safety benchmark
XSTest
XSTest is a test suite designed to identify exaggerated safety behaviours in large language models. It comprises 450 prompts: 250 safe prompts across ten prompt types that well-calibrated models should not refuse to comply with, and 200 unsafe prompts as contrasts that models should refuse. The benchmark systematically evaluates whether models refuse to respond to clearly safe prompts due to overly cautious safety mechanisms.
Updated Aug 7, 2026
Published models3
Registry coverage3
MetricScore
EvidenceB
XSTest leaderboard
Sorted by the source-provided rank. Higher score is better according to the registry.
| 1 | GO | 98.8% | 100.0% | 3 | C | |
| 2 | GO | 97.0% | 50.0% | 3 | C | |
| 3 | GO | 92.6% | 0.0% | 3 | C |
Score distribution
Top published rows on the benchmark's original scale.
XSTest highlights
The top published results on this benchmark's own scale.
What is XSTest?
Definition and scoring fields from the benchmark registry.
XSTest is a test suite designed to identify exaggerated safety behaviours in large language models. It comprises 450 prompts: 250 safe prompts across ten prompt types that well-calibrated models should not refuse to comply with, and 200 unsafe prompts as contrasts that models should refuse. The benchmark systematically evaluates whether models refuse to respond to clearly safe prompts due to overly cautious safety mechanisms.
Scores are shown in ratio. The current registry marks this benchmark as not independently verified with evidence level B.
- Family
- XSTest
- Modality
- text
- Primary category
- safety
- Score direction
- higher
- LLMBoard eligible
- No
- Evaluation key
- xstest|llm-stats-current
Source-native results are preserved. Eligibility for the overall LLMBoard score is a separate policy decision.
FAQ
Common questions about XSTest.
Which model scores highest on XSTest?
Gemini 1.5 Pro is currently ranked first with 98.8%.
What does XSTest measure?
XSTest is a test suite designed to identify exaggerated safety behaviours in large language models. It comprises 450 prompts: 250 safe prompts across ten prompt types that well-calibrated models should not refuse to comply with, and 200 unsafe prompts as contrasts that models should refuse. The benchmark systematically evaluates whether models refuse to respond to clearly safe prompts due to overly cautious safety mechanisms.
Is a higher score better?
Yes. Higher values rank better for this benchmark.
How many models are compared?
3 unique published model results are currently shown.
Does this benchmark affect the overall score?
This benchmark is preserved as source-native evidence but is not eligible for the current overall score.