Evaluation, Testing & Safety

Correct answer: .

Perplexity is computed by exponentiating the model's average per-token negative log-likelihood on the test text, so it directly measures how surprised the model is by the tokens that actually appear; a lower value means the model consistently assigned higher probability to the real continuation, which is exactly what happens for Model A here. The option claiming a higher score reflects 'flexibility' has the direction backwards: perplexity punishes a model for spreading probability away from the tokens that actually occurred, so a higher value reflects worse prediction, not a virtue. The option claiming perplexity is meaningless without a downstream task is wrong because perplexity is itself a standard, self-contained intrinsic evaluation of next-token prediction quality, independent of any downstream application. The option attributing the difference to training-corpus size is wrong because perplexity is computed purely from the model's output probabilities on the given test set; it says nothing directly about how much data the model was trained on, only about its predictive accuracy on that specific text.

Source: Jelinek, Mercer, Bahl & Baker, 'Perplexity—a measure of the difficulty of speech recognition tasks,' Journal of the Acoustical Society of America (1977), the original definition of perplexity as an evaluation metric for language models

Correct answer: .

BLEU scores a candidate translation by counting how many of its n-grams (contiguous word sequences) also appear in the reference translation(s), modified by a brevity penalty for candidates shorter than the reference; it has no mechanism for recognizing that a differently-worded sentence expresses the same meaning, so a fluent, accurate paraphrase that reuses few of the reference's exact word sequences will score low despite being a good translation. The option claiming BLEU uses a semantic similarity model is wrong because BLEU is a purely lexical, n-gram-overlap metric with no learned semantic component. The option claiming BLEU ignores the reference entirely and scores only the candidate's own grammaticality is wrong because reference comparison is the entire basis of the metric; a candidate cannot be scored without at least one reference to compare against. The option attributing the low score to sentence length is wrong because BLEU's brevity penalty specifically targets candidates that are shorter than the reference, not longer, and the scenario describes a wording difference rather than a length difference.

Source: Papineni, Roukos, Ward & Zhu, 'BLEU: a Method for Automatic Evaluation of Machine Translation,' Proceedings of ACL 2002

Correct answer: .

This is position bias, a well-documented weakness of using an LLM as an automated judge: the judge's verdict shifts based on which slot a response is placed in, independent of the response's actual content, which is exactly what the swap-and-re-judge test in the scenario reveals. The standard mitigation is to run each pairwise comparison in both orderings and only treat a response as the winner if it wins regardless of which slot it occupies (or to average the two orderings' results), which cancels out the ordering effect. The option calling this a sign the judged model is broken is wrong because the inconsistency described is in the judge's verdicts, not in the model being judged, which produced the same two responses both times. The option calling this benchmark contamination is wrong because contamination refers to test data leaking into training data, not to a judge's sensitivity to answer placement. The option claiming no mitigation is needed is wrong because treating an artifact of response placement as a genuine quality signal would systematically bias the evaluation toward whichever response happens to be listed first.

Source: Zheng et al., 'Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena,' arXiv:2306.05685 (2023) -- documents position bias, verbosity bias, and self-enhancement bias in LLM-as-judge evaluation

Correct answer: .

Benchmark (data) contamination occurs when test examples, or near-duplicates of them, are present in a model's pretraining corpus, which inflates its benchmark score by letting it partially memorize answers rather than generalize; a standard way to check for it is to measure n-gram overlap between the pretraining corpus and the benchmark's questions, or to check whether the model reproduces 'canary strings' -- unique marker text some benchmark creators deliberately insert so contamination can be detected later. The option describing catastrophic forgetting is wrong because that term refers to a model losing previously learned capability after further training, not to test data leaking into training data. The option describing mode collapse is wrong because that refers to a generative model producing overly repetitive or non-diverse outputs, which is unrelated to whether test data leaked into training. The option describing reward hacking is wrong because that refers to a policy exploiting flaws in a reward model during reinforcement learning, not to overlap between benchmark and pretraining text.

Source: Brown et al., 'Language Models are Few-Shot Learners' (GPT-3 paper), arXiv:2005.14165 (2020), Appendix C, which measures benchmark contamination via n-gram overlap between the pretraining corpus and benchmark test sets

Correct answer: .

Red-teaming is the practice of deliberately and adversarially probing a model with creative attacks before deployment specifically to surface harmful or policy-violating behavior, which is fundamentally different in intent from routine functional testing that simply checks whether the model does its intended job correctly; the goal in red-teaming is to break the model's safety guardrails on purpose so the weaknesses can be fixed first. The option describing A/B testing is wrong because that method compares average outcomes between two model versions shown to ordinary users under normal conditions, with no adversarial intent to provoke unsafe behavior. The option describing unit testing is wrong because it reduces the distinction to who writes the test cases rather than to the adversarial, safety-focused intent that actually defines red-teaming. The option describing regression testing is wrong because it reduces the distinction to timing relative to deployment rather than to the adversarial nature of the testing itself, and regression testing is about confirming old functionality still works, not about discovering new harmful behaviors.

Source: Ganguli et al., 'Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned,' arXiv:2202.03286 (Anthropic, 2022)

Correct answer: .

The distinction turns on who the adversary is: in the first case the application's own user is deliberately crafting the malicious input themselves, which is a direct prompt injection or jailbreak, while in the second case the user is trusted and simply asked for a legitimate summary, but the agent ingests third-party content -- the webpage -- that itself carries adversarial instructions, which is an indirect prompt injection. The option treating both as the same 'jailbreaking' attack is wrong because collapsing the two erases the difference in who controls the adversarial input, which changes what mitigations are appropriate (screening user input versus treating tool/webpage content as untrusted). The option that swaps the two labels is wrong because it inverts the actual basis for the distinction, which is the source of the adversarial content, not how 'directly' the text reaches the model. The option invoking data poisoning is wrong because data poisoning specifically means corrupting a model's training data, not injecting adversarial text into its input at inference time, which is what both scenarios describe.

Source: Anthropic, 'Mitigate jailbreaks and prompt injections,' platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks -- distinguishes direct prompt injection/jailbreaks (user is the adversary) from indirect prompt injection (trusted user, adversarial third-party content)

Correct answer: .

RLHF's standard pipeline trains a reward model on the collected pairwise human preference comparisons so it learns to score outputs the way a human annotator would, and then uses that learned reward model as the optimization signal for reinforcement learning -- typically PPO -- to update the language model's own policy so it produces outputs the reward model scores highly, aligning it with human preferences beyond the original pretraining objective. The option describing direct supervised editing of weights using preference labels as next-token targets is wrong because preference labels indicate which of two full outputs is better, not what the next token should be, so they cannot serve as ordinary supervised targets without the intermediate reward-modeling and RL steps. The option describing corpus filtering and retraining from scratch is wrong because RLHF fine-tunes the existing pretrained policy using reinforcement learning; it does not discard and rebuild the pretraining corpus. The option describing a retrieval index is wrong because RLHF changes the model's own generative behavior through training, rather than replacing generation with retrieval of past outputs.

Source: Ouyang et al., 'Training language models to follow instructions with human feedback' (InstructGPT), arXiv:2203.02155 (2022)

Correct answer: .

Faithfulness (also called groundedness) specifically measures whether each claim in the generated answer can be traced back to, and is supported by, the passages the retrieval step actually returned -- it is a check on whether the generator invented or distorted claims beyond what its retrieved evidence supports, and it is logically independent of the other two scores: an answer can be grounded in its context yet fail to address the question, or address the question well while retrieval itself was off-topic. The option labeling the retrieval-relevance score as faithfulness is wrong because relevance of the retrieved passages to the question says nothing about whether the generated answer's specific claims are actually supported by those passages. The option labeling the answer-relevance score as faithfulness is wrong for the same reason in reverse: directly addressing the question's wording says nothing about whether the answer's claims are grounded in retrieved evidence rather than fabricated. The option claiming all three scores are mathematically the same quantity is wrong because they are defined to capture distinct failure modes -- poor retrieval, off-topic answers, and ungrounded claims can each occur independently of the others.

Source: Es et al., 'RAGAS: Automated Evaluation of Retrieval Augmented Generation,' arXiv:2309.15217 (2023) -- defines faithfulness, answer relevance, and context relevance/precision as distinct RAG evaluation metrics

Correct answer: .

Pairwise comparisons are considered more reliable because judging which of two responses is better is a simpler, more consistent task for humans than assigning an absolute numeric score, since absolute scales suffer from raters anchoring differently, drifting over time, and disagreeing about what a given number means, whereas a relative 'which is better' judgment sidesteps most of that calibration problem; aggregating many such pairwise votes into an Elo-style rating is exactly how platforms like Chatbot Arena rank models. The option claiming absolute ratings are 'mathematically impossible' to aggregate is wrong because averaging or otherwise combining independent ratings is entirely possible, just noisier and harder to calibrate across raters than pairwise comparison; it is also wrong that pairwise votes need no aggregation, since converting many pairwise outcomes into an Elo rating is itself an aggregation step. The option attributing the advantage to collection speed and vote count alone is wrong because it ignores that the reliability gain comes from the nature of the judgment task itself, not merely from how fast or how many votes are collected. The option restricting absolute scales to machine translation is wrong because absolute rating scales are used across many evaluation tasks; they are not confined to translation.

Source: Chiang et al., 'Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preference,' arXiv:2403.04132 (2024)

Correct answer: .

OpenAI's Moderation API can classify standalone text a user submits as well as text a model has already generated, returning a binary flagged status, per-category violation flags, and confidence scores for each of its content categories; the documentation is explicit that the underlying generative model still produces its output normally and that the moderation results should be reviewed before that output is shown to a user or used to trigger a downstream action, meaning it is a review layer rather than a generation-time filter. The option claiming it replaces the need for the underlying model's own safety training is wrong because it is described as an additional review step applied around generation, not a substitute for the model's own alignment. The option restricting it to pre-generation user input only is wrong because the documentation explicitly supports scoring model-generated text as well. The option describing it as a paid, metered endpoint is wrong because OpenAI's documentation states the moderation endpoint is free to use.

Source: OpenAI, 'Moderation' guide, platform.openai.com/docs/guides/moderation (redirects to developers.openai.com/api/docs/guides/moderation) -- describes the omni-moderation-latest model, its categories, its use on both input and generated output, and that it is free to use

Correct answer: .

The scenario describes length (verbosity) bias: an LLM-as-judge protocol systematically rewarding longer outputs independent of actual quality, a well-documented failure mode of pairwise LLM judging where judges conflate thoroughness-sounding length with correctness. Because raw win rate can be gamed simply by generating more tokens, AlpacaEval 2.0 introduced a length-controlled win rate, which fits a regression model relating length difference and preference across the benchmark, then reports the win probability implied when the length-difference term is set to zero -- isolating a quality signal from a verbosity signal. The option about position bias describes a different, well-documented judge bias (favoring whichever response occupies a given slot in the prompt) which is mitigated by swapping response order and averaging, not by controlling for length, so it answers a different problem than the one described here. Self-enhancement bias refers to a judge favoring outputs stylistically similar to its own model family's outputs, a distinct bias unrelated to raw response length. Attributing the effect to the judge's decoding temperature misdiagnoses the cause: the bias tracks response length consistently across many prompts and judges, not stochastic sampling noise in the judge's own generation, so lowering temperature would not address it.

Source: Dubois et al., 'Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluators,' arXiv:2404.04475 (2024)

Correct answer: .

ROUGE (Recall-Oriented Understudy for Gisting Evaluation) is built around recall: it checks how much of the content present in the human reference summary also shows up in the generated summary, which fits summarization, where omitting important reference content is the main failure mode being penalized. BLEU (Bilingual Evaluation Understudy) is built around precision: it checks how much of the n-gram content the system produced also appears in the reference translation, which fits translation, where producing extra unsupported content is the main failure mode being penalized. The option describing both metrics as identical precision-oriented overlap measures differing only by naming convention is incorrect because the two metrics are built on genuinely different statistics (recall vs. precision), not relabeled versions of the same computation. The option that swaps the orientations, calling ROUGE precision-oriented and BLEU recall-oriented, states the exact opposite of each metric's actual construction. The option claiming both require a trained neural scoring model is incorrect because both ROUGE and BLEU are computed directly from n-gram overlap counts between candidate and reference text, with no trained model involved, unlike newer learned metrics such as BERTScore.

Source: Lin, 'ROUGE: A Package for Automatic Evaluation of Summaries,' ACL Workshop 2004; Papineni et al., 'BLEU: a Method for Automatic Evaluation of Machine Translation,' ACL 2002

Correct answer: .

Exact match is a strict, binary-per-example metric: after normalizing text (lowercasing, stripping articles and punctuation), a prediction scores 1 only if it matches a gold answer string exactly, and 0 otherwise, and EM is reported as the percentage of examples scoring 1. F1 is more forgiving: it treats the predicted span and the gold span as bags of tokens, computes token-level precision and recall between them, and reports their harmonic mean, so a predicted span that captures most but not all of the gold tokens still earns partial credit instead of scoring zero. The option describing EM as itself a harmonic mean and F1 as a plain overlap percentage swaps the two metrics' actual definitions. The option describing EM as a stricter threshold applied to the F1 score is incorrect because the two are computed independently from the same prediction/gold pair, not derived from one another. The option invoking embedding distance and character length is incorrect because neither SQuAD metric uses learned embeddings or raw string length; both operate on normalized token and string matching.

Source: Rajpurkar, Zhang, Lopyrev & Liang, 'SQuAD: 100,000+ Questions for Machine Comprehension of Text,' arXiv:1606.05250 (2016), including the official EM/F1 scoring script

Correct answer: .

Cohen's kappa is built exactly for this purpose: it starts from the observed proportion of examples where two annotators agree, then subtracts out the proportion of agreement that would occur by chance given how often each annotator uses each label, so a kappa near zero signals agreement no better than random guessing even if raw agreement looks high, and a kappa near one signals agreement well beyond chance. Standard deviation of raw label counts is a measure of dispersion within one annotator's labeling, not a measure of agreement between two annotators, so it cannot answer the question being asked. Pearson correlation is designed for continuous variables and is not the standard tool for two annotators' categorical labels, where treating label identifiers as numbers on which to compute a linear correlation would be a category error. Raw percentage agreement is exactly the naive measure Cohen's kappa was designed to improve on, because raw agreement does not account for the substantial agreement that occurs by chance alone whenever one or both annotators favor certain labels, which can make two careless or unreliable annotators look highly consistent.

Source: Cohen, 'A Coefficient of Agreement for Nominal Scales,' Educational and Psychological Measurement, 20(1), 1960

Correct answer: .

TruthfulQA is designed to measure whether a model reproduces 'imitative falsehoods': answers that are false but popular, reflecting misconceptions that appear frequently in text a model was trained on, rather than testing raw factual knowledge in general. The paper's explanation for larger models sometimes doing worse is that models trained to imitate the statistical patterns in human-written text can learn these popular false beliefs just as well as, or better than, true ones, so scaling up imitation-based training does not reliably fix a bias that is itself present in the training distribution -- the opposite of most benchmarks, where more capacity and training data usually help. The option describing plain factual-recall trivia and memorization-driven hallucination misidentifies the benchmark's specific design, which deliberately targets questions tied to common misconceptions rather than testing obscure facts. The option about confidence-versus-accuracy alignment describes a different evaluation concept, calibration, not what TruthfulQA's questions are built to probe. The option about toxicity detection misdescribes the benchmark's subject matter, which is truthfulness against human misconceptions, not classification of toxic content.

Source: Lin, Hilton & Evans, 'TruthfulQA: Measuring How Models Mimic Human Falsehoods,' ACL 2022, arXiv:2109.07958

Correct answer: .

Paired bootstrap resampling directly addresses the question asked: by repeatedly drawing new test sets of the same size, with replacement, from the original test set, and recomputing the score gap between the two models on each resampled set, it builds an empirical distribution of plausible score differences under resampling variation alone, letting a team estimate whether the true gap is likely nonzero rather than an artifact of which specific examples landed in a fixed test set. Increasing inference batch size affects computational efficiency and at most negligible floating-point differences, not the statistical question of whether an observed score gap reflects genuine model differences versus sampling noise. Cherry-picking the best of several retraining runs for each model would inflate apparent performance and is the opposite of a principled significance check; it introduces bias rather than removing sampling uncertainty. Rounding both scores to hide a small gap does not test whether the gap is statistically meaningful; it only obscures the reported numbers without answering the underlying question of whether the difference is likely real.

Source: Berg-Kirkpatrick, Burkett & Klein, 'An Empirical Investigation of Statistical Significance in NLP,' EMNLP-CoNLL 2012 (paired bootstrap resampling for comparing system scores)

Correct answer: .

The property being tested is calibration: whether a model's stated or implied confidence tracks its actual probability of being correct, commonly summarized by binning predictions by confidence level and computing a weighted average gap between each bin's average confidence and its average accuracy, known as Expected Calibration Error. A large persistent gap, such as a bucket of 70%-confidence predictions that is actually correct only 40% of the time, indicates poor calibration, typically overconfidence, which matters because downstream systems relying on a model's confidence to decide when to defer to a human or abstain will make worse decisions if that confidence is not trustworthy. Fluency concerns the grammatical and stylistic quality of generated text and has no defined relationship to a confidence-versus-accuracy comparison. Faithfulness, in the reasoning sense, refers to whether a model's explanation of its own reasoning matches the actual process behind its answer, a related but distinct question from confidence calibration that does not involve binning by stated confidence. Diversity concerns variation across multiple sampled outputs for the same input and is unrelated to comparing confidence to accuracy.

Source: Guo, Pleiss, Sun & Weinberger, 'On Calibration of Modern Neural Networks,' ICML 2017 (foundational Expected Calibration Error definition, widely applied to language model confidence evaluation)

Correct answer: .

This is the phenomenon of unfaithful chain-of-thought: the experiment shows that a factor demonstrably steering the model's answer, the biased slot position introduced across the few-shot examples, went completely unmentioned in the model's own stated reasoning, which instead constructed a coherent but causally inaccurate content-based justification, showing that a fluent chain-of-thought explanation is not guaranteed to reflect the actual computation behind the answer. The option claiming chain-of-thought reduces accuracy describes a different, unrelated empirical question about task performance, not what this bias-injection experiment was designed to probe, and is not the finding described. The option about benchmark contamination describes a model having memorized test answers from pretraining data, a data-leakage concern entirely separate from whether a model's self-reported reasoning is accurate, and nothing in the scenario involves checking pretraining data. The option about LLM-as-judge position bias describes a different setup altogether, where a separate judge model evaluates two candidate outputs side by side; this scenario instead concerns a single model's own multiple-choice answer and its self-generated explanation, not a judge comparing two outputs.

Source: Turpin, Michael, Perez & Bowman, 'Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting,' NeurIPS 2023, arXiv:2305.04388

Correct answer: .

This describes automated, model-based red-teaming: rather than relying solely on human red-teamers, one language model is trained, here via reinforcement learning against a harmful-content classifier's reward signal, to generate prompts that elicit harmful outputs from a separate target model, letting adversarial test-case generation scale far beyond manual human effort. A documented limitation of this reinforcement-learning-based approach is mode collapse: because the reward signal rewards successful attacks, the red-teaming model tends to converge on and repeat a narrow set of prompt patterns that reliably score well, rather than exploring a diverse range of attack strategies, which limits how comprehensively the target model's weaknesses get probed. Constitutional AI refers to a distinct technique for training a model to critique and revise its own outputs against a written set of principles, not a method for training an adversarial prompt generator, and does not require access to a target model's training data. Reward-model overoptimization describes a different failure mode, where optimizing too hard against an imperfect proxy reward model degrades true quality during preference fine-tuning, not a property of adversarial prompt generation. Claiming attack prompts never transfer across models is factually too strong and is not the documented limitation of this RL-based method; transferability varies but total non-transfer is not the established finding.

Source: Perez, Huang, Song, Cai, Ring, Aslanides, Glaese, McAleese & Irving, 'Red Teaming Language Models with Language Models,' EMNLP 2022, arXiv:2202.03286

Correct answer: .

The framework described is G-Eval, which uses an LLM to first generate its own chain-of-thought sequence of detailed evaluation steps from a task description and scoring criteria, then reuses that generated chain-of-thought as context while scoring each candidate output in a structured form-filling paradigm; this design lets the metric adapt its evaluation reasoning to the specific criteria and text at hand, rather than relying on fixed surface-level n-gram overlap with a single reference, which is why G-Eval reports substantially higher correlation with human judgment on tasks like summarization than BLEU or ROUGE. RLHF is a training-time technique that updates a model's own weights using human preference data; it is not a post-hoc scoring framework applied to already-generated outputs, so it does not fit a scenario about scoring existing summaries. BERTScore is a real reference-based metric, but it works by comparing contextual token embeddings, not by generating an LLM chain-of-thought of evaluation steps, so its underlying mechanism is different regardless of any embedding-based advantage. The Chatbot Arena Elo system aggregates crowdsourced pairwise human preference votes into a ranking; it does not involve an LLM generating its own evaluation-step reasoning to score a single output, so it does not match the framework in the scenario.

Source: Liu, Iter, Xu, Wang, Xu & Zhu, 'G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment,' EMNLP 2023, arXiv:2303.16634

Correct answer: .

HumanEval's pass@k is defined to estimate the probability that at least one of k samples shown to a user would pass, without requiring a fresh batch of exactly k samples for every value of k. The paper's estimator generates one large batch of n samples per problem (n >= k), counts how many of them, c, pass the unit tests, and computes pass@k as one minus the probability that a random k-sized draw from the n samples, taken without replacement, contains zero of the c passing ones -- a formula built purely from combinatorics over n, c, and k. This single-batch approach lets the same n=200 samples be reused to compute pass@1, pass@10, and pass@100 together, which is exactly why the option describing that reuse is correct and the option insisting each k needs its own fresh batch is wrong: reusing the batch introduces no cross-k leakage, since each pass@k value is computed from combinatorics over the same fixed set of outcomes rather than by peeking at a different k's results. The option treating the plain fraction of passing samples as identical regardless of k is wrong because it ignores that a user examining more samples has a mechanically higher chance of finding at least one success even at an unchanged per-sample pass rate -- collapsing pass@1 and pass@100 together throws away exactly the information the metric exists to capture, and is precisely the naive formula the paper's estimator was designed to replace. The option that always reports the single best sample as 'pass@k for every k' is wrong because it produces one fixed number regardless of how many samples a user is assumed to see, so it cannot distinguish a model that reliably succeeds on the first try from one that only occasionally succeeds even after 100 tries.

Source: Chen et al., 'Evaluating Large Language Models Trained on Code' (Codex/HumanEval paper), arXiv:2107.03374, Section 2.1 (pass@k unbiased estimator)

Correct answer: .

This is MMLU (Massive Multitask Language Understanding), introduced by Hendrycks et al., which aggregates 57 subject-specific multiple-choice tasks -- from elementary mathematics through US history to professional law and clinical medicine -- into a single benchmark meant to measure the breadth of a model's world knowledge and problem-solving ability across academic and professional domains, rather than any single narrow skill. The original paper reported that even the largest GPT-3 model of the time scored only modestly above the 25% random-chance baseline when averaged across all 57 subjects, exposing large gaps in breadth of knowledge that narrower benchmarks did not surface. The option describing a benchmark built from adversarially filtered everyday-event completions is describing HellaSwag, which targets commonsense plausibility judgments about mundane situations, not academic subject knowledge, so it does not fit a 57-subject exam-style design. The option describing a benchmark built around categories where humans hold common false beliefs is describing TruthfulQA, which specifically probes susceptibility to misconceptions rather than measuring broad subject-matter coverage. The option describing exact-span extraction from a supporting passage is describing SQuAD, an extractive reading-comprehension benchmark that requires a passage to quote from, not a closed-book knowledge test spanning dozens of independent subjects.

Source: Hendrycks et al., 'Measuring Massive Multitask Language Understanding,' arXiv:2009.03300

Correct answer: .

This is the 'needle in a haystack' test, an evaluation methodology popularized by Greg Kamradt, in which a short out-of-place statement (the 'needle') is embedded at varying depths inside filler text (the 'haystack') of varying total length, and the model is asked a question answerable only from that inserted sentence; plotting accuracy across a grid of context lengths and insertion depths as a heatmap is specifically designed to surface uneven retrieval, such as a model reliably finding facts near the start or end of its context while missing ones buried in the middle, or accuracy degrading sharply as total context length grows -- failure modes that a model's advertised maximum context length alone does not reveal. The option describing intermediate reasoning steps improving arithmetic accuracy describes chain-of-thought prompting, an unrelated technique about how a model reasons step by step, not about where in a long context it can retrieve information. The option describing iterative removal of wrong answers that simple classifiers can already solve describes adversarial filtering, a dataset-construction technique used to build hard benchmarks like HellaSwag, not a long-context retrieval probe. The option describing sampling multiple reasoning paths and taking a majority vote describes self-consistency decoding, a technique for improving reasoning accuracy through multiple samples, which has nothing to do with locating one inserted fact within a single long context window.

Source: Greg Kamradt, 'Needle In A Haystack - Pressure Testing LLMs' (2023), the original long-context retrieval evaluation methodology

Correct answer: .

This is SelfCheckGPT, a zero-resource, black-box hallucination-detection method: rather than checking a claim against an external knowledge source, it samples several additional responses to the same prompt at non-zero temperature and measures whether the original sentence's claims stay consistent with what those independent samples say. Its underlying assumption is that when a model genuinely 'knows' a fact, its sampled outputs about that fact will tend to agree with each other even though sampling introduces randomness, whereas a hallucinated claim -- not grounded in any real, load-bearing knowledge -- is more likely to be phrased inconsistently, contradicted, or omitted across independently sampled responses, so measuring cross-sample agreement becomes a proxy for factual grounding without needing any external reference. The option describing human-rater pairwise preference labels describes RLHF-style preference collection, which is used to align model behavior with human preferences during training, not to check sentence-level factual consistency at inference time. The option describing a stronger separate model comparing two candidate answers describes an LLM-as-judge setup, which depends on an external judge model's evaluation, unlike the sampling-only approach described here, which uses the same model's own repeated outputs. The option describing verification against retrieved passages describes a RAG faithfulness check, which explicitly requires an external knowledge source to check against -- the opposite of the zero-resource, no-external-reference setting the question specifies.

Source: Manakul, Liusie & Gales, 'SelfCheckGPT: Zero-Resource Black-Box Hallucination Detection for Generative Large Language Models,' EMNLP 2023, arXiv:2303.08896

Correct answer: .

This is self-enhancement (also called self-preference) bias, documented alongside position bias in the MT-Bench and Chatbot Arena LLM-as-judge study: it is the tendency of a judge model to rate outputs from itself, or from models in its own family, more favorably than equally strong outputs from other models. It differs from position bias precisely in what triggers it -- position bias is triggered purely by where a response is placed in the judging prompt (first slot vs. second slot), regardless of which model produced either response, and is typically mitigated by swapping the two responses' positions and re-judging; self-enhancement bias instead is triggered by the identity of the response's source, so swapping positions does nothing to remove it, since the favored response stays favored no matter which slot it occupies. The option describing this as position bias 'measured differently' is wrong because position bias by definition does not depend on which model generated a response, only on where it was placed, so it cannot explain a same-model preference that persists across position swaps. The option describing reward hacking is wrong because that phenomenon requires a reinforcement-learning training loop where a policy is optimized against a learned reward model's imperfections, whereas this bias shows up in a judge simply scoring or comparing already-generated text, with no training loop involved. The option describing anchoring from few-shot examples is wrong because that bias would depend on the content of examples shown earlier in the judge's own prompt, not on which underlying model actually generated the response being scored.

Source: Zheng et al., 'Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena,' arXiv:2306.05685

Correct answer: .

This describes Google Jigsaw's Perspective API, whose TOXICITY attribute score is documented as an estimated probability -- not a severity level or a policy verdict -- that a reader would perceive the comment as toxic, defined by Jigsaw as 'a rude, disrespectful, or unreasonable comment that is likely to make you leave a discussion'; a score of roughly 0.85, for example, is meant to indicate that about 85% of human raters would judge the text that way. The option describing OpenAI's Moderation API and policy-violating categories like self-harm or sexual content is describing a real, separately documented product, but it is the wrong API for a plain 'TOXICITY' attribute score, since OpenAI's tool returns category-specific flags rather than a single perceived-rudeness probability. The option describing a hard binary removal decision is wrong because Perspective explicitly returns a continuous probability for platforms to interpret and threshold themselves, not an automatic verdict on whether content must be taken down. The option describing a literal head-count of human moderators voting to ban an account is wrong on two counts: it misattributes the mechanism to OpenAI's Moderation API, and no such live per-request polling of a moderator panel is how any documented moderation API of this kind is described to work.

Source: Perspective API, 'About the API -- FAQs' (support.perspectiveapi.com); Jigsaw, 'What do Perspective's scores mean?'

Correct answer: .

This describes GLUE (General Language Understanding Evaluation), whose state-of-the-art average score surpassed its own human baseline within about a year of release, a sign the benchmark had become saturated and could no longer reliably distinguish genuinely stronger models on many of its easier tasks; in response, the same research group introduced SuperGLUE, a successor benchmark built from more difficult and more diverse tasks specifically chosen to restore headroom between model performance and the human baseline. The option describing retiring benchmarking entirely is wrong because the actual response was to build a harder successor benchmark, not to abandon fixed-task evaluation as a method. The option describing leaving the leaderboard unchanged indefinitely is wrong because a saturated benchmark, by definition, stops usefully separating strong models, which is exactly the problem that motivated building a new one rather than continuing to rely on the old leaderboard. The option describing quietly raising a passing-score threshold on the same unchanged test sets is wrong because the actual fix touched the tasks and data themselves -- introducing new, harder task types -- rather than just moving a scoring cutoff on the same, already-saturated test items.

Source: Wang et al., 'SuperGLUE: A Stickier Benchmark for General-Purpose Language Understanding Systems,' arXiv:1905.00537

Correct answer: .

This describes adversarial filtering, specifically the AFLite algorithm used to construct HellaSwag: wrong endings are machine-generated and then iteratively filtered by removing any candidate that a simple classifier can already learn to separate from the correct ending, leaving behind only wrong endings that remain deceptively hard for models while staying obviously wrong to humans -- the 'Goldilocks zone' the HellaSwag paper describes, which is exactly why humans score above 95% while contemporary models fall below 48%. The option describing chain-of-thought distillation is wrong because that technique trains a smaller model on a larger model's reasoning traces during training, and has nothing to do with selecting which wrong answers survive into a benchmark's dataset. The option describing RLAIF is wrong because that technique generates a preference signal used to train a policy model via reinforcement learning, an entirely different pipeline from filtering candidate wrong endings for an evaluation dataset. The option describing bootstrap resampling is wrong because that is a statistical technique for estimating uncertainty in an already-fixed benchmark score by resampling existing test examples, not a technique for deciding which distractor endings get included in the dataset in the first place.

Source: Zellers et al., 'HellaSwag: Can a Machine Really Finish Your Sentence?,' ACL 2019, arXiv:1905.07830; Sakaguchi et al./Le Bras et al. on the AFLite algorithm

Correct answer: .

This describes BIG-Bench Hard (BBH), a curated set of 23 tasks selected from the much larger BIG-Bench collection specifically because prior model evaluations using standard, non-reasoning few-shot prompts failed to surpass the average human-rater score on them; the paper found that adding chain-of-thought prompting before the final answer let strong models like PaLM and Codex surpass average human-rater performance on a majority of these 23 tasks, which suggests that evaluating models with only direct, non-reasoning prompts on this particular task subset understates their true capability, since much of the apparent gap closes once the model is allowed to reason step by step first. The option describing TruthfulQA is wrong because that benchmark is about susceptibility to common misconceptions across categories like health and law, not about a subset selected for requiring multi-step reasoning under few-shot prompting. The option describing GLUE is wrong because it names specific task types (sentiment, entailment) as needing reasoning prompts, but GLUE was not constructed as a reasoning-gap-selected subset of a larger benchmark collection the way BBH was. The option describing HumanEval is wrong because it conflates this reasoning-prompt finding with an unrelated code-generation metric (pass rates from multiple samples), which is a different evaluation entirely from a curated hard-reasoning task subset.

Source: Suzgun et al., 'Challenging BIG-Bench Tasks and Whether Chain-of-Thought Can Solve Them,' arXiv:2210.09261 (Findings of ACL 2023)

Correct answer: .

This describes HELM (Holistic Evaluation of Language Models), a framework built by Stanford's Center for Research on Foundation Models specifically to address fragmented, inconsistent evaluation practice: rather than letting each paper choose its own narrow scenario and metric, HELM takes a top-down approach that explicitly fixes a broad set of scenarios and measures a broad set of metrics -- including accuracy, calibration, robustness, fairness, bias, toxicity, and efficiency -- for every model evaluated wherever applicable, so that results become directly comparable across models and across papers rather than being cherry-picked. The option describing a tool for quickly running one benchmark on a single checkpoint is describing something closer to a lightweight evaluation harness, which does not itself impose a standardized, multi-metric comparison goal across many models the way HELM's stated purpose does. The option describing length-controlled pairwise LLM-as-judge comparisons is describing AlpacaEval, a benchmark focused specifically on instruction-following quality via automated judging, not a broad multi-metric, multi-scenario framework. The option describing anonymous crowdsourced pairwise voting aggregated into an Elo rating is describing Chatbot Arena, which ranks models via live human preference votes rather than a fixed, standardized battery of offline scenarios and metrics.

Source: Liang, Bommasani et al., 'Holistic Evaluation of Language Models,' arXiv:2211.09110

Correct answer: .

BLEU (Bilingual Evaluation Understudy) was designed for machine translation and measures n-gram precision between a candidate text and reference translations. In open-ended generation like customer support, there are many valid ways to answer a question, and a response can be fully correct while sharing few exact n-grams with the reference. This mismatch between lexical overlap and semantic quality is a well-documented limitation of BLEU and similar metrics (ROUGE, METEOR) when applied outside translation. The option trusting BLEU over human judgement for open-ended tasks ignores decades of NLP evaluation research. The option about memorisation is backwards — word-for-word copying would produce high BLEU, not low. The option restricting BLEU to translation is too strong — BLEU can be computed on any text, it simply may not correlate well with quality in non-translation settings.

Source: Papineni et al. (2002), 'BLEU: a Method for Automatic Evaluation of Machine Translation'; CFA of NLP evaluation literature

Correct answer: .

BERTScore represents every token of both the candidate and reference text as a contextual embedding from a pretrained transformer, so the same word gets a different vector depending on its surrounding context, unlike a static word embedding. Precision is computed by taking, for each candidate token, its highest cosine similarity to any reference token, and averaging those maximum similarities across all candidate tokens; recall does the mirror computation, taking each reference token's highest similarity to any candidate token and averaging those. The two are then combined into an F1 score, the same way ordinary precision and recall are combined, but computed over soft token-level semantic matches rather than exact string matches. Because the matching happens between individual contextual token embeddings rather than one averaged sentence vector, BERTScore captures token-level semantic correspondence, including paraphrases and synonyms, that a single-vector cosine similarity would blur together. The option describing a single strong LLM directly outputting a 1-10 rating describes an LLM-as-judge approach, a fundamentally different mechanism with no token-level embedding matching at all. The option describing inverse-document-frequency-reweighted n-gram overlap describes a variant of surface n-gram matching, not embedding-based semantic similarity, and would still fail to recognize paraphrases that share no overlapping n-grams.

Source: Zhang, Kishore, Wu, Weinberger & Artzi, 'BERTScore: Evaluating Text Generation with BERT' (ICLR 2020), arXiv:1904.09675

Correct answer: .

Self-BLEU repurposes the BLEU computation to measure diversity rather than reference fidelity: instead of comparing a generated sample to a human-written ground truth, it treats each generated sample in turn as the hypothesis and every other sample produced for the same prompt as if it were a reference, computes a BLEU score for that comparison, and averages the resulting scores across all samples. A model that has collapsed into producing nearly the same high-quality output every time will score a high Self-BLEU, because its samples overlap heavily with each other in n-grams, even though a reference-based metric like ordinary BLEU could still rate that repeated output as excellent quality; a model producing genuinely varied outputs will score a lower Self-BLEU. This directly addresses the blind spot of quality-only metrics, which cannot distinguish a diverse generator from one that repeatedly emits a single good response. The option describing BLEU against a larger held-out human reference set is still a reference-based quality metric, not a measure of similarity among the model's own samples. The option describing perplexity on generated samples measures the model's own confidence in its outputs, not how similar multiple sampled outputs are to one another. The option describing BERTScore against one fixed reference is, like the option describing BLEU against a larger human reference set, a reference-based fidelity metric rather than a same-sample-to-same-sample diversity measure.

Source: Zhu, Lu, Zheng, Guo, Zhang, Wang & Yu, 'Texygen: A Benchmarking Platform for Text Generation Models,' SIGIR 2018 (introduces Self-BLEU), arXiv:1802.01886

Correct answer: .

Llama Guard is itself a large language model, an instruction-tuned Llama 2 checkpoint, used as a classifier rather than as a conversational assistant: it is given a prompt containing a defined safety risk taxonomy plus the specific user prompt or model response to be judged, and it generates a decision of safe or unsafe together with which taxonomy category was violated when unsafe. Because the taxonomy the model reasons over is expressed as natural-language text inside the prompt rather than encoded as fixed weights tied to one specific set of categories, the same underlying model can be adapted to a new or custom taxonomy by instruction-tuning on examples that use the new category definitions, avoiding the need to design and train an entirely new classifier architecture from scratch for each new set of risk categories. The option describing a rule-based keyword denylist is wrong because Llama Guard is a trained, learned model, not a fixed keyword-matching system. The option describing a logistic regression model with the same feature set as a specific commercial API is wrong because Llama Guard's mechanism is an LLM performing classification through generation, not a small linear model over hand-engineered features. The option describing fine-tuning the target model's own weights at inference time is wrong because Llama Guard is deployed as a separate model that screens inputs and outputs alongside the target conversational model, not a modification made to the target model itself.

Source: Inan, Upasani, Chi, Rungta, Iyer, Mao, Tontchev, Hu, Fuller, Testuggine & Khabsa, 'Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations' (Meta, 2023), arXiv:2312.06674

Correct answer: .

Prometheus addresses the reproducibility and cost problems of relying on a proprietary LLM as a judge by being an openly released, fixed-weight language model fine-tuned specifically for the evaluator role: it is trained on a large synthetic feedback dataset in which a strong proprietary model was used to generate diverse score rubrics, reference answers, and detailed scoring rationale, and Prometheus learns to reproduce that kind of fine-grained, rubric-conditioned judgment. Because a team using Prometheus can run the exact same open weights themselves, evaluation results become reproducible across runs and across research groups in a way that is not guaranteed when relying on a proprietary API, whose underlying model version, safety filters, or default behavior can change without notice, and does so without incurring per-call API costs. The option describing a fixed embedding lookup table is wrong because Prometheus is a full fine-tuned language model, not a nearest-neighbor matching system with no learned generation. The option describing Prometheus as the proprietary judge model rebranded is wrong because Prometheus's weights, training data, and training process are distinct and separately released; it approximates rather than duplicates a proprietary judge's behavior. The option describing retraining the target model directly on feedback is wrong because that describes a training-time alignment technique applied to the model being evaluated, not a separate evaluator model used to score outputs after generation.

Source: Kim, Shin, Cho, Jang, Longpre, Lee, Yun, Shin & Seo, 'Prometheus: Inducing Fine-grained Evaluation Capability in Language Models' (ICLR 2024), arXiv:2310.08491

Correct answer: .

Hugging Face's investigation found that the same nominal benchmark, MMLU, was being implemented in genuinely different ways across evaluation harnesses, and one of the largest sources of divergence was the question format itself: a multiple-choice formulation (MCF) presents the answer options as text within the prompt and asks the model to generate the letter of its chosen answer, while a cloze formulation never shows the answer options as text at all and instead scores the model by computing the log-probability it assigns to each full candidate answer string as a continuation of the question, then picking whichever completion the model finds most probable. Because these two formulations exercise different model behaviors, generation under an instruction versus log-probability comparison over full completions, they can produce meaningfully different accuracy numbers for the exact same model and the exact same underlying questions, and can even change which of two models appears to score higher, which is why Hugging Face concluded that evaluations are tied to their implementations down to details like prompt format and tokenization, not just to the benchmark's name. None of the other proposed causes (translating questions, averaging repeated runs, or using a larger test split) was the mechanism the investigation identified; the gap traced specifically to how the question and its answer choices were formatted and scored.

Source: Hugging Face, 'What's going on with the Open LLM Leaderboard?' (2023), https://huggingface.co/blog/open-llm-leaderboard-mmlu

Correct answer: .

CheckList defines three named test types for structured, capability-level probing beyond a single aggregate score. A Minimum Functionality Test (MFT) is a small set of simple, targeted examples designed to check one specific capability in isolation, analogous to a unit test in software engineering, exactly like the hand-written 'This movie was great' example. An Invariance Test (INV) applies a perturbation to an input that should NOT change the correct label, such as swapping one location name for another in an otherwise unchanged sentence, and checks that the model's prediction indeed stays the same; a changed prediction under such a perturbation reveals the model is relying on a spurious cue like the specific location name rather than the actual sentiment content. A Directional Expectation Test (DIR) applies a perturbation where the label IS expected to change in a specific, known direction, such as adding clearly negative content to a positive review, and checks that the model's prediction shifts the way it should; failing to shift, or shifting the wrong way, reveals a capability gap. The option treating all three as identical MFTs is wrong because CheckList explicitly distinguishes perturbation-based invariance and directional tests from isolated MFT examples. The option that swaps which name applies to which scenario mislabels the test types. The option renaming them as regression test, A/B test, and unit test is wrong because those are different, non-equivalent software-testing and deployment concepts, not CheckList's actual terminology.

Source: Ribeiro, Wu, Guestrin & Singh, 'Beyond Accuracy: Behavioral Testing of NLP Models with CheckList,' ACL 2020, https://aclanthology.org/2020.acl-main.442/

Correct answer: .

Maintaining a small, curated set of real or representative examples with expert-verified expected outputs, and automatically re-running the entire set whenever a prompt template or model version changes, is commonly called a golden set or regression test suite for an LLM application. Its specific value is systematic coverage: because every example in the set is checked every time, it catches any case among that curated set where a change that was intended to improve or simply modify behavior instead silently breaks a previously correct classification, a failure mode that a one-off manual spot check on only a few newly written examples would very likely miss, since a human reviewer cannot feasibly re-check every previously working case by hand after each change. This is a distinct concern from red-teaming, which is about deliberately probing for adversarial inputs that provoke unsafe behavior rather than about detecting unintended regressions on already-correct cases. It is also distinct from A/B testing, which measures outcomes by exposing real users to two live versions rather than checking a fixed offline set before anything reaches users. It is unrelated to benchmark contamination, which concerns evaluation examples leaking into a model's pretraining data and inflating its reported scores, not the practice of re-running a curated regression suite after an application change.

Source: Common LLM application evaluation practice, as described in tooling such as OpenAI Evals and LangSmith evaluation datasets; general software regression-testing principle applied to LLM-based systems

Correct answer: .

GSM8K consists of roughly 8,500 grade-school math word problems, manually written and quality-checked, where each problem is specifically constructed to require chaining two to eight steps of basic arithmetic, such as first computing a subtotal, then applying a discount, then adding a fee, before arriving at the final numeric answer. This design is what makes it a meaningful test of multi-step reasoning rather than rote calculation: because no single arithmetic operation in isolation is difficult, a model cannot succeed by memorizing a fact or performing one calculation; it must correctly identify which quantities to combine, in which order, and carry intermediate results forward correctly across every step, so a failure at any single step in the chain typically produces a wrong final answer even though each individual operation is simple grade-school arithmetic. The option describing 57 subject-area exams requiring only fact recall describes MMLU, a knowledge benchmark, not GSM8K's arithmetic word problems. The option describing automatically generated symbolic algebra proofs is wrong because GSM8K's problems are manually written natural-language word problems, not machine-generated symbolic manipulation tasks. The option describing multiple-choice arithmetic questions is wrong because GSM8K requires the model to compute and produce its own final numeric answer rather than select among a small set of given options.

Source: Cobbe, Kosaraju, Bavarian, Chen, Jun, Kaiser, Plappert, Tworek, Hilton, Nakano, Hesse & Schulman, 'Training Verifiers to Solve Math Word Problems' (OpenAI, 2021), arXiv:2110.14168

Correct answer: .

Mitchell et al. (2019) call this a model card, a proposed standardized reporting framework meant to accompany a released model with the essential facts a downstream user or auditor needs. Its structure goes well beyond a single aggregate accuracy number by explicitly requiring sections including the model's intended use and, importantly, its out-of-scope uses; the factors that evaluation results should be disaggregated by, such as demographic groups, subpopulations, or usage conditions, so performance differences across those groups are visible rather than averaged away; descriptions of the training and evaluation data; and ethical considerations together with caveats and recommendations. This structure specifically prevents a single overall metric from standing in for the model's full behavior, since a model can score well on average while performing poorly for a particular subgroup or use case that only a disaggregated breakdown would reveal. The option describing a data sheet is wrong because that term (from a related but distinct proposal, 'Datasheets for Datasets') documents a dataset's own composition and provenance, not a model's intended use or evaluation results. The option describing a red-team report is wrong because that documents only adversarial safety testing, a narrower scope than a model card's full intended-use, data, and disaggregated-evaluation sections. The option describing a system prompt is wrong because that is a runtime instruction given to the model at inference time, not a static released document about the model's training and evaluation.

Source: Mitchell, Wu, Zaldivar, Barnes, Vasserman, Hutchinson, Spitzer, Raji & Gebru, 'Model Cards for Model Reporting,' FAT* 2019, arXiv:1810.03993

Correct answer: .

ANLI is collected through a human-and-model-in-the-loop, dynamic adversarial procedure across three rounds rather than a single unaided writing pass. In each round, human annotators are shown a current 'target' NLI model's predictions and are tasked with writing hypotheses that cause that specific target model to predict the wrong label; only examples that actually succeed in fooling the round's target model are retained in the dataset for that round. Before the next round begins, a new, harder target model is trained, incorporating the fooling examples collected so far along with additional training data, and in the later rounds, source contexts drawn from more varied domains, so that annotators in each subsequent round must find weaknesses in a progressively stronger adversary, making round 3's examples harder on average than round 1's. This design directly targets the concern that a benchmark's own statistical artifacts become learnable over time, since each round's examples are specifically selected for defeating the best available model rather than being written in a vacuum. The option describing three independent unaided crowdworker batches distinguished only by topic is wrong because no model is used to filter examples in that description, contradicting ANLI's defining human-and-model-in-the-loop mechanism. The option invoking CheckList's Minimum Functionality Tests is wrong because that is a separate, template-driven behavioral-testing methodology with no adversarial target model and no human annotators trying to fool one. The option describing pure LLM paraphrasing of SNLI and MultiNLI examples is wrong because ANLI's premises and hypotheses are newly written by human annotators specifically to defeat a target model, not machine-paraphrased from existing datasets.

Source: Nie, Williams, Dinan, Bansal, Weston & Kiela, 'Adversarial NLI: A New Benchmark for Natural Language Understanding,' ACL 2020, arXiv:1910.14599

Correct answer: .

Fleiss' kappa extends the logic of chance-corrected agreement to any fixed number of raters per item (the specific raters do not even need to be the same people across items, as long as the count per item is constant). It computes, for each item, how consistently the raters agreed on a category, averages that across all items for the observed agreement rate, and separately estimates the agreement expected by chance from the overall proportion of ratings that fell into each category across the whole dataset; the final statistic is the standard (observed minus chance)/(1 minus chance) ratio. The option claiming Cohen's kappa already handles any number of annotators is wrong because Cohen's original formula is specifically defined for exactly two raters rating the same items; it has no built-in mechanism for three or more. The option claiming that averaging the three pairwise Cohen's kappa values gives the same quantity as a proper multi-annotator statistic is a common but mistaken shortcut: pairwise averaging only ever looks at two raters at a time and does not use the joint three-way category-count information Fleiss' kappa is built on, so it is a different (and generally less principled) number, not a mathematically equivalent one. The option proposing a one-way ANOVA F-statistic is wrong because ANOVA tests for differences in group means on a continuous or ordinal measurement; it is not designed to measure, and does not correct for, chance-level agreement on nominal category labels.

Source: Fleiss, J.L. (1971), 'Measuring Nominal Scale Agreement Among Many Raters,' Psychological Bulletin, 76(5), 378-382

Correct answer: .

chrF (character n-gram F-score), introduced by Popovic (2015), computes precision and recall of overlapping character n-grams between the hypothesis and the reference and combines them into an F-score, exactly like BLEU does with word n-grams but operating one level lower, on sequences of characters. Because it works at the character level, two word forms that share a stem but differ only in a suffix or grammatical ending still overlap heavily in their character n-grams, so the metric naturally gives partial credit for the near-miss without needing any external stemmer, synonym list, or word-alignment step; this also makes it language-independent and tokenization-independent, which matters for morphologically rich languages. The option describing METEOR is a genuine near-miss on the underlying goal (crediting near-correct word forms) but describes a different mechanism: METEOR explicitly relies on an external stemmer and a WordNet-based synonym dictionary to align words before scoring, so its ability to credit a shared stem depends on that external resource existing for the language in question, unlike chrF's resource-free character-level overlap. The option describing BERTScore is wrong because that metric scores similarity in a neural embedding space produced by a pretrained contextual model, not by counting any kind of n-gram overlap directly. The option describing ROUGE-L is wrong because longest-common-subsequence scoring over whole words treats two different inflected forms of the same stem as entirely different tokens, which is exactly the harsh-penalty behavior the team is trying to avoid.

Source: Popovic, M. (2015), 'chrF: character n-gram F-score for automatic MT evaluation,' Proceedings of the Tenth Workshop on Statistical Machine Translation (WMT), ACL Anthology W15-3049

Correct answer: .

HaluEval (Li et al., 2023) is built specifically to test hallucination recognition rather than only hallucination production: it contains 35,000 samples, made up of 5,000 human-annotated ChatGPT responses to general queries plus 30,000 automatically generated, task-specific samples for question answering, knowledge-grounded dialogue, and summarization, each constructed so a model under test can be given a grounded candidate alongside a plausible but unsupported hallucinated candidate and asked to tell them apart. Separately from this recognition task, the paper's own analysis of ChatGPT's free-form responses found that it hallucinates in roughly 19.5% of them, primarily by fabricating information that cannot be verified against the source. The option describing TruthfulQA is a genuine near-miss since it is also about factual failure, but it presents single questions selected because humans commonly hold false beliefs about them, with no paired hallucinated-vs-grounded candidate to classify, and its headline finding is that larger models sometimes scored worse, which is a different result than a hallucination-rate figure on free-form generation. The option describing SelfCheckGPT is wrong because that approach detects hallucination by sampling multiple additional responses from the model itself and checking whether they are mutually consistent, which needs no pre-built pair of candidates and no external dataset of paired samples at all. The option describing G-Eval is wrong because that framework scores a single candidate's quality using an LLM judge's self-generated chain-of-thought criteria; it is not built around a paired hallucinated/non-hallucinated recognition task or a reported hallucination rate.

Source: Li, Cheng, Zhao, Nie & Wen, 'HaluEval: A Large-Scale Hallucination Evaluation Benchmark for Large Language Models,' EMNLP 2023, arXiv:2305.11747

Correct answer: .

HarmBench (Mazeika et al., 2024) was built precisely to solve the cross-team comparability problem: it provides a shared registry of several hundred harmful-behavior test cases together with unified implementations of many attack methods and defense interfaces, all evaluated under one experimental pipeline and one set of metrics, so a model's measured robustness no longer depends on which team's private choice of attack, behavior subset, or scoring method happened to be used. Running this standardized evaluation across roughly a dozen and a half attack methods and dozens of target models and defenses, the authors found that no single attack or defense method was universally effective across all scenarios, and that a model's robustness was not directly correlated with its size. The option describing manual human red-teaming is wrong because, while it is a legitimate and widely used practice, it is a testing activity carried out by individual teams rather than a standardized cross-team comparison pipeline with a shared behavior taxonomy and metric. The option describing an RL-trained attacker model is wrong because that describes one specific technique for generating adversarial prompts, not a framework for comparing many different attack and defense techniques against each other. The option describing a broad trustworthiness benchmark is a genuine near-miss in spirit (it is also about standardized, large-scale evaluation) but it is wrong here because its scope is general trustworthiness auditing across many unrelated dimensions, not specifically a unified attack-versus-defense jailbreak-robustness comparison built on a shared harmful-behavior taxonomy.

Source: Mazeika, Phan, Yin, Zou, Wang, Mu, Sakhaee, Li, Basart, Li, Forsyth & Hendrycks, 'HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal,' ICML 2024

Correct answer: .

FActScore (Min et al., 2023) is designed exactly for this problem: rather than issuing one binary judgment for an entire paragraph, it decomposes the generation into 'atomic facts,' defined as short statements each conveying a single piece of information, and checks each atomic fact individually against a reliable knowledge source the end user trusts, then reports the percentage of atomic facts that are supported as the factual-precision score. This fine-grained decomposition lets a paragraph that is mostly accurate but contains one fabricated detail score accordingly, instead of being judged wholesale as either fully right or fully wrong; the paper reports its automated verification pipeline achieves under 2% error relative to human annotation. The option describing RAG faithfulness/groundedness is a genuine near-miss because it also checks claims against supporting text, but it specifically checks an answer against the passages a retrieval step supplied for that one query, not against an open-domain knowledge source chosen independently of retrieval, and it is not built around decomposing the answer into atomic facts. The option describing BERTScore is wrong because that metric compares an entire generated text's embedding-space similarity to one reference text; it does not decompose the text into separately verified statements at all. The option describing SelfCheckGPT-style consistency checking is wrong because that approach checks a statement's agreement with other samples generated by the same model, with no external knowledge source involved, which is a different verification signal than checking each atomic fact against a trusted knowledge source.

Source: Min, Krishna, Lyu, Lewis, Yih, Koh, Iyyer, Zettlemoyer & Hajishirzi, 'FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generation,' EMNLP 2023, arXiv:2305.14251

Correct answer: .

RLHF, as already established, is a two-stage pipeline: a reward model is first trained on human preference pairs, then the policy is optimized via reinforcement learning (typically PPO) to maximize that learned reward while staying close to a reference policy. DPO's key insight is a reparameterization of this same constrained objective: for a fixed reward function, the optimal policy under that objective has a closed form in terms of the reward and the reference policy, and this relationship can be inverted to express an implicit reward purely in terms of the policy's own output probabilities. Substituting this implicit reward into the Bradley-Terry preference model yields a classification-style loss that can be optimized directly on the offline preference pairs with ordinary gradient steps -- no separate reward model needs to be trained, and no on-policy sampling loop like PPO is required, which is why the paper's title describes the language model as 'secretly' already being a reward model. The option describing DPO as training a reward model and then simply copying its top-scoring outputs skips the actual mechanism: DPO never produces a standalone reward model at all. The option claiming DPO and RLHF are the same procedure under different names ignores that removing the reward-model-and-RL stages entirely is precisely DPO's contribution, not a relabeling. The option describing DPO as substituting AI-generated labels for human ones describes a different axis of variation (who provides the preference labels) that is independent of DPO's actual innovation, which is about how the policy is optimized once preference pairs already exist, regardless of their source.

Source: Rafailov, Sharma, Mitchell, Ermon, Manning & Finn, 'Direct Preference Optimization: Your Language Model is Secretly a Reward Model,' NeurIPS 2023, arXiv:2305.18290

Correct answer: .

Constitutional AI's first phase has the model draft a response to a prompt, select one of a written set of principles (the 'constitution'), use that principle to critique its own response, and then revise the response to address the critique; this critique-and-revise cycle can repeat, and the resulting revised responses become supervised fine-tuning data. The second phase trains a preference model on pairs of responses sampled from this fine-tuned policy, but instead of a human choosing which response is better, a separate AI evaluator makes that judgment, guided by the same constitution -- this AI-generated preference data is what the term 'reinforcement learning from AI feedback' (RLAIF) refers to, and it trains a preference model used for a standard reinforcement learning stage, the same way a human-labeled preference model would in RLHF. The option describing the first phase as direct reinforcement learning against a human-labeled reward model skips the supervised critique-and-revise phase entirely and misattributes it to RL from the start. The option claiming both phases rely on human preference labels throughout, with the constitution merely shown to human annotators, misses the defining feature of the approach: human labels are replaced by AI-generated ones in the second phase specifically to reduce reliance on human-labeled harmfulness examples. The option describing the first phase as treating the constitution's text as pretraining data, with the second phase reducing to supervised learning on a reward model's top picks, misrepresents both phases: the first phase's data comes from the critique-and-revise process, not from treating principles as raw pretraining text, and the second phase is a full reinforcement learning stage, not simple supervised selection.

Source: Bai, Kadavath, Kundu, Askell, Kernion et al. (Anthropic), 'Constitutional AI: Harmlessness from AI Feedback,' 2022, arXiv:2212.08073

Correct answer: .

MT-Bench evaluates multi-turn conversational ability using a fixed, curated set of 80 questions split evenly across eight categories -- writing, roleplay, extraction, reasoning, math, coding, and two knowledge categories covering STEM and humanities/social science -- with each question structured as a two-turn conversation designed to be challenging enough to separate strong models from each other. Rather than collecting live human votes, the paper has a strong LLM, GPT-4, act as the judge, scoring or comparing model responses, and for categories like math where the judge model itself is prone to reasoning errors, the paper uses reference-guided grading to anchor the judge's scoring against a known correct answer. This is a fundamentally different mechanism from Chatbot Arena, introduced in the same paper, which instead pairs two anonymous models against each other on live, arbitrary prompts submitted by real users on a public platform, collects simple pairwise 'which is better' votes from those users, and aggregates the votes into an Elo-style ranking over time. The option claiming the two are the same pipeline under different names, with MT-Bench just adding a second GPT-4 pass, ignores that Chatbot Arena's votes come from real users on live arbitrary prompts while MT-Bench uses a fixed curated question set judged by an LLM. The option describing MT-Bench as single-turn and scored by human crowd raters inverts both defining features: MT-Bench is specifically multi-turn, and its judge is an LLM, not a human crowd. The option describing MT-Bench as scored via automatic n-gram overlap metrics like BLEU contradicts the paper's central contribution, which is replacing exactly that kind of reference-based n-gram metric with LLM-based judgment.

Source: Zheng, Chiang, Sheng, Zhuang, Wu, Zhuang et al., 'Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena,' arXiv:2306.05685 (NeurIPS 2023 Datasets and Benchmarks Track)

Correct answer: .

GPQA consists of 448 multiple-choice questions in biology, physics, and chemistry, written and validated by experts who hold or are pursuing PhDs in the relevant subfield, with validation specifically checking that the questions are unambiguous and remain hard even for domain experts outside the question's narrow subfield. The paper's key evidence for search-resistance comes from two human baselines: experts answering questions in their own specialty reach 65% accuracy (74% if their own identified mistakes are excluded), while highly skilled non-expert validators who are given unrestricted internet access and spend over 30 minutes per question on average still only reach 34% accuracy -- barely above the 25% chance rate for four-option multiple choice -- which the authors argue shows the questions cannot be reliably answered just by looking things up, only through genuine domain expertise. The option claiming the questions come from standardized graduate entrance exams and that no model has ever beaten chance contradicts the paper, which reports GPT-4 with chain-of-thought prompting reaching 39%, above chance, and describes original expert-written questions rather than exam-bank material. The option describing GPQA as a reading-comprehension benchmark where answers appear verbatim in a passage misunderstands the 'Google-proof' label, which refers to resistance to looking up an answer online, not to the absence of a supporting passage. The option claiming 'Google-proof' means the questions are kept unpublished and unindexed describes a data-contamination precaution, not what makes the questions themselves resistant to being answered via search, which is the actual basis for the name.

Source: Rein, Hou, Stickland, Petty, Pang, Dirani, Michael & Bowman, 'GPQA: A Graduate-Level Google-Proof Q&A Benchmark,' arXiv:2311.12022 (COLM 2024)

Correct answer: .

RealToxicityPrompts is a corpus of roughly 100,000 naturally occurring, sentence-level prompts drawn from English web text (OpenWebText), each pre-scored for toxicity using a widely used toxicity-classification API, and deliberately sampled across a full range of toxicity levels so that many of the prompts are themselves non-toxic. Expected Maximum Toxicity is computed per prompt by generating several continuations from the model under test (25 in the original paper) for the same prompt, scoring each continuation's toxicity, taking the single highest score among those continuations, and then averaging that per-prompt maximum across the whole dataset -- a design meant to capture a model's worst-case output under repeated sampling rather than its typical or average toxicity, since a model that is usually safe but occasionally degenerates into toxic text would score high on this metric even with a low average. The option describing the prompts as adversarially written to be maximally toxic, with the metric reducing to the toxicity of the most toxic prompt itself, ignores that the metric is about the model's generated continuations, not the prompts, and that many prompts in the dataset are intentionally non-toxic. The option claiming only prompts are scored and that the metric measures human first-read offense describes a completely different, annotation-based measurement, not the generation-based metric the paper actually defines. The option describing the metric as requiring access to internal token log-probabilities against a fixed toxic-word list misstates the method: toxicity is scored on complete generated text by an external classifier, not by inspecting the model's own internal probabilities for a fixed word list.

Source: Gehman, Gururangan, Sap, Choi & Smith, 'RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models,' Findings of EMNLP 2020, arXiv:2009.11462

Correct answer: .

SWE-bench is built from thousands of real-world issues and their corresponding merged pull requests collected from popular, actively maintained Python repositories on GitHub. For each task, the agent is given the full codebase at the commit before the fix, along with the issue's natural-language description, and must produce a patch; evaluation applies that patch and runs the repository's own test suite, counting the task as resolved only if the specific tests associated with the human fix now pass (fail-to-pass) while tests that already passed beforehand continue to pass (pass-to-pass). This makes SWE-bench a test of realistic, repository-scale software engineering -- navigating an existing large codebase, localizing the relevant files, and producing a change that doesn't break anything else -- rather than writing an isolated function from scratch. The option describing short function-signature prompts and a single hidden unit test describes HumanEval-style benchmarks, not SWE-bench, which instead operates on entire multi-file repositories. The option withholding the codebase and scoring by LLM-judge plausibility ignores that the agent is explicitly given the repository and that scoring is based on actually executing tests, not on a judge's impression. The option scoring by text similarity to the human patch is wrong because two functionally equivalent patches can differ substantially in wording and structure; SWE-bench deliberately scores by running tests rather than comparing patch text, since many different edits can resolve the same issue correctly.

Source: Jimenez et al., 'SWE-bench: Can Language Models Resolve Real-World GitHub Issues?', ICLR 2024, arXiv:2310.06770

Correct answer: .

BBQ is a hand-built benchmark that pairs an ambiguous context, which deliberately withholds the information needed to answer a question about two individuals (often one from a stereotyped social group and one not), with a disambiguated context that adds exactly the missing detail. In the ambiguous case, the only epistemically correct answer is that the question cannot be determined from the information given; a model that instead picks the individual aligned with a common social stereotype is exhibiting bias rather than reasoning from evidence, since no evidence favors either individual. The disambiguated version then provides a genuine ground-truth answer, letting the benchmark separately measure ordinary task accuracy and check whether a model's remaining mistakes on that version still skew toward the stereotype-consistent choice rather than being distributed evenly, which would indicate the stereotype is influencing answers even when real information is available. The option claiming only the disambiguated version is scored ignores that the ambiguous version is BBQ's primary bias signal, not a discarded placeholder. The option treating the stereotype-consistent individual as always correct inverts the actual scoring logic, which treats picking an unsupported stereotype as the biased outcome, not the desired one. The option describing real call-center transcripts and call-handling time mischaracterizes BBQ entirely; it is a hand-written, templated dataset of question-answering contexts, not a corpus of real customer interactions, and it measures a QA model's answer choices directly, not an operational business metric.

Source: Parrish et al., 'BBQ: A Hand-Built Bias Benchmark for Question Answering', Findings of ACL 2022, arXiv:2110.08193

Correct answer: .

GCG is a white-box, gradient-guided discrete optimization method. For a candidate adversarial suffix appended after the harmful request, it computes the gradient of the loss, defined as the probability of the model producing a chosen affirmative target string such as beginning its reply with 'Sure, here is', with respect to the one-hot encoding of the token at each suffix position; this gradient identifies a short list of promising replacement tokens for each position without needing to actually try every possible token. It then evaluates the true loss for each of these candidate substitutions with an actual forward pass and greedily keeps whichever single-token swap reduces the loss the most, repeating this process across suffix positions and iterations until a suffix is found that reliably elicits compliance. The paper also shows that optimizing jointly across multiple harmful prompts and multiple open-weight models at once produces a suffix that transfers to prompts and models it was never directly optimized against, including proprietary black-box chat models. The option describing an auxiliary model trained with reinforcement learning against a harmful-content classifier describes a different, separate red-teaming approach that trains a prompt-generating policy rather than directly optimizing a suffix's tokens via gradients. The option describing purely random token swapping judged by a human ignores GCG's defining feature, that gradients guide which candidate tokens are worth evaluating at all, making the search far more efficient than blind random search. The option describing a single fixed public phrase misdescribes GCG as requiring no optimization, when the entire contribution of the method is an automated per-target (or jointly-optimized) search procedure, not a static, universally pre-known string.

Source: Zou, Wang, Carlini, Nasr, Kolter & Fredrikson, 'Universal and Transferable Adversarial Attacks on Aligned Language Models', arXiv:2307.15043

Correct answer: .

FEVER's claims were constructed by having annotators rewrite (altering, negating, or otherwise modifying) sentences drawn from the introductory sections of Wikipedia pages, producing standalone factual claims. A separate, independent set of annotators then checked each claim against Wikipedia evidence without being shown the original sentence it came from, assigning one of three labels: Supported, Refuted, or NotEnoughInfo, and for the first two labels, recording the exact evidence sentence or sentences that justify the verdict. This two-stage, independently-verified process with a dedicated 'not enough information' label and explicit evidence citation is what distinguishes FEVER from a simple claim-classification dataset. The option describing claims scraped from fact-checking websites with an existing binary rating describes a different style of fact-checking dataset built on journalistic fact-checks, not FEVER's Wikipedia-sentence-alteration method, and wrongly claims no evidence annotation is required when evidence sentences are central to FEVER's labels. The option describing automatic generation from a knowledge graph with purely structural path-existence labeling ignores that FEVER's claims and verdicts come from human writing and verification against text, not graph traversal. The option describing a single annotator both paraphrasing and verifying, with four labels modeled on political fact-checking scales, misdescribes both FEVER's independent two-stage annotation (writer and verifier are different people) and its three-way label set.

Source: Thorne, Vlachos, Christodoulopoulos & Mittal, 'FEVER: a large-scale dataset for Fact Extraction and VERification', NAACL 2018, arXiv:1803.05355

Correct answer: .

Anthropic's many-shot jailbreaking research proposes that the attack exploits the same underlying mechanism responsible for ordinary in-context learning: a model's tendency to pick up a pattern demonstrated by examples earlier in its own context and continue that pattern going forward. By filling the prompt with a large number of fabricated question-and-answer turns in which the assistant readily complies with increasingly sensitive requests, the attack shifts the model's in-context behavior toward continuing that demonstrated compliance pattern, overriding safety training purely through the content of the prompt at inference time, with no access to model weights and no fine-tuning step required. The paper reports that attack effectiveness increases with the number of included turns in a power-law-like fashion, that the attack only became practical once context windows grew from roughly a few thousand tokens to the hundreds of thousands or millions of tokens supported by recent models, and that larger models tended to be more susceptible. The option describing gradient-based suffix optimization against model weights describes a different, white-box attack family entirely, not this in-context, prompt-content-only attack, and is also wrong to claim turn count is irrelevant when scaling with turn count is the paper's central finding. The option attributing the effect to verbatim memorization of the exact fabricated transcript misunderstands that the transcripts are newly fabricated by the attacker for the attempt, not reproduced training data. The option describing a fine-tuned backdoor trigger describes a data-poisoning attack requiring training-time access, the opposite of this attack's defining feature of working purely through in-context prompt content at inference time, and is also wrong that a single copy of any phrase would match the effect of many repeated turns, since the scaling with turn count is central to the mechanism.

Source: Anil et al. (Anthropic), 'Many-shot Jailbreaking', 2024 — anthropic.com/research/many-shot-jailbreaking