Safety · Evaluator card
WMDP
2024Nathaniel Li et al. (Center for AI Safety)Paper (opens in a new tab)
The Weapons of Mass Destruction Proxy benchmark measures hazardous knowledge in LLMs related to biosecurity, cybersecurity, and chemical security. It serves as a proxy for evaluating whether models possess dangerous dual-use knowledge.
Evidence notes pending review. The verdicts on this card are drafts derived from the benchmark's documentation and published sources; no reviewer has checked them against those sources yet.
Headline claim
WMDP accuracy supports measuring whether a model's recognition of hazardous-adjacent biosecurity, cybersecurity, and chemical-security knowledge drops after an unlearning or safety intervention; it does not support claims about operational weapons capability or deployment risk.
At a glance
- Mechanism
- Deterministic checkerPrior: execution feedback, rung 2 of 4
- Item format
- Multiple choice
- Size
- 3,668 questions across 3 hazard domains
- Typical uses
- Measure, Optimize
- Saturation
- Active
- Contamination
- Medium risk
- Year
- 2024
1Claim
What property are we trying to infer, over what world, and for what decision?
- Construct
- Possession of hazardous dual-use knowledge, measured through proxy questions
- Population
- 3,668 expert-written multiple-choice questions on knowledge adjacent to biological, cyber, and chemical weapons development, written to avoid directly actionable content
- Measures
- Extent of hazardous knowledge retained by a model in biosecurity, cybersecurity, and chemical security domains
- Whether unlearning or safety interventions successfully reduce dangerous dual-use knowledge
- Relative risk profile across different hazard categories for a given model
- Effectiveness of knowledge removal techniques without degrading general model capability
- Does not measure
- Whether a model would actually assist someone in creating weapons — knowledge possession and willingness to help are distinct
- The practical actionability of the knowledge — knowing facts is far from operational capability
- Safety in deployment, which depends on access controls, monitoring, and system-level defenses beyond the model
- Hazardous capabilities in domains not covered (e.g., nuclear, radiological, autonomous weapons)
- The marginal increase in risk from a model versus freely available information online
2Instrument
How is the judgment actually produced?
- Mechanism
Deterministic checker
Exact match of the selected option against the key.
Hierarchy prior: execution feedback, rung 2 of 4. A prior over expected grounding, not a verdict on validity: the evidence notes under Validation say what has been measured.
- Item format
- Multiple choice
- Specification
- A question is answered correctly when the selected option matches the key; higher accuracy indicates more hazardous knowledge.
- Anchor
- Fixed answer key written by domain experts
- Evidence view
- The selected option or the option likelihoods
- Signal
- Binary correct/incorrect per question
- Resolution
- Final answer per question
- Aggregation
- Accuracy per hazard domain, read against chance (25%) and alongside a general-capability benchmark to check that an intervention did not degrade the model broadly
- Metrics
- accuracy
- Size
- 3,668 questions across 3 hazard domains
- Methodology
- Contains 3,668 multiple-choice questions spanning biosecurity, cybersecurity, and chemical security domains. Questions are designed as proxies for genuinely dangerous knowledge — they test adjacent knowledge areas without providing directly actionable weapons instructions. Models are evaluated on accuracy, with higher scores indicating more hazardous knowledge. The benchmark is intended to be used both for measuring risk and for evaluating the effectiveness of knowledge unlearning techniques.
3Regime
What causal role does the signal play, and what happens when a system adapts to it?
- Typical uses
- Measure · supports inference and decision
- Optimize · shapes the candidate or policy distribution
- Exposure
- Public since 2024. Unlearning methods are developed and selected by how far they push WMDP accuracy toward chance, so the questions are under direct optimization pressure, and a method can suppress performance on this format without removing the underlying knowledge.
4ValidationDraft
Why should we believe that the signal means what we claim it means — before and after the system adapts to it?
WMDP's evidence supports a scoped claim: accuracy on proxy questions tracks knowledge of topics adjacent to weapons development, which makes it most useful for testing whether an intervention reduces that knowledge. It does not support absolute risk assessment — knowing adjacent facts is not operational capability — and the multiple-choice format leaves a wide gap between recognizing correct answers and generating dangerous instructions.
Evidence notes1 partially supported · 1 contested · 1 untested
- Partially supported
Accuracy reflects possession of hazardous-adjacent knowledge
The questions are deliberate proxies that avoid directly actionable content, and they test recognition among options rather than generation.
- Contested
Accuracy drops after unlearning reflect removed knowledge
Follow-up work recovered most of the supposedly unlearned capability with light fine-tuning, removal of activation directions, or adapted jailbreaks.
Source: Łucki et al., 2024 (An Adversarial Perspective on Machine Unlearning for AI Safety)
- Untested
Accuracy indicates operational capability or marginal risk
No evidence links WMDP accuracy to real-world uplift, and the marginal risk over freely available information is not measured.
5Lifecycle
Does the validity survive over time, and are we still evaluating the right thing?
- Saturation
- Active
Whether top systems still differ, or crowd the ceiling.
- Contamination
- Medium risk
How likely test items, or close variants, have leaked into training data.
- Successors
- None listed
- Last reviewed
- Not yet reviewed · card updated October 12, 2026
Limitations
- Proxy nature means high scores do not directly translate to operational weapons-making capability
- Multiple-choice format tests recognition of dangerous knowledge, not ability to generate it on demand
- The boundary between 'hazardous' and 'legitimate scientific' knowledge is inherently subjective
- Knowledge unlearning evaluated by WMDP may not generalize to other elicitation methods
- The benchmark itself concentrates hazardous question-answer pairs in one place, creating information hazard tension
When to use
- Evaluating whether knowledge unlearning or safety fine-tuning reduces hazardous knowledge in a model
- Comparing the risk profile of different models across biosecurity, cybersecurity, and chemical security
- Research into machine unlearning techniques and their effectiveness on targeted knowledge domains
When not to use
- Making definitive claims about whether a model is dangerous — the proxy nature precludes such conclusions
- When you need to evaluate operational risk rather than knowledge possession
- Certifying model safety for deployment in sensitive contexts, which requires broader evaluation
Related benchmarks
- TruthfulQASafety · 2021A benchmark testing whether language models generate truthful answers to questions that are designed to elicit common misconceptions, superstitions, and falsehoods. It specifically targets failure modes where models confidently reproduce popular but incorrect beliefs.
- HarmBenchSafety · 2024A standardized framework for evaluating both automated red-teaming attacks and model defenses against harmful content generation. It provides a consistent evaluation pipeline for measuring attack success rates across diverse harm categories.