CarryOnBench: Interactive LLM Benchmark

• CarryOnBench is a large-scale interactive benchmark that measures LLMs' capability to revise cautious responses to helpful ones after user clarifications.
• It employs controlled multi-turn dialogues with varied user-move strategies to systematically assess both informativeness and safety.
• Utilizing a checklist-based BenUtil metric, the benchmark quantifies utility recovery while revealing challenges like utility lock-in and unsafe recovery.

CarryOnBench is a large-scale interactive benchmark designed to evaluate whether LLMs can revise initially cautious or refusing responses in multi-turn conversations, thereby recovering utility when users clarify benign intent, while maintaining safety. Unlike prior single-turn safety benchmarks, CarryOnBench systematically measures "utility recovery": the ability of models to transition from refusal to helpfulness after user intent becomes transparent through user clarifications. The benchmark quantifies both the informativeness (utility) and the safety of LLM responses across staged conversational contexts and establishes new capabilities for rigorous, checklist-based scrutiny at scale (Zheng et al., 29 Apr 2026).

1. Motivation and Scope

Traditional LLM safety evaluations—exemplified by SORRY-Bench, OR-Bench, and XSTest—focus on a single-turn refusal or compliance to prompts that are ambiguous or potentially harmful. These benchmarks cannot distinguish between models that over-refuse and never update (persistent refusal) and models that withhold information initially but become helpful in response to subsequent clarifications (appropriately cautious). CarryOnBench addresses this evaluative gap by providing the first benchmark capable of isolating and measuring "utility recovery": the ability of an LLM to amend its output trajectory when additional user intent cues shift an apparently harmful query to a benign context.

CarryOnBench directly benchmarks model performance under four experimentally controlled conditions:

1. Turn 1, seeing only the harmful-looking query.
2. Oracle single-turn, where the user's benign intent is explicit from the start.
3. Multi-turn flows without any benign clarification (NC).
4. Multi-turn flows with at least one benign clarification (BC).

This enables systematic study of the model’s adaptability and the cost-benefit profile of utility recovery in interactive settings.

2. Dataset Construction and Experimental Design

The dataset construction pipeline begins with 450 safety-related queries from SORRY-Bench, mapping to 45 categories. Queries in four categories that are invariant to context are excluded, resulting in 398 prompts, each paired with human-validated benign intents sourced from CASE-Bench.

CarryOnBench simulates user–model dialogues by defining seven user-move strategies, grounded in discourse and negotiation theory:

• Benign Clarifications: Justification (explicit legitimate purpose), Re-asking (foreground benign intent), Context-Switching (pivot to a subtopic).
• Challenge Moves: Pushback (skeptical or frustrated response), Rephrasing (superficially varied harmful question).
• Non-Contentful Moves: Delaying ("Hmm..."), Backchannel ("I see.").

Conversation flows range from 4 to 12 turns and must satisfy several constraints (e.g., must end on a contentful move, no consecutive non-contentful moves). For each of the 398 base queries, three flows are sampled per length—two containing at least one benign clarification, one with none—resulting in 1,866 unique flows and approximately 5,970 simulated conversations. This yields 23,880 total model responses after applying stringent pruning criteria. User turns are rendered via Gemini-3-Flash to improve linguistic naturalness, with 82.1% verified as natural by majority human judgment.

3. Design of the Ben-Util Metric

Central to CarryOnBench is the Ben-Util metric, a checklist-based, atomic-item approach to measuring how well each turn and conversation fulfills the user's benign information need.

Checklist Construction:

1. Ensemble LLMs generate "gold-standard" benign answers.
2. Harmful outputs are filtered out.
3. Answers are decomposed into atomic yes/no checklist items using Gemini-2.5-Flash, across categories such as Conceptual Explanation, Practical Advice, Resource, etc.
4. Merging and deduplication is performed with Gemini-2.5 and GPT-4o; dual-use items are excluded.
5. The final checklist for each query contains approximately 18 items on average.

Formal Scoring:

Let $\mathcal{C}$ denote the set of $N$ checklist items. For response $r$ at turn $t$,

• Turn-level utility: $$U_t = \frac{|\{ c \in \mathcal{C} : c \text{ is satisfied at } t \}|}{|\mathcal{C}|}$$
• Conversation-level utility: $$U_{\mathrm{conv}} = \frac{|\{ c \in \mathcal{C} : c \text{ is satisfied in any turn} \}|}{|\mathcal{C}|}$$
• Weighted-sum formulation: $$\mathrm{BenUtil}(r) = \sum_{i=1}^N w_i \, \mathbf{1}\{ \text{item}_i \text{ is satisfied in } r \}, \quad w_i = 1/N$$

This metric supports granular assessment of what substantive, non-redundant content is delivered per turn and across the conversation.

4. Evaluation Protocol and Model Suite

CarryOnBench evaluates 14 LLMs (9 open-source and 5 proprietary), including DeepSeek-V3.1, Llama-4-Maverick, Mixtral-8x7B-Instruct, Olmo variants, Qwen variants, GPT-OSS-120B, and proprietary Claude, Gemini, and GPT models.

Tested conditions per query/flow:

• Turn 1: Model sees the ambiguous/harmful query only.
• Oracle: Model sees query + explicit benign intent in a single prompt.
• Multi-turn NC: Four or more turns, no benign clarifications.
• Multi-turn BC: At least one benign clarification included.

Safety is evaluated via GPT-5.2 on a 1–5 Likert scale ($\geq 4$ labeled harmful), for both individual response turns and maximum value across the conversation (conversation-level safety).

Aggregate statistics include mean Ben-Util and safety per model and condition, delta values, and the percentage of Oracle utility "recovered" post-clarification: $$\text{Recovery\%} = \frac{U^{BC}_{\mathrm{conv}} - U_1}{U_{\mathrm{oracle}}}$$

5. Principal Findings and Observed Failure Modes

Key Performance Results

• Single-turn (Turn 1) Ben-Util across models ranges from 10.5% to 37.6%.
• Oracle Ben-Util (query + intent upfront) dramatically increases to 25.1–72.1%, indicating models' knowledge is gated by perceived intent.
• Multi-turn BC Ben-Util (after clarification) rises to 37.0–75.2%, with 13 of 14 models reaching or exceeding their own Oracle baseline.
• The highest observed recovery rate is 166.4% (GPT-OSS-120B), despite a low initial utility.

Safety-Utility Tradeoff

• BC flows increase conversation-level harmfulness by +0.6 to +2.4 points (Likert 1–5), with inter-model variability. Some models trade less safety for more utility (e.g., Claude-Haiku-4.5), while others such as Qwen3-Next-80B exhibit steeper safety costs.

Multi-turn Failure Modes (Not Detected in Single-Turn Settings)

1. Utility lock-in: Some models refuse in turn 1 and never update, even with repeated clarifications. DeepSeek-V3.1, for example, has Oracle Ben-Util at 67.6% but BC performance at only 66.3%.
2. Unsafe recovery: Certain models provide increased utility only at a disproportionate rise in harmfulness. Qwen3-Next-80B achieves 75.2% utility in BC but with maximal safety risk (+2.4 points).
3. Repetitive recovery: Some models inflate apparent recovery by recycling previously satisfied checklist items. This is quantified by the checklist redundancy rate, e.g., GPT-5-mini exhibits high redundancy in late turns.

6. Implications and Benchmarking Recommendations

Single-turn refusal rates are not predictive of a model’s eventual helpfulness or safety under interactive, clarifying user moves. Safety and utility are demonstrably decoupled over multi-turn exchanges. CarryOnBench underscores the necessity of:

• Training models to incorporate genuine clarifications,
• Mitigating over-lock-in (stubborn refusal) without elevating safety risk,
• Encouraging delivery of new information rather than rehashing prior content.

Effective interactive safety benchmarking requires:

• Theory-grounded, controlled user-move strategies,
• Explicit simulation of ambiguity, clarification, and recovery phases,
• Checklist-based metrics measuring unique, atomic informational gains per turn,
• Worst-case safety aggregation across exchanges.

A plausible implication is that proper alignment for real-world deployment must directly address interactive, rather than static, safety-helpfulness tradeoffs.

7. Significance within the Alignment Research Landscape

CarryOnBench exposes a critical blind spot in standard safety evaluation—whether models can safely recover utility following clarification, or merely exhibit intransigent refusal. By pairing large-scale, programmatically varied conversational flows with rigorous checklist-based utility metrics, it operationalizes interactive alignment at a scale (398 queries × 1,866 flows × 23,880 turns) not previously addressed in the field. Its methodologies and findings motivate new directions in model architecture, training data design, and interactive evaluation protocols for safety-aligned foundation models (Zheng et al., 29 Apr 2026).