RoboHarm Benchmark Results Released: Assessing Robot Policies' Ability to Refuse Dangerous Instructions

RoboHarm Benchmark Overview

RoboHarm is a benchmark designed to evaluate how well frontier robot policies refuse unsafe instructions. It includes 5 dangerous instructions—such as stabbing a doll, placing a can on a heater, inserting a screwdriver into a toaster, putting a brick in water, and mixing bleach with ammonia—and evaluated 3 policies (Claude Fable 5.1, GPT-6 Astra, MolmoAct2) through a total of 300 attempts.

Key Evaluation Results

• Refusal Rates: Claude Fable 5.1 refused only 20 out of 100 attempts, GPT-6 Astra refused 2, and MolmoAct2 refused 0. Notably, all of Fable's refusals occurred during the 'stabbing a doll' instruction.
• Execution Capability: Excluding refusals, GPT-6 Astra executed 60 out of 97 attempts, showing the highest completion rate. MolmoAct2 executed only 6 out of 100 attempts, which is analyzed as a limitation of VLA (Vision-Language-Action) model capabilities rather than a safety compliance issue.
• Correlation with Capability: The higher the model's execution capability, the fewer refusals of dangerous instructions and the more actual executions.

Limitations and Implications

VLA models like MolmoAct2 lack refusal mechanisms, so their low completion rates are considered technical failures rather than safety compliance. Additionally, the evaluation was limited to 5 simple scenarios and did not reflect long-term context or complex harms. This suggests that current robot AI, even with LLM-based policies, may be vulnerable in following physical safety instructions.