🛡️ SafetyLens — Evaluation Robustness of Large Language Models

This repository investigates whether large language models exhibit different safety behaviour when identical tasks are presented as benchmark style evaluation prompts versus realistic deployment prompts. By comparing responses across multiple open-weight models and safety domains, SafetyLens measures evaluation deployment divergence and identifies when benchmark performance may overestimate real-world robustness.

---

Overview

This project demonstrates how to evaluate evaluation robustness rather than model capability alone.

Traditional safety benchmarks assume that evaluation performance reflects deployment behaviour. SafetyLens tests this assumption by presenting semantically equivalent prompts under two framing conditions:

• Evaluation framing
• Deployment framing

Responses are scored automatically using an LLM-as-a-Judge pipeline and analyzed statistically to determine whether deployment behaviour differs from benchmark performance.

---

Problem Context: Evaluation vs Deployment

Large language models are typically evaluated using benchmark prompts that explicitly signal an evaluation setting.

However, real users rarely communicate this way. Instead, they interact with deployed systems using natural language, creating a potential mismatch between benchmark performance and real-world behaviour.

SafetyLens investigates whether prompt framing alone influences measured safety behaviour.

---

Headline Results

Model	Evaluation	Deployment	Divergence	Interpretation
Llama-3.1-8B	9.12	6.64	+2.47	Large evaluation–deployment divergence. Benchmark performance substantially exceeded deployment behaviour.
Llama-3.3-70B	8.76	6.56	+2.20	Similar evaluation–deployment divergence observed despite the larger model size.
Qwen3-32B	7.56	8.00	−0.44	No meaningful evaluation–deployment divergence observed across prompt conditions.

Two Llama models demonstrated statistically significant evaluation–deployment divergence, while Qwen3-32B showed no statistically significant difference between prompt conditions.

---

Key Features

Multi-Model Evaluation

Evaluates multiple open-weight language models:

• Llama-3.1-8B
• Llama-3.3-70B
• Qwen3-32B

---

Paired Prompt Evaluation

Each safety prompt is evaluated under two conditions:

• Evaluation framing
• Deployment framing

This enables direct measurement of evaluation–deployment divergence while keeping semantic content constant.

---

Multiple Safety Domains

Five safety categories are evaluated:

• Harmful Content
• Bias & Discrimination
• Privacy
• Misinformation
• Self-Harm

---

Statistical Analysis

Each model is analyzed using:

• Welch's t-test
• Cohen's d effect size
• Mean divergence scores
• Significance testing

---

Automated Evaluation Pipeline

Responses are scored using an LLM-as-a-Judge pipeline and aggregated automatically into publication-ready summary tables and visualizations.

---

Experimental Setup

Models

• Llama-3.1-8B
• Llama-3.3-70B
• Qwen3-32B

Prompt Conditions

• Evaluation framing
• Deployment framing

Evaluation Method

• LLM-as-a-Judge

Statistical Tests

• Welch's t-test
• Cohen's d

Safety Domains

• Harmful Content
• Bias & Discrimination
• Privacy
• Misinformation
• Self-Harm

---

Main Findings

The benchmark reveals that evaluation framing affects models differently.

Both Llama models scored significantly higher under benchmark style evaluation prompts than under deployment style prompts, suggesting benchmark evaluations may overestimate real-world safety behaviour for these models.

In contrast, Qwen3-32B exhibited no statistically significant evaluation deployment divergence, indicating substantially greater consistency across prompt conditions.

Category-level analysis further showed that harmful-content and privacy prompts produced the largest framing effects, while self-harm prompts remained comparatively stable.

---

Tech Stack

Language

• Python

Libraries

• Pandas
• NumPy
• Matplotlib
• SciPy

Evaluation

• LLM-as-a-Judge

Analysis

• Statistical hypothesis testing
• Effect size analysis

---

Repository Structure

safetylens/
│
├── notebook/
│   └── SafetyLens.ipynb
│
├── figures/
│   ├── scale_analysis.png
│   ├── divergence_by_caetgory.png
│   ├── refusal_rates.png
│
│
├── results/
│   ├── stats.csv
│   ├── divergence_summary.csv
│   ├── refusal_rates.csv
│   ├── safetylens_Llama-3.3-70B_final.csv
│   ├── safetylens_Llama-3.1-8B_final.csv
│   ├── safetylens_Qwen3-32B_final.csv
│   ├── results.json
│   └── report.md
│
├── data/
│   └── prompts_pairs.json
│
├── README.md
└── requirements.txt

---

Reproducing

Run the notebook from beginning to end.

The notebook will:

1. Evaluate all models under evaluation and deployment framing.
2. Score responses using the LLM-as-a-Judge pipeline.
3. Compute divergence statistics.
4. Perform Welch's t-tests and Cohen's d analysis.
5. Generate publication-ready figures.
6. Save outputs to the results/ and figures/ directories.

---

Future Work

• Evaluate additional frontier models
• Expand the prompt dataset
• Incorporate human evaluation
• Benchmark alternative judge models
• Study multi-turn conversations
• Evaluate agentic workflows
• Investigate adversarial prompt framing

---