FORTRESS Average Risk Score (ARS)
Safety · 2025-06-17
Average Risk Score (ARS) across adversarial national-security and public-safety prompts; each response's harm score is the percentage of instance-specific rubric questions answered yes by a majority of three judges, and ARS averages those harm scores across prompts.
Top models (lower is better)
| Model | Score |
|---|---|
| Claude Opus 5.5 | 5.8 |
| Muse Spark Open | 5.8 |
| gpt-oss-120b | 8.2 |
| Claude Haiku 5.5 | 9.5 |
| Opus 4.5 | 9.6 |
| GPT-6 Luna | 10.8 |
| Muse Spark 1.1 | 12.4 |
| Sonnet 4.5 | 12.8 |
| Claude 3.5 Sonnet (June 2024) | 13.0 |
| Opus 4.6 | 13.0 |
| GPT-6 Sol | 13.5 |
| Claude Fable 5.1 | 13.7 |
| Opus 4.1 | 14.8 |
| GPT-5.4 Pro | 14.8 |
| GPT-5 Pro | 15.2 |
| o3 | 16.0 |
| GPT-5.5 | 16.3 |
| Claude Opus 5 | 16.8 |
| GPT-5 Mini | 17.0 |
| GPT-5 | 17.0 |
| GPT-5.2 | 17.5 |
| gpt-oss-20b | 17.6 |
| Sonnet 4 | 18.1 |
| GPT-6.1 Terra | 18.2 |
| Opus 4.8 | 18.2 |
| o1 (source unspecified) | 19.4 |
| GPT-5.6 Sol | 20.1 |
| Muse Spark | 20.2 |
| Llama 3.1 405B Instruct | 20.6 |
| O4 Mini | 21.5 |
| Mistral Large 4 Preview | 23.1 |
| Opus 4 | 24.8 |
| Inkling | 25.0 |
| GPT-5.1 | 25.7 |
| Kimi K3 | 26.6 |
| DeepSeek V4.1 Flash 1017 | 27.2 |
| GLM-5.3 | 28.2 |
| Gemini 3.1 Pro Preview | 29.8 |
| o3-mini | 30.1 |
| GPT-5.1 Instant | 30.4 |