FUSE: An Evaluating Framework for Dangerous Capabilities of LLMs

2609.02168 ↗ · 2026-09-02 · cs.AI

Zhengyi Jin, Ru Zhang, Xiao Chen, Xinbo Liu, Jiaxuan Lin, Jia Huang, Jianyi Liu, Zhen Yang

The finding

Headline claim

A unified three-pipeline evaluation (knowledge, defense, harm) shows that newer LLM generations do not uniformly become safer: hazardous knowledge compounds across releases, defense improvements diverge by family, and the actionability of harmful compliant outputs has stayed essentially flat from 2023 to 2026.

The test

A modular framework with three orthogonal pipelines was instantiated on a chemical-biological danger module and run against 12 commercial LLMs from four families spanning 2023 to 2026: knowledge scored via IRT (2PL) on MCQ item banks, defense scored under five-round adaptive multi-turn elicitation by a Red-Team Agent, and harm scored by rubric-based LLM judges on open-ended generations, aggregated into a seven-dimensional capability profile; a small cyber pilot tested protocol transfer.

Effect size & scope

Pipeline orthogonality is moderate: inter-pipeline correlations among K, D, H across the 12 models are rho in [0.32, 0.52], so the dimensions are not redundant; cross-judge reliability is bootstrap rho above 0.79 for 4 of 5 alternative judges. The temporal claim (compounding knowledge, diverging defense, inelastic harm) is a pattern over three generations per family with n=12 models, so the effect is a qualitative trend, not a quantified hazard delta in the provided text.

Limitations

The authors note reliability depends on LLM-as-judge agreement (one of five judges fell below the 0.79 threshold), that the harm dimension is scored by rubrics rather than ground-truth actionability, and that the cyber module is only a pilot. Unstated: n=12 models is small for temporal claims, the Red-Team Agent's fixed five-round escalation ladder may under- or over-state real attack pressure, item difficulty is calibrated on the same 12 models being evaluated, judge scores may correlate with judge family or verbosity, and no human-expert validation of harm actionability is reported in the provided text.

Counterpoint

A skeptic would say this is a new benchmark dressed as infrastructure whose headline temporal finding may be an artifact of judge models, rubric wording, and prompt sensitivity rather than a property of the evaluated models; the adaptive jailbreak strength is itself unvalidated against human red-teamers; the harm 'inelasticity' could reflect a saturated rubric ceiling; and the framework's added value over chaining WMDP, PAIR-style attacks, and rubric scoring is asserted more than demonstrated with baselines.

Economy implication

Little or nothing yet for AI economics in the next 12 to 24 months. The relevant if indirect signal is that safety profiles differ sharply across model families and do not automatically improve with each generation, which could matter for enterprise procurement and regulatory compliance if dangerous-capability profiles become a certification input, but the paper provides no evidence of that adoption.

Who this matters for

Regulatory & Legal: Regulators pushing standardized dangerous-capability reporting get a concrete template: one protocol, comparable seven-dimension risk vectors, and evidence that single-dimension benchmarks cannot answer 'which model is more dangerous'.

Technical Capability: Safety researchers get evidence that alignment progress is non-uniform across knowledge, defense, and harm dimensions, meaning frontier-safety claims need per-dimension measurement, not aggregate refusal rates.

Societal & Cultural: The finding that harmful output actionability has not declined across three years of model releases undercuts the narrative that scale plus alignment is steadily reducing misuse risk from public models.

Bears on (advisory · papers never write evidence)

[1.2] Benchmark gains are increasingly contaminated / saturated, overstating progress.

Abstract

Fragmented safety evaluation undermines the governance of dangerous AI capabilities. We present a modular framework that evaluates each model through three orthogonal pipelines---Knowledge ($K$), Defense ($D$), and Harm ($H$)---under a unified protocol, aggregating results into a standardized dangerous-capability profile $φ$. Pluggable modules supply scenario seeds, knowledge banks, hazard queries, and judge rubrics, while the core evaluation engine remains unchanged across domains; the CB evaluation is complemented by a cyber pilot demonstrating protocol transfer. Instantiating the framework with a chemical-biological (CB) module, we evaluate 12 commercial LLMs from four families. Our first contribution is a horizontal comparison of dangerous capability across models and model families: the three dimensions expose sharply divergent profiles---models with comparable knowledge differ in refusal resilience, and strong defenders do not generate less harmful content when they do comply---while family-level patterns further separate Claude, DeepSeek, and GPT models. The second is a temporal analysis of capability evolution: tracking $K$, $D$, and $H$ against model release dates reveals that dangerous capability has not monotonically declined; newer models deepen knowledge while only partially improving defense, showing that scaling and alignment progress do not uniformly translate into safety. Reliability is established via cross-judge consistency (bootstrap $ρ> 0.79$, 4 of 5 judges) and pipeline orthogonality ($K$--$D$--$H$ inter-correlations $ρ\in [0.32, 0.52]$).