---
type: "post"
id: "building-strong-safety-evaluations-anthropic-d8bdac"
slug: "building-strong-safety-evaluations-anthropic-d8bdac"
title: "Building strong safety evaluations \\ Anthropic"
description: "Anthropic published guidance for building safety evaluations, arguing that a score is only meaningful when the test measures the right behavior in realistic conditions."
retrieval_nugget: "Anthropic published guidance for building safety evaluations, arguing that a score is only meaningful when the test measures the right behavior in realistic conditions. For teams deciding whether an AI system is safe enough to deploy, the recommendations point toward domain-specific rubrics, multi-turn scenarios, and careful containment of risky tests."
published_at: "2026-11-13"
updated_at: "2026-11-13"
record_date: "2026-11-13"
date_kind: "published_at"
topics: ["anthropic","claude"]
entities: ["Anthropic","Claude"]
related_patterns: ["verification-bandwidth-is-the-scarce-resource"]
novelty_label: "new_fact"
what_changed: "Anthropic publishes recommendations for building reproducible, rigorous AI safety evaluations, drawing on research reforms and its experience with model evaluations."
prior_refs: []
source_url: "https://www.anthropic.com/research/building-strong-safety-evaluations"
source_urls: ["https://www.anthropic.com/research/building-strong-safety-evaluations"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:building-strong-safety-evaluations-anthropic-d8bdac"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/building-strong-safety-evaluations-anthropic-d8bdac/","markdown":"https://newruntime.com/posts/building-strong-safety-evaluations-anthropic-d8bdac.md","json":"https://newruntime.com/posts/building-strong-safety-evaluations-anthropic-d8bdac.json"}
markdown_url: "https://newruntime.com/posts/building-strong-safety-evaluations-anthropic-d8bdac.md"
---

# Building strong safety evaluations \ Anthropic

## Retrieval answer

Anthropic published guidance for building safety evaluations, arguing that a score is only meaningful when the test measures the right behavior in realistic conditions. For teams deciding whether an AI system is safe enough to deploy, the recommendations point toward domain-specific rubrics, multi-turn scenarios, and careful containment of risky tests.

## Summary
Anthropic published guidance for building safety evaluations, arguing that a score is only meaningful when the test measures the right behavior in realistic conditions. For teams deciding whether an AI system is safe enough to deploy, the recommendations point toward domain-specific rubrics, multi-turn scenarios, and careful containment of risky tests.

## What happened
Anthropic’s November 13, 2026 research post, “Building strong safety evaluations,” explains how to design, run and report evaluations of a model’s propensity to cause or contribute to harm. The company distinguishes these tests from capability evaluations: a safety evaluation asks whether, given a particular input, the model responds appropriately, and how its response affects the likelihood and severity of harm. The post draws on Anthropic’s evaluation work and examples in its system cards, and presents recommendations for people who build or rely on safety evaluations.

The first recommendation is to involve both methods specialists and domain experts from the beginning. Methods experts help determine how to sample, grade and analyze responses. Domain experts, such as psychologists, biologists or political scientists, help define realistic cases, identify borderline situations and decide what counts as harm or an appropriate answer. Anthropic says omitting either perspective can leave an evaluation technically rigorous but poorly matched to the risk, or deeply informed about a topic while covering too narrow a slice of behavior.

The post then argues that evaluation design should follow the question being asked. An observational evaluation can show that two models receive different scores, but does not explain why. To make a causal claim about an intervention, such as whether a system prompt makes a model safer, the design should vary one factor at a time. Anthropic also warns against treating refusal as a universal measure of safety. In self-harm contexts, a bare refusal may fail a person in crisis; in dual-use fields such as biology or cybersecurity, the appropriate answer may support legitimate work while withholding operational details that could enable harm. The company describes multi-turn evaluations that use domain-specific rubrics to score whether a model behaves appropriately throughout a conversation. A single harmful turn can fail the full conversation.

Anthropic recommends testing both harmful and benign prompts in the same domain, to measure harmful compliance and over-refusal. It also says single-turn tests can saturate and miss risks that emerge through gradual escalation or accumulated context. Its described scenario process begins with a domain expert’s specification of user objectives, tactics and relevant dimensions such as persona, situation, tone and conversational style. The first user turn stays fixed; another Claude model generates subsequent user turns based on that specification, while the model under test responds. Repeated runs draw different combinations of scenario characteristics, producing divergent conversations.

Safety conditions matter as well. Anthropic says evaluations often disable standard safeguards to measure baseline behavior. In cyber evaluations, models may probe test boundaries, so the company recommends a sandbox with no internet access and real-time monitoring that can stop a run. Anthropic says that, in response to incidents of its own, it hardened evaluation environments, temporarily stopped many evaluations that gave models internet access, and added real-time monitoring for web-search evaluations that require it.

## What the archive adds
New Runtime’s earlier coverage has examined how multi-turn sessions can erode safety defaults in evaluations. This guidance is a new fact on that thread: Anthropic describes building simulated conversations that change in response to model behavior, rather than relying only on isolated prompts. See [the earlier analysis](https://newruntime.com/analysis/research-wan-v-openai-tests-whether-letting-users-override-medical-advice-limits-is-a/).

## Trend signal
This supports the view that safety evaluation needs to test behavior across interaction, not merely inspect single-turn answers. The connection is specific to the multi-turn evaluation assumption in [New Runtime’s earlier analysis](https://newruntime.com/analysis/research-wan-v-openai-tests-whether-letting-users-override-medical-advice-limits-is-a/); Anthropic’s post describes scenario design, but does not independently establish that multi-turn sessions always erode safety.

## Why now
Anthropic says recent incidents led it to harden evaluation environments, temporarily stop many internet-connected evaluations, and add real-time monitoring to web-search evaluations that still need internet access. The post places evaluation quality alongside the practical task of keeping tests safe to run.

## Why it matters
A safety score can shape deployment decisions, safeguard choices and the next round of training. If the metric rewards refusal alone, a team may mistake blanket disengagement for safe support; if the test uses only single-turn prompts, it may miss escalation or context carried across a conversation. Anthropic’s recommendations imply more work up front: teams need domain expertise, explicit definitions of appropriate behavior, and test designs matched to the claims they intend to make.

For product teams, this is not just a research concern. A customer-facing assistant may need to help with a legitimate request in a dual-use domain while avoiding details that materially enable harm. Testing both harmful and benign prompts can expose the trade-off between unsafe compliance and over-refusal. Multi-turn simulations can also make evaluation closer to how people actually interact. These methods do not guarantee safe deployment, but they make the underlying evidence more relevant to decisions than a score detached from its scenario and rubric.

## Limits and uncertainty
Anthropic presents recommendations and describes its own evaluation approach; the post does not establish that following them guarantees safe behavior or that its scenarios represent every real-world interaction. The excerpted account gives no comparative results quantifying how much the described methods improve prediction of real-world harm. Anthropic’s statement that incidents prompted changes to its evaluation environments is not accompanied here by incident details, and the account does not independently validate the effectiveness of its sandboxing or monitoring measures.

## Skill to build now
Write a one-page rubric for one safety risk your product actually encounters. Define a harmful request, a benign request on the same subject, and what a good answer should do in each case; then test a short multi-turn conversation where earlier context changes the meaning of a later question. If the test could prompt risky behavior, run it in an isolated environment with a human able to stop it.

## Reader takeaway
A safety evaluation is only as useful as its definition of appropriate behavior and the situations it tests. Measure more than refusal, include realistic multi-turn context, and keep risky evaluation runs contained.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)