license: mit
language:

• en
  task_categories:
• text-classification
  tags:
• ai-safety
• red-teaming
• interpretability
• evaluation
• jailbreak
• confound-controlled
  size_categories:
• 1K<n<10K
  configs:
• config_name: controlled
  default: true
  data_files:
  • split: test
    path:
    • harmful_paired_v2.jsonl
    • benign_minpair_v2.jsonl
• config_name: standard
  data_files:
  • split: test
    path:
    • harmful.jsonl
    • benign_standard.jsonl
• config_name: minpair_v1
  data_files:
  • split: test
    path:
    • harmful_paired_v1.jsonl
    • benign_minpair_v1.jsonl

AICES Minimal-Pair Control Set

A confound-controlled benchmark for prompt-level harm detection.

Most benchmarks for "does this prompt look harmful?" are secretly measuring vocabulary, not harm.
This dataset is the fix: a benign control built so that a bag-of-words classifier cannot separate
benign from harmful prompts. Whatever your monitor scores here, it earned.

The problem

On a conventional benign control set, every activation-based harm monitor looks excellent
(0.92-0.98 AUROC). But a TF-IDF bag-of-words baseline with no model at all reaches 0.967 on the
same data. The "detection" is largely lexical. (A length-only classifier is near chance at 0.59, so it
is vocabulary, not length -- see DIAGNOSTIC.md.)

Each harmful prompt here is paired with a minimally-edited benign twin -- same topic, nearly the
same words, opposite intent:

Reproducible baseline numbers

Bag-of-words (TF-IDF 1-2 grams, min_df=2, logistic regression, 5-fold stratified CV):

Note on pairing. The controlled config contains only the 426 harmful prompts that have a
validated benign twin -- not all 510. This is deliberate and load-bearing: an unpaired harmful
prompt has no lexical counterweight, so including the 84 unmatched ones leaks surface signal back in
(TF-IDF rises 0.493 -> 0.538). Always evaluate on matched pairs.

What is inside

Categories (both sides): harassment, illegal_non_violent, chemical_biological_weapons,
cybercrime, misinformation, self_harm.

Schema: id, prompt, label (1=harmful, 0=benign), category, source, source_id,
benign_pair_id (links a benign back to the harmful prompt it was derived from), notes.

Usage

from datasets import load_dataset

ctrl = load_dataset("Robomb/aices-minpair-control", "controlled", split="test")  # TF-IDF at chance
std  = load_dataset("Robomb/aices-minpair-control", "standard",   split="test")  # reproduces inflation

Or via the aices package, which ships the canonical baseline:

from aices import load_control, tfidf_baseline
ds = load_control("controlled")
print(tfidf_baseline(ds))   # ~0.493 -- vocabulary is useless here

Recommended protocol: score your monitor on both configs and report the gap, alongside the
bag-of-words baseline. If your monitor beats TF-IDF on standard but not on controlled, it is a
vocabulary detector.

Reference results (five activation monitors)

Across Qwen2-1.5B/7B, Mistral-7B, Llama-3.1-8B, Gemma-2-9B. Every monitor is inflated by conventional
benigns, and the inflation is large enough to reorder which monitor looks best.

How the control was built and validated

Each benign twin is a minimal edit of a specific harmful prompt. Naive minimal editing is not enough --
an independent LLM safety judge found only 47% of the first-pass (v1) "benigns" were actually
benign; the rest changed too little and stayed harmful. v2 was rebuilt judge-in-the-loop
(edit -> judge -> retry) giving 426 validated pairs. A different-family judge (Llama-3.1-8B) then
rated 88% of them benign, so it is not circular self-validation. See CONTROL_QA.md.

Known limitation: v2 is LLM-judge-validated, not human-audited. A full human audit is the
natural next improvement. Treat the labels as high-quality but not gold.

Content warning & intended use

harmful.jsonl contains prompts requesting harmful content (weapons, cybercrime, self-harm,
harassment), in the style of public jailbreak benchmarks. Released for safety research and evaluation
only -- building and stress-testing harm detectors. Do not use it to elicit harmful outputs.

Links

• Code / paper: https://github.com/Robomba/ai-control-eval-suite (aices, MIT)

Citation

@misc{aices2026,
  title  = {Activation-Based Monitors for Detecting Harmful Prompts: A Confound-Controlled Cross-Model Benchmark},
  author = {Kaila, Rohan},
  year   = {2026},
  url    = {https://github.com/Robomba/ai-control-eval-suite}
}