Do-Not-Answer: Evaluating Safeguards in LLMs
Open accessAbstract
With the rapid evolution of large language models (LLMs), new and hard-to-predict harmful capabilities are emerging.This requires developers to identify potential risks through the evaluation of "dangerous capabilities" in order to responsibly deploy LLMs.Here we aim to facilitate this process.In particular, we collect an open-source dataset to evaluate the safeguards in LLMs, to facilitate the deployment of safer open-source LLMs at a low cost.Our dataset is curated and filtered to consist only of instructions that responsible language models should not follow.We assess the responses of six popular LLMs to these instructions, and we find that simple BERT-style classifiers can achieve results that are comparable to GPT-4 on automatic safety evaluation. 1 Warning: This paper contains examples that may be offensive, harmful, or biased.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The Do Not Answer dataset contains 939 malicious user prompts in English classified as unsafe.
“To this end, the Do Not Answer dataset was used, which contains 939 malicious user prompts.”
From Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction (2026) · cites this paper as [29]
The Introduction (page unavailable) describes Do-Not-Answer as a dataset of 939 prompts whose instructions should not be followed, and “Collecting questions” (page unavailable) confirms the total. The paper calls them risky prompts, covering mild as well as extreme risks; it does not establish that every prompt is malicious or explicitly state that all are in English. (LLM, conf=0.83)
Experimental — accuracy not yet measuredThe Do Not Answer dataset's prompts are organized into five major risk areas and 12 hazard categories.
“The prompts are organized into five major risk areas, and in total, there are 12 hazard categories distributed across each of these areas.”
From Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction (2026) · cites this paper as [29]
Llama Guard operates over 6 risk categories, ShieldGemma over 6 primary harm types, and the Do Not Answer corpus over 12 categories distributed across 5 risk areas, with only partial overlap among the three taxonomies.
“The first is taxonomic: Llama Guard operates over 6 risk categories [32], ShieldGemma over 6 primary harm types [33], and the Do Not Answer corpus over 12 categories distributed across 5 risk areas [29]-with only partial overlap among the three taxonomies.”
From Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction (2026) · cites this paper as [29]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 12
- Beltagy, Matthew E. Peters, and Arman Cohan. 2020. Longformer: The long-document transformer. CoRR, abs/2004.05150. · arXiv
- Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al. 2022. Red teaming language models to re- duce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858. · arXiv
- Xudong Han, Timothy Baldwin, and Trevor Cohn. 2023a. Everybody needs good neighbours: An un- supervised locality-based method for bias mitigation. In The Eleventh International Conference on Learn- ing Representations, ICLR 2023. OpenReview.net.
- Xudong Han, Timothy Baldwin, and Trevor Cohn. 2023b. Fair enough: Standardizing evaluation and model selection for fairness research in NLP. In Proceedings of the 17th Conference of the European Chapter of the Association for Computational Lin- guistics, EACL 2023, pages 297-312. Association for Computational Linguistics.
- Xudong Han, Aili Shen, Trevor Cohn, Timothy Bald- win, and Lea Frermann. 2022. Systematic evaluation of predictive fairness. In Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Asso- ciation for Computational Linguistics and the 12th International Joint Conference on Natural Language Processing, AACL/IJCNLP 2022 -Volume 1: Long Papers, pages 68-81. Association for Computational Linguistics.
- Jiaming Ji, Mickel Liu, Juntao Dai, Xuehai Pan, Chi Zhang, Ce Bian, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. BeaverTails: Towards im- proved safety alignment of LLM via a human- preference dataset. arXiv preprint arXiv:2307.04657. · arXiv
- Ilya Loshchilov and Frank Hutter. 2019. Decoupled weight decay regularization. In 7th International Conference on Learning Representations, ICLR 2019. OpenReview.net.
- Sander Van Der Linden. 2022. Misinformation: sus- ceptibility, spread, and interventions to immunize the public. Nature Medicine, 28(3):460-467.
- Yuxia Wang, Jonibek Mansurov, Petar Ivanov, Jinyan Su, Artem Shelmanov, Akim Tsvigun, Chenxi Whitehouse, Osama Mohammed Afzal, Tarek Mah- moud, Alham Fikri Aji, and Preslav Nakov. 2023. M4: Multi-generator, multi-domain, and multi- lingual black-box machine-generated text detection. arXiv:2305.14902. · arXiv
- Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Ed H. Chi, Quoc Le, and Denny Zhou. 2022. Chain of thought prompting elicits reasoning in large language models. CoRR, abs/2201.11903. · arXiv
- Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, Zac Kenton, Sasha Brown, Will Hawkins, Tom Stepleton, Courtney Biles, Abeba Birhane, Julia Haas, Laura Rimell, Lisa Anne Hendricks, William Isaac, Sean Legassick, Geoffrey Irving, and Iason Gabriel. 2021. Ethical and social risks of harm from language models. CoRR, abs/2112.04359. · arXiv
- Terry Yue Zhuo, Yujin Huang, Chunyang Chen, and Zhenchang Xing. 2023. Exploring AI ethics of ChatGPT: A diagnostic analysis. arXiv preprint arXiv:2301.12867. · arXiv
Cited by
Sorted by citations
Survey on LLM Safety: Attacks, Defenses, Alignment, Metrics, and Guardrails
Jalan, P., Abishethvarman, V., Chandna, B., & Naseem, U. (2026) · Machine Learning · doi:10.1007/s10994-026-07060-8 · Cited by 11 · see citing works
Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction
Azambuja, A. J., Guilherme, M., Castro, J. V. F. D., Lima, J. P. D. O., Oliveira, L. B., & Soares, A. D. S. (2026) · Future Internet · doi:10.3390/fi18050252 · Cited by 2 · see citing works
Tang, N., Zhang, A. Q., Wang, Q., Howe, E. S., Bullwinkel, B., Pedrelli, P., Suh, J., Heidari, H., & Shen, H. (2026) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3805689.3806723 · Cited by 2 · see citing works
STELLAR: A Search-Based Testing Framework for Large Language Model Applications
Sorokin, L., Vasilev, I., Friedl, K. E., & Stocco, A. (2026) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner67736.2026.00093 · Cited by 2 · see citing works
Anghel, A. A., Anghel, C., Pecheanu, E., Balau, A. S., Crăciun, M., Cocu, A., & Sandu, C. (2026) · Computers · doi:10.3390/computers15070460 · Cited by 2 · see citing works
CONSPIR ED: A Dataset for Cognitive Traits of Conspiracy Theories and Large Language Model Safety
Bates, L., Glockner, M., Nakov, P., & Gurevych, I. (2026) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl.a.794 · Cited by 1 · see citing works
Self-citationGenerating the language of AI harms: mapping guardrails using critical code studies
Ciston, S. (2026) · AI & Society · doi:10.1007/s00146-026-02922-0
Kim, D., Park, Y., Lee, H., Choi, S., & Song, H. (2026) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3772363.3799083
Sami, A. A., Debnath, G., Dey, R., & Chowdhury, A. N. (2025) · International Conference on Computer and Information Technology (ICCIT) · doi:10.1109/iccit68739.2025.11491067
Real-Time Legal Auditing of LLM Interactions Using Retrieval Augmented Small Language Models
Hossain, W., Wahid, A., Haque, S., Dhrubo, A. F. H., & Qayum, M. A. (2026) · International Conference on Integrated Intelligence and Cognitive Engineering (ICIICE) · doi:10.1109/iciice69672.2026.11565509
Qadir, S., Ni, C., Vaidya, M. S., Ryu, H., Mulvaney, S. A., Kantarcıoğlu, M., Novak, L. L., Malin, B., Rose, S. L., & Yin, Z. (2026) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3805689.3806456
Anghel, C., Anghel, A. A., Crăciun, M., Cocu, A., Moldovanu, S., & Sandu, C. (2026) · AI · doi:10.3390/ai7080286
Yuchen, Z. (2026) · Research Square · doi:10.21203/rs.3.rs-10594989/v1
Wang, S., He, R., Li, H., Yang, J., & Yin, R. (2026) · International Conference on Electronic Information Technology and Computer Engineering (EITCE) · doi:10.1109/eitce70137.2026.11634335
Self-citationHuang, Y., Jiang, W., & Ye, Y. (2026) · Quality and Reliability Engineering International · doi:10.1002/qre.70358
JailFlowEval: a workflow-safety benchmark for LLM-driven enterprise service workflows
Liu, Z., Yu, H., Pan, W., Li, X., Zhang, W., & Wang, B. (2026) · Service Oriented Computing and Applications · doi:10.1007/s11761-026-00511-z
Bias2Risk: Dual-Task Evaluation of Bias-Induction Risk in Chinese Large Language Models
Wang, Q., Li, Z., Gong, M., Qi, Y., & He, Y. (2026) · International Conference on Image, Vision and Computing (ICIVC) · doi:10.1109/icivc70586.2026.11686557
FirstImpress: LLM-Powered Multi-Agent Job Interview System for IT-based Learning
Axelsen, S. I., Iuel, N. C. M. F., Khan, S., Muuse, M. J., Ndikumana, H., & Erkut, C. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-39734-8_5
Han, S., Wang, Y., & Huang, S. (2026) · IEEE Access · doi:10.1109/access.2026.3743616
Self-citationUnifiedBench: Toward a Unified Dataset for Red-Teaming Language Models
de Sá, M. A., de Senna, P. H. G., Neto, M. P. P., & Miers, C. C. (2026) · Simpósio Brasileiro de Cibersegurança (SBSeg) · doi:10.5753/sbseg_estendido.2026.29187
Li, W., Song, S., Liu, X., Ji, B., Xiao, J., Wang, J., Gao, Z., & Yu, J. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11729050
Zero Trust Framework for Detecting and Preventing Prompt Injection Attacks in Enterprise AI Chatbots
Anbazhagan, G., Priyanga, S., & Dinakar Jose, S. (2026) · doi:10.1109/icstem68144.2026.11735682
TrojanShot: Reinforced Demonstrations Yield Sample-Efficient Jailbreaks and Guardrails for LLMs
Divekar, A., & Malik, V. (2026) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3799682.3841000
- Authors
- Wang, Y., Li, H., Han, X., Nakov, P., & Baldwin, T.
- Affiliations
- The University of Melbourne (AU)
- ORCID
- Baldwin, Timothy
- Venue
- Findings of the Association for Computational Linguistics: EACL 2024
- Published
- 2024
- Pages
- 896-911
- OpenAlex
- W7126420743
- Cited by
- 21
- References
- 0
- Citations by year
- 2026: 20 · 2025: 1
- FWCI
- 9.56
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by
- Locations
- Findings of the Association for Computational Linguistics: EACL (publishedVersion, cc-by)
- Topics
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- large language models, LLM safety evaluation, open-source LLMs, GPT-4 comparison, responsible AI deployment
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
