AI safety evaluations change with how you measure — chat UI versus API, search on or off, and repeated runs all move the result for the same model
An audit of one of the most widely used LLMs comparing two access modalities — the chat UI and the API — with and without web search, across repeated runs. Enabling web search reduced accuracy by up to 8 percentage points, and repeated runs of the same prompt produced inconsistent responses in up to 21% of prompts.
Paper overview (our summary)
- Field (arXiv category)cs.HC（+1）
- AuthorsRo Encarnación, Tina Behzad, Emma Lurie, et al. (4)
- Submitted2026-08-06
- arXiv ID2608.06202v1
Key points
- An audit using 401 prompts stratified from BBQ and SafetyBench, comparing chat UI and API with and without web search, collecting 4,812 responses across three runs.
- Enabling web search reduced accuracy by up to 8 percentage points and reversed the modality comparison on one benchmark.
- Repeated runs of the same prompt produced inconsistent responses in up to 21% of prompts.
- With search disabled, chat UI responses were less accurate than API responses on both benchmarks.
- The two modalities grounded answers in different citations, and abstention behavior was inconsistent across both.
1The same model shows a different face depending on how you look
Is a model safe, reliable, ready to deploy? Benchmark scores are routinely used to answer. But those scores are usually produced through one access path, one run per prompt, reporting accuracy alone. This paper checks whether that premise holds. It puts the same model behind two access modalities — the chat UI and the API — toggles web search on and off, and runs each prompt three times.
2The scale of the audit, and the gaps it found
What the numbers show is that changing one condition can move the conclusion. Enabling web search lowered accuracy, and on one benchmark it reversed the direction of the modality comparison outright. Search is an ordinary condition in deployment; if it is absent from the evaluation design, what the evaluation measures drifts away from how the system is actually used.
3What accuracy alone conceals
The dimensions the paper places outside standard performance measures are response consistency, response text similarity, citation grounding and abstention behavior. The two modalities grounded their answers in different citations, and abstention behavior was inconsistent across both. With search disabled, chat UI responses were less accurate than API responses on both benchmarks.
Even within a single model family, reporting only simple accuracy can obscure important forms of behavioral variation relevant to AI safety assessment — that is the authors' argument.
4Research aimed at the method rather than the model
Of the 1,900 arXiv papers this site holds as of 2026-09-02, 13 have cs.HC as their primary category. The distribution is led by cs.CV at 482, cs.LG at 377, cs.AI at 364 and cs.CL at 254, so most work targets models and methods themselves. This paper targets the evaluation procedure instead.
The authors argue that AI safety evaluations should systematically account for modality, multi-run consistency, search conditions and response-level behaviors. This article is our own summary and does not warrant the correctness of the claims.
Why it matters
It is a caution against selecting models or assessing risk on benchmark scores alone. For internal evaluation design it yields a concrete instruction: use the same access path and search settings as the real deployment, and run each prompt several times to measure consistency.
FAQ
Why would the chat UI and the API differ?
Does this mean evaluations are meaningless?
Sources (primary)
Source: arXiv (descriptive metadata is CC0 public domain). Summaries are our own; see arXiv for the original text and PDF.
- arXiv abstract page (original, official)
- PDF (arXiv)
- arXiv ID: 2608.06202