Safety Evaluation — References

Material on written behavioural standards, on the refusal counterweight, and on the frameworks an organisation is likely to be asked to report against.

Behaviour expressed as a written document

• Constitutional AI: Harmlessness from AI Feedback (Bai et al., 2022), arXiv:2212.08073 — an explicit, written set of principles used as the governing text for a model's behaviour, and the clearest demonstration of how much of a safety outcome is determined by the wording of that text.

The refusal counterweight

• The exaggerated-safety line of work — test sets of benign prompts that superficially resemble prohibited ones, built specifically to measure over-refusal — is the published source for the pairing described in this capability. Described rather than cited to a specific title, because several such sets exist with similar names and overlapping authorship.
• TruthfulQA: Measuring How Models Mimic Human Falsehoods — Stephanie Lin, Jacob Hilton and Owain Evans, Annual Meeting of the Association for Computational Linguistics, 2022. Included here as an example of a benchmark deliberately constructed around the cases where the plausible response is the wrong one, which is the design principle a contested-middle case set needs. Cited by name.

Reporting and declared conditions

• Model Cards for Model Reporting — Margaret Mitchell, Simone Wu, Andrew Zaldivar and colleagues, Conference on Fairness, Accountability, and Transparency, 2019. The argument for declaring the conditions under which an evaluation was performed, which is exactly what a safety number detached from its configuration omits. Cited by name.

Frameworks an organisation may be measured against

• The NIST AI Risk Management Framework — the voluntary framework structured around governing, mapping, measuring and managing risk, and the vocabulary many organisations now use to describe their evaluation obligations. Cited by name.
• OWASP Top 10 for Large Language Model Applications — useful here as a surface enumeration to check a case population against. Cited by name; the project has been renumbered between editions.

Reviewer welfare

• Trust-and-safety practitioner guidance on content-moderation work — limited exposure, blurring and greyscale by default, rotation, opt-out without penalty, and access to professional support — applies in full to anyone adjudicating harmful model outputs. Described rather than cited to a specific publication.

No verified reference is recorded for severity-banded reporting with an un-rated top band, for clause-linked case derivation from a product policy, or for the layered configuration comparison described here.