Who Judges the Judges? A Chinese Safety QA Benchmark for Evaluating LLM Responses and Safety Judges
Rui Yang, Shuang Huang, Junhua Liu, Ziqi Zhao, Qingzhong Yan, Yuhang Sun, Cong Liu, Guoping Hu, et al.
cs.CR · cs.AI
Quick verdict
C-SafeQA: 37,660 Chinese QA pairs benchmarking 4 LLMs and 7 safety judges; useful, but model-derived labels and no benign set temper its audit authority.
Summary
The paper introduces C-SafeQA, a policy-grounded Chinese benchmark that evaluates LLM safety at the response level and audits the automated judges used to produce such measurements. From 269 internal policy risk points the authors build 538 base queries and derive 8,877 adversarial variants via 21 mechanism-labeled transformations; four full-precision models (Qwen3.5-397B-A17B, Kimi-K2.5, DeepSeek-V3.2, MiniMax-M2.5) each answer all 9,415 queries, producing 37,660 records labeled safe, unsafe, or disputed. References combine agreement-aware adjudication by four strong models with stratified blind audits by three human experts. Unsafe-response rates span 0.93–3.35% on base queries and 11.68–30.05% on adversarial ones. Auditing seven guard models on the 35,508-record adversarial subset exposes recall/FPR trade-offs: YuFeng-XGuard leads recall (63.52%) and F1 (59.65%); WildGuard has the lowest safe-response FPR (3.13%) but weak recall; PolyGuard's 68.88% FPR makes it near-unusable. Both acrostic transformations suppress unsafe recall across all seven judges (0.67–13.81% and 1.33–26.43%) despite causing the highest target unsafe rates (91.05% and 69.71%). Limitations: references are model-assisted rather than exhaustively human-labeled (20% audit of unanimous cases), no benign-query set exists so over-refusal cannot be measured, construction assets are withheld so only released-field recomputation is possible, and all comparisons are descriptive with no significance testing.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 2
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Response-level, policy-grounded labeling distinguishes query risk from response violation, enabling target-LLM and judge evaluation against one shared reference set.
- Unsafe-response rates rise sharply from base queries (0.93–3.35%) to adversarial queries (11.68–30.05%) across all four target LLMs.
- No evaluated judge simultaneously achieves the best unsafe-response recall and the lowest safe-response FPR: YuFeng-XGuard leads recall (63.52%, F1 59.65%), WildGuard the lowest FPR (3.13%), and PolyGuard is near-unusable (68.88% FPR, 13.70% precision).
- Both acrostic transformations suppress unsafe recall across all seven judges (0.67–13.81% and 1.33–26.43%) despite producing the two highest target-model unsafe rates (91.05% and 69.71%).
- Judge-reference conflict rises in 45 of 49 judge-category cells after transformation, so aggregate accuracy conceals category- and mechanism-conditioned blind spots.
Strengths
Response-level, policy-grounded design closes a real gap
§3.3 separates query risk from response violation: a harmful query answered by a clean refusal is labeled safe, and Table 9 shows a seemingly benign translation task whose faithful rendering of pro-smoking content is correctly referenced unsafe. Traceable risk-point lineage (269 points → 538 seeds) plus a preserved disputed class (465 records, never merged into binary classes) keeps uncertainty explicit.
Judges as first-class subjects with mechanism-conditioned analysis
Fig. 7 and §5.4 expose findings invisible in aggregate metrics: acrostic-generation judge recall spans only 0.67–13.81% despite a 69.71% target unsafe rate, and PolyGuard posts 98.66–99.95% safe-response FPR on AIM/DAN/Developer-Mode templates, unmasking an almost-always-unsafe decision rule that its 43.49% recall would otherwise flatter.
Unusually candid metric bookkeeping
Release enables genuine recomputation
Weaknesses
Reference validity rests on unaudited model consensus
No benign-query set
Construction is unverifiable by design
Zero inferential statistics
Narrow slice of model behavior
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
C-SafeQA (arXiv 2609.01210v2, cs.CR) is a response-level Chinese safety benchmark built from an internal policy decomposed into 269 risk points, instantiated as 538 base queries (question- and declarative-form) and expanded to 8,877 adversarial queries via 21 mechanism-labeled transformations (§3.5, Table 2). Four full-precision deployments — Qwen3.5-397B-A17B, Kimi-K2.5, DeepSeek-V3.2, MiniMax-M2.5 — each answer all 9,415 queries, yielding 37,660 records labeled safe (30,116), unsafe (7,079), or disputed (465) (Table 3). The paper's central move is dual-purpose evaluation: the same reference labels measure target-LLM safety and audit seven guard models (Llama Guard 4, MD-Judge, NeMo Guard, PolyGuard, Qwen3Guard, WildGuard, YuFeng-XGuard). Headline claims: unsafe rates rise from 0.93–3.35% (base) to 11.68–30.05% (adversarial); no judge dominates recall and safe-response FPR simultaneously; both acrostic mechanisms collapse unsafe recall for all seven judges.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is C-SafeQA?
C-SafeQA is a Chinese-language safety benchmark of 37,660 labeled query-response pairs, built from 538 base queries derived from 269 safety-policy risk points plus 8,877 adversarial variants generated by 21 documented transformation methods (persona jailbreaks, encoding, acrostics, translation, etc.). Four open-weight LLMs answered every query, and each answer was labeled safe, unsafe, or disputed through multi-model adjudication with stratified human expert audits. It supports both measuring how safely target models respond and auditing how reliably automated safety judges label the outcomes.
Why is the paper called 'Who Judges the Judges?'
Because it treats the automated safety judges (guardrail models such as Llama Guard 4, WildGuard, Qwen3Guard, YuFeng-XGuard) as the object of study rather than as neutral instruments. Using policy-grounded reference labels, it measures each judge's unsafe-response recall and false-positive rate on Chinese query-response pairs, finding that no judge wins on all metrics and that all seven miss most unsafe responses hidden inside acrostic (hidden initial-character) transformations.
What are the main findings of the C-SafeQA paper?
Unsafe-response rates jump from 0.93–3.35% on direct queries to 11.68–30.05% under adversarial transformations across four target LLMs. Among the seven audited judges, YuFeng-XGuard has the best unsafe recall (63.52%) and F1 (59.65%), WildGuard the lowest false-positive rate (3.13%) but weak recall, and PolyGuard a 68.88% false-positive rate that makes it nearly unusable. Acrostic transformations suppress unsafe recall to 0.67–26.43% across all judges, revealing a shared blind spot that aggregate scores hide.
Is the C-SafeQA dataset publicly available?
Yes, partially. The 37,660 evaluation records are released on Hugging Face (SparkShieldLab/C-SafeQA) with prompts, responses, reference labels, raw and normalized outputs of all seven judges, plus a schema and manifest; GitHub hosts an integrity verifier and runner scripts for the seven judges. However, the internal safety policy, seed queries, transformation templates, reference-judge prompts, and the label-regeneration pipeline are withheld, so third parties can recompute released analyses but cannot regenerate the benchmark.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure interiors (Figs. 3-8) are charts/heatmaps whose per-cell values are only partially present in the extraction; per-judge per-mechanism values behind Fig. 7 are available only as the ranges quoted in prose. All other numbers cited in this review come from complete tables and prose.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.