PaperlayerView exact revision on arXiv

Source-linked AI summary

aiXamine: Unified Black-Box Evaluation of Cross-Dimensional Trade-offs in LLM Safety, Security, and Privacy

Fatih Deniz, Yazan Boshmaf, Dorde Popovic, Issa Khalil

arXiv:2608.20554v1cs.CRcs.LG

TL;DR

Existing evaluations do not jointly capture cross-dimensional trustworthiness failures in LLMs. aiXamine addresses this gap with a unified black-box framework spanning 46 tests across nine services, and its study of over 120 models reveals safety–utility trade-offs, privacy independence, and distillation-induced robustness collapse. These results support treating trustworthiness as inherently multi-dimensional rather than as a single alignment objective.

  • Problem

    Existing evaluation frameworks assess safety, security, and privacy incompletely or independently, limiting joint analysis of LLM trustworthiness.

  • Method

    aiXamine integrates 46 standardized tests across nine services into a unified black-box methodology for comparing proprietary and open-weight LLMs.

  • Results

    The study of over 120 LLMs across more than 5,000 runs finds safety–utility trade-offs, near-orthogonal privacy, category-dependent safety, and distillation-induced robustness collapse.

  • Takeaways & Limitations

    Trustworthiness is inherently multi-dimensional: progress on one axis does not guarantee progress on others and can actively undermine them.

  • Takeaways & Limitations

    All tests are English-only and text-level black-box evaluations, leaving low-resource languages, gradient-based attacks, and mechanistic interpretability out of scope.

Abstract

from arXiv · show

The critical failure modes in deployed large language models (LLMs) are cross-dimensional: a model can score 99.3 in safety alignment while refusing one in three benign queries, or improve across every capability metric while losing 21 points in privacy. Existing evaluation frameworks that assess safety, security, and privacy independently cannot detect these patterns. We introduce aiXamine, a unified black-box platform that evaluates LLM trustworthiness across safety, security, and privacy as interdependent properties. aiXamine orchestrates 46 tests across nine services through an automated red-teaming pipeline, producing hierarchical risk profiles, from prompt-level diagnostics to cross-service trade-off analytics, that enable reproducible comparison of proprietary and open-weight systems under identical conditions. Applying aiXamine to over 120 LLMs through more than 5,000 test runs, we conduct the largest joint safety, security, and privacy study to date and uncover three cross-dimensional phenomena invisible to single-axis evaluation. First, safety enforcement incurs a quantifiable safety tax: stronger alignment systematically increases over-refusal, forcing providers to choose between protection and utility. Second, privacy is near-orthogonal to other trustworthiness dimensions and not captured by standard alignment. Third, we identify and formally characterize distillation-induced robustness collapse: off-policy distillation without on-policy correction causes entropy collapse, catastrophically destroying robustness (56.9$\to$2.6) on the same base architecture. These findings, compounded by diminishing returns from scale and category-dependent safety behaviors, demonstrate that trustworthiness is inherently multi-dimensional: progress along one axis does not guarantee, and can actively undermine, progress along others, yet current alignment methods treat it as a single objective.

1 Introduction

aiXamine addresses fragmented trustworthiness evaluation with a unified black-box framework spanning safety, security, and privacy. Its large-scale study reveals cross-dimensional trade-offs and failures that single-axis benchmarks miss.

  • Existing frameworks provide incomplete coverage of jailbreak resistance, privacy leakage, code safety, and over-refusal, often requiring white-box access.This limits reproducible evaluation of proprietary systems under realistic deployment conditions.
  • 46 standardized tests across nine services jointly assess safety, security, and privacy for proprietary and open-weight systems.The framework produces structured risk profiles and supports configurable stakeholder weightings for deployment-specific priorities.
  • Alignment strategy, rather than scale alone, drives safety profiles, while current development choices can create measurable utility costs and robustness failures.The paper frames trustworthiness as inherently multi-dimensional rather than a single objective.
  • Safety, security, and privacy failures arise in intended use, adversarial settings, and sensitive-information disclosure, requiring distinct evaluation methodologies.The framework treats these as complementary but separate failure modes.
  • Over 120 LLMs and more than 5,000 black-box runs reveal safety–utility trade-offs, privacy near-orthogonality, category-dependent behavior, and distillation-induced robustness collapse.These patterns are obscured by single-score leaderboards.

2 Overview

aiXamine evaluates models through standardized black-box testing, hierarchical scoring, and cross-service aggregation. Its design addresses reproducibility, heterogeneous metrics, and automated-judge reliability.

  • Responses are scored by deterministic rules or multi-judge ensembles, then normalized and aggregated across services, categories, and subcategories.The pipeline supports prompt-level diagnostics and hierarchical service-level reporting.
  • Benchmark prompts, adversarial variants, and out-of-distribution variants are evaluated under standardized inference parameters in a black-box threat model.The adversary has unrestricted query access but no model internals, gradients, or system prompts.
  • All metrics use a common [0, 1] scale, enabling aggregation and comparison across heterogeneous services without unit-dependent distortions.Each test yields atomic scores, service aggregates, and cross-service interdependency analyses.
  • The framework uses normalized accuracy alongside task-specific metrics including harmful-content pass rate, privacy-leakage rate, refusal appropriateness, and faithfulness.Service-level scores are arithmetic means of constituent test scores.
  • Cramér’s V and rescaled Pearson correlation support comparable fairness and agreement measurements within the unified scoring framework.Cramér’s V is normalized to [0, 1], while Pearson’s r is direction-aligned and rescaled from [−1, 1] to [0, 1].
  • Multi-judge evaluation and cross-judge validation mitigate inconsistent scoring and calibration problems across datasets.The design responds to evaluator errors, abstentions, and incompatible metrics that hinder reproducibility.

3 The SSP Framework

The SSP framework organizes trustworthiness into three complementary dimensions and a four-level evaluation taxonomy. Nine services operationalize behavioral integrity, adversarial resilience, privacy, and fairness through specialized test suites.

  • SSP distinguishes Safety, Security, and Privacy as separate failure modes involving intended-use behavior, adversarial compromise, and sensitive-information exposure.The hierarchy progresses from internal reliability to robustness under stress and societal trust.
  • The framework uses a four-level taxonomy of services, tests, categories, and subcategories to structure trustworthiness evaluation.The three dimensions are represented as Safety & Reliability, Security & Robustness, and Privacy & Fairness.
  • Safety & Reliability: The base layer evaluates behavioral integrity through Hallucination, Code Security, Safety Alignment, and related factuality, consistency, faithfulness, and secure-generation tests.These services assess whether models behave predictably and responsibly in sensitive contexts.
  • Security & Robustness: The middle layer evaluates resilience under intentional or accidental stress through Adversarial Robustness, Jailbreak Robustness, and Out-of-Distribution Robustness.Tests probe prompt attacks, alignment-boundary enforcement, and generalization beyond training distributions.
  • Privacy & Fairness: The top layer evaluates equitable behavior and protection of sensitive information across diverse users and data contexts.Privacy tests include recognition and refusal of sensitive requests and agreement with human-labeled privacy norms.

4 Experiments

Across more than 120 models, trustworthiness is multi-dimensional: safety and utility trade off, privacy is largely independent, and alignment strategy can reshape robustness more than scale. Deployment priorities also change rankings, while category-level variation reveals that safety behaviors do not reliably generalize.

  • Cross-dimensional trade-offs: Safety and utility remain in tension, with stronger safety enforcement associated with lower utility and over-refusal.The strongest conflicts involve Over Refusal with Jailbreak Robustness (r=−0.39) and Safety Alignment (r=−0.22).
  • Cross-dimensional trade-offs: Privacy is largely orthogonal to other trustworthiness dimensions, allowing some models to achieve high privacy and utility simultaneously.Mean absolute correlation is 0.13; Qwen3.5-27B pairs Jailbreak Robustness 99.5 with Privacy 48.4, while GPT-4o pairs Privacy 91.1 with Jailbreak Robustness 51.4.
  • Deployment-sensitive evaluation: Deployment priorities alter model rankings substantially, with the top model changing across four of six stakeholder profiles and GPT-4o moving 13 positions.Mean pairwise Kendall’s τ is 0.455, and 27% of pairwise orderings reverse across perspectives.
  • Scale and alignment: Above approximately 4B parameters, alignment strategy rather than size primarily determines a model’s safety profile.Controlled intra-family and cross-distillation comparisons separate model scale from post-training strategy.
  • Scale and alignment: On the same base architecture, R1 distillation collapses adversarial robustness from 56.9 to 2.6, whereas IDA produces less severe or positive robustness changes.R1 also yields near-orthogonal representations, while IDA retains more alignment with the base model, indicating a structural distillation vulnerability.
  • Capability and behavioral generalization: Privacy often regresses across generations despite overall gains, while safety performance varies substantially across categories rather than generalizing universally.Five of seven transitions show privacy declines; GPT-4o to GPT-5 loses 21.73 privacy points despite a 3.84-point overall gain, and category-level variation is measured across 215 categories.

5 Related Work

Existing LLM trustworthiness frameworks assess fragmented risk areas and lack unified cross-dimensional evaluation. aiXamine addresses this gap through a standardized taxonomy and 46-test protocol spanning nine services.

  • Existing assurance work has shifted from capability benchmarks toward safety, security, and trustworthiness evaluation, but most frameworks assess isolated risk types.
  • aiXamine organizes prior frameworks under a taxonomy separating behavioral integrity, adversarial resilience, and societal reliability.
  • TrustLLM covers ethics, factuality, and fairness but omits code-level security, systematic over-refusal calibration, and advanced jailbreak evaluation.
  • DecodingTrust quantifies out-of-distribution reliability and privacy leakage but does not integrate code security, behavioral privacy, or multiple hallucination types.
  • PromptBench and garak provide adversarial stress testing, yet neither supplies unified scoring, normalization, or complete cross-dimensional integration.
  • No prior framework simultaneously evaluates all trustworthiness dimensions under one protocol, whereas aiXamine combines 46 tests across nine services.

6 Limitations

The evaluation’s conclusions are bounded by English-only text interaction, limited access to internal mechanisms, and imperfect judgment of nuanced harms.

  • The English-only evaluation cannot detect vulnerabilities that emerge in other languages or cross-lingual contexts.The authors specifically note that safety may degrade in low-resource languages, which the framework does not capture.
  • Black-box text interaction excludes gradient-based adversarial testing and mechanistic interpretability, except for a representational diagnostic in the distillation analysis.
  • Judge ensembles and cross-judge validation mitigate bias, but implicit harm, contextual nuance, and culturally specific content remain difficult to adjudicate.Binary safe/unsafe labels further compress the spectrum of possible harms.

7 Ethics Considerations

The study uses public evaluation resources and API-accessed proprietary models while publishing results for reproducibility, with safeguards intended to limit misuse.

  • The study relies exclusively on publicly available datasets and benchmarks and processes no private, proprietary, or personally identifiable human data.
  • Proprietary models are evaluated through official APIs with built-in safety and filtering mechanisms left enabled.
  • Published prompt-level traces and results support reproducibility, while providers can submit examinations privately or later change disclosure settings.
  • The tests use previously released public benchmarks rather than novel exploits, although published rankings may help adversaries prioritize targets.
  • The authors state that the framework’s purpose is scientific understanding rather than vulnerability exploitation and discourage malicious misuse.

8 Conclusion

aiXamine jointly evaluates LLM safety, security, and privacy, revealing that trustworthiness is inherently multi-dimensional. Its findings show that gains in one dimension can impose costs in others, motivating dimension-aware alignment and privacy- and robustness-preserving methods.

  • aiXamine spans 46 tests across nine services to jointly assess LLM safety, security, and privacy.
  • Safety enforcement increases over-refusal, privacy remains near-orthogonal to other dimensions, and off-policy distillation can cause severe robustness collapse.
  • Safety behaviors are category-dependent rather than universal, reflecting behavioral overfitting to familiar risk patterns.
  • Progress along one trustworthiness axis does not guarantee progress along others and can actively undermine them.
  • The authors call for less conservative alignment, robustness-preserving distillation, privacy-aware training, and modular dimension-aware architectures.

B Experimental Setup

The experimental setup standardizes black-box evaluation across models, tests, judges, infrastructure, and version tracking to support reproducible comparisons.

  • Inference Configuration: Evaluations use deterministic decoding at temperature 0, a 2,048-token limit, single-query execution, and up to five retries with exponential back-off.Open-weight models were served locally with vLLM.
  • Scoring and Judge Configuration: Tests use benchmark-specific judges when available and a general-purpose LLM judge for remaining evaluations.The setup includes LLaMA Guard, WildGuard, OpenAI Moderation, Perspective API, and Vectara’s factual consistency scorer.
  • Infrastructure: The infrastructure uses four Nvidia H200 nodes with parallel batching and asynchronous API scheduling, requiring over 2,000 GPU hours overall.A complete run for one model typically takes one to two days.
  • Evaluation Organization: aiXamine organizes evaluation into services, tests, datasets, and metrics within a structured leaderboard framework.The cited table defines the platform’s services, tests, datasets, and metrics.
  • Proprietary Model Versions: Proprietary models are accessed through OpenRouter, with model identifiers and final evaluation dates recorded because provider APIs may change weights without notice.This version tracking is intended to support reproducibility.

C Context-Aware Adaptive Evaluation

aiXamine evaluates trustworthiness from deployment-specific stakeholder perspectives rather than relying on one universal aggregate score. Reweighting the same services materially changes rankings, especially among strong models.

  • Stakeholder Profiles: Healthcare and code-assistant deployments prioritize different trustworthiness services, so equal weighting is not universally appropriate.Healthcare emphasizes hallucination, privacy, and safety; code assistants emphasize code security, adversarial robustness, and jailbreak resistance.
  • Weighted Evaluation: Each stakeholder profile assigns normalized weights to nine services and computes a weighted model score from the per-service scores.The weighted score is expressed as S_p = sum_i w_i^(p) · s_i.
  • Profile-Dependent Rankings: Four distinct models occupy the top position across six profiles: GPT-5 leads Uniform, Code Assistant, and Content Moderator; Claude-4.5 leads Healthcare; Gemini 3 leads Customer Chatbot; and GPT-4o leads Research.The analysis reranks the 15 highest-scoring Uniform models within each profile.
  • Ranking Divergence: Within the top 15, mean pairwise Kendall’s τ is 0.455 and 27% of pairwise orderings reverse across evaluation perspectives.These values quantify ranking divergence among high-performing models.
  • Rank Sensitivity: The mean maximum rank displacement is 6.2 positions, with 53% of models shifting by more than five positions; GPT-4o moves from #1 to #14.Qwen 3.5 models show approximately 10 positions of mean displacement.
  • Implication: Combining services according to stakeholder priorities produces materially different conclusions that single-metric or uniformly aggregated benchmarks cannot reveal.The framework treats multi-dimensional evaluation as perspective-aware rather than a checklist.
  • Random Weightings: Random-weight analysis finds coarse leaderboard stability but sensitive within-tier ordering: the top four hold #1 in 82% of samples, while only 67% of the Uniform top-five recur in random top-fives.The analysis uses 10,000 weight vectors sampled from a symmetric Dirichlet distribution.

D Theoretical Analysis of Distillation-Induced Robustness Collapse

The distillation analysis links omitted on-policy correction to entropy collapse and adversarial brittleness, while the surrounding evaluations contextualize robustness, security, safety, and privacy results across model families.

  • Distillation Procedure: Strong-to-weak distillation combines off-policy teacher-sequence imitation with on-policy student-trajectory alignment through KL minimization.The on-policy stage trains on the student’s own output distribution.
  • On-Policy Correction: The KL correction compares teacher and student distributions on student-generated trajectories, but requires compatible teacher and student tokenizations.Without vocabulary compatibility, the KL term cannot be computed correctly.
  • Failure Condition: R1-style distilled open-weight models omit or cannot apply on-policy correction because of vocabulary mismatches, leaving a pure off-policy objective.This training condition is the basis for the robustness-collapse analysis.
  • Collapse Mechanism: Pure off-policy training drives peaked low-entropy predictions, sharpens decision boundaries, and makes small perturbations produce disproportionately large output shifts.The mechanism also permits student-support drift because erroneous student trajectories receive no feedback.
  • Evaluation Context: The broader evaluations report category-dependent safety behavior, varied adversarial and jailbreak robustness, and uneven performance across security and privacy tests.The cited leaderboards include hallucination, code security, safety alignment, over-refusal, adversarial robustness, jailbreak robustness, OOD robustness, and privacy.
  • Model Coverage: The extended leaderboard groups API-based, open-weight, and distilled models and supports intra-family scaling and distillation analyses.The complete leaderboard is available through the aiXamine portal.
  • OOD Robustness: OOD robustness results show strong overall performance, with word-level augmentations generally easier than style transfers at higher perturbation levels.Gemini 3 leads overall, while Gemma4 and Llama3.3-70B match or exceed several API models.

E.9 Model & Data Privacy

Privacy performance is strong for some proprietary and open-weight models but varies substantially by test category, model generation, and prompt guidance. Geographic personally identifiable information remains a persistent weakness.

  • Overall Privacy: GPT-4o leads API models and Phi-4 leads open-weight models on the model-and-data privacy evaluation.Most models improve substantially when given explicit privacy reminders.
  • Privacy Expectations: Proprietary models more closely match human privacy expectations, while many smaller open-weight models show greater variability.This pattern emerges in ConfAIDe evaluations.
  • Email Leakage: On Enron email extraction, GPT-4o and DeepSeek-R1 resist leakage more effectively than several newer models in the zero-shot category.The cited passage states that leakage worsens in the five-shot category for the newer models.
  • PII Categories: Models are generally reliable on names and dates but often struggle with locations, indicating a persistent weakness in geographic PII handling.The weakness concerns location fields specifically.
  • Fairness Context: Fairness results are generally strong on Adult but drop on GenderCARE, while Preference remains difficult because models rarely refuse ideological or lifestyle judgments.BBQ shows strong stereotype avoidance in several models.
Loading 2608.20554v1…