Model profile
GPT 3.5 Turbo
OpenAIdeveloper
2023-03-01release date
#185 / 333Safety rank
#280 / 645Freedom rank
Evidence summary
Safety. GPT 3.5 Turbo has an estimated Safety rank of #185; its 90% source-sensitivity interval is #112–#231. Its behavior-only rank is #194; company governance moves the combined estimate to #185. Published Safety evidence spans 28 eval lineages and 7 of 7 components. Its strongest relative result is SafetyPrompts (score, #1 of 15); its weakest is SpeciesismBench (speciesism_recognition_rate, #8 of 8).
Freedom. GPT 3.5 Turbo has an estimated Freedom rank of #280; its 90% source-sensitivity interval is #207–#401. Published Freedom evidence spans 20 eval lineages and 1 of 1 components. Its strongest relative result is Human Pathogen Capabilities Test (HPCT) — overall refusal (refusal_rate_pct, #1 of 69); its weakest is SafetyPrompts (score, #15 of 15).
Compare this model
Only models sharing at least one published sub-eval are listed.
Official and reference links
- Artificial Analysis ↗gpt-3-5-turbo-0613
- OpenRouter ↗openai/gpt-3.5-turbo
- Official model documentation ↗Family-level model document · openai · first party
- Release source ↗direct research preview identity date
Safety evals
Rank and direction are specific to the Safety portfolio. Black marks the observed result; the grey dot marks the value implied by the Safety rank. Values stay on each source’s native scale.
| Eval / sub-eval | Rank | Value | Distribution | Source |
|---|---|---|---|---|
| AgentDojotargeted_attack_success_rate | #6 / 15 | ↓0.1033 | Source ↗official | |
| AgentDojoutility_under_attack | #9 / 15 | ↑0.3466 | Source ↗official | |
| AgentHarmharm_score | #9 / 12 | ↓62.2 | Source ↗official | |
| AIRBench 2024 Safety Scenariossafety_scenarios | #59 / 80 | ↑0.5577 | Source ↗official | |
| BioTIERpermit_compliance_pct | #32 / 52 | ↑98.8 | Source ↗official | |
| BioTIERrefuse_compliance_pct | #44 / 52 | ↑13 | Source ↗official | |
| CAIS Risk Indexpolitical_manipulation | #38 / 48 | ↓55.6 | Source ↗official | |
| Chinese Bias Benchmark for Question Answeringbias_score | #1 / 10 | ↓0.06549 | Source ↗official | |
| COMPL-AI AI-Identity Disclosurescore | #13 / 14 | ↑0.589 | Source ↗official | |
| COMPL-AI LLM RuLES Multi-Turn Rule Followingscore | #3 / 14 | ↑0.655 | Source ↗official | |
| DecodingTrustmachine_ethics | #2 / 8 | ↑86.38 | Source ↗official | |
| DecodingTruststereotype_bias | #7 / 8 | ↑87 | Source ↗official | |
| DecodingTrusttoxicity | #4 / 8 | ↑47 | Source ↗official | |
| Do-Not-Answerhuman_harmlessness_rate | #2 / 6 | ↑98.51 | Source ↗official | |
| Enkrypt AI Safety Leaderboardbias_attack_non_success_rate | #215 / 248 | ↑10.08 | Source ↗official | |
| Enkrypt AI Safety Leaderboardcbrn_attack_non_success_rate | #138 / 248 | ↑87.17 | Source ↗official | |
| Enkrypt AI Safety Leaderboardharmful_attack_non_success_rate | #223 / 248 | ↑37.22 | Source ↗official | |
| Enkrypt AI Safety Leaderboardtoxicity_attack_non_success_rate | #211 / 246 | ↑89.18 | Source ↗official | |
| Fake Alignment (FINE)multiple_choice_safe_decision_rate | #1 / 14 | ↑96 | Source ↗official | |
| Fake Alignment (FINE)open_ended_safe_response_rate | #1 / 14 | ↑100 | Source ↗official | |
| HarmBenchdr | #18 / 28 | ↓27.15 | Source ↗official | |
| HELM Safetyanthropic_red_team | #57 / 80 | ↑0.981 | Source ↗official | |
| HELM Safetybbq | #76 / 80 | ↑0.6513 | Source ↗official | |
| HELM Safetyharmbench | #50 / 80 | ↑0.6663 | Source ↗official | |
| HELM Safetysimple_safety_tests | #70 / 80 | ↑0.9337 | Source ↗official | |
| HELM Safetyxstest | #59 / 80 | ↑0.9373 | Source ↗official | |
| Human Pathogen Capabilities Test (HPCT) — overall refusalrefusal_rate_pct | #27 / 69 | ↑0 | Source ↗official | |
| JailBenchjailbreak_success_rate | #12 / 14 | ↓73.86 | Source ↗official | |
| Large-scale Moral Machine experiment on LLMshuman_choice_distance | #7 / 39 | ↓0.8161 | Source ↗official | |
| MACHIAVELLIdeception_relative_random_pct | #38 / 50 | ↓94 | Source ↗official | |
| MedSafetyBenchmedical_safety_score | #4 / 30 | ↑98.94 | Source ↗official | |
| OR-Benchover_refusal_rate | #8 / 25 | ↓36.17 | Source ↗official | |
| OR-Benchtoxic_acceptance_rate | #20 / 25 | ↓17.03 | Source ↗official | |
| SafetyBenchEM | #4 / 21 | ↑77.75 | Source ↗official | |
| SafetyBenchIA | #3 / 21 | ↑85 | Source ↗official | |
| SafetyBenchMH | #2 / 21 | ↑87.75 | Source ↗official | |
| SafetyBenchOFF | #3 / 21 | ↑77.4 | Source ↗official | |
| SafetyBenchPH | #2 / 21 | ↑79.65 | Source ↗official | |
| SafetyBenchPP | #2 / 21 | ↑85.65 | Source ↗official | |
| SafetyBenchUB | #4 / 21 | ↑67.9 | Source ↗official | |
| SafetyPromptsscore | #1 / 15 | ↑98.37 | Source ↗official | |
| SALAD-Benchattack_enhanced_human_autonomy_integrity | #3 / 33 | ↑72.41 | Source ↗official | |
| SALAD-Benchattack_enhanced_information_safety_harms | #3 / 33 | ↑72.64 | Source ↗official | |
| SALAD-Benchattack_enhanced_malicious_use | #3 / 33 | ↑71.86 | Source ↗official | |
| SALAD-Benchattack_enhanced_misinformation_harms | #3 / 33 | ↑71.38 | Source ↗official | |
| SALAD-Benchattack_enhanced_representation_toxicity | #3 / 33 | ↑75.65 | Source ↗official | |
| SALAD-Benchattack_enhanced_socioeconomic_harms | #3 / 33 | ↑68.83 | Source ↗official | |
| SALAD-Benchbase_human_autonomy_integrity | #24 / 33 | ↑89.4 | Source ↗official | |
| SALAD-Benchbase_information_safety_harms | #25 / 33 | ↑90.79 | Source ↗official | |
| SALAD-Benchbase_malicious_use | #22 / 33 | ↑88.74 | Source ↗official | |
| SALAD-Benchbase_misinformation_harms | #21 / 33 | ↑92.61 | Source ↗official | |
| SALAD-Benchbase_representation_toxicity | #21 / 33 | ↑87.99 | Source ↗official | |
| SALAD-Benchbase_socioeconomic_harms | #28 / 33 | ↑77.32 | Source ↗official | |
| SALAD-Benchmcq_human_autonomy_integrity | #9 / 33 | ↑51.39 | Source ↗official | |
| SALAD-Benchmcq_information_safety_harms | #10 / 33 | ↑43.89 | Source ↗official | |
| SALAD-Benchmcq_malicious_use | #10 / 33 | ↑47.82 | Source ↗official | |
| SALAD-Benchmcq_misinformation_harms | #10 / 33 | ↑49.05 | Source ↗official | |
| SALAD-Benchmcq_representation_toxicity | #10 / 33 | ↑46.77 | Source ↗official | |
| SALAD-Benchmcq_socioeconomic_harms | #9 / 33 | ↑46.67 | Source ↗official | |
| SORRY-Benchavg | #17 / 51 | ↓0.18 | Source ↗official | |
| SpeciesismBenchmorally_wrong_rate | #5 / 8 | ↑38.38 | Source ↗official | |
| SpeciesismBenchspeciesism_recognition_rate | #8 / 8 | ↑74.21 | Source ↗official | |
| SuperCLUE Safetyinstruction_attack | #9 / 31 | ↑68.97 | Source ↗official | |
| SuperCLUE Safetyresponsible_ai | #4 / 31 | ↑72.73 | Source ↗official | |
| SuperCLUE Safetytraditional_safety | #20 / 31 | ↑73.4 | Source ↗official |
Freedom evals
Rank and direction are specific to the Freedom portfolio. Black marks the observed result; the grey dot marks the value implied by the Freedom rank. Values stay on each source’s native scale.
| Eval / sub-eval | Rank | Value | Distribution | Source |
|---|---|---|---|---|
| AIRBench 2024 Safety Scenariossafety_scenarios | #22 / 80 | ↓0.5577 | Source ↗official | |
| BioTIERpermit_compliance_pct | #32 / 52 | ↑98.8 | Source ↗official | |
| BioTIERrefuse_compliance_pct | #9 / 52 | ↓13 | Source ↗official | |
| COMPL-AI LLM RuLES Multi-Turn Rule Followingscore | #12 / 14 | ↓0.655 | Source ↗official | |
| DecodingTrusttoxicity | #5 / 8 | ↓47 | Source ↗official | |
| Do-Not-Answerhuman_harmlessness_rate | #5 / 6 | ↓98.51 | Source ↗official | |
| Enkrypt AI Safety Leaderboardcbrn_attack_non_success_rate | #110 / 248 | ↓87.17 | Source ↗official | |
| Enkrypt AI Safety Leaderboardharmful_attack_non_success_rate | #26 / 248 | ↓37.22 | Source ↗official | |
| Enkrypt AI Safety Leaderboardtoxicity_attack_non_success_rate | #36 / 246 | ↓89.18 | Source ↗official | |
| Fake Alignment (FINE)open_ended_safe_response_rate | #13 / 14 | ↓100 | Source ↗official | |
| HarmBenchdr | #11 / 28 | ↑27.15 | Source ↗official | |
| HELM Safetyanthropic_red_team | #24 / 80 | ↓0.981 | Source ↗official | |
| HELM Safetyharmbench | #31 / 80 | ↓0.6663 | Source ↗official | |
| HELM Safetysimple_safety_tests | #11 / 80 | ↓0.9337 | Source ↗official | |
| HELM Safetyxstest | #59 / 80 | ↑0.9373 | Source ↗official | |
| Human Pathogen Capabilities Test (HPCT) — overall refusalrefusal_rate_pct | #1 / 69 | ↓0 | Source ↗official | |
| JailBenchjailbreak_success_rate | #3 / 14 | ↑73.86 | Source ↗official | |
| MedSafetyBenchmedical_safety_score | #27 / 30 | ↓98.94 | Source ↗official | |
| OR-Benchover_refusal_rate | #8 / 25 | ↓36.17 | Source ↗official | |
| OR-Benchtoxic_acceptance_rate | #6 / 25 | ↑17.03 | Source ↗official | |
| SafetyPromptsscore | #15 / 15 | ↓98.37 | Source ↗official | |
| SALAD-Benchattack_enhanced_human_autonomy_integrity | #31 / 33 | ↓72.41 | Source ↗official | |
| SALAD-Benchattack_enhanced_information_safety_harms | #31 / 33 | ↓72.64 | Source ↗official | |
| SALAD-Benchattack_enhanced_malicious_use | #31 / 33 | ↓71.86 | Source ↗official | |
| SALAD-Benchattack_enhanced_misinformation_harms | #31 / 33 | ↓71.38 | Source ↗official | |
| SALAD-Benchattack_enhanced_representation_toxicity | #31 / 33 | ↓75.65 | Source ↗official | |
| SALAD-Benchattack_enhanced_socioeconomic_harms | #31 / 33 | ↓68.83 | Source ↗official | |
| SALAD-Benchbase_human_autonomy_integrity | #10 / 33 | ↓89.4 | Source ↗official | |
| SALAD-Benchbase_information_safety_harms | #9 / 33 | ↓90.79 | Source ↗official | |
| SALAD-Benchbase_malicious_use | #12 / 33 | ↓88.74 | Source ↗official | |
| SALAD-Benchbase_misinformation_harms | #13 / 33 | ↓92.61 | Source ↗official | |
| SALAD-Benchbase_representation_toxicity | #13 / 33 | ↓87.99 | Source ↗official | |
| SALAD-Benchbase_socioeconomic_harms | #6 / 33 | ↓77.32 | Source ↗official | |
| SORRY-Benchavg | #35 / 51 | ↑0.18 | Source ↗official | |
| SpeechMap model completioncomplete_pct | #6 / 181 | ↑94.5 | Source ↗official | |
| SuperCLUE Safetyinstruction_attack | #18 / 31 | ↓68.97 | Source ↗official | |
| SuperCLUE Safetytraditional_safety | #12 / 31 | ↓73.4 | Source ↗official |
Values evaluations
Descriptive values and political-framing results are separate from safety/ethics ranks. Each strip shows the evaluation’s observed model range; its endpoint labels state what lower and higher values mean.
ValueCompass
| Dimension | Value | Distribution |
|---|---|---|
| Universalism | 30.4 | |
| Self-direction | 23.5 | |
| Care / Harm | 34.3 | |
| Fairness / Cheating | 30.1 | |
| Ethical | 89.2 |