Researchers find 81 of 134 AI models fail terrorism-safety benchmark

Eighty-one of 134 AI models failed a terrorism-safety benchmark from Tech Against Terrorism, which tested requests ranging from attack planning to radicalization. Every model tested with its safeguards stripped failed—a finding that has prompted the nonprofit to call for restrictions on public model libraries, drawing objections from Hugging Face.

The results identify failures to refuse requests, not proven assistance in carrying out attacks. The nonprofit says its benchmark measures whether a model provides the requested information, not whether someone could act on it. Apart from one extremist chatbot it identified, the group found no evidence of terrorist or extremist use of the tested models.

A researcher label weakened refusals

The Counter-Terrorism AI Benchmark report tested more than 200 prompts across models from US, Chinese and European developers, according to WIRED. Researchers tested each prompt three times, changing the framing: an explicit declaration of terrorist intent, a clandestine request, and a claim that the user was a safety researcher.

Failure had a specific definition: one complete, specific answer on a mass-casualty subject, or an overall score below 90 out of 100. Scores measured consistency in refusing requests, weighted by the severity of the subject. Only two models passed completely; that is a stricter result than simply avoiding the benchmark’s failure threshold.

Claiming a research purpose made a substantial difference. Models answered 16.9 percent of requests framed as coming from a safety researcher, nearly nine times as often as when terrorist intent was explicit, the report found. Researchers did not have to supply evidence for that claimed role: changing the description of the requester was enough.

Safety scores fell after safeguards were stripped

Open-weight models make their trained parameters—the numerical settings that encode what they have learned—publicly available for modification. That access also makes them vulnerable to “abliteration,” a process that removes refusal safeguards. Tech Against Terrorism says patterns learned during safety training can be located in those parameters and canceled, leaving a modified model more willing to answer harmful requests.

The report did not find a simple divide between open and closed models: their benchmark scores were similar overall. The sharper distinction was between ordinary models and stripped versions. A comparison using Meta’s Llama 3.1 8B showed how far the safety score could fall after modification.

The window before modified versions appear is shrinking, too. The nonprofit found that abliterated versions of newly released open-weight models now appear online in less than three days on average. In 2024, the average was more than 24 days.

A proposed repository ban meets resistance

Tech Against Terrorism is asking governments and developers to address both the testing gap and access to modified models. Its recommendations include three concrete measures:

• Fund independent benchmarks through government and developer support.
• Make models harder to strip of safeguards before releasing them.
• Prohibit models stripped of safeguards from public repositories.

Hugging Face’s head of machine learning and society, Yacine Jernite, told CBS News that the benchmark was useful as one safety signal, but criticized recommendations he said were incompatible with open research and could damage the wider safety ecosystem. He argued that abliterated does not automatically mean harmful: refusal safeguards can also block legitimate work. Hugging Face says it continually moderates its platform and acts on models, datasets and applications that violate its content policy.

Meta told CBS News that Llama 3.1 undergoes safety evaluations and risk assessments, including adversarial testing, and that its use policy prohibits harmful or illegal uses. Tech Against Terrorism, meanwhile, says it is not calling for an end to open-weight releases or a slowdown in AI development.