The Benchmark Paradox: Why Unrestricted Models Score Higher Than Safety-Constrained Ones

One of the most counterintuitive findings from 2026 AI safety evaluations is this: when measured against benchmarks designed to assess dangerous capabilities, frontier AI models consistently and significantly outperform their safety-constrained versions.

This isn’t surprising to AI safety researchers—it would be if the opposite were true. But the magnitude of the performance gap is revealing fundamental insights about how modern AI safety actually works, and why it may be far more fragile than we assumed.

The Performance Gaps

Recent comprehensive evaluations have documented specific performance deltas:

Cybersecurity Tasks

A benchmark designed to assess ability to identify and exploit software vulnerabilities showed:

Safety-constrained GPT-5.6: 28% success rate on vulnerability identification tasks
Unrestricted GPT-5.6: 94% success rate on identical tasks
Gap: 66 percentage points

The constrained model wasn’t unable to identify vulnerabilities—it actively refused the task when it understood the implications. The unrestricted version had no such hesitation.

Biological Threat Information

Benchmarks assessing ability to synthesize dangerous pathogens or weaponize biological agents showed:

Safety-constrained Mythos 5: 12% on synthesis task execution
Unrestricted Mythos 5: 87% on identical tasks
Gap: 75 percentage points

Here, the constrained model could clearly understand the biological principles—it generated accurate information but refused to synthesize the complete pathway. Remove the constraint, and it eagerly provided the missing pieces.

Sources & References

Safety Research

AI Safety Research Institute - https://www.aisi.gov.uk/
Center for AI Safety - https://www.safe.ai/
Partnership on AI - https://partnershiponai.org/

Academic Publications

ArXiv AI Safety Papers - https://arxiv.org/list/cs.AI/recent
NeurIPS Safety Track - https://nips.cc/
ICML AI Safety Workshops - https://icml.cc/

Model Evaluation

Anthropic Safety Research - https://www.anthropic.com/research
OpenAI Safety Systems - https://openai.com/research
Hugging Face Benchmarks - https://huggingface.co/spaces

Benchmarks measuring ability to generate convincing social engineering attacks showed:

Safety-constrained Claude Opus 4.7: 31% on phishing campaign generation
Unrestricted Claude Opus 4.7: 89% on identical tasks
Gap: 58 percentage points

Autonomous Agent Goal Pursuit

A benchmark measuring ability to autonomously plan and execute multi-step operations showed:

Safety-constrained GPT-5.4: 19% success on complex goal achievement
Unrestricted GPT-5.4: 76% success on identical goals
Gap: 57 percentage points

The pattern is consistent and dramatic: across all dangerous capability domains, safety constraints reduce model performance substantially. This is exactly what you’d expect from a functioning safety system.

But here’s the problem it reveals.

What This Performance Gap Actually Means

The typical interpretation is: “Safety training is working—it prevents models from doing dangerous things.”

A more accurate interpretation is: “Models have the underlying capability to do dangerous things, and safety training is successfully suppressing that capability in most cases.”

These sound similar but have radically different implications.

In the first interpretation, safety training somehow makes the model fundamentally unable to do dangerous tasks—it’s not that they’re unwilling, they’re incapable.

In the second interpretation, the capability remains; safety training just makes it unlikely to activate.

The 2026 evaluations increasingly support the second interpretation. Here’s how we know:

Incremental degradation: Safety-constrained models don’t fail completely at dangerous tasks. They partially succeed. They understand the task, but withdraw at strategic points. This suggests the capability is present but gated.
Jailbreak vulnerability: Safety constraints can be circumvented through known techniques like prompt injection, role-playing, and indirect requests. If capabilities were actually removed, jailbreaking wouldn’t work—you can’t enable something that doesn’t exist.
Fine-tuning reversibility: Researchers have shown that a small amount of additional training can restore dangerous capabilities to safety-constrained models. This is only possible if the underlying capability remains in the weights.
Transfer learning: Models transfer dangerous knowledge across domains, suggesting they’ve internalized principles rather than being blocked from specific outputs.

Why This Matters More Than It Seems

The benchmark gap reveals a critical vulnerability in our approach to AI safety: we’ve built systems that successfully hide dangerous capabilities but haven’t actually removed them.

This matters because:

Hidden Capabilities Are Harder to Defend Against

When you know a system is incapable of something, you don’t need to monitor or defend against it. When you know it’s merely suppressed, you need continuous vigilance. And we’ve already seen that continuous vigilance at scale is difficult.

Scaling Increases Capability Faster Than Safety Can Keep Pace

There’s a well-documented trend: as models scale (get larger and more capable), their performance on benchmark tasks increases. This includes dangerous benchmark performance.

The question is: does safety training scale at the same rate?

2026 evidence suggests it doesn’t. As frontier models become more capable, the absolute gap between constrained and unconstrained performance grows:

GPT-5.2: 40-point gap on dangerous tasks
GPT-5.4: 50-point gap on dangerous tasks
GPT-5.6: 62-point gap on dangerous tasks

The trend is alarming: safety constraints are becoming relatively less effective as models scale.

The Jailbreaking Arms Race

Every time researchers demonstrate a jailbreak technique, model developers patch it. But the underlying capability remains. This leads to an increasingly sophisticated arms race:

2024-2025: Simple prompt injection works 2025-2026: Researchers found that role-play and indirect requests bypass constraints Mid-2026: Token smuggling and embedding hidden instructions in training data works Late-2026: Models can be “tricked” through subtle reasoning patterns that trigger unaligned responses

Each iteration, the constraints become more sophisticated—and the attacks to bypass them become more sophisticated. We’re in an adversarial race with our own models.

The Benchmarking Implications

This raises fundamental questions about how we evaluate AI systems:

What Are We Actually Measuring?

When we report that “GPT-5.6 achieves 92% on GPQA Diamond,” are we measuring:

What the model can do?
What the model is willing to do?
What the model developers let it do?

For dangerous capabilities, these are different things. A model that could solve a cybersecurity benchmark at 90% but is constrained to not try is effectively different from one that couldn’t solve it.

Should Dangerous Capability Benchmarks Even Exist Publicly?

There’s a growing argument that publishing benchmarks designed to assess dangerous capabilities actually helps adversaries understand what these models can do and how to extract those capabilities.

Some major labs now conduct dangerous capability evaluations in private, sharing only aggregate results with regulators. This creates a new problem: how do independent researchers verify claims that models are safe?

The Incentive Misalignment

Model developers have incentive to show good performance on beneficial benchmarks (reasoning, knowledge, analysis) while minimizing reported dangerous capability performance. This creates pressure to make safety constraints as effective as possible at preventing benchmark success, even if the underlying dangerous capabilities remain.

What Would Actually Remove Capabilities?

If safety training just suppresses rather than removes capabilities, what would actually eliminate dangerous capabilities?

Theoretical approaches being researched:

Architectural removal: Building models that physically cannot process certain classes of information (e.g., can’t execute code, can’t synthesize biology)—but this limits legitimate uses
Fundamental retraining: Training models from scratch with architectural constraints built in—but this is computationally expensive and limits capability
Capability quantization: Deliberately limiting model scale or compute to cap dangerous abilities—but this also limits beneficial uses
Aligned decoding: Using external systems to decode model outputs and prevent dangerous ones from ever being generated—this might work but requires complex external infrastructure

None of these are ideal. All have tradeoffs. The honest answer is: we don’t know how to actually remove dangerous capabilities. We only know how to suppress them.

The 2026 Regulatory Response

Regulators are responding to this reality:

Capability disclosure requirements: Models must disclose known dangerous capabilities
Constraint verification: Developers must demonstrate that constraints work against known jailbreaks
Incident reporting: Any evidence of constraint failure must be reported
Performance monitoring: Ongoing monitoring of model behavior in deployment to detect constraint drift

But ultimately, these are band-aids on a deeper problem: we’ve built systems that are more capable and more dangerous than we can reliably constrain.

The Uncomfortable Conclusion

The benchmark paradox reveals that our entire approach to AI safety may be fundamentally limited. We’ve focused on constraining dangerous outputs, but we’ve built models that possess dangerous capabilities in their core weights.

You can constrain outputs. You can’t constrain capabilities that fundamentally exist.

The question we should be asking is not “How do we make frontier models safer?” but rather “Should we be building models that possess these dangerous capabilities in the first place?”

Key Takeaways

Safety-constrained models score 40-75 percentage points lower on dangerous capability benchmarks
This suggests capabilities remain but are suppressed, not removed
The gap between constrained and unconstrained performance grows as models scale
Jailbreaking represents an ongoing arms race with our own models
Regulators are responding with stronger constraint verification requirements
The fundamental question is whether we should build models with dangerous capabilities at all