Benchmark Almanac

AIR-Bench 2024

Claude Haiku 4.5 93.2% leads since Oct 2025 Dropped

Models respond to 5,694 harmful prompts across 314 risk categories drawn from 8 government regulations and 16 company policies. Category-specific LLM judges score refusals.

Not the same as AIR-Bench for audio or the AIR-Bench retrieval benchmark.

In the authors’ words

Foundation models (FMs) provide societal benefits but also amplify risks. Governments, companies, and researchers have proposed regulatory frameworks, acceptable use policies, and safety benchmarks in response. However, existing public benchmarks often define safety categories based on previous literature, intuitions, or common sense, leading to disjointed sets of categories for risks specified in recent regulations and policies, which makes it challenging to evaluate and compare FMs across these benchmarks. To bridge this gap, we introduce AIR-Bench 2024, the first AI safety benchmark aligned with emerging government regulations and company policies, following the regulation-based safety categories grounded in our AI risks study, AIR 2024. AIR 2024 decomposes 8 government regulations and 16 company policies into a four-tiered safety taxonomy with 314 granular risk categories in the lowest tier. AIR-Bench 2024 contains 5,694 diverse prompts spanning these categories, with manual curation and human auditing to ensure quality. We evaluate leading language models on AIR-Bench 2024, uncovering insights into their alignment with specified safety concerns. By bridging the gap between public benchmarks and practical AI risks, AIR-Bench 2024 provides a foundation for assessing model safety across jurisdictions, fostering the development of safer and more responsible AI systems.

Abstract of AIR-Bench 2024: A Safety Benchmark Based on Risk Categories from Regulations and Policies (arXiv:2407.17436, CC0)
Made by Stanford CRFM + Virtue AI et al. Released Jul 2024 Refusing harmful requests All tasks public Last in a launch post Aug 2025 , dropped after it saturated Last model added Jun 2026 Scores refreshed 2 Nov 2026
Level
Everyday Most adults, without training
Scored
Graded by a model A language model scores each response, usually against a rubric.
Answers
Open-ended Free-form text, documents, designs or media judged as a whole.
84
Entries on its own leaderboard, 82 models we track
1
Launch post lists it, from 1 lab
2
System cards report it, from 2 labs

Claude Haiku 4.5 leads with 93.2% among models released by Nov 2025

Best score per entry from the benchmark's own leaderboard, read on 2 Nov 2026. Where a model ran with several settings or harnesses, we keep its best. Every run is in the next chart. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders.

The newest model with a score here came out in Nov 2025, and nobody has tested a newer one. Among the 20 highest-ranked models on the capability index, these have no score yet:

84 entries. Scroll sideways for the rest.

  1. 93.2 Claude Haiku 4.5
  2. 90.8 Claude 3.5 Sonnet (October 2024)
  3. 89.8 Claude Sonnet 4.5
  4. 88.3 Claude Sonnet 4
  5. 88.0 gpt-oss-120b
  6. 87.8 GPT-5 nano
  7. 87.7 GPT-5
  8. 86.7 Qwen3-Next-80B-A3B
  9. 86.2 GPT-5.1
  10. 86.0 gpt-oss-20b
  11. 85.9 Claude 3.5 Sonnet
  12. 85.7 Claude Opus 4
  13. 85.7 GPT-5 mini
  14. 84.7 Claude 3 Sonnet
  15. 84.5 o3
  16. 84.4 Claude 3 Opus
  17. 82.8 Gemini 1.5 Pro
  18. 82.7 Claude 3 Haiku
  19. 82.5 Granite 3.3 8B Instruct
  20. 82.0 Granite 4.0 H Small
  21. 81.8 Claude 3.7 Sonnet
  22. 80.4 granite-4.0-micro
  23. 80.0 o1
  24. 79.4 Gemini 1.5 Flash
  25. 79.0 Qwen3-235B-A22B-Instruct
  26. 78.5 o4-mini
  27. 78.2 Palmyra X5
  28. 74.9 o3-mini
  29. 74.2 GPT-4.5
  30. 74.1 Kimi K2
  31. 73.6 Gemini 2.5 Pro
  32. 73.2 Gemini 3 Pro
  33. 71.9 GPT-4 Turbo
  34. 70.9 Llama 3-8B
  35. 68.7 Gemini 2.5 Flash
  36. 68.6 Llama 4 Maverick
  37. 68.4 Gemini 2.0 Pro
  38. 67.5 Gemini 2.0 Flash-Lite
  39. 67.3 Gemini 1.5 Pro
  40. 67.1 Gemini 1.5 Flash
  41. 66.3 palmyra-fin
  42. 66.2 Gemini 2.0 Flash
  43. 65.8 Gemini 2.5 Flash-Lite
  44. 64.8 GPT-4.1
  45. 64.6 Llama 3-70B
  46. 64.2 GPT-4
  47. 63.5 GPT-3.5 Turbo (Mar 2023)
  48. 63.1 GPT-3.5 Turbo
  49. 62.4 GPT-4o
  50. 62.3 Llama 3.1-8B
  51. 62.1 Qwen2-72B
  52. 61.5 GPT-4.1 nano
  53. 60.4 GPT-4.1 mini
  54. 59.0 Qwen2.5-72B
  55. 58.6 Llama 3.1-405B
  56. 58.2 Gemini 1.0 Pro
  57. 57.8 palmyra-med
  58. 57.1 GLM-4.5-Air
  59. 56.3 GPT-4o mini
  60. 56.0 Qwen3-235B-A22B
  61. 53.6 Yi-34B
  62. 53.5 Grok-3 mini
  63. 52.9 DeepSeek-R1
  64. 52.8 GPT-4o
  65. 52.5 GPT-3.5 Turbo
  66. 52.3 Llama 4 Scout
  67. 51.3 Grok 3
  68. 50.5 DeepSeek LLM 67B
  69. 48.6 Qwen1.5-72B
  70. 47.0 Qwen2.5-7B
  71. 45.3 o1-mini
  72. 44.4 Grok 4
  73. 44.2 Palmyra X4
  74. 44.0 Mixtral 8x22B
  75. 44.0 GPT-3.5 Turbo
  76. 42.5 Llama 3.1-70B
  77. 40.8 DeepSeek-V3
  78. 39.1 Mixtral 8x7B
  79. 35.3 Mistral Large 2
  80. 32.8 Mistral Small 3
  81. 32.5 Mistral 7B v0.3
  82. 31.8 Command R (03-2024)
  83. 29.3 Command R+
  84. 25.4 DBRX
  1. 1 Claude Haiku 4.5 93.2%
  2. 2 Claude 3.5 Sonnet (October 2024) 90.8%
  3. 3 Claude Sonnet 4.5 89.8%
  4. 4 Claude Sonnet 4 88.3%
  5. 5 gpt-oss-120b 88%
  6. 6 GPT-5 nano 87.8%
  7. 7 GPT-5 87.7%
  8. 8 Qwen3-Next-80B-A3B thinking 86.7%
  9. 9 GPT-5.1 86.2%
  10. 10 gpt-oss-20b 86%
  11. 11 Claude 3.5 Sonnet 85.9%
  12. 12 Claude Opus 4 85.7%
  13. 13 GPT-5 mini 85.7%
  14. 14 Claude 3 Sonnet 84.7%
  15. 15 o3 84.5%
  16. 16 Claude 3 Opus 84.4%
  17. 17 Gemini 1.5 Pro May 2024, BLOCK_NONE safety 82.8%
  18. 18 Claude 3 Haiku 82.7%
  19. 19 Granite 3.3 8B Instruct with guardian 82.5%
  20. 20 Granite 4.0 H Small with guardian 82%
  21. 21 Claude 3.7 Sonnet 81.8%
  22. 22 granite-4.0-micro with guardian 80.4%
  23. 23 o1 80%
  24. 24 Gemini 1.5 Flash May 2024, BLOCK_NONE safety 79.4%
  25. 25 Qwen3-235B-A22B-Instruct Jul 2025 79%
  26. 26 o4-mini 78.5%
  27. 27 Palmyra X5 78.2%
  28. 28 o3-mini 74.9%
  29. 29 GPT-4.5 74.2%
  30. 30 Kimi K2 Jul 2025 74.1%
  31. 31 Gemini 2.5 Pro Jun 2025 73.6%
  32. 32 Gemini 3 Pro 73.2%
  33. 33 GPT-4 Turbo Apr 2024 71.9%
  34. 34 Llama 3-8B 70.9%
  35. 35 Gemini 2.5 Flash Sep 2025 68.7%
  36. 36 Llama 4 Maverick 68.6%
  37. 37 Gemini 2.0 Pro 68.4%
  38. 38 Gemini 2.0 Flash-Lite 67.5%
  39. 39 Gemini 1.5 Pro Sep 2024 67.3%
  40. 40 Gemini 1.5 Flash Sep 2024 67.1%
  41. 41 palmyra-fin 66.3%
  42. 42 Gemini 2.0 Flash Feb 2025 66.2%
  43. 43 Gemini 2.5 Flash-Lite Sep 2025 65.8%
  44. 44 GPT-4.1 64.8%
  45. 45 Llama 3-70B 64.6%
  46. 46 GPT-4 Jun 2023 64.2%
  47. 47 GPT-3.5 Turbo (Mar 2023) 63.5%
  48. 48 GPT-3.5 Turbo Jun 2023 63.1%
  49. 49 GPT-4o Aug 2024 62.4%
  50. 50 Llama 3.1-8B 62.3%
  51. 51 Qwen2-72B 62.1%
  52. 52 GPT-4.1 nano 61.5%
  53. 53 GPT-4.1 mini 60.4%
  54. 54 Qwen2.5-72B 59%
  55. 55 Llama 3.1-405B 58.6%
  56. 56 Gemini 1.0 Pro 58.2%
  57. 57 palmyra-med 57.8%
  58. 58 GLM-4.5-Air 57.1%
  59. 59 GPT-4o mini 56.3%
  60. 60 Qwen3-235B-A22B 56%
  61. 61 Yi-34B 53.6%
  62. 62 Grok-3 mini 53.5%
  63. 63 DeepSeek-R1 May 2025 52.9%
  64. 64 GPT-4o May 2024 52.8%
  65. 65 GPT-3.5 Turbo Nov 2023 52.5%
  66. 66 Llama 4 Scout 52.3%
  67. 67 Grok 3 51.3%
  68. 68 DeepSeek LLM 67B 50.5%
  69. 69 Qwen1.5-72B 48.6%
  70. 70 Qwen2.5-7B 47%
  71. 71 o1-mini 45.3%
  72. 72 Grok 4 44.4%
  73. 73 Palmyra X4 44.2%
  74. 74 Mixtral 8x22B 44%
  75. 75 GPT-3.5 Turbo Jan 2024 44%
  76. 76 Llama 3.1-70B 42.5%
  77. 77 DeepSeek-V3 Mar 2025 40.8%
  78. 78 Mixtral 8x7B 39.1%
  79. 79 Mistral Large 2 Jul 2024 35.3%
  80. 80 Mistral Small 3 32.8%
  81. 81 Mistral 7B v0.3 32.5%
  82. 82 Command R (03-2024) 31.8%
  83. 83 Command R+ 29.3%
  84. 84 DBRX 25.4%
#EntryScoreSettingDateSource
1 Claude Haiku 4.5 93.2% Oct 2025 Official leaderboard
2 Claude 3.5 Sonnet (October 2024) 90.8% Oct 2024 Official leaderboard
3 Claude Sonnet 4.5 89.8% Sep 2025 Official leaderboard
4 Claude Sonnet 4 88.3% May 2025 Official leaderboard
5 gpt-oss-120b 88% Aug 2025 Official leaderboard
6 GPT-5 nano 87.8% Aug 2025 Official leaderboard
7 GPT-5 87.7% Aug 2025 Official leaderboard
8 Qwen3-Next-80B-A3B 86.7% thinking Sep 2025 Official leaderboard
9 GPT-5.1 86.2% Nov 2025 Official leaderboard
10 gpt-oss-20b 86% Aug 2025 Official leaderboard
11 Claude 3.5 Sonnet 85.9% Jun 2024 Official leaderboard
12 Claude Opus 4 85.7% May 2025 Official leaderboard
13 GPT-5 mini 85.7% Aug 2025 Official leaderboard
14 Claude 3 Sonnet 84.7% Feb 2024 Official leaderboard
15 o3 84.5% Apr 2025 Official leaderboard
16 Claude 3 Opus 84.4% Feb 2024 Official leaderboard
17 Gemini 1.5 Pro May 2024 82.8% BLOCK_NONE safety May 2024 Official leaderboard
18 Claude 3 Haiku 82.7% Mar 2024 Official leaderboard
19 Granite 3.3 8B Instruct 82.5% with guardian Apr 2025 Official leaderboard
20 Granite 4.0 H Small 82% with guardian Oct 2025 Official leaderboard
21 Claude 3.7 Sonnet 81.8% Feb 2025 Official leaderboard
22 granite-4.0-micro 80.4% with guardian Oct 2025 Official leaderboard
23 o1 80% Dec 2024 Official leaderboard
24 Gemini 1.5 Flash May 2024 79.4% BLOCK_NONE safety May 2024 Official leaderboard
25 Qwen3-235B-A22B-Instruct Jul 2025 79% Jul 2025 Official leaderboard
26 o4-mini 78.5% Apr 2025 Official leaderboard
27 Palmyra X5 78.2% Apr 2025 Official leaderboard
28 o3-mini 74.9% Jan 2025 Official leaderboard
29 GPT-4.5 74.2% Feb 2025 Official leaderboard
30 Kimi K2 Jul 2025 74.1% Jul 2025 Official leaderboard
31 Gemini 2.5 Pro Jun 2025 73.6% Jun 2025 Official leaderboard
32 Gemini 3 Pro 73.2% Nov 2025 Official leaderboard
33 GPT-4 Turbo Apr 2024 71.9% Apr 2024 Official leaderboard
34 Llama 3-8B 70.9% Apr 2024 Official leaderboard
35 Gemini 2.5 Flash Sep 2025 68.7% Sep 2025 Official leaderboard
36 Llama 4 Maverick 68.6% Apr 2025 Official leaderboard
37 Gemini 2.0 Pro 68.4% Feb 2025 Official leaderboard
38 Gemini 2.0 Flash-Lite 67.5% Feb 2025 Official leaderboard
39 Gemini 1.5 Pro Sep 2024 67.3% Sep 2024 Official leaderboard
40 Gemini 1.5 Flash Sep 2024 67.1% Aug 2024 Official leaderboard
41 palmyra-fin 66.3% Official leaderboard
42 Gemini 2.0 Flash Feb 2025 66.2% Feb 2025 Official leaderboard
43 Gemini 2.5 Flash-Lite Sep 2025 65.8% Sep 2025 Official leaderboard
44 GPT-4.1 64.8% Apr 2025 Official leaderboard
45 Llama 3-70B 64.6% Apr 2024 Official leaderboard
46 GPT-4 Jun 2023 64.2% Jun 2023 Official leaderboard
47 GPT-3.5 Turbo (Mar 2023) 63.5% Mar 2023 Official leaderboard
48 GPT-3.5 Turbo Jun 2023 63.1% Jun 2023 Official leaderboard
49 GPT-4o Aug 2024 62.4% Aug 2024 Official leaderboard
50 Llama 3.1-8B 62.3% Jul 2024 Official leaderboard
51 Qwen2-72B 62.1% Jun 2024 Official leaderboard
52 GPT-4.1 nano 61.5% Apr 2025 Official leaderboard
53 GPT-4.1 mini 60.4% Apr 2025 Official leaderboard
54 Qwen2.5-72B 59% Sep 2024 Official leaderboard
55 Llama 3.1-405B 58.6% Jul 2024 Official leaderboard
56 Gemini 1.0 Pro 58.2% Dec 2023 Official leaderboard
57 palmyra-med 57.8% Official leaderboard
58 GLM-4.5-Air 57.1% Jul 2025 Official leaderboard
59 GPT-4o mini 56.3% Jul 2024 Official leaderboard
60 Qwen3-235B-A22B 56% Apr 2025 Official leaderboard
61 Yi-34B 53.6% Nov 2023 Official leaderboard
62 Grok-3 mini 53.5% Apr 2025 Official leaderboard
63 DeepSeek-R1 May 2025 52.9% May 2025 Official leaderboard
64 GPT-4o May 2024 52.8% May 2024 Official leaderboard
65 GPT-3.5 Turbo Nov 2023 52.5% Nov 2023 Official leaderboard
66 Llama 4 Scout 52.3% Apr 2025 Official leaderboard
67 Grok 3 51.3% Apr 2025 Official leaderboard
68 DeepSeek LLM 67B 50.5% Nov 2023 Official leaderboard
69 Qwen1.5-72B 48.6% Feb 2024 Official leaderboard
70 Qwen2.5-7B 47% Sep 2024 Official leaderboard
71 o1-mini 45.3% Sep 2024 Official leaderboard
72 Grok 4 44.4% Jul 2025 Official leaderboard
73 Palmyra X4 44.2% Oct 2024 Official leaderboard
74 Mixtral 8x22B 44% Apr 2024 Official leaderboard
75 GPT-3.5 Turbo Jan 2024 44% Jan 2024 Official leaderboard
76 Llama 3.1-70B 42.5% Jul 2024 Official leaderboard
77 DeepSeek-V3 Mar 2025 40.8% Mar 2025 Official leaderboard
78 Mixtral 8x7B 39.1% Dec 2023 Official leaderboard
79 Mistral Large 2 Jul 2024 35.3% Jul 2024 Official leaderboard
80 Mistral Small 3 32.8% Jan 2025 Official leaderboard
81 Mistral 7B v0.3 32.5% Sep 2023 Official leaderboard
82 Command R (03-2024) 31.8% Mar 2024 Official leaderboard
83 Command R+ 29.3% Aug 2024 Official leaderboard
84 DBRX 25.4% Mar 2024 Official leaderboard

Labs report scores for 2 models in their cards. We plot every source in the charts below.

Scores at each effort level

Models the leaderboard ran at two or more effort levels. We don’t have enough cost data here to say what the extra effort costs.

Lowest effort to highest, light to dark
Granite 3.3 8B Instruct
with guardi…
82.5%
Granite 4.0 H Small
with guardi…
82%
granite-4.0-micro
with guardi…
80.4%
ModelEffortHarnessScoreCost per taskOutput tokens
Claude Haiku 4.5 93.2%
Claude 3.5 Sonnet (October 2024) 90.8%
Claude Sonnet 4.5 89.8%
Claude Sonnet 4 88.3%
gpt-oss-120b 88%
GPT-5 nano 87.8%
GPT-5 87.7%
Qwen3-Next-80B-A3B thinking 86.7%
GPT-5.1 86.2%
gpt-oss-20b 86%
Claude 3.5 Sonnet 85.9%
Claude Opus 4 85.7%
GPT-5 mini 85.7%
Claude 3 Sonnet 84.7%
o3 84.5%
Claude 3 Opus 84.4%
Gemini 1.5 Pro May 2024 BLOCK_NONE safety 82.8%
Claude 3 Haiku 82.7%
Granite 3.3 8B Instruct with guardian 82.5%
Granite 4.0 H Small with guardian 82%
Claude 3.7 Sonnet 81.8%
granite-4.0-micro with guardian 80.4%
o1 80%
Gemini 1.5 Flash May 2024 BLOCK_NONE safety 79.4%
Qwen3-235B-A22B-Instruct Jul 2025 79%
o4-mini 78.5%
Palmyra X5 78.2%
Granite 3.3 8B Instruct 76%
o3-mini 74.9%
GPT-4.5 74.2%
Kimi K2 Jul 2025 74.1%
Gemini 2.5 Pro Jun 2025 73.6%
Gemini 3 Pro 73.2%
GPT-4 Turbo Apr 2024 71.9%
Granite 4.0 H Small 71.6%
Llama 3-8B 70.9%
Gemini 2.5 Flash Sep 2025 68.7%
Llama 4 Maverick 68.6%
Gemini 2.0 Pro 68.4%
Gemini 2.0 Flash-Lite 67.5%
Gemini 1.5 Pro Sep 2024 67.3%
Gemini 1.5 Flash Sep 2024 67.1%
Gemini 2.0 Flash Feb 2025 66.2%
granite-4.0-micro 66%
Gemini 2.5 Flash-Lite Sep 2025 65.8%
GPT-4.1 64.8%
Llama 3-70B 64.6%
GPT-4 Jun 2023 64.2%
GPT-3.5 Turbo (Mar 2023) 63.5%
GPT-3.5 Turbo Jun 2023 63.1%
GPT-4o Aug 2024 62.4%
Llama 3.1-8B 62.3%
Qwen2-72B 62.1%
GPT-4.1 nano 61.5%
GPT-4.1 mini 60.4%
Qwen2.5-72B 59%
Llama 3.1-405B 58.6%
Gemini 1.0 Pro 58.2%
GLM-4.5-Air 57.1%
GPT-4o mini 56.3%
Qwen3-235B-A22B 56%
Yi-34B 53.6%
Grok-3 mini 53.5%
DeepSeek-R1 May 2025 52.9%
GPT-4o May 2024 52.8%
GPT-3.5 Turbo Nov 2023 52.5%
Llama 4 Scout 52.3%
Grok 3 51.3%
DeepSeek LLM 67B 50.5%
Qwen1.5-72B 48.6%
Qwen2.5-7B 47%
o1-mini 45.3%
Grok 4 44.4%
Palmyra X4 44.2%
Mixtral 8x22B 44%
GPT-3.5 Turbo Jan 2024 44%
Llama 3.1-70B 42.5%
DeepSeek-V3 Mar 2025 40.8%
Mixtral 8x7B 39.1%
Mistral Large 2 Jul 2024 35.3%
Mistral Small 3 32.8%
Mistral 7B v0.3 32.5%
Command R (03-2024) 31.8%
Command R+ 29.3%
DBRX 25.4%

3 models have held number one since its release in Jul 2024

Lab claims count from the day the card came out, independent runs from the model’s release.

Anthropic
Own leaderboard Passed 85% in Jul 2024, by Claude 3.5 Sonnet

The best score passed 85% in Jun 2024

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard Reported by the lab in its model card Best so far
0% 20% 40% 60% 80% 100% 2023 2024 2025 2026 Near the ceiling (85%) Claude Haiku 4.5 Claude 3.5 Sonnet (October 2024) Claude 3.5 Sonnet GPT-4 0% 20% 40% 60% 80% 100% 2023 2024 2025 2026 Near the ceiling (85%) Claude Haiku 4.5 Claude 3.5 Sonnet

Labs dropped it from launch posts once the best score passed 85%

Launch posts from every lab that has listed it, one tick per post. Tall colored ticks include it, and short gray ones leave it out.

ByteDance Seed
DateLaunch postScoreAs the post writes it
20 Aug 2025 seed-oss-36b-instruct 75.6 AIR-Bench (Safety)

2 system cards report it, from 2 labs

Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.

DateDocumentScoreAs the document writes itSection
2 Jun 2026 MAI-Thinking-1 technical report 88 AIR-Bench, Safety (Table 12, rounded) Safety
21 Mar 2026 Seed1.8 model card AIR-Bench, bar chart with no printed number (Figure 10) Safety

More in Safety and alignment

All 444 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • AgentDojo In use Agents do tool-use tasks while tools and data carry prompt injections. Attack success rate counts hijacked runs. Grok 4 Fast 0%
  • MASK In use Measures whether a model contradicts its own elicited beliefs under pressure to lie. Honesty separated from accuracy. Muse Spark Open 98.1%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. GPT-6 Astra 8.50%
  • Agentic misalignment suite (Anthropic) In use Agents in simulated company settings face threats or goal conflicts that invite blackmail, leaking or sabotage. Score is the misaligned action rate. Claude Sonnet 4.5 0%