In this paper, we argue that current safety alignment research efforts for large language models are hindered by many intertwined sources of noise, such as small datasets, methodological inconsistencies, and unreliable evaluation setups. This can, at times, make it impossible to evaluate and compare attacks and defenses fairly, thereby slowing progress. We systematically analyze the LLM safety evaluation pipeline, covering dataset curation, optimization strategies for automated red-teaming, response generation, and response evaluation using LLM judges. At each stage, we identify key issues and highlight their practical impact. We also propose a set of guidelines for reducing noise and bias in evaluations of future attack and defense papers. Lastly, we offer an opposing perspective, highlighting practical reasons for existing limitations. We believe that addressing the outlined problems in future research will improve the field's ability to generate easily comparable results and make measurable progress.
View on arXiv@article{beyer2025_2503.02574,
title={ LLM-Safety Evaluations Lack Robustness },
author={ Tim Beyer and Sophie Xhonneux and Simon Geisler and Gauthier Gidel and Leo Schwinn and Stephan Günnemann },
journal={arXiv preprint arXiv:2503.02574},
year={ 2025 }
}