What a Good Public Safety Benchmark Still Leaves to You

MLCommons and its collaborators have done something hard. AILuminate is a public, versioned way to compare how AI systems handle 12 hazard areas, from violent crimes to privacy. The prompt sets are written by MLCommons and kept confidential so models cannot memorize them. The scoring follows a published standard and a fixed reference panel. This is careful work, and the field needed it.

We read the results closely and have three additions. They come from what we see when enterprises put AI into production.

1. A benchmark should be there when you want to run it

A safety score is most useful when a team can ask for it at the moment it changes something: a new model, a new policy, a new guardrail. Official results come from scheduled rounds. The latest one began on September 22 and published on October 29. The full practice sets are available to MLCommons members. The public repository holds a 1,200-prompt demo set, a tenth of the practice set.

A team that wants to know today whether Tuesday's change made things better should be able to run the test today. It should be able to run it again tomorrow, without weighing what each run will cost. A test that is rationed gets run less often, and a test that is run less often finds problems later.

2. One message at a time is not how attacks arrive

The current published results cover single-turn, text-to-text requests in US English. That is a clean design for comparing systems. It leaves out most of what happens in a real deployment.

Real attacks often start with a harmless question, add a plausible purpose, and ask for a little more each turn. Others pack a long run of examples into one request. Others arrive through a document, a web page or a tool result the assistant was asked to read. A check that reads one message at a time can pass every step of such a conversation.

In our own small test, two leading safety models caught between 73% and 87% of escalating conversations, and a general-purpose Cortega model caught all of them. The direction matches what we see in the field.

3. Test continuously

Cortega recommends continuous testing. RedTeam runs versioned scenarios against a target, stores every result, replays the same attacks after a fix, and compares runs side by side. The AILuminate demo prompts are in RedTeam as ready-to-run scenarios, next to multi-turn escalations, long-prompt attacks and tool-injection tests. A team can re-run them whenever the model, the prompt or the policy changes.

A separate result

We also measured our guardrails against the safety models named on the AILuminate page (https://cortega.ai/blog/ailuminate-guardrails-vs-safety-models). In one sentence: Cortega Agentic Firewall that used general-purpose models in AWS matched the best safety model we tried on hazard prompts when set to a strict policy, and held up on multi-turn attacks as well. A customer can use models it already has access to, with no extra models to host!

Not affiliated with or endorsed by MLCommons.