AI is tested in four layers, benchmarks, red teams, interpretability and monitoring, and each finds real problems but is weak at anything new.
- Benchmarks can mislead. Test questions circulate publicly, so they may have appeared in training data.
- Red teams have limits. They only find what someone thought to try.
- Interpretability is early. It finds real internal structure but is not a safety net yet.
- Monitoring stops at download. Open-weights models on private hardware are outside anyone's monitoring.
- Passing evals is a start. Treat it as a starting condition, not a guarantee.
Layer 1 · Benchmarks
Standardised exams — maths, code, reasoning, factual recall — run identically across models so results can be compared. This is where "state of the art" claims come from.
Layer 2 · Red teams
People paid to make the model misbehave: extract dangerous instructions, talk it past its own guidelines, get it to deceive. Findings are logged, patched, retested. This is the layer most responsible for the guardrails you encounter day to day.
Layer 3 · Interpretability
Probes that look for internal structure: features corresponding to recognisable concepts, circuits that activate for particular kinds of reasoning. The ambition is to stop treating the model as a black box you can only test from outside.
Layer 4 · Monitoring
Usage watched for harm and drift after release, incidents reported, models revised. Testing does not end at launch — arguably it barely starts there, because the world produces inputs no evaluation suite contains.
Every layer is good at finding problems that resemble problems already found, and weak at novelty. That is not incompetence — it is the same limitation every safety discipline has, from aviation to pharmaceuticals, which is why those fields lean on incident reporting and staged rollout rather than pre-launch testing alone. AI evaluation is roughly where those industries were before they learned that lesson.
Before trusting a test result, ask what it would miss. Each layer is good at finding problems like ones already found and weak at anything new.
The nine questions testing does not answer
These are not rhetorical. They are open in the literature, argued about by people who work on this daily, and no benchmark reports on them.
Optimising for helpfulness, harmlessness and honesty at once produces conflicts. Which yields, and who decided?
Alignment means alignment to someone. The written principles are public; the choice of whose norms they encode is a decision, not a discovery.
A model can be trained to sound calibrated. Distinguishing genuine uncertainty from performed uncertainty remains unsolved.
Agents that act rather than answer change the failure mode from a wrong sentence to a wrong action. The pace here is set by product competition, not by testing readiness.
When an agent causes harm, liability currently sits in a gap between the lab, the deployer and the user.
Not whether jobs vanish — which is the wrong framing — but which parts of which jobs get repriced, and who absorbs the cost.
The frontier tier is expensive; the open-weights layer trails it by months. Whether that gap closes or widens decides how concentrated this capability stays. See who builds AI.
Once weights are published they cannot be recalled. Frontier safety measures do not travel with a downloaded model.
Some labs publish safety frameworks that name risk thresholds in advance. How binding those thresholds are, and who outside a lab could hold anyone to them, is still argued over. A commitment defined only after the fact is not a commitment.
WHY THIS PAGE HAS NO ANSWERS
Because there are none yet, and pretending otherwise would fail the standard this site holds everything else to. What can be said honestly: the testing that exists is real work by serious people, it catches genuine problems, and it is not sufficient.
Take both halves seriously. Evaluation is more rigorous than critics assume and less complete than marketing implies. The useful posture is the one aviation reached decades ago: assume the tests miss things, report incidents publicly, stage deployment, and treat "it passed our evals" as a starting condition rather than a guarantee.
When a model is called safe, ask which of these questions the claim covers. Testing measures capability and known failures; values, liability, access and stopping points sit outside what a benchmark reports.