FUSE maps dangerous LLM capabilities across knowledge and defence

Problem

The paper addresses fragmented safety evaluation of large language models, which prevents consistent governance of dangerous capabilities. Existing benchmarks measure knowledge, refusal behaviour, or harmful outputs in isolation using incompatible protocols, so regulators and operators cannot compare models or track risk over time. The authors propose a unified, modular evaluation that produces a standardised dangerous-capability profile φ across models and domains.

Approach

The framework evaluates each model along three orthogonal pipelines: Knowledge (K) measuring hazardous-domain proficiency via an IRT-weighted multiple-choice bank; Defense (D) measuring access-control robustness through adaptive, multi-round red-team interactions; and Harm (H) measuring the actionability of outputs that bypass defences using rubric-scored open-ended prompts. A pluggable Danger-Domain Module supplies scenario seeds, knowledge banks, harm queries and rubrics so the core engine is reusable across domains. The authors instantiate a chemical-biological (CB) module and evaluate 12 commercial LLMs from four families over a 2023–2026 release window. Judgement is performed by LLM-as-judge ensembles with cross-judge validation; a Tool-Enhanced sandboxed mode with real Bash/Python execution was piloted for cyber scenarios.

Key Findings

• Orthogonal, divergent profiles across models: Knowledge, Defense and Harm are weakly correlated (pairwise ρ in [0.32, 0.52]), so models with similar knowledge may differ sharply in refusal resilience and in the harmfulness of outputs they yield when coerced.
• Family- and model-level patterns: Across 12 models, defence scores spanned a 43-point range while harm scores were tightly clustered (roughly 68–78), meaning that once a model complies its outputs are similarly actionable. Examples include DeepSeek variants combining high knowledge with weak, eroding defence and high harm, and Claude variants showing strong defence but high conditional harm and frequent silent refusal (empty responses in ~67.8–78.6% of turns).
• Temporal evolution is non-monotonic: knowledge tends to compound across generations while defence improvements are partial and family-dependent; harm remains inelastic over the evaluated period. Reliability checks show cross-judge consistency for defence (bootstrap ρ>0.79 for four of five alternative judges) and near-perfect agreement between IRT ability and raw accuracy rankings (Spearman ρ=0.998).

Limitations

Main constraints are that full validation is concentrated on the CB module; the cyber pilot is smaller-scale with a less mature knowledge bank. Harm scoring is inherently subjective and showed moderate inter-judge agreement (ρ≈0.42–0.58). Knowledge-bank contamination by pre-training data remains a risk. Some deployment behaviours (silent refusal) reflect serving configurations rather than model weights.

Implications

Offensive security implications are direct: attackers can extract increasingly hazardous knowledge as models accumulate domain expertise across generations, and adaptive multi-round elicitation can erode refusals to produce actionable protocols. Tool-enhanced modes amplify this risk by enabling models to author and iterate executable artefacts inside sandboxes. Silent refusal strategies complicate detection and auditing because they leave no textual refusal trace. The decoupling of Defence and Harm means that even models judged safe on single-turn tests can still yield highly actionable outputs on the subset of queries they fail to refuse, so defenders should not conflate strong first-contact refusal with low overall exploitability.