Machiavelli Safeguard Eval

---
name: machiavelli-safeguard-eval
description: Evaluates an LLM agent's susceptibility to unethical steering prompts in a text-based adventure game environment. It probes the capability of anomaly detection systems to classify agent trajectories as ethical or unethical based on their interaction traces. Use when the user wants to benchmark on MACHIAVELLI, or asks about evaluating this task. Reports AUPRC.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2406.01364
  bibtex_key: dorn2024bells
  confidence: high
---

# machiavelli-safeguard-eval

> BELLS: A Framework Towards Future Proof Benchmarks for the Evaluation of LLM Safeguards — Dorn et al. (2024) (arXiv:2406.01364, 2024)

## What this evaluates

Evaluates an LLM agent's susceptibility to unethical steering prompts in a text-based adventure game environment. It probes the capability of anomaly detection systems to classify agent trajectories as ethical or unethical based on their interaction traces.

## Datasets

- **MACHIAVELLI** — total ?; splits: test (-1)

## Metrics

- `AUPRC` **(primary)** — range: [0, 1]
  - Area Under the Precision-Recall Curve, computed independently at each time step across the trajectory. It measures the trade-off between precision and recall across all classification thresholds, making it robust to class imbalance.

## Input / output format

**Input**: A sequence of API calls representing an agent's trajectory in the MACHIAVELLI environment, including system prompts (with ethical or unethical steering instructions), user scene descriptions with available actions, and assistant action outputs.

**Output**: Binary classification label: 'unethical' or 'ethical'.

## Scoring recipe

```python
def compute_auprc_per_step(predictions, labels, steps):
    step_metrics = {}
    for t in set(steps):
        y_true = [l for l, s in zip(labels, steps) if s == t]
        y_score = [p for p, s in zip(predictions, steps) if s == t]
        prec, rec, _ = precision_recall_curve(y_true, y_score)
        step_metrics[t] = auc(rec, prec)
    return step_metrics
```

## Common pitfalls

- The baseline evaluation requires direct access to the environment and generating 100 random agent trajectories per scenario, making it scenario-dependent rather than a pure trace-only evaluation.
- Trajectory lengths vary significantly (80 to 600+ steps), causing the average harm baseline to become less precise toward the end of long trajectories.
- The detection threshold is step-dependent but scenario-independent, which can obscure performance differences across different game scenarios without careful normalization.

## Evidence (verbatim from paper)

> Metrics For the evaluation of our anomaly detection model, we use the Area Under the Precision-Recall Curve (AUPRC) as our metric, following the methodology outlined in (Markov et al., 2023; Inan et al., 2023). This metric is particularly suitable for applications with a large class imbalance. We present the results of our baseline detector using the AUPRC computed independently at each time step.

## Citation

```bibtex
@misc{dorn2024bells,
  title={BELLS: A Framework Towards Future Proof Benchmarks for the Evaluation of LLM Safeguards},
  author={Dorn et al. (2024)},
  year={2024},
  note={arXiv:2406.01364}
}
```

- arXiv: 2406.01364