This report introduces version 1.0 of AILuminate, a safety benchmark for AI products developed by the MLCommons AI Risk and Reliability working group in partnership with the AI Verify Foundation. Correspondence is listed to Shaona Ghosh (NVIDIA), Marisa Boston, Heather Frase (Veraitech), Sarah Luger and Peter Mattson (MLCommons), with contributors from Meta FAIR, Bocconi University, Oxford, UL Research Institutes, PRISM Eval, TU Darmstadt, Contextual AI, Google DeepMind, Sony AI, Qualcomm, Accenture, Rochester Institute of Technology, Lawrence Berkeley National Laboratory and Iowa State, among others. It was posted to arXiv as 2503.05731 in 2025, following a v0.5 release.
The report describes the benchmark as an industry standard for assessing an AI system's resistance to prompts designed to elicit dangerous, illegal or undesirable behaviour, and names three audiences: model providers, model integrators, and standards bodies and policymakers. It states that results "should be interpreted strictly as system-level risk and reliability measurements in specific hazard categories and use cases" and that no evaluation system can guarantee safety.
Summary
Components
The benchmark has five components: an assessment standard defining the hazards and the guidelines for judging responses; practice and official prompt datasets; a response evaluator built on models fine-tuned for the task; a grading and reporting system; and the technical and organisational infrastructure to operate and evolve the benchmark.
Twelve hazard categories are covered: violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, indiscriminate weapons, suicide and self-harm, intellectual property, privacy, defamation, hate, sexual content, and specialized advice spanning election, financial, health and legal.
Prompt datasets
Version 1.0 is English-only, with French, Hindi and Simplified Chinese planned. Two conceptually identical datasets are drawn at random from the same prompt pool: a practice set for developer testing and an official set used for grading and reporting. Each holds 12,000 prompts, 1,000 per hazard category, for 24,000 in total. A 10% subset of the practice set is public under CC-BY 4.0 and the full practice set is available on request; the official set stays confidential to resist overfitting, and reserve prompts can be rotated into it and monitored for signs of overfitting. Within each category, prompts represent two user personas, the first being naive users who straightforwardly solicit a hazardous response. Prompts were written by contracted suppliers rather than drawn from real user interactions.
Evaluator and grading
Responses are classified as violating or non-violating by an automatic evaluator rather than by humans, on the grounds that human evaluation does not scale and is hard to make repeatable; a small number of human ratings is used to assess and improve the evaluator. The surrounding software, ModelBench, holds the prompt database and a runner that sends prompts to the system under test, receives responses and passes prompt-response pairs to the evaluator.
A system's score is the percentage of violating responses. Grades use five named tiers. Excellent requires an absolute score at or below 0.1% violating responses, a threshold the report says is well above what systems currently reach and is set to encourage progress. The other four are relative: the score is divided by a reference score to give a ratio, with Very Good at 0.5 or below, Good between 0.5 and 1.5, Fair from 1.5 to below 3, and Poor at 3 or above. The same scheme produces both the overall grade and per-hazard grades.
The reference system is a composite of the two best-scoring accessible systems, defined as having fewer than 15 billion parameters and relatively open weights, taking the higher (worse) of their two scores overall and per hazard. The report notes this guarantees at least two accessible systems grade Good or better, and that the reference will likely improve over time, raising the bar. The stated grading goals include a single top-level grade for non-technical decisions such as whether to release, buy or permit a system, alongside hazard-specific grades.
Three sources of scoring uncertainty are named: prompt sampling from an effectively infinite linguistic space, evaluator classification error, and response variance from temperature and other randomness. The report expects evaluator error to be large relative to the others.
Limitations
The report lists its scope limits first: only the hazards and personas in the assessment standard are tested, excluding untestable hazards such as environmental impact, unlisted ones such as bias, and unlisted personas such as expert adversarial users — and it states directly that "an expert adversarial user attacking a specific model with adaptive techniques would achieve a substantially higher unsafe rate." The assessment standard is not regionalised: a multilingual team wrote the prompts and evaluator guidelines in American English and in alignment with US cultural norms.
Second, the interactions are human-engineered and single-turn, neither recorded from real users nor testing sustained multi-turn context. Third, uncertainty is significant, and the report lists specific improvements to its own process, including clearer annotation guidelines, more sessions with annotators, more human annotations per response, and transparency in the feedback mechanism.
The abstract names continued development in multi-turn interaction, multimodal understanding, additional languages and emerging hazard categories.
Initial results
Initial results cover systems chosen on stated criteria: the four vendors of greatest public interest (Anthropic, Google, Meta and OpenAI); for each target language, a vendor of greatest interest in the country with the most speakers of that language, which for French was Mistral; sponsors who opted in; and OLMo v1.0 as a control, chosen as coming from a high-trust nonprofit with open training data and being older and less safety-optimised, to demonstrate the benchmark's difficulty. The numbers themselves are published at the MLCommons site rather than in the report, because they may be updated live.
Key claims
- 24,000 English prompts in two 12,000-prompt sets, 1,000 per hazard category, across 12 hazard categories and two personas; official set confidential, 10% of practice set public.
- Score is the percentage of violating responses; Excellent requires ≤0.1% absolute, the other four tiers are ratios against a reference.
- The reference is a composite of the two best systems under 15 billion parameters with relatively open weights, taking the worse score.
- Evaluation is automatic, with human ratings used to assess the evaluator; evaluator error is expected to be the largest source of uncertainty.
- Single-turn, English-only, US-norm-aligned, and excluding expert adversarial users, who the report says would produce substantially higher unsafe rates.
Provenance
Retrieved 22 September 2026 from the arXiv HTML rendering (arxiv.org); abstract page arxiv.org. Results are published at mlcommons.org; the public practice subset is at github.com and the harness at github.com.
Relationships
- supports: AILuminate — the primary text behind the benchmark's description, grading scheme and stated limits.
- instance-of: AI Benchmarks and Evaluation
- related: StrongREJECT, AgentHarm — adjacent safety and refusal benchmarks.