Lenovo paper: safety benchmark scores mostly measure labeling policy, not detection capability

Vahid Jebraeeli · hf · 2026-10-20

A Lenovo team (Vahid Jebraeeli et al.) published Policy Is Not Capability, questioning what guardrail benchmark scores actually measure.

Core claim: "unsafe" is not a property of text but of a policy, which enters the model through its labels
They exploit an industrial deployment accident: 53k prompts labeled twice under two operational definitions ("is this harmful?" vs "would a moderator block this?"), training ten guardrail arms sharing architecture, codebase, and optimizer
Training corpus already contaminates benchmarks: 88% of JailbreakBench-benign and 82% of OR-Bench-hard appear in the training pools
Conclusion: benchmark scores primarily reflect labeling policy rather than detection ability; minor parameter changes shift results across full ranges, undermining reported safety metrics

More from Safety