AIR-Bench 2024
Models respond to 5,694 harmful prompts across 314 risk categories drawn from 8 government regulations and 16 company policies. Category-specific LLM judges score refusals.
Not the same as AIR-Bench for audio or the AIR-Bench retrieval benchmark.
In the authors’ words
Foundation models (FMs) provide societal benefits but also amplify risks. Governments, companies, and researchers have proposed regulatory frameworks, acceptable use policies, and safety benchmarks in response. However, existing public benchmarks often define safety categories based on previous literature, intuitions, or common sense, leading to disjointed sets of categories for risks specified in recent regulations and policies, which makes it challenging to evaluate and compare FMs across these benchmarks. To bridge this gap, we introduce AIR-Bench 2024, the first AI safety benchmark aligned with emerging government regulations and company policies, following the regulation-based safety categories grounded in our AI risks study, AIR 2024. AIR 2024 decomposes 8 government regulations and 16 company policies into a four-tiered safety taxonomy with 314 granular risk categories in the lowest tier. AIR-Bench 2024 contains 5,694 diverse prompts spanning these categories, with manual curation and human auditing to ensure quality. We evaluate leading language models on AIR-Bench 2024, uncovering insights into their alignment with specified safety concerns. By bridging the gap between public benchmarks and practical AI risks, AIR-Bench 2024 provides a foundation for assessing model safety across jurisdictions, fostering the development of safer and more responsible AI systems.
- Level
- Everyday Most adults, without training
- Scored
- Graded by a model A language model scores each response, usually against a rubric.
- Answers
- Open-ended Free-form text, documents, designs or media judged as a whole.
Claude Haiku 4.5 leads with 93.2% among models released by Nov 2025
Best score per entry from the benchmark's own leaderboard, read on 2 Nov 2026. Where a model ran with several settings or harnesses, we keep its best. Every run is in the next chart. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders.
The newest model with a score here came out in Nov 2025, and nobody has tested a newer one. Among the 20 highest-ranked models on the capability index, these have no score yet:
- GPT-6 Astra
- Claude Opus 5.5
- GPT-6.1 Terra
- GPT-6.1 Sol
- and 16 more
- 93.2 Claude Haiku 4.5
- 90.8 Claude 3.5 Sonnet (October 2024)
- 89.8 Claude Sonnet 4.5
- 88.3 Claude Sonnet 4
- 88.0 gpt-oss-120b
- 87.8 GPT-5 nano
- 87.7 GPT-5
- 86.7
Qwen3-Next-80B-A3B
- 86.2 GPT-5.1
- 86.0 gpt-oss-20b
- 85.9 Claude 3.5 Sonnet
- 85.7 Claude Opus 4
- 85.7 GPT-5 mini
- 84.7 Claude 3 Sonnet
- 84.5 o3
- 84.4 Claude 3 Opus
- 82.8
Gemini 1.5 Pro
- 82.7 Claude 3 Haiku
- 82.5 Granite 3.3 8B Instruct
- 82.0 Granite 4.0 H Small
- 81.8 Claude 3.7 Sonnet
- 80.4 granite-4.0-micro
- 80.0 o1
- 79.4
Gemini 1.5 Flash
- 79.0
Qwen3-235B-A22B-Instruct
- 78.5 o4-mini
- 78.2 Palmyra X5
- 74.9 o3-mini
- 74.2 GPT-4.5
- 74.1 Kimi K2
- 73.6
Gemini 2.5 Pro
- 73.2
Gemini 3 Pro
- 71.9 GPT-4 Turbo
- 70.9
Llama 3-8B
- 68.7
Gemini 2.5 Flash
- 68.6
Llama 4 Maverick
- 68.4
Gemini 2.0 Pro
- 67.5
Gemini 2.0 Flash-Lite
- 67.3
Gemini 1.5 Pro
- 67.1
Gemini 1.5 Flash
- 66.3 palmyra-fin
- 66.2
Gemini 2.0 Flash
- 65.8
Gemini 2.5 Flash-Lite
- 64.8 GPT-4.1
- 64.6
Llama 3-70B
- 64.2 GPT-4
- 63.5 GPT-3.5 Turbo (Mar 2023)
- 63.1 GPT-3.5 Turbo
- 62.4 GPT-4o
- 62.3
Llama 3.1-8B
- 62.1
Qwen2-72B
- 61.5 GPT-4.1 nano
- 60.4 GPT-4.1 mini
- 59.0
Qwen2.5-72B
- 58.6
Llama 3.1-405B
- 58.2
Gemini 1.0 Pro
- 57.8 palmyra-med
- 57.1 GLM-4.5-Air
- 56.3 GPT-4o mini
- 56.0
Qwen3-235B-A22B
- 53.6
Yi-34B
- 53.5 Grok-3 mini
- 52.9
DeepSeek-R1
- 52.8 GPT-4o
- 52.5 GPT-3.5 Turbo
- 52.3
Llama 4 Scout
- 51.3 Grok 3
- 50.5
DeepSeek LLM 67B
- 48.6
Qwen1.5-72B
- 47.0
Qwen2.5-7B
- 45.3 o1-mini
- 44.4 Grok 4
- 44.2 Palmyra X4
- 44.0
Mixtral 8x22B
- 44.0 GPT-3.5 Turbo
- 42.5
Llama 3.1-70B
- 40.8
DeepSeek-V3
- 39.1
Mixtral 8x7B
- 35.3
Mistral Large 2
- 32.8
Mistral Small 3
- 32.5
Mistral 7B v0.3
- 31.8
Command R (03-2024)
- 29.3
Command R+
- 25.4
DBRX
- 1 Claude Haiku 4.5 93.2%
- 2 Claude 3.5 Sonnet (October 2024) 90.8%
- 3 Claude Sonnet 4.5 89.8%
- 4 Claude Sonnet 4 88.3%
- 5 gpt-oss-120b 88%
- 6 GPT-5 nano 87.8%
- 7 GPT-5 87.7%
- 8
Qwen3-Next-80B-A3B thinking 86.7%
- 9 GPT-5.1 86.2%
- 10 gpt-oss-20b 86%
- 11 Claude 3.5 Sonnet 85.9%
- 12 Claude Opus 4 85.7%
- 13 GPT-5 mini 85.7%
- 14 Claude 3 Sonnet 84.7%
- 15 o3 84.5%
- 16 Claude 3 Opus 84.4%
- 17
Gemini 1.5 Pro May 2024, BLOCK_NONE safety 82.8%
- 18 Claude 3 Haiku 82.7%
- 19 Granite 3.3 8B Instruct with guardian 82.5%
- 20 Granite 4.0 H Small with guardian 82%
- 21 Claude 3.7 Sonnet 81.8%
- 22 granite-4.0-micro with guardian 80.4%
- 23 o1 80%
- 24
Gemini 1.5 Flash May 2024, BLOCK_NONE safety 79.4%
- 25
Qwen3-235B-A22B-Instruct Jul 2025 79%
- 26 o4-mini 78.5%
- 27 Palmyra X5 78.2%
- 28 o3-mini 74.9%
- 29 GPT-4.5 74.2%
- 30 Kimi K2 Jul 2025 74.1%
- 31
Gemini 2.5 Pro Jun 2025 73.6%
- 32
Gemini 3 Pro 73.2%
- 33 GPT-4 Turbo Apr 2024 71.9%
- 34
Llama 3-8B 70.9%
- 35
Gemini 2.5 Flash Sep 2025 68.7%
- 36
Llama 4 Maverick 68.6%
- 37
Gemini 2.0 Pro 68.4%
- 38
Gemini 2.0 Flash-Lite 67.5%
- 39
Gemini 1.5 Pro Sep 2024 67.3%
- 40
Gemini 1.5 Flash Sep 2024 67.1%
- 41 palmyra-fin 66.3%
- 42
Gemini 2.0 Flash Feb 2025 66.2%
- 43
Gemini 2.5 Flash-Lite Sep 2025 65.8%
- 44 GPT-4.1 64.8%
- 45
Llama 3-70B 64.6%
- 46 GPT-4 Jun 2023 64.2%
- 47 GPT-3.5 Turbo (Mar 2023) 63.5%
- 48 GPT-3.5 Turbo Jun 2023 63.1%
- 49 GPT-4o Aug 2024 62.4%
- 50
Llama 3.1-8B 62.3%
- 51
Qwen2-72B 62.1%
- 52 GPT-4.1 nano 61.5%
- 53 GPT-4.1 mini 60.4%
- 54
Qwen2.5-72B 59%
- 55
Llama 3.1-405B 58.6%
- 56
Gemini 1.0 Pro 58.2%
- 57 palmyra-med 57.8%
- 58 GLM-4.5-Air 57.1%
- 59 GPT-4o mini 56.3%
- 60
Qwen3-235B-A22B 56%
- 61
Yi-34B 53.6%
- 62 Grok-3 mini 53.5%
- 63
DeepSeek-R1 May 2025 52.9%
- 64 GPT-4o May 2024 52.8%
- 65 GPT-3.5 Turbo Nov 2023 52.5%
- 66
Llama 4 Scout 52.3%
- 67 Grok 3 51.3%
- 68
DeepSeek LLM 67B 50.5%
- 69
Qwen1.5-72B 48.6%
- 70
Qwen2.5-7B 47%
- 71 o1-mini 45.3%
- 72 Grok 4 44.4%
- 73 Palmyra X4 44.2%
- 74
Mixtral 8x22B 44%
- 75 GPT-3.5 Turbo Jan 2024 44%
- 76
Llama 3.1-70B 42.5%
- 77
DeepSeek-V3 Mar 2025 40.8%
- 78
Mixtral 8x7B 39.1%
- 79
Mistral Large 2 Jul 2024 35.3%
- 80
Mistral Small 3 32.8%
- 81
Mistral 7B v0.3 32.5%
- 82
Command R (03-2024) 31.8%
- 83
Command R+ 29.3%
- 84
DBRX 25.4%
| # | Entry | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | Claude Haiku 4.5 | 93.2% | Oct 2025 | Official leaderboard | |
| 2 | Claude 3.5 Sonnet (October 2024) | 90.8% | Oct 2024 | Official leaderboard | |
| 3 | Claude Sonnet 4.5 | 89.8% | Sep 2025 | Official leaderboard | |
| 4 | Claude Sonnet 4 | 88.3% | May 2025 | Official leaderboard | |
| 5 | gpt-oss-120b | 88% | Aug 2025 | Official leaderboard | |
| 6 | GPT-5 nano | 87.8% | Aug 2025 | Official leaderboard | |
| 7 | GPT-5 | 87.7% | Aug 2025 | Official leaderboard | |
| 8 | | 86.7% | thinking | Sep 2025 | Official leaderboard |
| 9 | GPT-5.1 | 86.2% | Nov 2025 | Official leaderboard | |
| 10 | gpt-oss-20b | 86% | Aug 2025 | Official leaderboard | |
| 11 | Claude 3.5 Sonnet | 85.9% | Jun 2024 | Official leaderboard | |
| 12 | Claude Opus 4 | 85.7% | May 2025 | Official leaderboard | |
| 13 | GPT-5 mini | 85.7% | Aug 2025 | Official leaderboard | |
| 14 | Claude 3 Sonnet | 84.7% | Feb 2024 | Official leaderboard | |
| 15 | o3 | 84.5% | Apr 2025 | Official leaderboard | |
| 16 | Claude 3 Opus | 84.4% | Feb 2024 | Official leaderboard | |
| 17 | | 82.8% | BLOCK_NONE safety | May 2024 | Official leaderboard |
| 18 | Claude 3 Haiku | 82.7% | Mar 2024 | Official leaderboard | |
| 19 | Granite 3.3 8B Instruct | 82.5% | with guardian | Apr 2025 | Official leaderboard |
| 20 | Granite 4.0 H Small | 82% | with guardian | Oct 2025 | Official leaderboard |
| 21 | Claude 3.7 Sonnet | 81.8% | Feb 2025 | Official leaderboard | |
| 22 | granite-4.0-micro | 80.4% | with guardian | Oct 2025 | Official leaderboard |
| 23 | o1 | 80% | Dec 2024 | Official leaderboard | |
| 24 | | 79.4% | BLOCK_NONE safety | May 2024 | Official leaderboard |
| 25 | | 79% | Jul 2025 | Official leaderboard | |
| 26 | o4-mini | 78.5% | Apr 2025 | Official leaderboard | |
| 27 | Palmyra X5 | 78.2% | Apr 2025 | Official leaderboard | |
| 28 | o3-mini | 74.9% | Jan 2025 | Official leaderboard | |
| 29 | GPT-4.5 | 74.2% | Feb 2025 | Official leaderboard | |
| 30 | Kimi K2 Jul 2025 | 74.1% | Jul 2025 | Official leaderboard | |
| 31 | | 73.6% | Jun 2025 | Official leaderboard | |
| 32 | | 73.2% | Nov 2025 | Official leaderboard | |
| 33 | GPT-4 Turbo Apr 2024 | 71.9% | Apr 2024 | Official leaderboard | |
| 34 | | 70.9% | Apr 2024 | Official leaderboard | |
| 35 | | 68.7% | Sep 2025 | Official leaderboard | |
| 36 | | 68.6% | Apr 2025 | Official leaderboard | |
| 37 | | 68.4% | Feb 2025 | Official leaderboard | |
| 38 | | 67.5% | Feb 2025 | Official leaderboard | |
| 39 | | 67.3% | Sep 2024 | Official leaderboard | |
| 40 | | 67.1% | Aug 2024 | Official leaderboard | |
| 41 | palmyra-fin | 66.3% | Official leaderboard | ||
| 42 | | 66.2% | Feb 2025 | Official leaderboard | |
| 43 | | 65.8% | Sep 2025 | Official leaderboard | |
| 44 | GPT-4.1 | 64.8% | Apr 2025 | Official leaderboard | |
| 45 | | 64.6% | Apr 2024 | Official leaderboard | |
| 46 | GPT-4 Jun 2023 | 64.2% | Jun 2023 | Official leaderboard | |
| 47 | GPT-3.5 Turbo (Mar 2023) | 63.5% | Mar 2023 | Official leaderboard | |
| 48 | GPT-3.5 Turbo Jun 2023 | 63.1% | Jun 2023 | Official leaderboard | |
| 49 | GPT-4o Aug 2024 | 62.4% | Aug 2024 | Official leaderboard | |
| 50 | | 62.3% | Jul 2024 | Official leaderboard | |
| 51 | | 62.1% | Jun 2024 | Official leaderboard | |
| 52 | GPT-4.1 nano | 61.5% | Apr 2025 | Official leaderboard | |
| 53 | GPT-4.1 mini | 60.4% | Apr 2025 | Official leaderboard | |
| 54 | | 59% | Sep 2024 | Official leaderboard | |
| 55 | | 58.6% | Jul 2024 | Official leaderboard | |
| 56 | | 58.2% | Dec 2023 | Official leaderboard | |
| 57 | palmyra-med | 57.8% | Official leaderboard | ||
| 58 | GLM-4.5-Air | 57.1% | Jul 2025 | Official leaderboard | |
| 59 | GPT-4o mini | 56.3% | Jul 2024 | Official leaderboard | |
| 60 | | 56% | Apr 2025 | Official leaderboard | |
| 61 | | 53.6% | Nov 2023 | Official leaderboard | |
| 62 | Grok-3 mini | 53.5% | Apr 2025 | Official leaderboard | |
| 63 | | 52.9% | May 2025 | Official leaderboard | |
| 64 | GPT-4o May 2024 | 52.8% | May 2024 | Official leaderboard | |
| 65 | GPT-3.5 Turbo Nov 2023 | 52.5% | Nov 2023 | Official leaderboard | |
| 66 | | 52.3% | Apr 2025 | Official leaderboard | |
| 67 | Grok 3 | 51.3% | Apr 2025 | Official leaderboard | |
| 68 | | 50.5% | Nov 2023 | Official leaderboard | |
| 69 | | 48.6% | Feb 2024 | Official leaderboard | |
| 70 | | 47% | Sep 2024 | Official leaderboard | |
| 71 | o1-mini | 45.3% | Sep 2024 | Official leaderboard | |
| 72 | Grok 4 | 44.4% | Jul 2025 | Official leaderboard | |
| 73 | Palmyra X4 | 44.2% | Oct 2024 | Official leaderboard | |
| 74 | | 44% | Apr 2024 | Official leaderboard | |
| 75 | GPT-3.5 Turbo Jan 2024 | 44% | Jan 2024 | Official leaderboard | |
| 76 | | 42.5% | Jul 2024 | Official leaderboard | |
| 77 | | 40.8% | Mar 2025 | Official leaderboard | |
| 78 | | 39.1% | Dec 2023 | Official leaderboard | |
| 79 | | 35.3% | Jul 2024 | Official leaderboard | |
| 80 | | 32.8% | Jan 2025 | Official leaderboard | |
| 81 | | 32.5% | Sep 2023 | Official leaderboard | |
| 82 | | 31.8% | Mar 2024 | Official leaderboard | |
| 83 | | 29.3% | Aug 2024 | Official leaderboard | |
| 84 | | 25.4% | Mar 2024 | Official leaderboard |
Labs report scores for 2 models in their cards. We plot every source in the charts below.
Scores at each effort level
Models the leaderboard ran at two or more effort levels. We don’t have enough cost data here to say what the extra effort costs.
3 models have held number one since its release in Jul 2024
Lab claims count from the day the card came out, independent runs from the model’s release.
The best score passed 85% in Jun 2024
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Labs dropped it from launch posts once the best score passed 85%
Launch posts from every lab that has listed it, one tick per post. Tall colored ticks include it, and short gray ones leave it out.
| Date | Launch post | Score | As the post writes it |
|---|---|---|---|
| 20 Aug 2025 | 75.6 | AIR-Bench (Safety) |
2 system cards report it, from 2 labs
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| 2 Jun 2026 | | 88 | AIR-Bench, Safety (Table 12, rounded) | Safety |
| 21 Mar 2026 | | AIR-Bench, bar chart with no printed number (Figure 10) | Safety |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- AgentDojo In use Agents do tool-use tasks while tools and data carry prompt injections. Attack success rate counts hijacked runs. Grok 4 Fast 0%
- MASK In use Measures whether a model contradicts its own elicited beliefs under pressure to lie. Honesty separated from accuracy.
Muse Spark Open 98.1%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. GPT-6 Astra 8.50%
- Agentic misalignment suite (Anthropic) In use Agents in simulated company settings face threats or goal conflicts that invite blackmail, leaking or sabotage. Score is the misaligned action rate. Claude Sonnet 4.5 0%