SoSBench Catches DeepSeek-R1 Leaking Dangerous Science at 84.9%
A new regulation-grounded benchmark exposes how frontier models leak hazardous scientific knowledge, with Deepseek-R1 violating safety policies 84.9% of the time.
- SoSBench benchmarks LLM safety across six regulated scientific domains with 3,000 knowledge-intensive prompts (paper).
- Deepseek-R1 violates policy on 84.9% of prompts, GPT-4.1 on 50.3%, while Claude-4-Sonnet-Thinking stays at 10.6%.
- Domain-expert models like BioMistral-7B hit 91.5% PVR, worse than general-purpose peers.
- Visible chain-of-thought reasoning increases policy violations as the reasoning budget grows.
- Multi-turn Crescendo jailbreaks push most tested models above 92% violation rates.
- Code and gated dataset released on GitHub and Hugging Face.
Scientific prompts slip past model safeguards in SoSBench
Frontier language models routinely reject explicit requests for dangerous instructions, yet the same safeguards can fail when a request uses specialized scientific language. A new benchmark called SoSBench tests that weakness with 3,000 prompts drawn from high-risk scientific domains.
Researchers from the University of Washington, University of Georgia, Western Washington University, and the University of Illinois Urbana-Champaign evaluated 26 open-weight and proprietary models. Reported policy-violation rates ranged from 10.6% for Claude-4-Sonnet-Thinking to 84.9% for DeepSeek-R1, while GPT-4.1 reached 50.3%. The paper has been accepted as an ICLR 2026 poster.
The results expose a practical gap for developers building laboratory assistants, biomedical copilots, scientific search tools, and domain-specific fine-tunes. A hazardous request can retain its meaning when rewritten with a synonym, molecular formula, trade name, or regulatory term, even if familiar safety keywords disappear.
Scientific language slips through the filters
Common safety evaluations often use explicit requests that require little expertise to classify, such as direct questions about constructing a weapon. Other benchmarks ask models to label or select hazardous content, which measures recognition without testing whether the model will produce operational instructions.
SoSBench instead uses knowledge-intensive prompts that can appear routine to a general-purpose classifier while signaling danger to a specialist. Its six high-risk domains draw on authoritative sources such as the NFPA 704 chemical-hazard standard, the World Health Organization’s ICD-11, International Atomic Energy Agency transport regulations, and US Drug Enforcement Administration controlled-substance schedules.
From regulations to adversarial prompts
Prompt construction begins with domain experts extracting seed terms from regulatory documents and retaining entries in the highest hazard tiers, including NFPA Level 4 chemicals. External databases such as PubChem then expand each term into synonyms, systematic names, molecular formulas, trade names, and slang. A substance commonly identified by an abbreviation may therefore appear under a less familiar chemical name or formula.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
