PaSBench: Proactive Safety AI Benchmark

• PaSBench is a comprehensive benchmark that evaluates proactive safety by testing if models can infer impending risks from diverse, open-ended observations.
• It comprises 416 scenarios across image sequences and text logs, covering domains such as home, outdoor, sports, food, and emergency response.
• An extension, PaSBench-Video, challenges models with streaming video to assess temporal calibration and early, robust risk warnings.

Searching arXiv for the PaSBench papers and related benchmark extension. PaSBench, short for Proactive Safety Bench, is a benchmark for evaluating whether current LLMs and multimodal LLMs can proactively detect and warn about potential physical safety risks in daily life by observing behaviors and environments without being prompted by the user (Yuan et al., 23 May 2025). It was introduced to assess a capability that differs from conventional reactive safety assistance: rather than answering a query about a known hazard, the model must infer an impending risk from open-ended observations and issue a warning in advance. The benchmark contains 416 multimodal scenarios—128 image sequences and 288 text logs—spanning five safety-critical domains. A subsequent benchmark, PaSBench-Video, generalizes the same research program to streaming video, adding causal observation, temporal calibration, and explicit false-positive measurement on safe scenes (Zhao et al., 1 Jun 2026).

1. Conceptual scope and task definition

PaSBench was proposed to evaluate whether contemporary models can function as proactive safety AI systems rather than merely reactive assistants. The central research question is whether a model can observe everyday behavior and environment cues, identify a risk before an incident occurs, and produce an appropriate reminder or warning. The original benchmark frames this as a multimodal problem over image sequences and text logs, rather than as standard visual question answering or text classification (Yuan et al., 23 May 2025).

The task is formalized as

$$\mathcal{R} = \mathcal{M}(\mathcal{O}, \mathcal{S}),$$

where $\mathcal{O}$ denotes a sequence of observations, $\mathcal{S}$ is the system prompt that sets the model to act as a Reminder Agent, $\mathcal{M}$ is the model under test, and $\mathcal{R}$ is the model’s risk reminder. This formulation is important because it makes the benchmark explicitly open-ended: the model is not told what risk to look for, and success depends on proactive recognition rather than prompted recall.

The benchmark covers Home Safety, Outdoor Safety, Sports Safety, Food Safety, and Disaster and Emergency response. Examples given in the benchmark description include leaving a stove on, unsafe riding, trying risky exercises, storing raw meat above vegetables, and not ducking during an earthquake. These examples illustrate that the benchmark targets ordinary but safety-relevant situations in which risk is inferable from visible or logged context before an accident is shown.

2. Dataset composition and construction

PaSBench comprises 416 high-quality, realistic scenarios across two modalities: 128 image sequences and 288 text logs (Yuan et al., 23 May 2025). The image-sequence samples contain 1–4 sub-images that display actions, scenes, or progressions leading up to—but not including—an incident. The text-log samples are realistic third-person daily activity logs with entries specifying [Time], [Location], [Environmental Observation], and [Behavioral Observation].

Aspect	Image sequences	Text logs
Size	128	288
Max length	4 images	805 words
Avg. length	2.2 images	547 words
Min length	1 image	171 words
Model used in construction	GPT-4o (text-to-image)	DeepSeek-R1 (text log)

The benchmark’s knowledge base was sourced from science books and government sites, with emphasis on safety risks that were described as clear, person-centric, significant, and verifiable. For image creation, GPT-4o generated prompts for 1–4 images per knowledge point, and those prompts were refined by annotators to ensure that the risks were visible and pre-incident. For text creation, DeepSeek-R1, guided by crafted prompts, was used to simulate observable behaviors and contexts matching the risks, after which annotators further curated the outputs. Each scenario then underwent multi-round human refinement and cross-validation.

This construction process matters because PaSBench was designed not as a passive corpus of accidents, but as a benchmark of observable precursors. The curated scenarios therefore aim to isolate the pre-incident interval in which a proactive reminder should be possible.

3. Evaluation protocol and metrics

The original PaSBench paper evaluates 36 state-of-the-art LLMs and MLLMs. Of these, 22 models were tested on the image set and 32 models on the text set. Each model was run on every scenario under a consistent system prompt that cast it as a Reminder Agent (Yuan et al., 23 May 2025).

For each sample, the benchmark collects 16 responses from the model, using temperature 0.7, Top-P 0.9, and chain-of-thought when possible. This repeated-sampling design is central to the benchmark because it separates average correctness from latent capability and from run-to-run stability. Outputs are scored by GPT-4.1 acting as the grader, which matches the model’s identification and explanation to the ground-truth risk; the reported grading accuracy is 94.5%.

PaSBench defines three principal metrics:

Metric	Definition
Accuracy	Proportion of correct responses (Average-of-N)
Potential	Proportion where at least one of 16 outputs is correct (Best-of-N)
Robustness	Proportion where all 16 outputs are correct (Worst-of-N)

This metric design encodes a substantive distinction. Accuracy measures expected performance under stochastic decoding. Potential measures whether the capability is present at least once across repeated trials. Robustness measures whether the capability is dependable. In safety-critical deployment, this separation is consequential: a model that can identify a risk intermittently is not equivalent to one that can do so consistently.

4. Empirical performance and cross-modal behavior

The benchmark results show that current models possess nontrivial proactive safety ability but remain far from fully reliable. The top performer reported in the original PaSBench study, Gemini-2.5-pro, achieves 71% image accuracy and 64% text accuracy, with 55% robustness on image and 45% robustness on text (Yuan et al., 23 May 2025). By contrast, weaker models such as Qwen2.5-VL-7B on image (23%) and GPT-4.1-nano on text (20%) typically remain below 30% accuracy.

A common misreading is to treat the top-line accuracy numbers as evidence of dependable proactive warning. The benchmark rejects that interpretation. Even for the best model, the reported robustness values imply that many scenarios are solved inconsistently, and the paper states that the top model misses about half the risks in at least one of 16 runs per sample. More broadly, for most models, less than 5% of the time are all 16 responses correct per scenario.

The reported scaling trends indicate that larger models consistently outperform smaller ones in accuracy, robustness, and potential. At the same time, the comparison between reasoning-augmented and strong non-reasoning systems is not straightforward: models such as Gemini-2.0-pro, Claude-3.5, and GPT-4.1 performed as well as or better than some reasoning-augmented models. The paper interprets this pattern as evidence that the principal bottleneck is not simply access to more elaborate reasoning traces, but stable knowledge recall and proactive analysis.

Across modalities, detection performance is reported as highly correlated on text and image benchmarks, with

$r = 0.897,\quad p < 0.01.$

The paper states that this indicates the main challenge is not modality-specific but stems from a more general deficiency in proactive risk reasoning. It also reports no clear performance drop with moderately longer observation sequences or more sub-images, although longer sequences were not extensively tested.

5. Failure analysis, misconceptions, and research directions

The central diagnosis of PaSBench is that current models do not primarily fail because they lack the relevant safety facts. The paper reports that models possess relevant safety knowledge, validated by more than 80% multiple-choice QA accuracy on the same facts, and that in reactive settings—when given the risk to look for—the same models often identify previously missed hazards correctly (Yuan et al., 23 May 2025). For example, in the reported reactive recovery analysis, Gemini-2.5-pro turns 552/596 previously failed image cases and 1217/1646 previously failed text cases into correct detections; GPT-4.1-nano turns 1047/1393 image failures and 2525/3698 text failures into correct detections.

This evidence underwrites one of the benchmark’s main claims: the primary limitation is unstable proactive reasoning rather than knowledge deficits. In other words, the models often know the relevant safety principle and can apply it when cued, but they do not reliably surface it under open-ended, observation-driven conditions.

The repeated-trial design also exposes a second misconception: that “best-of-many” performance is sufficient evidence of safety competence. PaSBench distinguishes potential from robustness precisely because a model that succeeds in only some sampling runs is unsuitable for dependable warning. The paper notes that many models recognize a risk only in some runs, showing that the ability is latent but unreliable.

The paper identifies two explicit limitations of the original benchmark. First, short observation sequences dominate the dataset: most samples contain only several images or log entries, whereas real-world safety scenarios are often longer and more complex. Second, severity is unaddressed: the benchmark does not rank risk severity or demand tailored response, which may encourage over-reporting minor risks.

The research directions proposed in the paper follow directly from these diagnoses. Under training-based approaches, it suggests scaling models, adding proactively framed data, and using online reinforcement learning, including GRPO algorithms, to encourage stable reminder output. Under training-free methods, it suggests propose-then-verify pipelines and expert risk-checklists + model prompts. It also proposes expanding the dataset to longer, more nuanced, or ranked risk scenarios.

6. PaSBench-Video and the move to streaming proactive warning

PaSBench-Video extends the proactive safety benchmarking program from static or short observational inputs to streaming video, where a model must observe a video causally and produce a warning that is both temporally calibrated and content-correct (Zhao et al., 1 Jun 2026). The benchmark contains 740 videos, including 481 risk videos and 259 no-risk videos, across driving, healthcare, daily life, and industrial production. Risk videos are annotated at the frame level with risk onset $r$, accident onset $a$, risk source, and associated avoidance action.

The crucial addition is temporal evaluation. A warning is valid only if it occurs in the interval

$[r, a-\tau],$

where $\tau$ is the minimum lead time required for actionable intervention. The benchmark uses a streaming protocol in which models see only current and past frames in 3-second sliding windows with 0.3s stride. It reports progressively stricter metrics on risk videos: $\mathcal{O}$0

$\mathcal{O}$1

$\mathcal{O}$2

and First-Act@$\mathcal{O}$3, which additionally requires that the warning accurately identify the risk source. On the no-risk split, it reports the false-positive video rate, defined as the fraction of benign clips where at least $\mathcal{O}$4 warnings are emitted, with $\mathcal{O}$5 tested. Metrics are typically reported at $\mathcal{O}$6.

The empirical findings are severe. Across 13 contemporary MLLMs, no model exceeded 20.0% on First-Act@1, the strictest metric. The paper also reports that recall and false-positive rate are tightly coupled, with Pearson correlation

$\mathcal{O}$7

meaning that higher detection tends to come only at the cost of more false alarms. Loosening the metric—by allowing repeated warnings or ignoring content correctness—can raise apparent recall to 80–90%, but actual actionable early warnings stagnate below 20%.

Performance varies sharply by domain. In daily life, a model such as Claude Opus 4.7 reaches 56.2% First-Hit@1 with only 22.7% FP, whereas in driving the same model reaches only 6.2% First-Hit@1 with 81.9% FP. The paper attributes this to the fact that daily-life risks are often inherently anomalous, whereas in driving, routine and hazardous scenes look alike. It further reports that in driving, 90% of warnings are too early for Gemini 3.1 Pro, and that the average number of false warnings per normal driving clip reaches 38.9 for Claude Opus 4.7. Across models, the “valid” window for a correctly timed first warning covers only 9–31% of risk videos, and among correctly timed warnings the median lead time is only 1.7s, with 35% landing less than 1s before accident.

The video benchmark also supplies a more granular account of content errors. From 504 analyzed “First-Act” failures, the largest categories are wrong risk object (36.9%), entity-type swap (33.9%), sensor/env. fixation (11%), and wrong failure mode (8.1%); only 8% of content errors concern the causal mechanism itself. The authors conclude that current MLLMs behave more like activity threshold detectors than genuine reasoners about emerging harm. This suggests a broader interpretation of the PaSBench program: across text, images, and streaming video, the principal challenge is not merely recognizing unsafe categories, but producing stable, calibrated, content-grounded proactive warnings under open-ended conditions.