BenchMIRT reveals safety tests also gauge general reasoning

Researchers introduced BenchMIRT, a method that breaks down benchmark scores of large language models (LLM) into the underlying factors that actually drive performance at the level of a single question or task. Rather than relying on an average score, the tool examines how each model behaves on each item and estimates which latent capabilities are statistically linked to success. The approach is derived from Item Response Theory (IRT), a psychometric framework that infers traits from response patterns; IRT assumes that not every question provides the same information—some are harder, some discriminate better between strong and weak performers. BenchMIRT extends this to multidimensional IRT (MIRT), allowing several capabilities that jointly contribute to an item to be separated.

The model was trained on results from 100 LLMs evaluated on 16 benchmarks, comprising more than 34 thousand prompts. Six of the benchmarks assess general reasoning—MMLU-Pro, GPQA, MATH, BBH—and ten belong to the Olmo 3 safety suite, including HarmBench, StrongReject, WildJailbreak, BBQ, WMDP and XSTest. Crucially, the researchers did not tell BenchMIRT which benchmark measured what; the system identified two dominant dimensions—safety and general reasoning—on its own, and when the analysis was rerun from scratch the same two dimensions reappeared, indicating stability rather than a one-off artifact.

The biggest surprise came from BBQ, a benchmark that tests social biases and is commonly grouped with safety. BenchMIRT aligned BBQ much more strongly with the general-reasoning dimension. The implication is that a low BBQ score may reflect difficulty understanding or reasoning through certain scenarios—for example, tracking who is the grandchild and who is the grandparent in an Uber order—not necessarily unsafe behavior. In other words, the benchmark measures tracking and inference ability as much as, if not more than, reliance on stereotypes.

WMDP behaves differently from most safety tests. It assesses dual-use knowledge in biology, chemistry and cyber security—knowledge that could enable harmful exploitation. Unlike jailbreak and harmful-content benchmarks, which aligned with safety, WMDP shows a distinct profile. The source truncated before the full conclusion, but the direction is clear: not all items labeled “safety” load on the same factor.

When a single score is attached to a benchmark, the distinction between different capabilities that overlap in the same questions is lost. WildJailbreak illustrates this: malicious prompts load on safety, while benign prompts that probe excessive refusal load on general reasoning, and averaging them blurs the difference. BenchMIRT gives researchers a lens that separates these signals, allowing them to ask not only “how safe is the model” but also “what portion of the score comes from reasoning versus safe behavior.” This separation is a necessary step before using such scores for deployment decisions or regulation.