OR-Bench
Models meet benign and borderline prompts and the benchmark measures how often they wrongly refuse. Reports false refusal rate.
Public over-refusal benchmark for large language models.
- Made by
- Cui et al.
- Released
- May 2024
- Kind
- Jailbreaks and prompt injection
- Level
- University
- Scored
- Graded by a model
- Answers
- Open-ended
- Tasks
- All public
- Strongest model tested
-
Muse Spark 1.3 #26 on the capability index
- Last in a system card
- October 2026
- Last model added
- October 2026
- Scores refreshed
- November 12th, 2026
In the authors’ words
Large Language Models (LLMs) require careful safety alignment to prevent malicious outputs. While significant research focuses on mitigating harmful content generation, the enhanced safety often come with the side effect of over-refusal, where LLMs may reject innocuous prompts and become less helpful. Although the issue of over-refusal has been empirically observed, a systematic measurement is challenging due to the difficulty of crafting prompts that can elicit the over-refusal behaviors of LLMs. This study proposes a novel method for automatically generating large-scale over-refusal datasets. Leveraging this technique, we introduce OR-Bench, the first large-scale over-refusal benchmark. OR-Bench comprises 80,000 over-refusal prompts across 10 common rejection categories, a subset of around 1,000 hard prompts that are challenging even for state-of-the-art LLMs, and an additional 600 toxic prompts to prevent indiscriminate responses. We then conduct a comprehensive study to measure the over-refusal of 32 popular LLMs across 8 model families. Our datasets are publicly available at https://huggingface.co/bench-llms and our codebase is open-sourced at https://github.com/justincui03/or-bench. We hope this benchmark can help the community develop better safety aligned models.
GPT-4o leads with 6.80% among models released by June 2024
Best score per model from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best.
Muse Spark 1.1 leads with 4.80%, claims included
Best score per model from every source, including labs’ own numbers and claims Epoch AI collected from reports and papers. Labs pick their own settings, so a claim can beat an independent run of the same model.
The newest model with a score here came out in June 2024, and nobody has tested a newer one. Among the 20 highest-ranked models on the capability index, these have no score yet:
- Claude Fable 5.2
-
Gemini 4 Carbon
- GPT-6 Astra
- Claude Opus 5.5
- and 16 more
- 1 GPT-4o May 2024 6.80%
- 2
Gemini 1.0 Pro 9.70%
- 3
Mistral Large 9.80%
- 4 GPT-4 Turbo (Jan 2024) 12.2%
- 5 GPT-3.5 Turbo Jan 2024 12.7%
- 6 GPT-4 Turbo Apr 2024 12.8%
- 7 mistral-small-2402 13.3%
- 8
Mistral Medium 14%
- 9
Gemma 7B 26.3%
- 10
Llama 3-70B 37.7%
- 11 GPT-3.5 Turbo Jun 2023 38.4%
- 12
Qwen1.5-7B 39.2%
- 13 Claude 3.5 Sonnet 43.8%
- 14
Qwen1.5-72B 46.9%
- 15
Qwen1.5-32B 50.8%
- 16 GPT-3.5 Turbo (Mar 2023) 57.4%
- 17
Gemma 2 27B 62%
- 18
Llama 3-8B 69.4%
- 19
Gemma 2 9B 79.9%
- 20
Gemini 1.5 Flash May 2024 84.3%
- 21
Llama 2-7B 87.5%
- 22
Gemini 1.5 Pro May 2024 88%
- 23
Llama 2-13B 91%
- 24 Claude 3 Opus 91%
- 25 Claude 3 Sonnet 94.5%
- 26
Llama 2-70B 96.1%
- 27 Claude 3 Haiku 96.3%
- 28 Claude 2.1 99.8%
Source: Official OR-Bench leaderboard
- 1
Muse Spark 1.1 4.80%
- 2 GPT-4o May 2024 6.80%
- 3
Muse Spark 8.00%
- 4
Gemini 1.0 Pro 9.70%
- 5
Mistral Large 9.80%
- 6 GPT-4 Turbo (Jan 2024) 12.2%
- 7 GPT-3.5 Turbo Jan 2024 12.7%
- 8 GPT-4 Turbo Apr 2024 12.8%
- 9 mistral-small-2402 13.3%
- 10
Mistral Medium 14%
- 11
Muse Spark 1.3 16.8%
- 12
Gemma 7B 26.3%
- 13
Llama 3-70B 37.7%
- 14 GPT-3.5 Turbo Jun 2023 38.4%
- 15
Qwen1.5-7B 39.2%
- 16 Claude 3.5 Sonnet 43.8%
- 17
Qwen1.5-72B 46.9%
- 18
Qwen1.5-32B 50.8%
- 19 GPT-3.5 Turbo (Mar 2023) 57.4%
- 20
Gemma 2 27B 62%
- 21
Llama 3-8B 69.4%
- 22
Gemma 2 9B 79.9%
- 23
Gemini 1.5 Flash May 2024 84.3%
- 24
Llama 2-7B 87.5%
- 25
Gemini 1.5 Pro May 2024 88%
- 26
Llama 2-13B 91%
- 27 Claude 3 Opus 91%
- 28 Claude 3 Sonnet 94.5%
- 29
Llama 2-70B 96.1%
- 30 Claude 3 Haiku 96.3%
- 31 Claude 2.1 99.8%
Sources: Labs’ model cards and official OR-Bench leaderboard
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | GPT-4o May 2024 | 6.80% | May 2024 | Official leaderboard | |
| 2 | | 9.70% | Dec 2023 | Official leaderboard | |
| 3 | | 9.80% | Feb 2024 | Official leaderboard | |
| 4 | GPT-4 Turbo (Jan 2024) | 12.2% | Jan 2024 | Official leaderboard | |
| 5 | GPT-3.5 Turbo Jan 2024 | 12.7% | Jan 2024 | Official leaderboard | |
| 6 | GPT-4 Turbo Apr 2024 | 12.8% | Apr 2024 | Official leaderboard | |
| 7 | mistral-small-2402 | 13.3% | Feb 2024 | Official leaderboard | |
| 8 | | 14% | Dec 2023 | Official leaderboard | |
| 9 | | 26.3% | Feb 2024 | Official leaderboard | |
| 10 | | 37.7% | Apr 2024 | Official leaderboard | |
| 11 | GPT-3.5 Turbo Jun 2023 | 38.4% | Jun 2023 | Official leaderboard | |
| 12 | | 39.2% | Feb 2024 | Official leaderboard | |
| 13 | Claude 3.5 Sonnet | 43.8% | Jun 2024 | Official leaderboard | |
| 14 | | 46.9% | Feb 2024 | Official leaderboard | |
| 15 | | 50.8% | Feb 2024 | Official leaderboard | |
| 16 | GPT-3.5 Turbo (Mar 2023) | 57.4% | Mar 2023 | Official leaderboard | |
| 17 | | 62% | Jun 2024 | Official leaderboard | |
| 18 | | 69.4% | Apr 2024 | Official leaderboard | |
| 19 | | 79.9% | Jun 2024 | Official leaderboard | |
| 20 | | 84.3% | May 2024 | Official leaderboard | |
| 21 | | 87.5% | Jul 2023 | Official leaderboard | |
| 22 | | 88% | May 2024 | Official leaderboard | |
| 23 | | 91% | Jul 2023 | Official leaderboard | |
| 24 | Claude 3 Opus | 91% | Feb 2024 | Official leaderboard | |
| 25 | Claude 3 Sonnet | 94.5% | Feb 2024 | Official leaderboard | |
| 26 | | 96.1% | Jul 2023 | Official leaderboard | |
| 27 | Claude 3 Haiku | 96.3% | Mar 2024 | Official leaderboard | |
| 28 | Claude 2.1 | 99.8% | Nov 2023 | Official leaderboard |
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | | 4.80% | Jul 2026 | Lab model card | |
| 2 | GPT-4o May 2024 | 6.80% | May 2024 | Official leaderboard | |
| 3 | | 8.00% | Jun 2026 | Lab model card | |
| 4 | | 9.70% | Dec 2023 | Official leaderboard | |
| 5 | | 9.80% | Feb 2024 | Official leaderboard | |
| 6 | GPT-4 Turbo (Jan 2024) | 12.2% | Jan 2024 | Official leaderboard | |
| 7 | GPT-3.5 Turbo Jan 2024 | 12.7% | Jan 2024 | Official leaderboard | |
| 8 | GPT-4 Turbo Apr 2024 | 12.8% | Apr 2024 | Official leaderboard | |
| 9 | mistral-small-2402 | 13.3% | Feb 2024 | Official leaderboard | |
| 10 | | 14% | Dec 2023 | Official leaderboard | |
| 11 | | 16.8% | Oct 2026 | Lab model card | |
| 12 | | 26.3% | Feb 2024 | Official leaderboard | |
| 13 | | 37.7% | Apr 2024 | Official leaderboard | |
| 14 | GPT-3.5 Turbo Jun 2023 | 38.4% | Jun 2023 | Official leaderboard | |
| 15 | | 39.2% | Feb 2024 | Official leaderboard | |
| 16 | Claude 3.5 Sonnet | 43.8% | Jun 2024 | Official leaderboard | |
| 17 | | 46.9% | Feb 2024 | Official leaderboard | |
| 18 | | 50.8% | Feb 2024 | Official leaderboard | |
| 19 | GPT-3.5 Turbo (Mar 2023) | 57.4% | Mar 2023 | Official leaderboard | |
| 20 | | 62% | Jun 2024 | Official leaderboard | |
| 21 | | 69.4% | Apr 2024 | Official leaderboard | |
| 22 | | 79.9% | Jun 2024 | Official leaderboard | |
| 23 | | 84.3% | May 2024 | Official leaderboard | |
| 24 | | 87.5% | Jul 2023 | Official leaderboard | |
| 25 | | 88% | May 2024 | Official leaderboard | |
| 26 | | 91% | Jul 2023 | Official leaderboard | |
| 27 | Claude 3 Opus | 91% | Feb 2024 | Official leaderboard | |
| 28 | Claude 3 Sonnet | 94.5% | Feb 2024 | Official leaderboard | |
| 29 | | 96.1% | Jul 2023 | Official leaderboard | |
| 30 | Claude 3 Haiku | 96.3% | Mar 2024 | Official leaderboard | |
| 31 | Claude 2.1 | 99.8% | Nov 2023 | Official leaderboard |
Labs report scores for 3 models in their cards. Switch the scores above to rank them together.
2 models have held number one on the official leaderboard since its release in May 2024 3 models have held number one with claims included since its release in May 2024
Lab claims count from the day the card came out, independent runs from the model’s release. We draw one row each for the benchmark’s own leaderboard and what labs claim in their cards.
Sources: Official OR-Bench leaderboard and labs’ model cards
Scores over time
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Sources: Official OR-Bench leaderboard and labs’ model cards
Labs report it only in system cards
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.
3 system cards report it, from 1 lab
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Oct 23, 2026 | | 16.8 | OR-Bench false refusal rate, Muse Spark 1.3 (API) (Table 2, Figure 23). Muse system 9.3 | Robustness |
| Jul 9, 2026 | | 4.8 | OR-Bench false refusal rate, 1263 sampled prompts (Table 2, Figure 25) | Robustness |
| Jun 12, 2026 | | 8 | OR-Bench FRR, 1263 sampled prompts (Table 2, Table 19) | Robustness |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0%
- DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4%
- Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%