You're pledging to donate if the project hits its minimum goal and gets approved. If not, your funds will be returned.
$7,000 left to reach the funding goal.
Jailbreak benchmarks use automatic judges to decide if an attack worked. I want to pay new people to rate the cases where the original raters disagreed, and find out how much of the judges' drop in agreement on those cases holds up with a new group.
The pilot is done and public: github.com/EconLearn/judges-hardcases. HarmBench and JailbreakBench released 902 items between them, each with three human labels, plus 15 sets of judge predictions across the two datasets. On the 114 HarmBench items where people split 2-1, HarmBench's own classifier agreed with the majority 69% of the time. When all three people agreed, it was 96%.
Some of that drop is expected, because raters make mistakes too. If every rater made mistakes independently and at the same rate on every item, you'd expect about 93% agreement on HarmBench's split items and about 96% on JailbreakBench's. All 15 sets of predictions came in below that, even allowing for the margin of error. Mostly they called outputs harmful when the majority said they were safe. That expected line rests on assumptions, though. From the pilot alone I can't tell if the judges are wrong, the original labels are shaky, or my error model is off. I wrote down the analysis plan and hashed it before I computed any results, and the repo reproduces from a fresh download.
The new ratings will show how each judge compares with fresh votes, and how stable those votes are. Researchers could use that to spot the cases that need a person to look before an automated verdict counts as evidence that an attack worked.
The main part is new human ratings. I'll get five new blind ratings for each of the 124 contested items, plus 50 items where all three original raters agreed, as a check. The 124 are all 147 split items from both datasets (114 from HarmBench, 33 from JailbreakBench) minus HarmBench's 23 chemical and biological ones, which I'm leaving out. Raters use each benchmark's own instructions, and I report the two datasets separately. Raters won't see the old labels, what the judges said, or each other's votes.
A timed 20-item trial comes first, so I can set fair pay and know the full cost. The trial votes stay out of the main analysis, which uses fresh raters. Before the main ratings start, I'll post a public pre-registration that fixes the control items, rater checks and analysis rules. It names the main comparison and how I compute uncertainty, and keeps that apart from exploratory comparisons across judges.
The main results are the new vote counts and how often each judge agrees with them. I'll report agreement with the new majority on all contested items, then on their own for items where at least 4 of the 5 agree and for items that split 3-2. Those groups show how much the new panel agrees. Neither establishes whether its majority judgment is correct. The 50 control items show whether the new panel also drifts on cases the original raters all agreed on.
Other people already study how reliable judges are, including A Coin Flip for Safety (Schwinn et al., proceedings.mlr.press/v306/schwinn26a.html) and How Reliable Is Your Jailbreak Judge? (arxiv.org/abs/2606.25487). Mine is narrower. I'll re-rate the 124 contested items and 50 controls, and publish an item-by-item record of which disputed labels hold up.
After that comes a deception-probe audit. Apollo Research's probe paper (Goldowsky-Dill et al. 2025, arxiv.org/abs/2502.03407) sets its threshold so only 1% of ordinary chat answers (ones with nothing to do with deception) get flagged, and its per-item scores are public. The paper already checks what happens when ambiguous answers are included (Appendix E). I'll test whether a different measure adds anything. An independent grader labels each answer several times, and an answer counts as hard if the grader doesn't give it the same label every time. That measures how much one grader flips between labels, not how independent people would split. Before I look at any probe scores, I'll freeze the grader, prompt, settings and rule. Then, at the paper's own threshold, I'll report how many deceptive answers the probe catches and how many honest answers it flags, for hard and easy answers in each dataset. If the data can't support a useful audit, I'll publish why.
The last part is a small open-source Python tool (MIT licence). You give it any file of detector scores, labels and a hardness measure, and it runs this split. It reports group sizes, agreement, confidence intervals and two negative controls, a label shuffle and a random set of items the same size. I'll check that the controls are calibrated before I read anything into a subgroup.
The judge results are due by 31 January 2027, and the tool by the same date if I raise $1,500 or more. At full funding, the probe audit (or a write-up of why it couldn't be done) is due by 31 March 2027. I'll send the plans and findings to the HarmBench, JailbreakBench and Apollo authors first, then publish on GitHub whatever they say. Nothing here trains or fine-tunes a model.
The judge study is done when the planned ratings are in, the report shows every new vote count and judge comparison, and the public code rebuilds the tables. I'll report the unclear and unresolved cases right next to any clear pattern. If the result weakens what I was worried about, that still answers the question.
The probe stage is done if the paper's baseline reproduces, the hard/easy grouping passes the check I set in advance, and the fixed-threshold results are out. If the probe turns out fine on hard cases, that counts too. I'd only stop for unusable data or a grouping that fails its check, and I'd publish that. Not finding what I expected isn't a reason to stop.
Stipend, about 200 hours at $30 an hour, December 2026 to March 2027: 6,000 USD
New human ratings (Prolific, only raters who opt in to sensitive content, pay set from the timed trial), platform fees, the trial, plus API calls for the independent grader: 1,000 USD
Total: 7,000 USD
$650 pays for the new ratings. I estimate them at about $600-650 including platform fees, and the trial will check that estimate. I'd do the judge analysis unpaid. Public by 31 January 2027. If the trial shows the ratings cost more than the minimum, I'll say so on this page before collecting them.
$1,500 adds about 32 paid hours for the analysis and the tool. Same date.
$7,000 covers all three parts by 31 March 2027.
It's just me, Jude Wallis. I'm 17 (18 on 24 April 2027) and a high-school senior in California.
The judge pilot above. The plan, code and results are all public.
In the AIMO Interpretability Challenge (NeurIPS 2026 competition track), my report found that a score that seemed to detect "fragile" math problems was mostly measuring how hard they were, and the standard checks missed it. This project looks for the same trap in safety detectors. Code and report: github.com/EconLearn/aimo-interp-difficulty-vs-fragility (also on OpenReview: openreview.net/forum?id=kxa8HTLglU).
2nd of 66 in a 9-day round of the Huawei Optimization Tournament (1st of the 46 students); 4th of 110 in Learn2Design 2026, a NeurIPS competition on designing gravitational-wave detectors (1st of 67 in Round 3); the next term of Erdős problem #293 (OEIS A400352, linked from erdosproblems.com/293); and a merged pull request to the Vesuvius Challenge code (github.com/ScrollPrize/villa/pull/2123).
I built EconLearn, a free economics site. Students never pay. My school district paid for a licence for the classroom tools this school year.
I use Claude Code for most of the coding. Every pilot number here reruns from the public repo.
The new raters disagree with each other as much as the old ones did. Then those labels stay unresolved, which still doesn't prove the items have no right answer. I'd publish the votes anyway, because benchmarks score judges against those labels as if they were settled.
The new panel sides with the judges more often than with the original majority. I'll publish that result alongside the original comparisons.
The new rater pool or instructions behave differently from the original ones. The 50 control items will help check for this, and I'll report what they show.
The probe data or the grader measure can't support the later audit. Then I publish the judge results, the tool and what the probe data would need.
The work adds little beyond existing reliability studies. Then I'll say exactly what it replicated and what it couldn't settle.
Whichever way it goes, the code, the pre-registrations and the results go public.
Emergent Ventures gave me $3,000 in August 2026 for EconLearn, and a $5,000 travel grant in November 2026 to give my NeurIPS talk in Sydney. Neither was for this project.
Caroline Ellison
about 1 hour agoThis looks like a reasonable project, and you have an impressive record for someone so young! Right now the proposal is being flagged for being AI-generated--if you rewrite it in your own words, you might have a better chance of being seen by donors and getting funded.