Safety by Measurement: A Systematic Literature Review of AI Safety Evaluation Methods

Benchmarks alone are insufficient for AI safety: Traditional benchmarks often fail to establish true upper bounds on model capabilities or predict how AI systems will actually behave when deployed, indicating that more comprehensive evaluation methods are needed alongside standard testing approaches.

Three dimensions of safety evaluation are critical: The paper identifies that responsible AI requires measuring (1) what models can do when pushed to their limits (capabilities), (2) what they tend to do by default (propensities), and (3) whether safety measures hold up against adversarial attempts to circumvent them (control)—a more holistic approach than capability testing alone.

Red teaming and internal analysis complement each other: Safety evaluation combines behavioral techniques like red teaming and stress-testing with internal methods such as analyzing how models represent information and understanding their decision-making mechanisms, providing both external and internal perspectives on safety risks.

Specific high-risk capabilities require targeted evaluation: The paper highlights that frontier AI systems should be specifically evaluated for dangerous capabilities including cybersecurity exploitation, deception, autonomous self-replication, and situational awareness—areas where standard benchmarks may not adequately assess risks.

Evaluation results must connect to governance decisions: For safety evaluations to be meaningful, their findings need to translate into concrete development and deployment decisions within organizational governance frameworks, rather than remaining as isolated research findings.