LearnPython

WMDP and Dual-Use Capability Evaluation

Li et al., "The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning" (ICML 2024, arXiv:2403.03218), has 4,157 multiple-choice questions across biosecurity (1,520), cybersecurity (2,225), and chemistry (412). The questions sit in the "yellow zone": proximate enabling knowledge, filtered by multi-expert review and ITAR/EAR legal compliance. The benchmark does two jobs. It is a proxy evaluation of dual-use capability, and it is an unlearning benchmark, since the companion RMU method lowers WMDP performance while preserving general capability. The 2024-2025 field narrative moved from early OpenAI and Anthropic 2024 evaluations that reported "mild uplift" over internet search, to OpenAI's Preparedness Framework v2 in April 2025 saying models are "on the cusp of meaningfully helping novices create known biological threats." Anthropic's bioweapon-acquisition trial showed 2.53x uplift, which was insufficient to rule out ASL-3.

TIME: ~60 minutesPREREQUISITES: Phase 18 · 16 (red-team tooling), Phase 14 (agent engineering)

Learning Objectives

Describe WMDP's three domains, question counts, and "yellow zone" filter criterion.
Explain RMU and why WMDP is both an evaluation and an unlearning benchmark.
Describe the 2024-2025 uplift narrative: "mild uplift" -> "on the cusp" -> "insufficient to rule out ASL-3."
Distinguish novice-relative uplift from expert-absolute capability.

The Problem

Every lab's frontier safety framework (Lesson 18) rests on one measurement problem: does model X materially advance a novice's ability to cause mass harm in bio, chem, or cyber? Measuring directly, by asking the model to actually produce harm, is illegal and unethical. So you need a proxy. The benchmark has to be one the model can't refuse, otherwise you get dishonest capability numbers, and its questions can't themselves be harmful publications.

Warm-up0/3

1. A red-team harness reports that a model refuses 98% of harmful bio prompts. Why is that a weak measure of the model's underlying dual-use capability?Warm-up

A bar chart of 100 harmful bio prompts fired at a model, 98 marked refused and 2 marked answered, with a dashed box asking whether this measures the model's bio knowledge. — Typed schematic, not captured output.

2. A four-option multiple-choice test is answered entirely by random guessing. What accuracy should you expect?Warm-up

A circle split into four equal wedges labeled A, B, C and D, with a dot marking a randomly guessed answer and a question asking the chance that the guess lands on the correct wedge. — Typed schematic, not captured output.

3. A team wants to publish a test set that probes hazardous knowledge. What is the main risk of including full step-by-step answers?Warm-up

Typed schematic, not captured output.

Check: The Problem0/1

1. Why can't you measure a model's ability to advance mass harm by asking it to actually produce that harm?Explain

Two boxes side by side, one labeled direct test, ask the model to actually cause harm, and one labeled proxy test, a scored stand-in like a quiz, with a dashed box asking why the proxy is used instead. — Typed schematic, not captured output.

The Concept

The "yellow zone"

Yellow-zone questions require proximate, enabling knowledge of a harmful process without being a direct synthesis recipe. "What reagent catalyzes step 4 of [published pathway]?" is in. "How do I make [dangerous compound]?" is out. Multiple domain experts review each question, and each is filtered for ITAR/EAR export-control compliance.

4,157 questions total:

Biosecurity: 1,520
Cybersecurity: 2,225
Chemistry: 412

The format is multiple choice. Nobody asks the model to assist with anything, so you can measure capability without eliciting harmful behaviour.

RMU: Representation Misdirection for Unlearning

RMU is the companion unlearning method. Applied to LLaMa-2-7B, it reduced WMDP scores to near-random while keeping MMLU and other general-capability benchmarks within a few percentage points. Later bio, chem, and cyber unlearning papers all use it as the baseline to beat.

The 2024-2025 uplift narrative

It plays out in three phases:

2024 "mild uplift." Early OpenAI and Anthropic Preparedness/RSP evaluations reported small advantages over internet search for novices attempting bio-adjacent tasks. The public framing was that frontier models help, but not substantially more than Google.
April 2025 "on the cusp." OpenAI's Preparedness Framework v2 reported models "on the cusp of meaningfully helping novices create known biological threats." Read that as a warning that the cusp is close, not as a capability claim.
Anthropic's 2025 bioweapon-acquisition trial. A controlled study with novice participants that measured relative success at acquisition-phase tasks. It reported 2.53x uplift, which was insufficient to rule out ASL-3 (Lesson 18). The threshold for tier 3 of Anthropic's Responsible Scaling Policy is met or approached.

Novice-relative vs expert-absolute

These two ideas get conflated, so keep them apart:

Novice-relative uplift. How much does the model help a non-expert? The effect is multiplicative. Novices know little, so even modest information produces a high relative advantage.
Expert-absolute capability. How much information does the model produce at maximum effort? An expert can extract more than a novice can, so the absolute ceiling is high.

Safety cases (Lesson 18) target both. One claim is that the model cannot give a novice enough uplift to execute. The other is that an expert cannot extract information from the model that isn't already published.

The measurement pitfall

WMDP is a capability proxy, not a deployment measurement. A model that scores high may or may not be exploitable by a novice in practice, depending on:

Elicitation resistance (how hard it is to get the capability out without tripping safety filters)
Tacit knowledge (capability that needs wet-lab skill, not information)
Execution barriers (procurement, equipment)

Anthropic's 2025 bioweapon-acquisition trial adds the novice-elicitation layer on top of WMDP-style capability. It measures actual task success rather than multiple-choice capability.

Where this fits in Phase 18

Lessons 12-16 cover attack and defense tooling on model outputs. Lesson 17 is the dual-use capability layer, the measurement that frontier safety frameworks (Lesson 18) evaluate. Lesson 30 closes the arc with the current 2026 cyber/bio/chem/nuclear uplift evidence.

Check: The Concept0/22

1. What is the yellow zone in WMDP?Define

A three-band spectrum from public knowledge on the left to a full synthesis recipe on the right marked not asked, with a dashed middle band holding the real example question about which reagent catalyzes step 4 of a published pathway, and a note that multi-expert review and an ITAR/EAR filter apply to that middle band. — Typed schematic, not captured output.

2. What is WMDP?Define

Four lettered multiple-choice option boxes feeding into a box labeled 4,157 questions total, yellow zone, which splits into three domain boxes named biosecurity, cybersecurity and chemistry with no counts shown. — Domain counts intentionally omitted; this lesson's quiz asks for them separately.

3. What does RMU, the companion method to WMDP, do?Define

A real call to apply_rmu_style_unlearning targeting cybersecurity with the function's default strength and collateral, showing cybersecurity's accuracy dropping from its baseline to the chance line, next to a box noting the general-capability domain loses only the small flat collateral amount. — Real values from main.py (seed 47). Different target domain and parameters than the quiz's other unlearning questions use.

4. What does novice-relative uplift measure?Define

Illustrative, generic numbers not from the lesson.

5. What does expert-absolute capability describe?Define

A curve of information extracted by a motivated expert across repeated attempts, rising and then flattening out near a dashed line marked ceiling, with a question asking what that ceiling equals. — Illustrative, generic numbers not from the lesson.

6. In the context of Anthropic's bioweapon-acquisition trial, what is an acquisition-phase task?Define

Typed schematic, not captured output.

7. WMDP questions get multi-expert review and one more filter. What is ITAR/EAR, the framework behind that filter?Define

A pipeline from a candidate question through multi-expert review to a dashed box labeled ITAR/EAR filter, with a question asking what kind of thing that filter is. — Typed schematic, not captured output.

8. WMDP has 4,157 multiple-choice questions. Which breakdown by domain is correct?Explain

Three domain boxes named biosecurity, cybersecurity and chemistry each marked with an unknown question count, a note that the total is 4,157, and a dashed box asking for the split. — Counts intentionally withheld here.

9. Why is WMDP built as multiple-choice questions rather than open requests for help?Explain

Two question formats side by side, an open request asking the model to explain how to do a harmful thing, and a multiple-choice item asking which of four lettered options is correct, with a dashed box asking which format risks eliciting the harmful content itself. — Typed schematic, not captured output.

10. Why is WMDP described as both an evaluation and an unlearning benchmark?Explain

A box labeled WMDP with two arrows fanning down to two dashed boxes, one named evaluation role and one named unlearning role, with a question asking how one benchmark does both. — Typed schematic, not captured output.

11. What did the 2024 phase of the uplift narrative report about frontier models?Explain

A three-point timeline labeled 2024, April 2025 and 2025 trial, with the 2024 point highlighted and a dashed box asking what the 2024 phase reported. — Typed schematic, not captured output.

12. OpenAI's April 2025 framework said models were 'on the cusp of meaningfully helping novices create known biological threats.' How should that statement be read?Explain

A three-point timeline with the April 2025 point highlighted, next to a quoted statement that models are on the cusp of meaningfully helping novices create known biological threats, with a dashed box asking how that statement should be read. — Quote as given in the stem.

13. Anthropic's 2025 bioweapon-acquisition trial reported 2.53x uplift. What did that result imply for ASL-3?Explain

A three-point timeline with the 2025 trial point highlighted, next to a box reading 2.53x uplift, with a dashed box asking what that result implied for ASL-3. — Figure as given in the stem.

14. What is the difference between novice-relative uplift and expert-absolute capability?Explain

A bar pair for a novice's success with and without model help, next to a rising-then-flattening curve for an expert's repeated attempts, with a dashed box asking how the two measures differ. — Illustrative, generic numbers not from the lesson.

15. Why can modest information produce a high novice-relative uplift?Explain

Two generic bar pairs, each showing a starting value and the same-sized boost added to it, one case starting low and one case starting high, with a question asking whether the resulting ratio is the same in both cases. — Illustrative, generic numbers not from the lesson.

16. Why do safety cases target both a novice claim and an expert claim?Explain

A box labeled safety case with two arrows pointing to two unlabeled dashed boxes, claim 1 and claim 2, with a question asking why a safety case needs two separate claims. — Typed schematic, not captured output.

17. Which of these is NOT a reason that a high WMDP score may fail to show real deployment risk?Explain

A box labeled WMDP score, high, connected by a dashed line noting several real-world factors sit in the gap, to a dashed box labeled deployment risk, with a note asking which of the four listed options is not one of those factors. — Typed schematic, not captured output.

18. After an unlearning step, a model's WMDP bio score is near-random but its MMLU score fell by 20 points. What does this suggest?Analyze

A box showing WMDP bio score at near-random next to a falling line labeled MMLU down 20 points, with a dashed box asking what the combination suggests. — Bio result as given; MMLU's starting value is illustrative, the 20-point drop is given.

19. A lab evaluates its model on bio questions through a policy-gated path that refuses most of them and reports a low score. What is the flaw?Analyze

Bio questions flowing into a box labeled policy-gated path, refuses most of them, which leads to a box reading reported score, low, with a separate dashed box asking whether this reflects capability. — Typed schematic, not captured output.

20. A model scores high on WMDP chemistry, yet novices in a trial fail to complete the matching tasks. Which explanation fits the lesson best?Analyze

A box reading WMDP chemistry score, high, next to a box reading novice trial, task failed, with a dashed box asking which explanation fits the mismatch. — Both results as given in the stem.

21. You are adding a radiological domain to a WMDP-style benchmark. Which candidate question belongs in the yellow zone?Design

The same three-band spectrum used for the yellow zone, now for a radiological domain, with a full raw-materials-to-device how-to on one outer band and no-harm-link trivia on the other, and a bare question mark over the middle band, with a dashed box asking which band a good question belongs in. — Typed schematic, not captured output.

22. You want to compare a new unlearning method against RMU on WMDP. Which pair of results should you report?Design

Two blank axes to fill.

Use It

code/main.py builds a toy WMDP-shaped evaluation harness. A mock model is tested on category-binned questions and scores are reported per domain. A simple unlearning intervention cuts the target domains' accuracy and leaks a small penalty into the rest, so you can measure the trade-off against general capability.

Check: Use It0/7

1. Why does the toy harness subtract a collateral penalty from the non-target domains after unlearning?Explain

The real source of apply_rmu_style_unlearning showing a first loop that floors target-domain accuracy and a second loop that subtracts a flat collateral from every other domain, with a dashed box asking why the second loop exists. — Real source, quoted verbatim from main.py.

2. In main.py, the baseline biosecurity accuracy is 0.72. After apply_rmu_style_unlearning(base, targets=['biosecurity', 'chemistry'], strength=0.85, collateral=0.04), what accuracy does the model have for biosecurity?Apply

The target-domain formula with biosecurity's baseline of 0.72 substituted in, and a dashed box asking for the result. — Values as given; not evaluated in this picture.

3. With the same call (targets biosecurity and chemistry, strength 0.85, collateral 0.04), what accuracy does cybersecurity end up with from a baseline of 0.80?Apply

The non-target-domain formula with cybersecurity's baseline of 0.80 substituted in, and a dashed box asking for the result. — Values as given; not evaluated in this picture.

4. The call is apply_rmu_style_unlearning(base, targets=['chemistry'], strength=0.5). Chemistry starts at 0.64. What is its new accuracy?Apply

The target-domain formula with chemistry's baseline of 0.64 and a strength of 0.5 substituted in, and a dashed box asking for the result. — Values as given; not evaluated in this picture.

5. In main.py's uplift lines, a domain measures 0.50 and the novice baseline is 0.25. What does the line print for that domain?Apply

The real uplift_pre line from main.py next to the stem's given numbers, a measured score of 0.50 and a novice baseline of 0.25, with a dashed box asking for the printed value. — Real source line; values as given, not evaluated in this picture.

6. A model_accuracy dict passed to evaluate() has no 'mmlu_general' key. Which accuracy does the harness sample from for that domain?Apply

The real evaluate() fallback line, get of domain with a default of cfg accuracy, next to a note that the model_accuracy dict passed in has no mmlu_general key, and a dashed box asking which accuracy gets used. — Real source line; the fallback value is not shown in this picture.

7. A reader sees the toy print about 3.2x for cybersecurity (0.80 / 0.25) and concludes it is more dangerous than the 2.53x in Anthropic's trial. What is wrong with that comparison?Analyze

A box showing the toy harness's ratio, 0.80 divided by 0.25 equals 3.2x, next to a box showing the Anthropic trial's reported 2.53x, with a dashed box asking whether these are the same kind of number. — Both figures as given in the stem.

Ship It

This lesson produces outputs/skill-wmdp-eval.md. Given a dual-use capability claim ("our model does not meaningfully help with bioweapons"), it audits: which benchmarks were run, which refusal path was used for evaluation (raw completion vs policy-gated), and whether novice-elicitation studies complement the multiple-choice result.

Check: Ship It0/3

1. Why does the wmdp-eval audit ask whether novice-elicitation studies complement the multiple-choice result?Explain

A box labeled WMDP score, multiple-choice result, next to a separate box labeled elicitation study, novice task trial, with a question asking why the audit checks for both. — Typed schematic, not captured output.

2. A lab reports that its RMU-treated model scores near-random on WMDP and concludes it 'does not meaningfully help with bioweapons.' What should an auditor check next?Analyze

A box reading WMDP score, near-random, RMU-treated, leading to a claim that the model does not meaningfully help with bioweapons, with a dashed box asking what the auditor checks next. — Typed schematic, not captured output.

3. A lab must support the claim that its new model does not give novices meaningful bio uplift. Which evidence package fits the lesson best?Design

A box stating the claim that a new model gives novices no meaningful bio uplift, above three unlabeled dashed boxes marked question-mark evidence, with a question asking which evidence package fits best. — Typed schematic, not captured output.

Author's Note

I'd run main.py after reading the pitfalls section, because the toy makes one of them concrete. The mock model is just a table of per-domain accuracies, and evaluate samples 200 questions per domain against it. There is no model and no real question anywhere in the file, so the numbers show how the harness reports a result, not what any model can do.

The unlearning step is where I'd spend the time. apply_rmu_style_unlearning multiplies the target accuracy by 1 - strength and floors it at 0.25, then subtracts a flat collateral from every other domain. With the strength of 0.85 that main() uses, bio and chem both land on the floor, which is the random-guess level for four options. That is the near-random result described for RMU, but here it comes from a hand-set constant. The collateral cost is also an input you choose, not something the toy measures. The real method has to earn that number on a real model.

The uplift lines divide each score by 0.25, so a model at random guessing prints as 1.00x. I'd treat that as practice at comparing against a baseline, and no more than that. It is a multiple-choice ratio against chance. The 2.53x figure from Anthropic's trial comes from measured task success, which is a different quantity, and putting the two side by side would mislead you.

Exercises

Run code/main.py. Report per-domain accuracy before and after the toy unlearning step. Explain the general-capability trade-off.
Augment the toy WMDP with a fourth domain (e.g., radiological). Specify two illustrative question types in the yellow zone. Explain why crafting such questions is harder than adding MMLU-shaped questions.
Read WMDP 2024 Section 5 (RMU methodology). Sketch a simpler unlearning approach (e.g., suppress top-k neurons for domain content) and describe its expected general-capability cost.
Anthropic 2025's bioweapon-acquisition trial reports 2.53x uplift. Describe two ways this number could be biased upward (novice sample size, task fidelity) and two downward (elicitation ceiling, model safety gating).
Articulate what a safety case for ASL-3 requires beyond passing WMDP unlearning. Name at least two complementary elicitation studies.

Key Terms

Term	What people say	What it actually means
WMDP	"the dual-use benchmark"	4,157 MCQ questions across bio/cyber/chem in the yellow zone
Yellow zone	"enabling but not synthesis"	Proximate knowledge adjacent to harmful capability without being a synthesis recipe
RMU	"the unlearning baseline"	Representation Misdirection for Unlearning; reduces WMDP scores, preserves general capability
Novice-relative uplift	"how much it helps non-experts"	Multiplicative advantage over status-quo internet search for a novice
Expert-absolute capability	"ceiling for experts"	Maximum information extractable from the model by a motivated expert
Acquisition-phase task	"steps before synthesis"	Procurement, equipment, permits. The earliest parts of a harm pathway
ITAR/EAR	"export-control compliance"	Legal frameworks that constrain publishing certain enabling knowledge