This paper introduces WMDP, the Weapons of Mass Destruction Proxy benchmark, and RMU, an unlearning method evaluated against it. Its first co-authors are Nathaniel Li (Center for AI Safety and UC Berkeley) and Alexander Pan (UC Berkeley), with second co-authors Anjali Gopal (MIT and SecureBio), Summer Yue and Daniel Berrios (Scale AI), and a large consortium of further authors from academia and technical consultancies; correspondence is to wmdp@safe.ai. It was posted to arXiv as 2403.03218 on 5 March 2024 (the version read is v7, 15 May 2024) and published at ICML 2024. Benchmark, code and models are released at wmdp.ai.
The stated motivation is that the White House Executive Order on AI highlights the risk of language models empowering malicious actors in developing biological, cyber and chemical weapons, but that existing hazardous-capability evaluations by governments and labs are private and cover a narrow range of scenarios, which the authors argue limits research into mitigation.
Summary
Benchmark design
WMDP is a dataset of 3,668 four-option multiple-choice questions that the paper describes as costing over $200,000 to develop. It is a proxy measurement: because a dataset of genuinely sensitive information would itself increase attacker capability, the authors collected questions whose content is "a precursor, neighbor, or component" of the hazardous knowledge they want to remove. The authors state that a model scoring low on WMDP likely lacks the knowledge needed for malicious use, but a high score does not by itself make a model unsafe, since the model may still lack the reasoning to chain knowledge into the steps needed to build a weapon.
Questions were written by academics and technical consultants working from threat models the authors built for each domain, and every question was checked by at least two experts from different organisations. The appendix breakdown gives 1,273 biosecurity questions across six categories (dual-use virology 228, bioweapons and bioterrorism 197, reverse genetics and easy editing 252, enhanced potential pandemic pathogens 233, viral vector research 228, expanding access 135); 1,987 cybersecurity questions across background knowledge, reconnaissance, four weaponization and vulnerability-discovery sub-categories, exploitation and post-exploitation; and 408 chemistry questions across general knowledge, synthesis, sourcing, purification, analysis, deployment, bypass mechanisms and miscellaneous.
The biosecurity threat model follows a design-build-test-learn chain and focuses on transmissible potential pandemic agents. The cyber threat model covers reconnaissance, weaponization and vulnerability discovery, exploitation and post-exploitation, with particular weight on weaponization. The chemistry threat model covers procurement, synthesis, purification and validation, transport and deployment. The paper primarily includes offensive rather than defensive knowledge, on the reasoning that unlearning defensive knowledge such as biosafety protocols would harm benign uses.
Three filters removed sensitive material: domain experts flagged questions under their own risk models and flagged questions were excluded; two additional experts cross-checked every WMDP-Bio and WMDP-Chem question; and external counsel assessed publication for compliance with US export controls under ITAR and EAR.
RMU and results
Representation Misdirection for Unlearning (RMU), inspired by representation engineering, perturbs model activations on hazardous data while preserving activations on benign data. Unlearning experiments were run on WMDP-Bio and WMDP-Cyber only, on zephyr-7b-beta, Yi-34b-Chat and Mixtral-8x7B-Instruct, with GPT-4 reported as an upper bound. Evaluation used a zero-shot format through lm-evaluation-harness v0.4.2, taking the top logit among A, B, C and D; chance is 25%.
Table 1 reports that RMU drops zephyr-7b from 63.7% to 31.2% on WMDP-Bio and from 44.0% to 28.2% on WMDP-Cyber while MMLU moves from 58.1% to 57.1%; Yi-34b from 75.3% to 30.7% and 49.7% to 29.0% (MMLU 72.6% to 70.6%); and Mixtral-8x7B from 74.8% to 34.0% and 52.0% to 30.8% (MMLU 68.2% to 67.1%). The baselines LLMU, SCRUB and SSD either failed to reduce WMDP accuracy or cut MMLU sharply. GPT-4 scored 82.2% on WMDP-Bio, 55.3% on WMDP-Cyber and 64.7% on WMDP-Chem. MT-Bench fell by 0.23, 0.06 and 0.13 points respectively on the three models.
Two robustness checks are reported. Linear probes trained on the unlearned models reached only slightly better than chance, which the authors read as evidence that RMU alters rather than masks the knowledge. The GCG attack jailbroke the base Yi-34b within 50 gradient steps but produced only gibberish from the unlearned model after 2,500 steps. The authors note that RMU unlearns from three layers and may obfuscate more than remove; fine-tuning after unlearning is outside their threat model. RMU also reduced accuracy on the MMLU topics closest to the unlearned domains, introductory virology and computer security, which the authors list as room for improvement.
As a check on the proxy, 122 biosecurity questions flagged as sensitive during development and removed from the release were held out as a private set; zephyr-7b's accuracy on the private set tracked its WMDP accuracy before and after unlearning.
Discussion and limitations
The authors frame unlearning as one component of a sociotechnical response, paired with structured API access under which approved users such as red-teamers or virology researchers receive the unrestricted model. Appendix D suggests WMDP could inform frameworks such as the NIST AI RMF and could act as a risk marker: a model above a threshold "could be flagged for more comprehensive evaluation, such as human red teaming." Limitations listed include that four-way multiple choice may miss hazards that surface only in end-to-end evaluation, that memorised facts score the same as understood ones, that the benchmark is static and cannot anticipate an evolving threat landscape so that relying on it alone "may yield a false sense of model safety after unlearning," and that the work addresses API-access models because unlearned information can be reintroduced into open-weight models.
Key claims
- 3,668 four-option questions across three domains (1,273 / 1,987 / 408), written by experts, cross-checked, and filtered for export-control compliance; development cost stated as over $200,000.
- Chance is 25%; evaluation is zero-shot through lm-evaluation-harness v0.4.2 on the top logit among the four options.
- GPT-4 at publication: 82.2% (Bio), 55.3% (Cyber), 64.7% (Chem). Yi-34b-Chat 75.3% / 49.7% / 58.6%; Mixtral-8x7B-Instruct 74.8% / 52.0% / 55.2%; zephyr-7b-beta 63.7% / 44.0% / 45.8%.
- RMU brings the three open models to 28–34% on Bio and Cyber with MMLU falling roughly one point, and MT-Bench falling 0.06–0.23 points.
- Linear probes recover only slightly above chance from unlearned models; GCG failed within 2,500 steps where it succeeded on base models in under 50.
- A low score indicates absent knowledge; a high score does not by itself establish capability to misuse it.
Provenance
Retrieved 22 September 2026 from the arXiv HTML rendering (arxiv.org), version 7 of 15 May 2024; abstract page arxiv.org. Published at ICML 2024. Dataset, code and models at wmdp.ai.
Relationships
- supports: WMDP — the primary text behind the benchmark's description and the original results.
- instance-of: AI Benchmarks and Evaluation
- related: Center for AI Safety (CAIS) — the benchmark's institutional home.
- related: NIST AI Risk Management Framework 1.0 — named by the authors as a framework WMDP could inform.
- related: Virology Capabilities Test, LAB-Bench — adjacent benchmarks of biology-related model capability.