builds on 233 of its 291 references that are in the map. First posted on arXiv 6 Jun 2025.
Builds on
233 of 291 references.
References · 233
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
- 2023GPT-4 Technical Reportcited by 18,396
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
38 more
- 2022Large Language Models are Zero-Shot Reasonerscited by 4,374
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2020Longformer: The Long-Document Transformercited by 3,413
- 2023Qwen Technical Reportcited by 3,344
- 2023Tree of Thoughts: Deliberate Problem Solving with Large Language Modelscited by 3,211
- 2023Mistral 7Bcited by 3,164
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2022Locating and Editing Factual Associations in GPTcited by 2,691
- 2023A Survey of Large Language Modelscited by 2,576
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
- 2022Survey of Hallucination in Natural Language Generationcited by 2,075
- 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
- 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,439
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2024A Survey on LLM-as-a-Judgecited by 1,423
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,282
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,255
- 2023A Survey on Evaluation of Large Language Modelscited by 1,242
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2023Large Language Models are not Fair Evaluatorscited by 1,085
- 2023A Survey on Multimodal Large Language Modelscited by 909
- 2023A Multitask, Multilingual, Multimodal Evaluation of ChatGPT on Reasoning, Hallucination, and Interactivitycited by 894
- 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 792
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
- 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 734
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 729
- 2020Aligning AI With Shared Human Valuescited by 723
- 2023Siren's Song in the AI Ocean: A Survey on Hallucination in Large Language Modelscited by 698
- 2024LLM Evaluators Recognize and Favor Their Own Generationscited by 686
- 2020SummEval: Re-evaluating Summarization Evaluationcited by 674
- 2024A Survey on Large Language Models for Code Generationcited by 658
- 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
- 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 518
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
50 most cited of 233 All 233 (JSON)
Built on by
Citing papers per year: 2025: 8; 2026: 18.
26 papers.
Sort:
By area:
- 2026Safe Language Generation in the Limitcited by 9
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Modelscited by 6
- 2026Steering at the Source: Style Modulation Heads for Robust Persona Controlcited by 5
- 2025From "Aha Moments" to Controllable Thinking: Toward Meta-Cognitive Reasoning in Large Reasoning Models via Decoupled Reasoning and Controlcited by 4
- 2026When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAGcited by 4
- 2026How Real is Your Jailbreak? Fine-grained Jailbreak Evaluation with Anchored Referencecited by 3
- 2026IndicSafe: A Benchmark for Evaluating Multilingual LLM Safety in South Asiacited by 3
- 2026MHSafeEval: Role-Aware Interaction-Level Evaluation of Mental Health Safety in Large Language Modelscited by 3
- 2026Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAScited by 3
- 2026Safety is Contextual, LLM-Judges Are Not: Navigating the Rigid Priors of Evaluatorscited by 3
- 2025PRISON: Unmasking the Criminal Potential of Large Language Modelscited by 2
- 2025LLMEval-Fair: A Large-Scale Longitudinal Study on Robust and Fair Evaluation of Large Language Modelscited by 2
14 more
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Modelscited by 2
- 2025Safe for Whom? Rethinking How We Evaluate the Safety of LLMs for Real Userscited by 2
- 2026A Systematic Evaluation of Black-Box Uncertainty Estimation Methods for Large Language Modelscited by 2
- 2026Testing Retrieval-Augmented Generation Systems with Chunk Coveragecited by 2
- 2025SafetyFlow: An Agent-Flow System for Automated LLM Safety Benchmarkingcited by 1
- 2025Do You Feel Comfortable? Detecting Hidden Conversational Escalation in AI Chatbotscited by 1
- 2026JUBAKU: An Adversarial Benchmark for Exposing Culturally Grounded Stereotypes in Japanese LLMscited by 1
- 2025Constrained Language Model Policy Optimization via Risk-aware Stepwise Alignmentcited by 0
- 2026Taiwan Safety Benchmark and Breeze Guard: Toward Trustworthy AI for Taiwanese Mandarincited by 0
- 2026Magic, Madness, Heaven, Sin: LLM Output Diversity is Everything, Everywhere, All at Oncecited by 0
- 2026Efficient Safety Benchmarking via Item Response Theorycited by 0
- 2026EvalSafetyGap: A Hybrid Survey and Conceptual Framework for LLM Evaluation-Safety Failurescited by 0
- 2026No One Model Catches Every Harm: Benchmarking Content Moderation Across Safety Scenarioscited by 0
- 2026AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreakscited by 0
- 2026AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks3 Sep 2026
- 2026No One Model Catches Every Harm: Benchmarking Content Moderation Across Safety Scenarios22 Aug 2026
- 2026Testing Retrieval-Augmented Generation Systems with Chunk Coverage20 Jul 2026
- 2026EvalSafetyGap: A Hybrid Survey and Conceptual Framework for LLM Evaluation-Safety Failures29 Jun 2026
- 2026A Systematic Evaluation of Black-Box Uncertainty Estimation Methods for Large Language Models18 Jun 2026
- 2026Safety is Contextual, LLM-Judges Are Not: Navigating the Rigid Priors of Evaluators5 Jun 2026
- 2026Efficient Safety Benchmarking via Item Response Theory26 May 2026
- 2026Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS25 May 2026
- 2026MHSafeEval: Role-Aware Interaction-Level Evaluation of Mental Health Safety in Large Language Models20 Apr 2026
- 2026Magic, Madness, Heaven, Sin: LLM Output Diversity is Everything, Everywhere, All at Once2 Apr 2026
- 2026JUBAKU: An Adversarial Benchmark for Exposing Culturally Grounded Stereotypes in Japanese LLMs21 Mar 2026
- 2026IndicSafe: A Benchmark for Evaluating Multilingual LLM Safety in South Asia18 Mar 2026
14 more
- 2026Taiwan Safety Benchmark and Breeze Guard: Toward Trustworthy AI for Taiwanese Mandarin7 Mar 2026
- 2026When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG4 Mar 2026
- 2026Steering at the Source: Style Modulation Heads for Robust Persona Control24 Feb 2026
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Models21 Jan 2026
- 2026Safe Language Generation in the Limit13 Jan 2026
- 2026How Real is Your Jailbreak? Fine-grained Jailbreak Evaluation with Anchored Reference4 Jan 2026
- 2025Constrained Language Model Policy Optimization via Risk-aware Stepwise Alignment30 Dec 2025
- 2025Safe for Whom? Rethinking How We Evaluate the Safety of LLMs for Real Users11 Dec 2025
- 2025Do You Feel Comfortable? Detecting Hidden Conversational Escalation in AI Chatbots5 Dec 2025
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Models1 Nov 2025
- 2025SafetyFlow: An Agent-Flow System for Automated LLM Safety Benchmarking21 Aug 2025
- 2025LLMEval-Fair: A Large-Scale Longitudinal Study on Robust and Fair Evaluation of Large Language Models7 Aug 2025
- 2025From "Aha Moments" to Controllable Thinking: Toward Meta-Cognitive Reasoning in Large Reasoning Models via Decoupled Reasoning and Control6 Aug 2025
- 2025PRISON: Unmasking the Criminal Potential of Large Language Models19 Jun 2025
- 2026Safe Language Generation in the Limitcited by 9
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Modelscited by 6
- 2026MHSafeEval: Role-Aware Interaction-Level Evaluation of Mental Health Safety in Large Language Modelscited by 3
- 2026Safety is Contextual, LLM-Judges Are Not: Navigating the Rigid Priors of Evaluatorscited by 3
- 2025PRISON: Unmasking the Criminal Potential of Large Language Modelscited by 2
- 2025LLMEval-Fair: A Large-Scale Longitudinal Study on Robust and Fair Evaluation of Large Language Modelscited by 2
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Modelscited by 2
- 2026A Systematic Evaluation of Black-Box Uncertainty Estimation Methods for Large Language Modelscited by 2
- 2025Do You Feel Comfortable? Detecting Hidden Conversational Escalation in AI Chatbotscited by 1
- 2026JUBAKU: An Adversarial Benchmark for Exposing Culturally Grounded Stereotypes in Japanese LLMscited by 1
- 2026Taiwan Safety Benchmark and Breeze Guard: Toward Trustworthy AI for Taiwanese Mandarincited by 0
- 2026Magic, Madness, Heaven, Sin: LLM Output Diversity is Everything, Everywhere, All at Oncecited by 0
12 most cited of 14 All 14 (JSON)
- 2026EvalSafetyGap: A Hybrid Survey and Conceptual Framework for LLM Evaluation-Safety Failures29 Jun 2026
- 2026A Systematic Evaluation of Black-Box Uncertainty Estimation Methods for Large Language Models18 Jun 2026
- 2026Safety is Contextual, LLM-Judges Are Not: Navigating the Rigid Priors of Evaluators5 Jun 2026
- 2026Efficient Safety Benchmarking via Item Response Theory26 May 2026
- 2026MHSafeEval: Role-Aware Interaction-Level Evaluation of Mental Health Safety in Large Language Models20 Apr 2026
- 2026Magic, Madness, Heaven, Sin: LLM Output Diversity is Everything, Everywhere, All at Once2 Apr 2026
- 2026JUBAKU: An Adversarial Benchmark for Exposing Culturally Grounded Stereotypes in Japanese LLMs21 Mar 2026
- 2026Taiwan Safety Benchmark and Breeze Guard: Toward Trustworthy AI for Taiwanese Mandarin7 Mar 2026
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Models21 Jan 2026
- 2026Safe Language Generation in the Limit13 Jan 2026
- 2025Do You Feel Comfortable? Detecting Hidden Conversational Escalation in AI Chatbots5 Dec 2025
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Models1 Nov 2025
12 newest of 14 All 14 (JSON)