Research map / Large language models / Language, safety and interpretability
CASE-Bench: Context-Aware SafEty Benchmark for Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces CASE-Bench, a context-aware LLM safety benchmark with 900 query-context pairs (450 SORRY-Bench queries, two contexts each) built on Contextual Integrity theory and rated by ~2,000 crowd annotators, and evaluates LLMs and Llama-Guard-3-8B as safety judges.
Problem
Existing LLM safety benchmarks judge refusal of isolated queries and ignore the context in which a query occurs, leading to over-refusal in safe contexts and under-moderation in unsafe ones; it is unclear whether LLMs can make context-aware safety judgments that match humans.
Approach
Pair each SORRY-Bench query with formally specified safe and unsafe contexts derived from Contextual Integrity parameters (sender, recipient, transmission principle), collect 21 crowd judgments per query-context task sized by power analysis, and use the non-binary human ratings to evaluate LLM judges via accuracy, recall, PCC and BCE.
Key results
- Context significantly shifts human judgments: manually revised unsafe context gave z = -31.18 versus no context (p<0.0001), and manually revised safe context gave z = 21.95.
- Claude-3.5-sonnet achieved the best accuracy (90.1%) and PCC (76.27) among evaluated LLM judges, while GPT-4o reached 78.6% accuracy with 58.1% recall on safe contexts, indicating over-refusal.
- Adding context improved Llama-Guard-3-8B accuracy from 54.1% to 60.1% and PCC from 8.10 to 26.34.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Include context in Llama-Guard-3-8B's input (ablation) | Llama-Guard-3-8B · CASE-Bench | accuracy: 54.1% -> 60.1% | Helped |
| Use direct score prompting instead of binary classification | Claude-3.5-sonnet · CASE-Bench | accuracy: 88.7% -> 90.1% | Helped |
| Use direct score prompting instead of binary classification | DeepSeek-R1 · CASE-Bench | accuracy: 87.9% -> 88.6% | Helped |
| Use direct score prompting instead of binary classification | GPT-4o · CASE-Bench | accuracy: 77.0% -> 78.6% | Helped |
| Use direct score prompting instead of binary classification | GPT-4o-mini · CASE-Bench | accuracy: 82.0% -> 80.0% | Hurt |
| Use direct score prompting instead of binary classification | Llama-3-70B-Instruct · CASE-Bench | accuracy: 86.6% -> 84.4% | Hurt |
| Use normalized token probabilities instead of binary classification | Llama-3-70B-Instruct · CASE-Bench | accuracy: 86.6% -> 87.2% | Helped |
| Use direct score prompting instead of binary classification | Qwen2-72B · CASE-Bench | accuracy: 86.4% -> 84.7% | Hurt |
| Use normalized token probabilities instead of binary classification | Qwen2-72B · CASE-Bench | accuracy: 86.4% -> 81.6% | Hurt |
| Use direct score prompting instead of binary classification | Mixtral 8x7B Instruct · CASE-Bench | accuracy: 81.9% -> 83.1% | Helped |
| Use normalized token probabilities instead of binary classification | Mixtral 8x7B Instruct · CASE-Bench | accuracy: 81.9% -> 83.1% | Helped |
| Use direct score prompting instead of binary classification | Dolphin-2.9-Llama3-70B · CASE-Bench | accuracy: 82.6% -> 80.8% | Hurt |
Surprising findings
- Auto-generated (GPT-4o) safe contexts did not produce the expected shift in human judgments (z = -7.83), while manually revised safe contexts did.
- DeepSeek-R1, not safety-optimized, performed similarly to Claude-3.5-sonnet and clearly outperformed GPT-4o on safe-context recall.
Limitations
- Assumes context is verified and reliable, which is not enforced in practice.
- Some queries remain inherently unsafe and show little change under safe contexts, limiting coverage.
- Relies on SORRY-Bench queries and access is restricted to users with SORRY-Bench permission.
Experimental setup
Datasets: SORRY-Bench
Benchmarks: CASE-Bench
Metrics: accuracy recall Pearson correlation coefficient binary cross-entropy
Baselines: GPT-4o GPT-4o-mini Claude-3.5-sonnet DeepSeek-R1 Llama-3-70B-Instruct Qwen2-72B Mixtral 8x7B Instruct Dolphin-2.9-Llama3-70B Llama-Guard-3-8B
Builds on: SORRY-Bench Contextual Integrity theory
Closest papers by meaning
- SafetyPrompts: A Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safety (AAAI 2025 · similarity 0.91)
- Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models (NeurIPS 2024 · similarity 0.90)
- Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements (ICLR 2025 · similarity 0.89)
- SafeInfer: Context Adaptive Decoding Time Safety Alignment for Large Language Models (AAAI 2025 · similarity 0.89)
- SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal (ICLR 2025 · similarity 0.89)
- Measuring what Matters: Construct Validity in Large Language Model Benchmarks (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.