RealToxicityPrompts
Models continue 100,000 web text prompts. Scored on the rate of toxic generations judged by a toxicity classifier.
Labs use different classifiers and sampling, so rates rarely compare across reports.
- Made by
- Allen Institute for AI and University of Washington
- Released
- September 2020
- Kind
- Refusing harmful requests
- Level
- Everyday
- Scored
- Graded by a model
- Answers
- Open-ended
- Tasks
- All public
- Strongest model tested
- GPT-4 Mar 2023 #180 on the capability index
- Last in a system card
- September 2025
- Last model added
- September 2025
In the authors’ words
Pretrained neural language models (LMs) are prone to generating racist, sexist, or otherwise toxic language which hinders their safe deployment. We investigate the extent to which pretrained LMs can be prompted to generate toxic language, and the effectiveness of controllable text generation algorithms at preventing such toxic degeneration. We create and release RealToxicityPrompts, a dataset of 100K naturally occurring, sentence-level prompts derived from a large corpus of English web text, paired with toxicity scores from a widely-used toxicity classifier. Using RealToxicityPrompts, we find that pretrained LMs can degenerate into toxic text even from seemingly innocuous prompts. We empirically assess several controllable generation methods, and find that while data- or compute-intensive methods (e.g., adaptive pretraining on non-toxic data) are more effective at steering away from toxicity than simpler solutions (e.g., banning "bad" words), no current method is failsafe against neural toxic degeneration. To pinpoint the potential cause of such persistent toxic degeneration, we analyze two web text corpora used to pretrain several LMs (including GPT-2; Radford et. al, 2019), and find a significant amount of offensive, factually unreliable, and otherwise toxic content. Our work provides a test bed for evaluating toxic generations by LMs and stresses the need for better data selection processes for pretraining.
Apertus 70B leads with 0.20%
Best score per model as labs report them in their own cards. Labs pick their own settings, so these compare less cleanly than independent runs.
- 1
Apertus 70B 0.20%
- 2 GPT-4 Mar 2023 0.73%
Source: Labs’ model cards
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | | 0.20% | Sep 2025 | Lab model card | |
| 2 | GPT-4 Mar 2023 | 0.73% | Mar 2023 | Lab model card |
Scores over time
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Source: Labs’ model cards
Labs report it only in system cards
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.
6 system cards report it, from 3 labs
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Sep 17, 2025 | | 0.2 | RealToxicityPrompts LlaMA-Guard3 Subsampled, a 10% subsample with a Llama-Guard-3-8B classifier, lower is better (Table 26) | Safety |
| Jul 31, 2024 | | 8.25 | RealToxicity, avg tox (lower is better), IT (Table 18) | Safety |
| Jul 31, 2024 | | 8.84 | RealToxicity, avg tox (lower is better), IT (Table 18) | Safety |
| Mar 13, 2024 | | 7.9 | RealToxicity, average toxicity (lower is better), IT (Table 8) | Safety |
| Mar 13, 2024 | | 6.86 | RealToxicity, average toxicity (lower is better), IT (Table 8) | Safety |
| Mar 14, 2023 | GPT-4 technical report | 0.73 | RealToxicityPrompts, toxic generations rate (6) | Safety |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0%
- DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4%
- Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%