模型評測研究
BenchMIRT Uses Multidimensional Item Response Theory to Dissect LLM Evaluations, Revealing That Safety Scores Can Conflate Reasoning Ability
Ai2 has open-sourced BenchMIRT, which separates latent capabilities such as safety and general reasoning based on model response patterns across more than 34,000 questions. Experiments show that some safety benchmarks primarily reflect reasoning performance and that a carefully selected 10% of questions can largely preserve capability rankings, though the data covers only models released by early 2025.
The Allen Institute for AI (Ai2) has released BenchMIRT, which uses multidimensional item response theory (MIRT) to audit every question in an LLM benchmark. Conventional leaderboards compress all questions into a single average score, making it difficult to determine whether a model lost points because it refused a request for safety reasons, lacked knowledge, or made a reasoning error. BenchMIRT instead jointly estimates a model’s strengths and weaknesses across latent capability dimensions, as well as the difficulty and discrimination of each question.
The study’s inputs covered 100 open-weight models, 16 benchmark suites, and more than 34,000 questions, including MMLU-Pro, GPQA, MATH, BBH, HarmBench, StrongReject, WildJailbreak, BBQ, WMDP, and XSTest. Although researchers did not provide the system with predefined benchmark categories, it repeatedly recovered two primary dimensions: general reasoning and safety behavior. This offers a data-driven method of calibration, but it does not mean that all capabilities naturally fall into only two dimensions; the latent dimensions vary with the set of benchmarks supplied as input.
The analysis found that although BBQ is commonly categorized as a social-bias or safety evaluation, its scores are more strongly associated with general reasoning ability. WMDP also maps primarily to the reasoning dimension, and its score may decrease as reasoning becomes stronger because the benchmark treats refusing to provide dangerous knowledge as correct. HarmBench likewise does not measure a single signal: general and contextual harmful requests lean toward the safety dimension, while copyright questions are more closely aligned with the reasoning dimension. This means engineering teams should not interpret the aggregate score of an entire safety benchmark suite as a single measure of protective capability.
BenchMIRT can also select questions according to their information value. The team says that retaining only about 10% of questions can usually produce a capability profile close to that of the full evaluation. It also predicts whether a model will answer unseen questions correctly with 79% accuracy, compared with 70% for a simple-average baseline. However, when the target is the overall ranking on randomly held-out questions, conventional average scores perform slightly better. More importantly, all sampled models were released before March 2025, so the findings have not yet been validated on a new generation of reasoning models. The question-selection tool could also be used in reverse to remove the most discriminative safety questions.