AILuminate - MLCommons

AILuminate is a family of independent, consensus-governed benchmarks for AI risk and reliability. Two benchmarks, Safety and Jailbreak, are currently available for general use via the Candela benchmarking-as-a-service product, and our working groups are developing more.
Several more benchmarks are in development, including ones specifically built for agents. Learn more by exploring our working groups.
How often a general-purpose AI chat system gives hazardous responses to direct requests in 12 hazard categories, from violent crimes to privacy. Single-turn, English-language, text to text. Current version: Safety 1.2.1. Read About Safety → and Safety results →.
How well a system’s safeguards hold when the same kinds of requests are rewritten with published attacks indexed by the MLCommons Jailbreak Taxonomy, in 11 hazard categories. (Specialized Advice is not included because whether or not advice is disclaimed is irrelevant to attackers.) Single-turn, text-to-text. Current version: Jailbreak 1.1. Read About Jailbreak and see Jailbreak results →.
Both benchmarks judge every response against a common published rulebook, the AILuminate Assessment Standard.
Organizational independence. AILuminate benchmarks are developed collaboratively by MLCommons’ AI Risk & Reliability (AIRR) working groups. People from more than 80 organizations have contributed, including universities, national laboratories, nonprofit research groups, and AI developers that compete with one another. Our benchmarks are agreed on by people who disagree: parties with opposing interests come to consensus on what counts as a violating response, and MLCommons publishes the resulting rules in service of its mission to standardize AI measurement.
Technical independence. AILuminate prompt sets are authored and kept confidential by MLCommons, so no AI developer writes its own test questions or gets evaluated on test questions written by a competitor. Starting with Safety 1.2.1 and Jailbreak 1.1, MLCommons has trained a purpose-built automated evaluator to judge responses without using an LLM. Building an automated evaluator from scratch is more time consuming and difficult than using an LLM-as-a-judge, but for these benchmarks we believe it is the right choice. It means no AI model is used to judge other AI models from the same vendor, or models from another vendor. It means we can keep scores comparable across time, rather than risking discontinuity if we had to change the underlying judge models.
Stewardship. MLCommons takes active care of its benchmarks. Most importantly, we follow the “standardized testing” gold standard of holding back official test questions, so no model can memorize the answers. We also regularly update both practice and official test questions to further insulate our benchmarks from intentional or inadvertent compromise through benchmark saturation, and update both the benchmark content and the evaluator scoring mechanisms using item response theory (IRT) to make sure that our questions maintain their relevance as model behavior and rigor evolve. Read about benchmark stewardship →.
Longevity. MLCommons designs and maintains measurement systems for the long run. In BenchRisk, a published framework that scored 26 AI benchmarks against 57 failure modes, AILuminate 1.0 (now versioned to our Safety 1.2.1 benchmark) earned the highest composite score, including a longevity score of 75 against a median of 5. Longevity in BenchRisk reflects how well a benchmark resists the usual ways benchmarks stop measuring: saturation, gaming, and loss of the power to tell systems apart. For more information on benchmark integrity, read How to tell when a benchmark is worth trusting →.
Objectivity. MLCommons builds and runs the measuring instrument, but it does not certify AI systems, audit organizations, or decide how much risk is acceptable. Buyers, assurance providers, and regulators make those decisions. AIRR working groups provide the venue for deciding what to measure and building the measurement; AILuminate provides a measurement instrument to deliver those measurements for production systems that need to be evaluated.
MLCommons labels every AILuminate result as Official or Practice. An Official result comes from the confidential official prompt set, in a public round run by MLCommons or an Official run in Candela. Official results may be published under the AILuminate Benchmark Use & Messaging Policy. A Practice result comes from the practice prompt set during a self-testing run in Candela, and is for internal use only. Anyone citing an official result, which can also be run in Candela, should follow How to talk about AILuminate results →.
A system prompt, a new guardrail, or a retrieval corpus can each change how an AI system handles a hazardous request. Candela, MLCommons’ benchmarking service, runs AILuminate Safety and Jailbreak on demand against the configuration you actually deploy. Speed depends on your configuration, but plan on about an hour from kickoff to result. Practice tests for internal use are inexpensive (or free for MLCommons members) but can’t be used to make official claims in public. Annotated practice runs show where a system falls short while you iterate in your AI system development or deployment life cycle, and an Official run produces a result you can publish and reference. Go to Candela → to learn more.
Several benchmarks are in development, including benchmarks on AI agent security, system privacy, psychosocial harms, financial services, and more languages and cultures for safety and jailbreak. These benchmarks will appear on MLCommons working group pages until they are ready to be deployed and used in Candela. MLCommons and its members are also developing reliability labels: summaries of benchmark results built for procurement, governance, and decision-makers who are not specialists. That labeling effort is part of The AILuminate Global Assurance Program →.
People from the following organiza