BenchMIRT: What are LLM benchmarks actually measuring?

The industry treats benchmark averages as thermometers. A lab posts a higher BBQ or HarmBench number, the slide deck calls it a safety win, and buyers update their priors. If those scores are partly measuring something else — reading comprehension, entity tracking, a model's appetite for copyrighted lyrics — then a large share of the public safety narrative has been running on a blended signal.

Allen Institute for AI's BenchMIRT audits benchmarks at the level of individual prompts. Using multidimensional item response theory, it estimates which underlying capabilities actually predict a correct answer. Trained on 100 models across 16 benchmarks and more than 34,000 questions, it independently recovered two dominant dimensions — safety and general reasoning — without being told which suites were supposed to measure which.

That recovery is the useful result. The field's informal taxonomy is close enough to be real, and wrong enough that several well-cited suites are being misread.

The most damaging finding is about BBQ. The benchmark is designed to test stereotype reliance and is routinely grouped with safety evaluations. BenchMIRT finds it aligns much more strongly with general reasoning. A low score can mean the model failed to track who is who in a short vignette, not that it is more biased. Labs citing BBQ movement as a safer model may have been citing a reasoning gain.

WMDP is the mirror image. It tests dangerous dual-use knowledge and scores a refusal as the desired outcome. BenchMIRT associates it more with general reasoning than with safety — and finds that stronger reasoning tracks with *lower* WMDP scores, because the smarter model is better at knowing what not to say. A rising WMDP number, in that frame, can mean a dumber model.

HarmBench splits internally. Standard and contextual harmful requests track safety. Copyright prompts track reasoning. Averaging them into one headline number is how a lab can look safer because it declined to generate lyrics, or look worse because it got better at a phishing email. Either way, the single score is a blender.

The efficiency claim is what evaluation teams will use. Keeping the most informative 10 percent of questions generally preserved the rank-order picture; 50 percent often matched the full suite. BenchMIRT predicted held-out item outcomes at 79 percent accuracy against a 70 percent overall-rate baseline. That is a real cost cut — and a real abuse path. The same estimates that isolate the most informative safety items could be used to strip them. Ai2 thinks the transparency is worth that risk. The risk is not theoretical.

Expect the next wave of model cards to cite "BenchMIRT-adjusted" subscores. Treat those as an improvement on raw averages, not a new thermometer. The method was trained on models released by March 2025, and the dimensions it finds depend on the suite it is given.

Item response theory comes from psychometrics: questions differ in difficulty and in how well they separate strong performers from weak ones. Researchers had already applied single-dimension IRT to LLM benchmarks, including in Ai2's Fluid Benchmarking work. BenchMIRT lets multiple capabilities load on the same item. The training mix — MMLU-Pro, GPQA, MATH, and BBH on one side; HarmBench, StrongReject, WildJailbreak, BBQ, WMDP, and XSTest from the Olmo 3 safety suite on the other — is what made safety-versus-reasoning the stable two-axis picture.