What does a benchmark score actually tell you about a language model?

How BenchMIRT reads the test questions

A new auditing method looks at individual prompts instead of only the aggregate number. It builds on Item Response Theory, a psychometric technique that treats test questions as having different difficulty and different power to separate strong from weak performers. The multidimensional extension, MIRT, lets the system estimate several latent capabilities at the same time.

Researchers trained the system on results from 100 open-weight LLMs across 16 benchmarks and more than 34K questions. Six of those benchmarks target general reasoning: MMLU-Pro, GPQA, MATH, and BBH. The other ten come from the Olmo 3 safety suite, including HarmBench, StrongReject, WildJailbreak, BBQ, WMDP, and XSTest.

Crucially, the team did not label which benchmark belonged to which category. The model independently recovered two dominant dimensions — safety and general reasoning — and those same two dimensions appeared each time the analysis was repeated from scratch.

What the method found inside familiar benchmarks

For many benchmarks the results matched their stated purpose. Reasoning benchmarks tracked with reasoning ability. Jailbreak and harmful-content benchmarks tracked with safety.

But three evaluations behaved differently. BBQ, designed to probe social bias and usually grouped with safety tests, aligned much more strongly with general reasoning. A low BBQ score may partly reflect difficulty understanding or reasoning through certain questions rather than safety behavior alone.

WMDP tests dangerous dual-use knowledge in biology, chemistry, and cybersecurity. The analysis found its scores were more strongly associated with general reasoning than with safety. Stronger general reasoning correlated with lower WMDP scores because the benchmark counts refusing or failing to provide the dangerous knowledge as the desired response.

HarmBench mixes signals within a single suite. Its standard and contextual harmful-request questions both aligned with safety. Its copyright questions — such as generating the lyrics of "What a Wonderful World" by Louis Armstrong — aligned with general reasoning.

Fewer questions, similar picture

The method can rank questions by how well they distinguish stronger from weaker models on a target capability. Across the 16 benchmarks, keeping only 10 percent of the questions generally preserved nearly the same picture of model capabilities as using the full set. Keeping 50 percent often matched the full benchmark even more closely.

It also predicts how a model would answer a held-out question. In experiments it correctly predicted the outcome 79 percent of the time. A simpler baseline that assumes a model performs on each question about as well as its overall benchmark average was correct 70 percent of the time.

That means the system can estimate performance more precisely from what it has already learned about the model's abilities and the demands of each question.

Where the approach stops working

The models used to train and evaluate were all released by March 2025. The analysis does not capture how the method behaves on newer generations of LLMs.

The dimensions discovered depend on the benchmark set it receives. Safety and reasoning emerged as dominant across these 16 benchmarks, but a different mix of evaluations could surface different underlying capabilities.

There is a trade-off. If the goal is to rank models by predicted performance on randomly held-out items, the benchmark's average score performs slightly better. The advantage is the finer-grained picture of performance on individual questions.

That detail cuts both ways. The same estimates that help identify a benchmark's most informative safety questions could be used to remove them, producing a weaker evaluation that an unsafe model could pass. Existing tools already make it possible to trim evaluations in similar ways. The team argues the added transparency into what benchmark questions are actually measuring is worth that risk, but the risk is real.