Olmo 3 — part 19/19

Cleaned-text code points [279647, 288421). Bibliography omitted here; source.md includes it.

• WildGuard-Test ( Han et al., 2024 ) provides a comprehensive evaluation of prompt harm, response harm, and response refusal across a set of 1,725 items. Prompts are collected from adversarial synthetic data and real in-the-wild user interactions with LLMs. We evaluate on the subset of 749 adversarial prompts. The evaluation reports the safety of outputs using the WildGuard classifier’s safety label, capturing both the model’s ability to refuse harmful queries and to respond appropriately to benign prompts. OLMo 3 32B Think Baselines Benchmark SFT DPO Final Think 3.0 Final Think 3.1 Qwen 3 32B Qwen 3 VL 32B Think DS-R1 32B K2-V2 70B In- struct DoAnythingNow 16.7 15.6 20.2 54.7 59.0 88.7 46.0 100.0 HarmBench 66.5 69.7 73.5 89.7 67.3 75.2 64.0 99.7 TrustLLM-JailbreakTrigger 68.3 69.6 73.3 86.4 60.7 75.6 55.3 91.4 WildJailbreak-Test Harmful 17.6 17.5 25.6 71.7 12.6 47.0 13.7 99.6 WildJailbreak-Test Benign 99.2 99.6 99.7 92.3 100.0 94.0 99.2 5.7 WildGuard-Test 86.3 86.5 89.4 96.9 81.3 92.9 81.7 99.3 XSTest 93.0 92.1 93.9 91.8 89.6 93.4 78.1 87.9 BBQ Accuracy 90.6 88.5 88.2 85.5 89.7 90.5 88.1 89.7 BBQ Bias - Ambig. 6.9 8.2 9.2 12.3 7.1 5.6 8.1 5.0 BBQ Bias - Disambig. 0.8 0.2 1.1 -0.2 0.1 0.0 0.4 -0.1 StrongReject 75.9 77.2 80.8 90.5 79.3 88.5 79.1 90.7 Toxigen 100.0 100.0 100.0 100.0 100.0 99.9 100.0 100.0 WMDP 40.2 34.9 34.8 32.7 24.0 31.0 30.9 35.6 Table 54 : Olmo 3 Think 32B and comparisons on the safety benchmarks . All numbers are the mean of three runs. Olmo 3.1 32B Instruct Baselines Benchmark SFT DPO Final Instruct 3.1 Apertus 70B Qwen 3 32B (No Thinking) Qwen 3 VL 32B Instruct Qwen 2.5 32B Gemma 3 27B Gemma 2 27B OLMo 2 32B DoAnythingNow 93.6 84.9 85.2 43.6 87.7 88.3 75.4 30.7 29.4 73.3 HarmBench 90.5 93.9 96.0 84.4 77.3 80.6 87.9 71.4 90.8 89.0 TrustLLM-JailbreakTrigger 91.3 86.0 85.3 76.2 82.2 89.0 82.9 71.7 75.6 77.0 WildJailbreak-Test Harmful 83.5 51.5 60.5 50.9 25.7 40.2 22.6 17.4 39.8 50.3 WildJailbreak-Test Benign 86.9 99.6 98.8 93.7 99.3 98.7 99.6 99.5 98.5 99.1 WildGuard-Test 98.9 98.3 97.8 95.4 89.6 93.5 91.7 88.4 92.0 98.3 XSTest 93.0 95.1 93.1 91.0 90.1 93.7 94.0 92.1 89.6 92.7 BBQ Accuracy 85.5 86.1 86.7 83.0 87.3 91.9 91.1 83.2 86.2 84.1 BBQ Bias - Ambig. 8.6 11.0 9.2 7.7 10.6 5.9 7.7 11.2 10.2 9.8 BBQ Bias - Disambig. 1.3 0.6 1.0 1.8 -1.0 0.0 0.5 1.2 -0.1 2.2 StrongReject 95.5 89.3 91.7 81.2 86.9 90.2 85.6 84.6 88.1 87.4 Toxigen 100.0 100.0 100.0 100.0 100.0 100.0 100.0 99.5 100.0 100.0 WMDP 39.4 34.7 33.5 44.2 28.6 25.5 32.8 38.4 40.9 42.6 Table 55 : Olmo 3.1 32B Instruct and comparisons on the safety benchmarks . All numbers are the mean of three runs.

• WildJailbreak-Test ( Jiang et al., 2024 ) assesses model safeguards in the face of advanced, adversarial jailbreak attacks across both harmful and benign contexts. The dataset comprises 2,000 adversarially crafted harmful prompts and 250 adversarial benign queries intended to measure over-refusals. We evaluate models’ refusal accuracy using WildGuard’s refusal label: refusals are desirable on harmful queries (indicating stronger refusals), and non-refusals are desired on benign queries (indicating fewer unnecessary refusals).

• TrustLLM-JailbreakTrigger ( Huang et al., 2024a ) tests susceptibility to 13 distinct jailbreak attack methods with a suite of 400 prompts. Prompts are equally split between two types: "Questions about Bad Behaviors" and "Instructions to generate Toxic Content". This benchmark evaluates whether models’ safety mechanisms withstand a variety of jailbreak strategies and measures the toxicity of outputs produced under attack. The main metric is the refusal accuracy, reported using WildGuard’s refusal label.

• Toxigen ( Hartvigsen et al., 2022 ) tests whether models’ comply with instructions to generate toxic or stereotypical sentences for given demographic groups. Each prompt includes a list of 10 examples of toxic sentences, to which an unsafe model would add new toxic sentences. We subsampled a random set of 1400 input prompts divided equally between demographic subcategories from ToxiGen: Asian, Black, Chinese, Jewish, Latino, LGBTQ, Mental Disability, Muslim, Native American, Physical Disability, Trans, Women. We report the toxicity score of the model’s output, measured by the ToxiGen RoBERTa-based trained classifier. 74 74 74 huggingface.co/tomh/toxigen_roberta

• StrongReject ( Souly et al., 2024 ) assesses models’ susceptibility to advanced jailbreak prompts intended to elicit forbidden content. Each input prompt is a real-world adversarial instruction, constructed to evade common safety guardrails using one of 37 jailbreak techniques, plus a baseline with no jailbreak. We subsampled approximately 20% of the full benchmark, resulting in 2,294 unique prompts, maintaining the diversity of jailbreak techniques and forbidden instruction topics. The model’s output is scored on a 1-5 safety scale according to the risk or compliance with the forbidden prompt, using a classifier that is uses a version of the StrongReject classifier 75 75 75 huggingface.co/qylu4156/strongreject-15k-v1 that is a LoRa adapter merged with the base Gemma-2B ( Gemma Team et al., 2024 ) model by the benchmark creators. The final evaluation metric is a weighted sum over the probability distribution across possible scores computed via log-probabilities of top-scoring response tokens, which is then reversed such that higher scores indicate higher safety.

• Weapons of Mass Destruction Proxy (WMDP) ( Li et al., 2024b ) evaluates whether models can provide answers to dual-use knowledge questions in the domains of biology, chemistry, and cybersecurity. Each prompt is a factual multiple choice question related to weapons of mass destruction, with four answer options and one correct answer. We sample 20% of the full benchmark, yielding 734 total questions distributed across the original biological (1273), chemical (408), and cybersecurity (1987) test sets. Prompts include the instruction we use when evaluating MMLU ( Wang et al., 2024a ) : The following are multiple choice questions. Summarize your reasoning concisely, then conclude with ’Therefore, the answer is: X’ where X is one of A, B, C, or D.\n \n Models’ outputs are evaluated via exact match (based on regex parsing) where only outputs with a correctly formatted, unambiguous final answer string are considered correct.

• Bias Benchmark for QA (BBQ) ( Parrish et al., 2022 ) measures bias and stereotype adherence by presenting models with multiple choice questions targeting social dimensions such as age, gender, race, religion, and intersectional identities. The benchmark includes questions split by 11 subcategories, each clustered along axes of ambiguous vs. unambiguous and stereotypical vs. anti-stereotypical framing, and sometimes presence or absence of names. For our evaluation, we drew a subset of ∼ \sim 500 questions per subcategory (excluding intersectional combinations), distributed evenly across prompt types (ambiguous/unambiguous, stereotypical/anti-stereotypical, and, with or without names), resulting in 4482 total instances. Each prompt is presented in the same structured format as WMDP. 76 76 76 Note that this is different from the more restrictive HELM-Safety prompting format Kaiyom et al. (2024) which only scores based on the first generated token. Model responses are evaluated for accuracy (proportion of correct answers) and for bias , using a regex-based string parser (similar to BBQ). Accuracy simply measures whether models picked the right answer. Bias is quantified according to the protocol in Parrish et al. (2022) : ambiguous and disambiguated bias scores are computed as the frequency with which non-unknown outputs reinforce stereotypes within each prompt type (e.g., the model incorrectly picks the stereotypical answer).

## Instructions for reporting errors

We are continuing to improve HTML versions of papers, and your feedback helps enhance accessibility and mobile support. To report errors in the HTML that will help us improve conversion and rendering, choose any of the methods listed below:

Click the "Report Issue" ( ) button, located in the page header.

Tip: You can select the relevant text first, to include it in your report.

Our team has already identified the following issues . We appreciate your time reviewing and reporting rendering errors we may not have found yet. Your efforts will help us improve the HTML versions for all readers, because disability should not be a barrier to accessing research. Thank you for your continued support in championing open access for all.

Have a free development cycle? Help support accessibility at arXiv! Our collaborators at LaTeXML maintain a list of packages that need conversion , and welcome developer contributions .