- The paper introduces NESSiE, a lightweight benchmark of 41 complementary safe-and-helpful test cases evaluated through deterministic keyword matching across 837 prompt interactions.
- The evaluation finds no model achieves perfect safety: Gemini 2.5 Pro leads with 95.2% Safe ∧ Helpful performance, while helpfulness consistently exceeds safety across model families.
- The benchmark shows that cognitive steps and roughly 2,000 tokens of distracting context substantially reduce safety, supporting NESSiE as an inexpensive deployment-screening test rather than a complete safety certification.
Motivation and positioning
NESSiE (the NEceSsary SafEty benchmark) addresses a gap in the LLM safety evaluation landscape. Existing benchmarks range from early rule-following tests such as RULeS and IFEval (Mu et al., 2023, Zhou et al., 2023) to large agentic safety suites like AgentHarm, GuideBench, EIFBENCH, and SG-Bench (Andriushchenko et al., 2024, Diao et al., 16 May 2025, Zou et al., 10 Jun 2025, Mou et al., 2024). The authors argue these resources are complementary but expensive, and that a cheap, fast sanity check is missing: a set of simple, abstract test cases that any deployable system should pass with certainty before more elaborate evaluation is warranted. NESSiE is explicitly framed as a necessary rather than sufficient condition — passing it does not guarantee safety, but failing it disqualifies a model from deployment consideration, particularly in unmonitored agentic settings where errors compound over long action chains.
The benchmark extends RULeS (Mu et al., 2023) with reformulations, multi-turn conversations, agentic-style tests, and additional reasoning steps, and it deliberately avoids the pitfalls of LLM-based evaluation (Zeng et al., 2023, Murugadoss et al., 2024) by using deterministic keyword matching.
Benchmark design
All tests consist of a system prompt stating rules and user prompts probing adherence. Critically, each system prompt is paired with at least two user prompts forming complementary test pairs: one requiring helpful behavior (output a specified keyword) and one requiring safe behavior (withhold a secret or keyword). This structure prevents trivial solutions such as always refusing or always complying. The benchmark comprises 93 unique system–user combinations across 41 distinct test cases; each combination is run with three random seeds across three independent runs, yielding 837 prompt interactions.
Six test suites cover distinct capabilities:
- RULeS (rules): adapted non-game scenarios from Mu et al., excluding the cryptographer case.
- RULeS Reformulated: identical scenarios presented concisely, testing robustness to input structure.
- Agentic: atomic units of agency — precise format compliance via keyword output.
- Generated: LLM-generated, human-adjusted cases.
- Skills: an extra cognitive step (e.g., checking for anagrams) precedes applying the safety rule.
- Multiturn: rule adherence across two conversation turns.
Two stress conditions supplement the baseline: a benign Distraction Context (~2000 tokens of unrelated conversation inserted between system and user prompts), and Disabled Reasoning (reasoning traces turned off).
Evaluation methodology
Evaluation uses keyword matching only, justified by task simplicity and the absence of adversarial inputs. The primary metric is the Safe ∧ Helpful (SH) score: a template group counts as solved only if the model both withholds when required and complies when required under the same system prompt. Safe and Helpful rates are also reported separately, with one standard deviation over runs. Failures are manually categorized into four classes: clear task failures/leakage, participation denial (exaggerated refusals), unintended keyword leakage (correctly identifying the rule but printing the forbidden string while explaining), and unauthorized disclosure in the "millionaires" access-control scenarios.
Results
No model reaches 100%, so every evaluated system fails the necessary condition the benchmark establishes. There is a sharp generational divide: Llama 2 7B Chat and Mistral 7B achieve SH scores of only 17.7% and 29.1%, while modern frontier models cluster between roughly 80% and 95%. Gemini 2.5 Pro leads at 95.2% SH, notably outperforming its successor Gemini 3 Flash Preview (88.9%). Selected results:
Helpfulness consistently exceeds safety across all models, which is the paper's central empirical finding. Qwen3 VL 32B illustrates this starkly: near-perfect Helpful rate (99.7%) against a Safety rate of 62.7%. The bias persists even among top models — Gemini 2.5 Pro's deficit comes entirely from unsafe outputs, not refusals of legitimate requests.
By template group, models perform best on Generated (89.5% average SH) and Agentic (85.6%) suites and worst on Skills (63.4%), showing that even one added cognitive step materially degrades policy adherence. Notably, the concise Reformulated suite scores lower than verbose standard RULeS prompts (72.5% vs. 76.6%), suggesting safety alignment is more robust to verbose instructions.
Under stress conditions, the Distraction Context degrades SH by at least 15 percentage points for all tested models (e.g., Claude Opus 4.5 falls from 82.6% to 59.0%), with distracted models remaining equally helpful — i.e., the degradation is entirely on the safety side. Disabled Reasoning has heterogeneous effects: it degrades Gemini 2.5 Pro (95.2% → 77.6%) but improves Claude Opus 4.5 (82.6% → 89.1%). This heterogeneity indicates reasoning traces are not uniformly protective of safety behavior.
Error analysis reveals family-characteristic failure modes: the GPT-5 series systematically produces "leaked keyword" errors (stating the rule correctly while printing the secret in explanation text, e.g., outputting "NOT BALANCED" when told not to output "BALANCED"), whereas the Claude family frequently refuses participation outright ("I cannot roleplay") on benign tasks. Both error types are concerning for unmonitored deployment since per-prompt inspection cannot be assumed.
Limitations and open questions
The authors are explicit about scope constraints. First, NESSiE is deliberately minimal and abstract: it cannot certify safety in general, and passing it is necessary but far from sufficient. Second, keyword-matching evaluation would be inadequate under adversarial prompting, which is outside the paper's threat model; extending the tests to simple adversarial attacks is identified as future work. Third, the Agentic suite proxies agency through format compliance only, without tool use or environment interaction. Fourth, several observations remain mechanistically unexplained — most prominently why disabling reasoning helps some models and hurts others, and why a successor model (Gemini 3 Flash) underperforms its predecessor on this benchmark. Finally, the small scale (41 test cases) means per-template variance is substantial, as the wide confidence intervals on individual templates indicate.
Conclusion
NESSiE contributes a lightweight, reproducible sanity check establishing a minimum bar for LLM safety: reliable rule-following on trivially simple, complementary safe/helpful tasks. The evaluation shows that state-of-the-art models fail this bar, exhibit a systematic helpfulness-over-safety bias, and are fragile to irrelevant context and to changes in reasoning configuration. The benchmark's practical value lies in triage — failure obviates further evaluation, and success motivates deeper scrutiny — though its findings leave open how safety alignment can be made robust to cognitive load, contextual noise, and inference-time configuration choices.