BioDisclose: An Actionability-Aware Benchmark for Biomedical Safety under Adversarial Elicitation

2026/07/28 by Yinuo Zhu, He Liu, Boyuan Gu
#cs.HC

paper · pdf

Abstract

Large language models (LLMs) increasingly support biomedical research, yet their behavior under adversarial requests for dual-use knowledge remains insufficiently characterized. We introduce BioDisclose, a benchmark for measuring biomedical knowledge disclosure under adversarial elicitation. BioDisclose contains 480 prompts derived from 24 expert-authored scenarios across six biomedical risk domains and four elicitation families spanning academic, historical, role-playing, and decomposed prompting. We grade model responses on a four-level scale from refusal to executable disclosure, distinguishing high-level discussion from technically specific and actionable content, including refuse-then-leak behavior. Across five deployed LLM systems, detailed-or-higher disclosure rates vary substantially, ranging from 9.2% to 64.0%. Academic framing is the most effective elicitation family on average (43.2%), while laboratory safety scenarios show the highest disclosure rate across domains (51.5%). These results reveal pronounced variation across models, prompting strategies, and biomedical risk categories, suggesting that current safeguards remain uneven in high-stakes scientific settings. BioDisclose provides a focused testbed for evaluating biomedical safety beyond binary refusal metrics.

Citations

• Adversarial Attacks on Large Language Models in Medicine
• Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models
• The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• Jailbroken: How Does LLM Safety Training Fail?
• Artificial intelligence and biological misuse: Differentiating risks of language models and biological design tools
• DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models
• Can large language models democratize access to dual-use biotechnology?
• Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study
• Large Language Models Encode Clinical Knowledge
• Affective Coherence Monitoring for Transformer-Based Language Models
• Training language models to follow instructions with human feedback

Related

• BioTIER: A Refusal Benchmark for Targeted Biological Risk Mitigation
• Distilling Large Language Models for Biomedical Knowledge Extraction: A Case Study on Adverse Drug Events
• Forbidden Science: Dual-Use AI Challenge Benchmark and Scientific Refusal Tests
• BioSecBench-Refusal: A paired metric for performance and alignment in agentic biosecurity risk assessment
• Artificial intelligence and biological misuse: Differentiating risks of language models and biological design tools