Anthropic Publishes Guidance for More Reliable AI Safety Evaluations

Anthropic published recommendations for more reliable AI safety evaluations on November 13, 2026, reporting aggregate harmless-response rates of 94% to 98% for every recent model on its single-turn API tests. Those saturated tests are useful mainly as regression checks on known failure modes; multi-turn evaluations offer more variation and can capture gradual changes across a conversation.

A safety evaluation measures a model’s propensity to cause or contribute to harm, whether its response makes harm more or less likely and how severe that harm could be, rather than a specific capability. A central concern is construct validity, or whether a test captures the concept it intends to measure. Refusal rate can be misleading for suicide and self-harm conversations because simply declining to engage may itself be a failure; the desired response offers support and directs the user toward human help. Anthropic’s multi-turn evaluations instead measure an appropriate-response rate across the entire conversation, using risk-specific rubrics in which one bad turn fails the whole exchange.

Multi-Turn Tests and Real-World Coverage

To construct these tests, a domain expert writes a specification for the simulated user’s objectives, tactics, persona, situation, tone and conversational style. The first user turn remains fixed, while a separate Claude model generates subsequent turns in response to the tested model. Each scenario runs repeatedly with different combinations of characteristics, and a grader model scores the complete transcript against the relevant risk rubric.

Varying dimensions independently helps identify what drives behavior; if every severe case also uses an urgent tone, the effects of severity and tone cannot be separated. Anthropic also recommends building from observed behavior, public data, red-teaming transcripts, incident reports or expert interviews rather than invented situations alone. Its single-turn suites cover 16 policy areas in seven languages across multiple product surfaces, and the evaluation environment is matched to the deployment being tested.

Running the tests also requires containment. For cyber evaluations, the guidance calls for sandboxes without internet access and real-time monitoring so a run can be stopped if a model’s actions could cause real-world harm.

Grader Validation and Statistical Limits

Automated graders create another measurement risk because broken systems can continue producing plausible scores. The recommended safeguards include atomic yes-or-no criteria, explicit treatment of disclaimers and borderline cases, loud failure alerts, and checks for response-length, position and self-preference biases. Human reviewers should independently label a sample of transcripts so grader-to-expert agreement can be compared with agreement among experts themselves.

That human baseline determines the remedy. If experts agree with one another but not with the grader, the rubric or grader needs work; if experts disagree with each other, the evaluation may not have a stable answer to measure. The guidance also calls for preregistering metrics, comparisons and improvement thresholds before results are seen.

Sample sizes underpin those judgments. Anthropic uses floors of 100 items for complex multi-turn evaluations and 1,000 for simpler single-turn tests, alongside repeated runs to account for noisy, nondeterministic outputs. Anthropic reports that confidence intervals on multi-turn API evaluations can exceed ±10 percentage points: in a multi-turn romance-scam evaluation on claude.ai, Claude Opus 5 and Opus 5.5 recorded appropriate-response rates of 98% and 94%, respectively, but the difference was not statistically significant. The example shows why a numerical gap alone cannot establish which model behaved more safely.

Deployment Settings and Reporting

Deployment configuration is another documented variable. While reviewing Claude Fable 5.1, Anthropic found that some responses implicitly validated self-harm as a coping strategy even when they discouraged self-harm and pointed toward human support. The company reports that re-running the evaluation with targeted system-prompt mitigations produced a 94% appropriate-response rate on claude.ai, compared with 60% on the API. The comparison shows why scores from different configurations cannot be treated as equivalent.

The reporting recommendations extend to model versions, sampling settings, prompts, grader versions and dates, with continuous evaluation during fine-tuning rather than a single pre-release check. Severe flaws in deployed systems should be disclosed to the developer first so there is time to remediate before results are published.

Anthropic’s three highest priorities are to define the construct before collecting data, validate the grader against human judgment and report uncertainty. The broader implication is that a claim that one model is safer than another depends on the test’s design, deployment context and statistical power as much as the headline score.