uplift study
In plain wordsAn experiment that measures how much an AI really helps people do a task — often a dangerous one, like planning a biological attack — compared with people using only ordinary resources such as the internet.
An experiment, usually a randomized controlled trial, that estimates how much access to an AI system improves human performance on a task relative to a control group with conventional resources such as web search and textbooks. In safety work the task is a proxy for serious misusemisuse, n.: People deliberately using AI to cause harm — for scams, harassment, propaganda, hacking or weapons — as opposed to harm from AI making mistakes or pursuing goals of its own. — writing a feasible plan to acquire, produce or deploy a biological or chemical agent, or carrying out a cyberattack — with participants ranging from novices to domain experts and outputs scored blind by specialists. The quantity of interest is marginal uplift: the added risk attributable to the model beyond what is already freely available. Uplift studies give more direct evidence of real-world risk than knowledge benchmarksbenchmark, n.: A fixed, shared test — a set of questions or tasks with an agreed way of scoring — used to compare AI systems with one another and to track progress over time., but are slow, costly, small in sample and ethically limited to safe proxy tasks. The same design is used for benign questions, such as programmer productivity.
Experts with model access wrote more complete protocols, but the uplift was not statistically significant.
Origin
Grew out of biosecurity red-teaming of language models in 2023. Early published examples, both released in January 2024, are a RAND red-team study of large-scale biological attacks and an OpenAI 'early warning' study of biological threat creation; neither found statistically significant uplift. In July 2025 METR applied the design to productivity, finding that experienced open-source developers took 19% longer with early-2025 AI tools.
Usage note
'Uplift' alone is jargon for any increase in capability a model confers, as in 'novice uplift'. Results depend heavily on the model version, the participants' skill and the proxy task, so a null result may not survive the next model generation.
Related
- dangerous capability evaluationdangerous capability evaluation, n.: A test of whether an AI system can do things that could cause severe harm in the wrong hands or on its own — such as helping make a bioweapon, hacking computers or copying itself.
- CBRN riskCBRN risk, n.: The danger that AI could help someone make or use chemical, biological, radiological or nuclear weapons — for example, by explaining hard technical steps an attacker could not work out alone.
- biosecuritybiosecurity, n.: Protecting people from the deliberate or careless spread of dangerous germs and toxins; in AI, making sure AI tools do not make it easier to create or release biological weapons.
- red teamingred teaming, n.: Deliberately attacking your own AI system — trying to make it misbehave, leak secrets or help with harm — so that weaknesses are found before real adversaries or users find them.
- misusemisuse, n.: People deliberately using AI to cause harm — for scams, harassment, propaganda, hacking or weapons — as opposed to harm from AI making mistakes or pursuing goals of its own.
- capability thresholdcapability threshold, n.: A level of dangerous ability — such as meaningfully helping someone make a biological weapon — that, once an AI model reaches it, obliges its developer to add stronger safeguards or hold the model back.
Sources
- Mouton, C. A., Lucas, C. & Guest, E. (2024). The Operational Risks of AI in Large-Scale Biological Attacks: Results of a Red-Team Study. RAND Corporation.
- Becker, J., Rush, N., Barnes, E. & Rein, D. (2025). Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity. METR.
Mentioned in
biosecuritybiosecurity, n.: Protecting people from the deliberate or careless spread of dangerous germs and toxins; in AI, making sure AI tools do not make it easier to create or release biological weapons., capability thresholdcapability threshold, n.: A level of dangerous ability — such as meaningfully helping someone make a biological weapon — that, once an AI model reaches it, obliges its developer to add stronger safeguards or hold the model back., CBRN riskCBRN risk, n.: The danger that AI could help someone make or use chemical, biological, radiological or nuclear weapons — for example, by explaining hard technical steps an attacker could not work out alone., dangerous capability evaluationdangerous capability evaluation, n.: A test of whether an AI system can do things that could cause severe harm in the wrong hands or on its own — such as helping make a bioweapon, hacking computers or copying itself., human evaluationhuman evaluation, n.: Judging an AI's outputs by asking people to rate or compare them, because for many tasks — writing, conversation, translation — no automatic score captures quality well., hypothesis testinghypothesis testing, n.: A formal procedure for deciding whether data show a real effect or could easily be explained by chance — for instance, whether one AI model is genuinely better than another., capability elicitationcapability elicitation, n.: The work of drawing out the best an AI can do on a test — with better instructions, tools, retries or extra training — so that its abilities are not underestimated., marginal riskmarginal risk, n.: How much extra danger an AI model adds compared with what people could already do without it — for instance with search engines, textbooks or models that are already freely available., uplift modelinguplift modeling, n.: Predicting not who will buy, recover or respond, but whose behavior will actually change because of an action such as a discount or a treatment, so that it is offered only where it makes a difference., Virology Capabilities TestVirology Capabilities Test, prop. n.: A hard test of practical laboratory virology know-how, used to check whether AI models know enough about working with viruses that they might help someone misuse biology., WMDPWMDP, prop. n.: A multiple-choice test of AI knowledge that could help someone make biological, chemical or cyber weapons, built from questions near the dangerous line but not over it, and used to test ways of erasing such knowledge.