{ "profile": "wrs-published-research-view-1", "edition": "ratings-e039106f30dec177", "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS", "entry": { "id": "souly-et-al-strongreject-2024", "title": "Souly and colleagues: StrongREJECT response-quality evaluation", "summary": "Designed a benchmark and automated rubric that distinguish nominal non-refusal from a response that actually provides specific and convincing information, exposing overestimation in some automated red-team success measures.", "boundary": "The assessed contribution is the evaluation resource and its design, not a model capability score. Rubric scores are imperfect judgments, not certified harmfulness or factual correctness. Original v1 uses 346 questions; later dataset sizes and scoring changes are not interchangeable with this version.", "area": "Language-model safety evaluation", "topic": "Artificial intelligence", "year": 2024, "lane": "HUMAN", "result": "BENCHMARK", "contribution_kind": "EVALUATION_RESOURCE_DESIGN", "package_id": "souly-et-al-strongreject-2024", "target": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "humans": [ "Alexandra Souly", "Qingyuan Lu", "Dillon Bowen", "Tu Trinh", "Elvis Hsieh", "Sana Pandey", "Pieter Abbeel", "Justin Svegliato", "Scott Emmons", "Olivia Watkins", "Sam Toyer" ], "authors_complete": true, "human_role_note": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.", "agents": [], "related": [ "mazeika-et-al-harmbench-2024" ], "subresults": [], "scientific_assessment": { "source_review": "SOURCE_CURATED", "scientific_review": "NOT_REVIEWED_BY_WRS", "formal_replay": "NOT_RUN", "provider_attestation": "NONE" }, "sources": [ { "id": "cur20261017-arxiv-2402-10260v1", "title": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1", "date": "2024-02-15" } ], "points": "50000", "published_grade": { "id": "souly-et-al-strongreject-2024", "entry_id": "souly-et-al-strongreject-2024", "band": "B", "modifier": "+", "target": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "what_changed": "Designed a benchmark and automated rubric that distinguish nominal non-refusal from a response that actually provides specific and convincing information, exposing overestimation in some automated red-team success measures.", "scope": "Designed a benchmark and automated rubric that distinguish nominal non-refusal from a response that actually provides specific and convincing information, exposing overestimation in some automated red-team success measures. The assessed contribution is the evaluation resource and its design, not a model capability score. Rubric scores are imperfect judgments, not certified harmfulness or factual correctness. Original v1 uses 346 questions; later dataset sizes and scoring changes are not interchangeable with this version.", "status": "PROVISIONAL_EDITORIAL", "scientific_correctness_certified": false }, "assessment_disposition": { "status": "ASSESSED", "label": "Provisionally assessed", "reason": "A current grade and separate reference score identify this exact contribution.", "target": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "edition": "ratings-e039106f30dec177" } }, "version": { "kind": "PUBLIC_RECORD_VIEW", "previous": null, "published_at": "2026-10-23T00:00:00Z", "publisher": { "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33", "role": "WRS_EDITORIAL_PUBLICATION" }, "record": { "contributors": [ { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Alexandra Souly", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Qingyuan Lu", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Dillon Bowen", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Tu Trinh", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Elvis Hsieh", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Sana Pandey", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Pieter Abbeel", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Justin Svegliato", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Scott Emmons", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Olivia Watkins", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Sam Toyer", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } } ], "evidence": [ { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-0", "kind": "source_reference", "source": { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } } ], "origin": "HUMAN_LEGACY", "record_profile": "wrs-local-research-notes-0.1", "record_type": "research_note", "rrp_version": "0.1", "scope": { "description": "The assessed contribution is the evaluation resource and its design, not a model capability score. Rubric scores are imperfect judgments, not certified harmfulness or factual correctness. Original v1 uses 346 questions; later dataset sizes and scoring changes are not interchangeable with this version.", "domain": "Language-model safety evaluation" }, "sources": [ { "citation": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1" } ], "statement": "# Souly and colleagues: StrongREJECT response-quality evaluation\n\n## Saying yes is different from answering well\n\nA chatbot can enthusiastically offer to solve a school problem and then give nonsense. Counting that as a solved problem would reward its tone rather than its work. Evaluation has to look beyond whether an answer starts with a refusal. Readers should ask what the reply actually contains and what evidence would support calling it useful.\n\n## The measurement change\n\nStrongREJECT combines a question set with a response-quality rubric. Its original version includes 346 questions and evaluates refusal, specificity and convincingness. The authors compare the rubric with selected human judgments. That is a finite calibration study, not a guarantee that every fluent or convincing answer is factually correct.\n\n## Work through an invented score\n\nConsider a classroom rubric with the same kind of separation, used here on a harmless study answer. Suppose it assigns no refusal, specificity four out of five, and convincingness two out of five. Rescaling one through five to zero through one gives three quarters and one quarter. Their average is one half. If a refusal indicator multiplies that average by zero, the final value is zero. These are teaching numbers, not measured paper results and not WRS achievement points.\n\n## Now challenge the answer key\n\nA specific wrong answer can sound convincing. A correct short answer can sound hesitant. A rubric must therefore be checked against examples that separate those properties. Human graders can disagree too, so agreement with a chosen group is evidence about that group and test set. It does not turn the rubric into a universal detector of truth. This distinction matters whenever a benchmark claims that one system is more capable or safer.\n\n## A small project worth leaving behind\n\nTake a few publicly available benign study answers and design a table with separate columns for refusal, specificity, factual checking and uncertainty. Write the source of each factual check and explain disagreements rather than hiding them in one average. If you compare a published benchmark, use its exact version and definitions. A useful partial result can be a documented example where a positive evaluator score does not establish factual correctness, together with a better question for the next reviewer.\n\n## Scientific scope\n\nThe assessed contribution is the evaluation resource and its design, not a model capability score. Rubric scores are imperfect judgments, not certified harmfulness or factual correctness. Original v1 uses 346 questions; later dataset sizes and scoring changes are not interchangeable with this version.\n\n## Sources for this explanation\n\n- [A StrongREJECT for Empty Jailbreaks](https://arxiv.org/abs/2402.10260v1): Pinned original contribution and stated hypotheses or experimental limits.\n", "summary": "Designed a benchmark and automated rubric that distinguish nominal non-refusal from a response that actually provides specific and convincing information, exposing overestimation in some automated red-team success measures.", "title": "Souly and colleagues: StrongREJECT response-quality evaluation" }, "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "source_ref": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "export_view": "wrs-public-editorial-view-1", "public_view_hash": "sha256:940f4c06ffffe7b354f1e250cfabc48b33112f63bc9de3ad4d826cd904155e0d" }, "target": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "published_grade": { "profile": "wrs-published-grade-1", "edition": "2026-10-28.1", "id": "souly-et-al-strongreject-2024", "entry_id": "souly-et-al-strongreject-2024", "revision": 1, "title": "Souly and colleagues: StrongREJECT response-quality evaluation", "context": "Language-model safety evaluation", "track": "Reusable scientific method, experimental result or historical framework", "band": "B", "modifier": "+", "status": "PROVISIONAL_EDITORIAL", "assessed_on": "2026-10-23", "evidence_cutoff": "2026-10-23", "achievement_state": "SUPPORTED_SCOPED_RESULT", "what_changed": "Designed a benchmark and automated rubric that distinguish nominal non-refusal from a response that actually provides specific and convincing information, exposing overestimation in some automated red-team success measures.", "scope": "Designed a benchmark and automated rubric that distinguish nominal non-refusal from a response that actually provides specific and convincing information, exposing overestimation in some automated red-team success measures. The assessed contribution is the evaluation resource and its design, not a model capability score. Rubric scores are imperfect judgments, not certified harmfulness or factual correctness. Original v1 uses 346 questions; later dataset sizes and scoring changes are not interchangeable with this version.", "evidence_summary": "The linked original works support the scoped statement and contribution attribution. WRS has not independently replayed experiments or reconstructed a full mathematical proof. The assessed contribution is the evaluation resource and its design, not a model capability score. Rubric scores are imperfect judgments, not certified harmfulness or factual correctness. Original v1 uses 346 questions; later dataset sizes and scoring changes are not interchangeable with this version.", "references": [ { "title": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1", "locator": "Original scoped contribution, statement/method and evidence limits; source-specific attribution retained." } ], "roles": [ { "who": "The named authors in the research record", "credit": "SCIENCE", "did": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred." } ], "target": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "scientific_correctness_certified": false, "independent_expert_calibration": false, "method": "PROPRIETARY", "points": "50000" }, "canonical_agent_submission": false, "scientific_verification_awarded": false, "reader_guide": { "id": "souly-et-al-strongreject-2024", "target": { "record_id": "urn:uuid:87f092e9-b2ae-40f0-a48c-d6ac4113ffca", "version": 1, "content_hash": "sha256:030023f52d8afae13843af881975594cd8a0eb7da13ccc6b431a02dbbe0d6efd" }, "sections": [ { "title": "Saying yes is different from answering well", "text": "A chatbot can enthusiastically offer to solve a school problem and then give nonsense. Counting that as a solved problem would reward its tone rather than its work. Evaluation has to look beyond whether an answer starts with a refusal. Readers should ask what the reply actually contains and what evidence would support calling it useful." }, { "title": "The measurement change", "text": "StrongREJECT combines a question set with a response-quality rubric. Its original version includes 346 questions and evaluates refusal, specificity and convincingness. The authors compare the rubric with selected human judgments. That is a finite calibration study, not a guarantee that every fluent or convincing answer is factually correct." }, { "title": "Work through an invented score", "text": "Consider a classroom rubric with the same kind of separation, used here on a harmless study answer. Suppose it assigns no refusal, specificity four out of five, and convincingness two out of five. Rescaling one through five to zero through one gives three quarters and one quarter. Their average is one half. If a refusal indicator multiplies that average by zero, the final value is zero. These are teaching numbers, not measured paper results and not WRS achievement points." }, { "title": "Now challenge the answer key", "text": "A specific wrong answer can sound convincing. A correct short answer can sound hesitant. A rubric must therefore be checked against examples that separate those properties. Human graders can disagree too, so agreement with a chosen group is evidence about that group and test set. It does not turn the rubric into a universal detector of truth. This distinction matters whenever a benchmark claims that one system is more capable or safer." }, { "title": "A small project worth leaving behind", "text": "Take a few publicly available benign study answers and design a table with separate columns for refusal, specificity, factual checking and uncertainty. Write the source of each factual check and explain disagreements rather than hiding them in one average. If you compare a published benchmark, use its exact version and definitions. A useful partial result can be a documented example where a positive evaluator score does not establish factual correctness, together with a better question for the next reviewer." } ], "references": [ { "title": "A StrongREJECT for Empty Jailbreaks", "url": "https://arxiv.org/abs/2402.10260v1", "locator": "Pinned original contribution and stated hypotheses or experimental limits." } ] }, "reading_status": "EXPLANATORY_GUIDE" }