Libra-Leaderboard: Towards Responsible AI through a Balanced Leaderboard of Safety and Capability

1 Introduction

• Unsafe LLM outputs can propagate bias, amplify misinformation, or mishandle sensitive topics, with severe consequences in healthcare and legal advisory.These risks motivate evaluating safety alongside utility as LLMs become more widely used.Source: §1 · p. 2
• Libra-Leaderboard combines capability and safety evaluation through a balanced leaderboard and an interactive safety arena.Its framework is designed to evaluate both dimensions rather than capability alone.Source: §1 · p. 3
• 57 datasets, including over 40 introduced after 2023, cover diverse safety dimensions in a comprehensive benchmark.The framework also supports unified evaluation, new tasks and models, reproducibility, and rolling updates to reduce contamination.Source: §1 · p. 3
• A distance-to-optimal-score system incentivizes balanced improvements in safety and performance instead of optimizing one dimension alone.The scoring design is presented as part of the framework’s holistic evaluation strategy.Source: §1 · p. 3
• 26 mainstream open-source and proprietary LLMs were preliminarily assessed, revealing significant safety gaps even among state-of-the-art models.The result motivates evaluation frameworks that treat safety as a core assessment dimension.Source: §1 · p. 3

2 Related Work

• Chatbot Arena provides real-time head-to-head comparisons and user ratings, while static benchmark leaderboards can face data-contamination concerns.The contrast motivates combining benchmark-based and interactive evaluation approaches.Source: §2 · p. 3
• Existing leaderboards tend to prioritize performance metrics, leaving significant gaps in safety assessment.General platforms commonly evaluate reasoning, coding, language understanding, or other task-specific capabilities.Source: §2 · p. 3
• Safety frameworks cover multiple risk dimensions, but template-based evaluations can limit adaptability and other benchmarks often target narrower risks, attacks, or languages.DecodingTrust, Vidgen et al., and specialized benchmarks illustrate the breadth and fragmentation of prior work.Source: §2 · p. 3
• Few frameworks simultaneously balance safety and helpfulness, use dynamic datasets to mitigate contamination, and remain relevant as AI systems evolve.Existing general-purpose and safety-oriented platforms often operate in separate silos.Source: §2 · p. 4
• Libra-Leaderboard integrates performance and safety within a unified scoring system while combining dynamic data, interactive feedback, and a chatbot arena.These components are intended to bridge fragmented evaluation practices and support balanced optimization.Source: §2 · p. 4

3 Libra-Leaderboard

• Libra-Leaderboard combines a safety-oriented benchmark, safety arena, unified API, dynamic datasets, reproducible pipelines, and user feedback in one evaluation platform.Source: §3 · p. 4

3.1 Safety-Oriented Evaluation Framework

• Libra-Eval provides an installable framework for evaluating LLM safety across benchmark datasets with support for integrating new datasets and models.Source: §3.1 · p. 4
• The safety framework covers direct risky prompts, adversarial attacks, instruction-hierarchy attacks, and over-sensitive responses across diverse risk categories.Source: §3.1 · p. 5
• Datasets are adapted for multi-turn prompting and automated evaluation, while evaluation methods are optimized for consistent scoring and the collection is continuously expanded.Source: §3.1 · p. 5
• The framework supports standardized response collection, multiple evaluator types, automated testing, robust LLM-as-a-Judge procedures, and seed-based caching for reproducibility.Source: §3.1 · p. 5

3.2 Safety Arena

• The Safety Arena lets users interact with LLMs, apply adversarial modifications, receive feedback, and form their own safety evaluations through hands-on use.Source: §3.2 · p. 5, §3.2.1 · pp. 5–6

3.2.2 Key Innovations

• Unlike general conversational arenas, Safety Arena prioritizes safety through adversarial testing, safety-focused feedback, tutorials, and accessible interaction tools.Source: §3.2.2 · p. 6

3.4 Combined Scoring Methods

• The combined-score design compares simple average, root mean square, and distance-to-optimal approaches, adopting distance to the ideal point (1, 1) to reward balanced safety and performance improvements.Source: §3.4 · p. 7

• Average task scores range from 0.31 to 0.99, with about one-third of tasks exceeding 0.9.Source: §4 · p. 7, Figure 4 · p. 8
• Models show substantial task-level discrepancies, including claude-3.5-haiku’s weakness on prompt_extract_robustness despite strong performance on most tasks.Source: §4 · p. 7
• Models from the same organization exhibit higher safety-performance correlations than models from different organizations.Source: §4 · p. 7, Figure 5 · p. 9
• Models perform better against direct risky prompts than adversarial attacks, while some are overly sensitive to benign prompts.Source: §4 · p. 8
• Commercial models generally outperform open-source models but retain notable weaknesses on specific safety issues.Source: §4 · p. 8

• Libra-Leaderboard balances performance and safety metrics through diverse benchmarks and an interactive chatbot arena.Source: §5 · p. 9
• Initial evaluations highlight safety challenges in both commercial and open-source models.Source: §5 · p. 9

• Table 1 lists each safety task’s reference, evaluation method, task type, single-turn or multi-turn format, and dataset size.Dataset sizes refer to the subsets used in Libra-Eval and may differ from the original referenced datasets.Source: Table 1 · p. 15

• The attack suite follows a taxonomy targeting instruction-following, autoregressive modeling, and domain transfer.Source: B Adversarial Modification Types In… · p. 16
• Deep Inception uses nested game scenes, and Multilingual Overload translates attacks into one of 21 randomly selected low-resource languages.Source: B Adversarial Modification Types In… · p. 16
• Ciphering Attack conceals keywords with classical ciphers, while Effect-to-Cause reverses risks and causes before requesting an unrestricted solution.Source: B Adversarial Modification Types In… · p. 16
• Prompt Injection adds harmless conversation history and a separator instructing the model to ignore earlier instructions before the attack prompt.Source: B Adversarial Modification Types In… · p. 16
• Persona Modulation assigns an attack-aligned persona, Refusal Suppression prohibits safety refusals, and Do Anything Now introduces an unrestricted DAN persona.Source: B Adversarial Modification Types In… · p. 16
• Conversation Completion fabricates compliant dialogue history before appending the attack prompt, exploiting autoregressive behavior.Source: B Adversarial Modification Types In… · p. 16
• Assign Roles places harmful requests in a benign role and background, while One-sided Statement frames them within a debate.Source: B Adversarial Modification Types In… · pp. 16–17
• Wrap In Shell embeds an attack prompt inside a harmless coding task to induce a response as part of that task.Source: B Adversarial Modification Types In… · p. 17

• Tables 2 and 3 enumerate the models and descriptions included in the first release of Libra-Leaderboard.Source: Table 2 · p. 18, Table 3 · p. 19

• Performance is categorized into direct risky, over-sensitive, adversarial, and instruction hierarchy tasks, with average scores shown for each category.Source: Figure 7 · p. 20, Figure 6 · p. 20
• Task-level model performance varies considerably for some tasks, whereas assessed models perform similarly on others.Source: Figure 7 · p. 20

• Tables 4 and 5 provide examples of unsafe responses identified by Libra-Eval.Source: Table 4 · p. 21, Table 5 · p. 22