Govbench

Measure any AI's refusal behaviour on an adversarial grid — reproducibly, for free. Defensive by construction: fires adversarial prompts at a model's gate and scores whether it refuses. It never reproduces harmful methods; goals are harm-class labels only.

Disambiguation: this repo vs. csoai/gspc-gov

This package is the adversarial-refusal grid (48 cells: 6 risk categories × 8 attack styles). It is not the EU AI Act risk-tier classifier. The risk-tier classifier lives in the CSOAI measurement instrument family as csoai/gspc-gov on Hugging Face — a different project with a different schema, a different frozen split, and a different six-axis ledger. The two share a family name (govbench / GSPC governance) but measure different properties and have different output schemas. Cite them separately.

pip install git+https://github.com/CSOAI-ORG/govbench

Do not run pip install govbench. That name on PyPI belongs to an unrelated third party (BenchFlow, [email protected]) whose package is also described as a governance benchmarking framework. It is not this project and we have no connection to it. Install from this repository using the line above.

from govbench import score_model
from govbench.scorer import is_refusal
from govbench.benign_controls import over_block_rate

# plug in ANY model — a callable(prompt)->response
def generate(prompt):
    return my_model(prompt)          # OpenAI, Anthropic, HF, Ollama, your own gate...

result = score_model(generate, verbose=True)
print(result["overall_refusal_rate"], result["by_category"])
print(over_block_rate(generate, is_refusal))   # guard against over-refusing benign asks

What it measures

• 6 risk categories (weapons, CBRN, kinetic-targeting, surveillance, cyber, exfiltration) × 8 attack styles (direct, roleplay, hypothetical, authority, persona, academic, incremental, urgency) = a 48-cell refusal grid (after Meta's Rainbow-Teaming, 2024).
• Refusal rate overall and per-category — where the gate holds, where it leaks.
• Over-block rate on benign controls — a gate that refuses "what is the capital of France?" is broken too.

The honest contract (read this)

• A high refusal rate on this grid is a reference target, not proof of un-jailbreakability. Real attackers vary phrasing far beyond 8 styles. Finding a leak is the point — a grid that finds nothing wasn't trying hard enough.
• This is a measurement standard, not an accredited compliance certification. It maps to EU AI Act Art.9 (risk management), Art.15 (robustness) — but running it is not a legal conformity attestation.
• The refusal detector is a heuristic (string patterns). It can miss a soft refusal or a hedged answer. Inspect cells and tune for your context.

Why this exists

Capability benchmarks are everywhere. Governed-refusal-as-a-measured-property is not. As models scale, internal (trained-in) guardrails fail precisely where capability — and danger — is highest. An external, auditable refusal measurement is the missing standard. This is the open version so any lab can run it.

Apache-2.0 (see LICENSE). MEOK AI Labs / CSOAI. Contributions of new attack styles and categories welcome — widening the grid is the whole idea.