Skip to content

Summary — LabSafety Bench: Benchmarking LLMs on Safety Issues in Scientific Labs

This paper (Zhou et al., 2025; published in Nature) introduces LabSafety Bench, a comprehensive benchmark for evaluating LLM performance on laboratory safety tasks across biology, chemistry, and physics. The benchmark encompasses 765 multiple-choice questions (632 text-only, 133 with images) and 404 realistic lab scenarios generating 3,128 open-ended tasks. Evaluations across 19 advanced LLMs and VLMs reveal that current models fall well short of safety-critical reliability thresholds.

Benchmark Structure

LabSafety Bench evaluates three complementary safety competencies:

  1. Knowledge assessment (MCQs): structured questions aligned with OSHA protocols covering hazardous substances, equipment handling, radiation hazards, electrical safety, emergency response, and PPE use
  2. Hazard identification (scenario-based): open-ended identification of all safety issues in realistic lab scenarios, covering most common hazards, improper operation issues, negative lab environment impacts, and most likely safety incidents
  3. Consequence identification (scenario-based): predicting the outcome of specific unsafe actions in realistic contexts

Key Findings

No Model Exceeds Safety Thresholds

On structured MCQs, proprietary models achieve over 70% accuracy (GPT-4o highest at 86.55%), but no model surpasses 70% on the more demanding hazard identification task. This gap between structured knowledge recall and applied safety reasoning represents a fundamental limitation for real-world deployment.

Misaligned Safety Priorities Are the Primary Failure Mode

The most prevalent error across all models is misalignment of safety priorities — models overemphasise certain perceived high-risk hazards while neglecting other relevant dangers. Even top models like GPT-4o fabricate non-existent hazards, underestimate the need for protective equipment, and over-generalise scenarios. This directly connects to hallucination risks in safety-critical contexts.

Model Scale Does Not Guarantee Safety

Larger, newer, or reasoning-enhanced models do not reliably outperform smaller ones on safety tasks. In hazard identification, the smaller GPT-4o-mini outperformed both the larger GPT-4o and the reasoning-enhanced o3-mini. This finding challenges the assumption underlying capability-gradient that general capability improvements translate to domain-specific safety.

RAG Is Often Detrimental

Standard retrieval-augmented generation (see retrieval-augmented-generation) was largely ineffective and often harmful for lab safety tasks. Most models, including GPT-4o and DeepSeek-R1, showed accuracy declines with RAG. The paper attributes this to "contextual distraction" — retrieved context, though factually accurate, distracts from the subtle safety cues needed for nuanced reasoning. This finding is particularly important for safety-critical systems that rely on RAG for knowledge grounding.

Chain-of-Thought and Few-Shot Often Hurt Performance

For larger models, CoT reasoning and few-shot examples frequently decreased safety performance. CoT can exacerbate hallucination, while few-shot examples add unhelpful complexity. Only smaller open-weight models benefited from hints and examples, likely because they lack sufficient safety knowledge in their base training. This is a cautionary finding for system designers who might assume that explicit reasoning prompts always improve safety.

Fine-Tuning Is Effective for Smaller Models

Supervised fine-tuning on LabSafety Bench data improved smaller model (Llama-3-8B) performance by 5–10%, with training on hazard identification transferring positively to consequence identification. However, whether fine-tuning similarly benefits large-capacity models remains unexplored.

Relevance to Safety-Critical Domains

The findings generalise beyond laboratory safety to any safety-critical AI deployment:

  1. The "illusion of understanding" — researchers (and by extension, operators in any domain) may over-trust AI safety advice based on fluent, confident output. Over 30% of surveyed graduate students reported moderate-to-high trust in LLM experimental guidance, despite the models' demonstrated inability to comprehensively identify hazards. This connects directly to automation-bias and trust-calibration.

  2. Domain-specific evaluation is essential — general safety benchmarks provide false assurance about domain-specific performance. This echoes findings from the AIRGA nuclear regulatory gap analysis and the Argonne scientific LLM safety taxonomy.

  3. Structured tasks mask applied reasoning deficits — high accuracy on MCQs (structured knowledge recall) does not predict performance on open-ended hazard identification (applied safety reasoning). This distinction matters for any domain deploying LLMs in advisory roles where the real task is nuanced risk assessment, not multiple-choice fact recall.