EvalSafetyGap: A Hybrid Survey and Conceptual Framework for LLM Evaluation-Safety Failures
Not on the map. Why?
Abstract (arXiv)
This paper presents a systematic survey and conceptual synthesis of the shared measurement problem underlying large language model (LLM) evaluation and AI safety: benchmark scores, reward signals, and safety metrics can improve while the capabilities and alignment properties they are meant to represent remain uncertain. Synthesizing 373 primary studies published between 2018 and 2026, the survey organizes evidence on benchmark validity, contamination, dynamic evaluation, LLM-as-a-judge protocols, adversarial safety testing, reward and proxy optimization, mechanistic interpretability, and AI governance into an eight-stream evidence taxonomy. Building on this synthesis, we introduce EvalSafetyGap, a conceptual framework that unifies benchmark-validity and alignment-failure research as a shared proxy-target divergence problem under optimization pressure, formalized through a Goodhart-inspired Instability Decomposition and an Alignment Trilemma. An exploratory ten-model public-evidence audit illustrates the framework by showing why capability, behavioral robustness, and governance disclosure should be reported as separate evidence layers rather than collapsed into a single safety score. The survey closes with a research agenda for dynamic and contamination-resistant benchmarks, pre-specified multi-attempt threat models, version-locked evaluation, transparent source reporting, and validated mechanistic safety indicators, offering researchers, model developers, and AI auditors a shared vocabulary for measurement-aware LLM safety evaluation.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 117 of its 147 references that are in the map. First posted on arXiv 29 Jun 2026.
Builds on
117 of 147 references.
References · 117
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2021Training Verifiers to Solve Math Word Problemscited by 10,109
- 2021Evaluating Large Language Models Trained on Codecited by 8,320
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2017Deep reinforcement learning from human preferencescited by 3,912
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
- 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,879
- 2019Fine-Tuning Language Models from Human Preferencescited by 2,150
- 2024LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Codecited by 2,004
- 2022Beyond the Imitation Game: Quantifying and extrapolating the capabilities of language modelscited by 1,998
- 2016Concrete Problems in AI Safetycited by 1,642
38 more
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
- 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Promptingcited by 1,122
- 2022Scaling Laws for Reward Model Overoptimizationcited by 1,095
- 2023Towards Understanding Sycophancy in Language Modelscited by 1,040
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2020Beyond Accuracy: Behavioral Testing of NLP models with CheckListcited by 1,006
- 2020StereoSet: Measuring stereotypical bias in pretrained language modelscited by 924
- 2023Steering Language Models With Activation Engineeringcited by 922
- 2023A General Theoretical Paradigm to Understand Learning from Human Preferencescited by 912
- 2024Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluatorscited by 897
- 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 836
- 2023Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formattingcited by 817
- 2023Just Ask for Calibration: Strategies for Eliciting Calibrated Confidence Scores from Language Models Fine-Tuned with Human Feedbackcited by 812
- 2022Quantifying Memorization Across Neural Language Modelscited by 763
- 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedbackcited by 759
- 2023Measuring Faithfulness in Chain-of-Thought Reasoningcited by 703
- 2021BBQ: A Hand-Built Bias Benchmark for Question Answeringcited by 701
- 2024LLM Evaluators Recognize and Favor Their Own Generationscited by 686
- 2024RewardBench: Evaluating Reward Models for Language Modelingcited by 499
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
- 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
- 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
- 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
- 2023Detecting Pretraining Data from Large Language Modelscited by 387
- 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscationcited by 384
- 2024Justice or Prejudice? Quantifying Biases in LLM-as-a-Judgecited by 368
- 2024Alignment faking in large language modelscited by 360
- 2021AI and the Everything in the Whole Wide World Benchmarkcited by 349
- 2023NLP Evaluation in trouble: On the Need to Measure LLM Data Contamination for each Benchmarkcited by 348
- 2024Replacing Judges with Juries: Evaluating LLM Generations with a Panel of Diverse Modelscited by 326
- 2024Humans or LLMs as the Judge? A Study on Judgement Biasescited by 323
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
- 2024JudgeBench: A Benchmark for Evaluating LLM-based Judgescited by 318
- 2023Evaluating Large Language Models at Evaluating Instruction Followingcited by 302
50 most cited of 117 All 117 (JSON)
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judges
- 2025LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge
- 2024SG-Bench: Evaluating LLM Safety Generalization Across Diverse Tasks and Prompt Types
- 2024Large Language Model Safety: A Holistic Survey
- 2025AdversariaLLM: A Unified and Modular Toolbox for LLM Robustness Research
- 2024ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teaming
- 2025Picky LLMs and Unreliable RMs: An Empirical Study on Safety Alignment after Instruction Tuning
- 2025Safer or Luckier? LLMs as Safety Evaluators Are Not Robust to Artifacts