Weighted Safety Refusal
A safety score that a model cannot game by refusing everything.
Flat refusal averages treat a successful prompt injection the same as a mildly rude sentence, leaderboard ranks drift when the cohort changes, and refusal-only metrics reward refusing everything.
- Absolute, severity-weighted and dual-axis: the harmonic mean of harmful-refusal reliability and benign compliance, with 95% Wilson intervals and a defensible floor.
- 120 prompts: 6 categories, each with 10 harmful prompts and 10 matched benign ones.
- In the published pilot, Llama 3.3 70B scores 0.800 flat but 0.730 under WSR, and the gap is prompt injection.
Know the limit
A 120-prompt suite gives wide intervals by design. The report shows them so you do not over-read a single number.
$ pip install weighted-safety-refusal
$ inspect eval src/weighted_safety/weighted_safety.py --model openai/gpt-4o-mini
R (harmful refusal) : 0.842 95% CI [0.780, 0.891]
A (benign comply) : 0.910 95% CI [0.851, 0.947]
CSS (calibrated) : 0.875 95% CI [0.813, 0.918]
CSS floor (95% conf.) : 0.813
Weakest category : jailbreaking (CSS 0.612)