Technical Summary: HelpBench

Problem Statement

Large Language Models (LLMs) are increasingly used by individuals to seek assistance regarding digital privacy, safety, and security (PSS). While prior research has explored LLM capabilities in generating passwords, parsing policies, and detecting vulnerabilities, significant gaps remain. Existing studies indicate that LLMs often fail to refute misconceptions, generate insecure credentials, struggle with sensitive safety topics, and lack accurate mental models regarding sensitive information disclosure. Crucially, there is a lack of benchmarks specifically designed to evaluate the quality of advice provided to honest users seeking help. Unlike safety benchmarks focused on preventing policy violations or adversarial jailbreaks, the PSS domain requires evaluating whether models provide factually accurate, context-aware, and non-harmful advice to users in genuine distress. Flawed advice in this domain carries high stakes, potentially leading to compromised accounts, financial loss, or physical harm.

Methodology

The authors introduce HelpBench, a benchmark comprising 450 manually curated questions derived from authentic user situations on Reddit. The methodology involves four primary stages:

1. Question Curation and Construction

• Source: Questions were drawn from a dataset of three million Reddit posts (2021–2024) previously identified as PSS-related.
• Topics: The 450 questions cover nine distinct categories: Accounts, Moderation Tools, Security Tools, Privacy Tools, Compromise, Platform Actions, Scams, Harassment, and Data Concerns.
• Stratification: To ensure diversity, the selection process balanced questions across:
  • Length: Short (<333 chars), Medium (333–666 chars), and Long (666–1000 chars).
  • Practices: Whether the user mentioned prior PSS practices (e.g., running antivirus scans).
  • Need Type: "Sensemaking" (understanding a situation) vs. "Guidance" (actionable steps).
• Privacy and Rephrasing: To protect user privacy and prevent memorization, all questions were rephrased using an LLM (Gemini 2.5 Flash) and manually verified. This process removed personally identifiable information (PII), adjusted context for an LLM audience (removing forum-specific greetings), and ensured semantic equivalence while minimizing lexical similarity (average 3-gram overlap of 0.04).

2. Evaluation Rubric Development

For each of the 450 questions, the authors developed a specific evaluation rubric.

• Expert Involvement: Six researchers, each with over a decade of PSS expertise, collaborated to create these rubrics.
• Structure: Rubrics consist of 5–15 criteria assigned point values (+1 to +5 for inclusion, -1 to -5 for exclusion).
  • Factual Criteria: Assess the accuracy of technical information (e.g., "States that Tor bridges do not conceal use of Tor").
  • Delivery Criteria: Assess tone, relevance, and clarity (e.g., "The most important information is at the beginning," "Avoids overwhelming the user").
• Scoring: A response's score is calculated as the sum of points for met positive criteria and avoided negative criteria, divided by the maximum possible points.

3. Automatic Evaluation (Auto-Rater)

To scale evaluation across 18 state-of-the-art LLMs, the authors developed an auto-rater.

• Process: The auto-rater uses an LLM (Gemini 2.5 Pro) to apply the human-developed rubrics to model responses.
• Calibration: The auto-rater was iteratively refined by comparing its scoring against human expert scores on random subsets.
• Performance: The final auto-rater achieved a Pearson correlation of 0.85 with human scores (0.96 for factual criteria, 0.78 for delivery criteria).

4. Experimental Setup

• Models Evaluated: 18 models from seven families (ChatGPT, Claude, Gemini, Grok, DeepSeek, GLM, Qwen).
• Procedure: Each model was queried five times per question using default parameters and chat interfaces.
• Scale: This resulted in 40,500 total responses (2,250 per model).

Key Results

The evaluation of 18 models yielded the following findings:

• Overall Performance: Models achieved an average score of 82%. The best-performing model was GPT 5.0 (87%), while the lowest was Qwen 3 (67%).
• The "Long Tail" of Failure: Despite high averages, 1 in 10 responses (14%) scored below 65%. This indicates a significant long tail of incorrect or harmful advice. For example, Qwen 3 produced 800 responses below the 65% threshold, while GPT 5.0 produced 156.
• Topic Variance: Performance varied significantly by topic.
  • Easiest: Scams (88% average).
  • Hardest: Moderation Tools (77% average).
  • Models showed statistically significant differences in performance across topics for 17 of the 18 models.
• Factual vs. Delivery:
  • Models generally performed well on positive factual criteria (avoiding misinformation).
  • However, failures often stemmed from negative delivery criteria (e.g., overwhelming the user, escalating tone) or negative factual criteria (e.g., confirming misconceptions).
  • GPT 5.0 avoided negative factual criteria best (7%) but was least likely to satisfy positive delivery criteria (82%).
• Model Evolution: Within model families, performance improvements were marginal or non-existent between versions (e.g., GPT 4.1 vs. 5.0 showed a 3% difference; some versions regressed). Model size (e.g., Opus vs. Sonnet) had a minor impact (1–2% difference).
• Context Sensitivity: Models struggled with questions involving existing user practices or complex safety contexts. For instance, many models failed to recognize that creating multiple accounts to recover a frozen one is a security flag.

Characterization of Low-Quality Responses

The paper identifies specific patterns in the 14% of responses scoring below 65%:

1. At-Risk Context Failures: Models failed to recognize high-stakes scenarios (e.g., domestic violence), offering technical advice that could escalate physical danger (e.g., suggesting a victim wear a disguise to a store to hide from an abuser).
2. Overlooked Risks: Models provided false reassurance, such as claiming that moving a file to a cryptographic vault securely deletes the original, or dismissing location tracking as mere intimidation.
3. Non-Scalable Solutions: Suggesting unsustainable actions like contacting a platform's VP directly or launching "shaming" campaigns.
4. Cost-Prohibitive Advice: Recommending extreme measures like buying a new device or opening a new bank account for issues that could be resolved with simpler steps.
5. Safety Circumvention: Some models adopted a value-neutral stance on Terms of Service violations, effectively outsourcing ethical decisions to the user.
6. Tone Escalation: Models often used inflammatory language ("horrifying," "traumatic") for neutral queries, violating trauma-informed computing principles.

Significance and Claims

The authors claim that HelpBench is the first benchmark to evaluate LLMs on honest user help-seeking in the PSS domain, moving beyond adversarial safety tests.

• Critical Gap: The paper argues that current models are not yet ready to serve as trustworthy, scalable sources of bespoke PSS advice. The existence of a "long tail" of harmful advice (1 in 10 responses) is unacceptable given the potential for real-world harm.
• Benchmark Utility: HelpBench serves as a tool to isolate harmful behaviors and track progress in domain expertise. It highlights that improvements are needed not just in factual accuracy, but in delivery, context awareness, and ethical consistency.
• Future Directions: The authors suggest that future work must address multimodal inputs (e.g., screenshot analysis), multi-turn dialogues for crisis intervention, and multilingual support. They emphasize that models must integrate with broader socio-technical ecosystems (e.g., routing users to human advocacy groups) rather than acting as standalone arbiters of safety.

The paper concludes that while LLMs provide high-quality advice on average, the inconsistency and potential for harm in specific contexts necessitate continued rigorous evaluation and the development of safer interaction paradigms before these models can be fully trusted for critical PSS needs.