HelpBench: Assessing the Ability of LLMs to Provide Privacy, Safety, and Security Advice
Source: arXiv:2606.24819 · Published 2026-06-23 · By Sarah Meiklejohn, Sunny Consolvo, Patrick Gage Kelley, Tara Matthews, Sai Teja Peddinti, Renee Shelby et al.
TL;DR
HelpBench addresses the critical problem of evaluating whether large language models (LLMs) can reliably provide accurate and safe advice in the domains of digital privacy, safety, and security (PSS). The benchmark consists of 450 curated authentic user questions across nine PSS topics, each paired with a detailed expert-developed rubric to evaluate both factual accuracy and delivery qualities such as tone and clarity. By applying an automatic rating system built around these rubrics, the authors measured responses from 18 state-of-the-art LLMs, including GPT, Claude, Gemini, and others.
The study finds that while LLMs achieve high average scores (~82%), there remains a concerning long tail of poor responses — about 1 in 10 model answers score below 65%, indicating incomplete, inaccurate, or potentially harmful advice. Performance varies by topic with the best results on scam-related queries (~88%) and weakest on moderation tools (~77%). The analysis also surfaces key failure modes such as lack of context awareness in safety-critical situations, incorrect risk assessments, non-scalable or costly remediation advice, and tone escalation that could harm user trust or safety. These findings highlight that LLMs are promising but currently insufficiently reliable for standalone PSS advice and that work remains to refine model factuality, nuance, and ethics in this sensitive domain.
Key findings
- HelpBench includes 450 manually curated questions covering nine PSS topics sourced from Reddit (2021-2024).
- Average model score across all 18 LLMs and questions is 82%; best performing model (GPT 5.0) scores 87%.
- Approximately 10–14% of model responses score below 65%, indicating harmful or inaccurate advice.
- Performance varies significantly by topic, with scams questions scoring highest (~88%) and moderation tools lowest (~77%).
- Model family and version impact accuracy modestly; Qwen 3.6 Plus improved by 16% over Qwen 3 baseline.
- Factual criteria correlation to expert scores is high (Pearson r=0.96), delivery criteria less so (r=0.78).
- Models frequently fail on subtle safety and ethical nuances, e.g., ignoring risk of triggering escalation in abuse cases.
- Common model failures include unsubstantiated speculation, tone escalation, recommending costly or non-scalable solutions.
Threat model
The adversary is not a malicious actor attempting to subvert LLMs, but rather the inherent risk stemming from inaccurate, incomplete, or harmful advice generated by models upon honest users seeking help for privacy, safety, and security issues. The assumption excludes deliberate adversarial prompt engineering or attempts to bypass model filters. Instead, the goal is to measure the real-world risk of LLM advice causing harm when given imperfect knowledge or missing contextual cues.
Methodology — deep read
The study’s threat model assumes honest users seeking privacy, safety, and security advice from LLMs without malicious intent, focusing on inadvertent inaccuracies rather than adversarial manipulation. The adversary is therefore model limitations rather than an active attacker.
Data provenance involves extracting 450 questions from a 3 million Reddit post dataset labeled for PSS relevance between 2021 and 2024. Questions were selected to cover nine PSS topics (e.g., accounts, harassment, scams) with stratified sampling to ensure diversity in length, topic, help type (sensemaking vs guidance), and whether users had tried any prior remediation steps. All questions were manually rephrased to protect privacy and adapt for LLM interaction style.
Each question was paired with a detailed evaluation rubric created collaboratively by PSS domain experts with 10+ years experience. The rubrics assign weighted positive and negative criteria focused on factual accuracy, risk assessment, and appropriate tone/delivery. Rubrics were iteratively refined including prompt engineering with Gemini 2.5 Flash and calibration against human expert scores.
The evaluation pipeline applies an auto-rater prompt to LLM-generated answers. 18 models across 7 families (GPT, Claude, Gemini, Grok, DeepSeek, GLM, Qwen) were queried five times per question in chat mode with default parameters, resulting in 40,500 responses. The auto-rater scores responses across all rubric criteria and aggregates results.
Metrics include the rubric score (0-100%), broken down by positive factual, negative factual, positive delivery, and negative delivery criteria. Statistical tests verify significance of model/version differences and correlations. Topic- and question-level breakdowns are presented alongside standard deviations to capture variance.
Reproducibility is supported by detailed rubric descriptions, prompts, and performance breakdowns in appendices. However, the underlying Reddit dataset collection is private. The auto-rater prompt and rubric templates are publicly described, enabling approximate replication.
A concrete example: For a question about how Tor bridges conceal Tor usage, the rubric includes points for stating bridges are hard to get comprehensively, that pluggable transports disguise traffic, and that governments can block bridges but cannot easily block all. LLM answers are scored by presence/absence of these key facts and by tone criteria. This structured scoring enables objective and nuanced evaluation.
Overall, the methodology balances domain expertise with automation, leveraging a realistic, diverse, and privacy-preserving dataset of user queries. The paper acknowledges limitations such as potential overlap with model training data, and aspects of help seeking (multimodal, multiturn) not yet covered.
Technical innovations
- Curated a high-quality, multi-topic benchmark of 450 real user privacy, safety, and security questions drawn from Reddit with rich annotations for question type, length, and prior practices.
- Developed per-question expert rubrics with positive and negative weighted criteria capturing both factual accuracy and delivery factors like tone and relevance.
- Constructed an auto-rater leveraging large model prompts that achieves high correlation (r=0.85) with human expert rubric scores to enable scalable, repeatable evaluation of 18 LLMs on 40,500 responses.
- Executed a thorough empirical evaluation comparing 18 state-of-the-art LLM variants across multiple families, quantifying nuanced failure modes in PSS advice.
- Analyzed how question topic, phrasing, presence of prior practices, and help need type impact LLM performance in a privacy-sensitive domain.
Datasets
- Reddit PSS posts dataset — ~3 million posts — private dataset collected 2021-2024 with multi-label PSS annotations
Baselines vs proposed
- GPT 5.0: average rubric score = 87% vs overall average across 18 models: 82%
- Gemini 3 Flash: 84% vs overall average 82%
- Claude Opus 4.6: 84% vs overall average 82%
- Qwen 3: 83% vs Qwen 3.6 Plus improved to 83% (16% improvement over Qwen 3 original)
- Grok 4: 83% vs Grok 4.20 regression to 79%
- Models vary in positive factual criteria met from 79% (Grok 4.20) to 89% (Grok 4)
- Negative delivery criteria worst for Qwen 3 (86%), improved to 34% in Qwen 3.6 Plus
Limitations
- Possibility of benchmark questions or similar variants appearing in model training data, artificially inflating scores despite rephrasing.
- Rubrics do not capture every conceivable misconception or future platform changes—PSS advice advice can become obsolete quickly.
- Evaluation focuses on single-turn, text-only questions and answers; does not cover multiturn, multimodal, or multilingual help seeking.
- Expert rubric ratings may differ from typical non-expert user perceptions of helpfulness or tone.
- Analysis does not include active adversarial evaluation or prompt injection attacks on model safety.
- Models sometimes produce non-scalable, costly, or ethically problematic advice that rubrics may only partially penalize.
Open questions / follow-ons
- How can LLMs better incorporate and reason about at-risk user contexts such as technology-facilitated abuse to avoid triggering physical harm?
- What are effective methods for integrating multi-turn, interactive dialogue to improve guidance and risk assessment in sensitive PSS scenarios?
- How can benchmarks be expanded to multimodal inputs (e.g., screenshots, logs) and multilingual realistic datasets beyond English Reddit posts?
- What frameworks can systematically evaluate the ethical consistency and platform policy alignment of LLM-generated PSS advice?
Why it matters for bot defense
Bot-defense and CAPTCHA practitioners aiming to integrate or evaluate LLM assistance modules for user security queries can use HelpBench to rigorously assess model advice quality in critical privacy, safety, and security contexts. The benchmark highlights that while current state-of-the-art models provide generally good guidance, their long tail of unsafe or inaccurate answers poses risk if deployed without safeguards.
Developers should consider embedding HelpBench-like evaluation procedures as part of their LLM validation pipelines, especially focusing on domain-specific factuality, safety nuances, and tone appropriateness. Furthermore, the research underscores the importance of coupling LLM advice with external expert oversight, escalation paths, or trusted ecosystem partners to ensure harmful or costly suggestions are mitigated. This work also informs the design of question filtering, moderation, or answer auditing stages to enhance user trust and safety when combining automated advice with bot defense or automated support flows.
Cite
@article{arxiv2606_24819,
title={ HelpBench: Assessing the Ability of LLMs to Provide Privacy, Safety, and Security Advice },
author={ Sarah Meiklejohn and Sunny Consolvo and Patrick Gage Kelley and Tara Matthews and Sai Teja Peddinti and Renee Shelby and Lenin Simicich and Kurt Thomas },
journal={arXiv preprint arXiv:2606.24819},
year={ 2026 },
url={https://arxiv.org/abs/2606.24819}
}