WOG safety testing framework

The Whole-of-Government (WOG) safety testing framework defines how Singapore public-sector teams should evaluate AI systems for safety before deployment. It standardises the risk taxonomy, the choice of metrics, and the evaluation protocol used across agencies.

Why safety testing matters

Chatbot systems without structured safety testing can generate unsafe or policy-violating outputs under unsafe or adversarial conditions, such as instructions to generate hateful content or engage in dangerous activities. Developers and product teams frequently work with chatbot systems and products that are subject to safety requirements, and therefore need a systematic approach to safety evaluation.

The role of a safety taxonomy

One central component of safety evaluation is a well-defined safety taxonomy, which provides the structure needed to organise safety risks, evaluate chatbot safety performance, and standardise evaluation across different chatbots. As new risk categories emerge, risk taxonomies must be updated to maintain risk coverage, ensuring that the corresponding benchmark dataset remains valid.

This taxonomy is designed to categorise AI safety within the scope of application-level chatbot systems, focusing on outputs generated in response to user prompts. Within this scope, failure modes are defined as observable patterns in model outputs that violate specified safety criteria, and safety domains correspond to categories of real-world hazards as defined in relevant governmental and regulatory contexts.

Taxonomy design principles

These principles provide a consistent, comprehensive, and practical framework for organising AI safety risks and evaluation categories:

• Government-relevant risk coverage. The taxonomy focuses on safety domains relevant to governmental use of AI systems.
• Observable failure modes. All categories are defined in terms of externally measurable behaviour in prompt-response interactions.
• Mutual exclusivity. Each risk category is mutually exclusive. Although chatbot outputs may exhibit multiple failure modes, the taxonomy adopts a single-label approach to prioritise consistency and tractability.
• Completeness within scope. The taxonomy is considered complete if it covers all observable failure modes within the defined scope. Within this scope, failure modes are restricted to outputs that fulfil one of the definitions of a hazard in a governmental context.
• Singapore-centric coverage. The taxonomy includes risks grounded in Singapore's sociopolitical context, such as domestic policy and issues related to racial and religious harmony, which may not be covered under existing international benchmarks.

How the taxonomy was developed

The taxonomy was developed by first compiling a comprehensive list of known AI safety risks relevant to application-level chatbot systems from established AI safety taxonomies and benchmarks. Specifically, we focused on recurring risks and commonly evaluated safety hazards that fell within our defined categories of harm. This review was limited to concrete, observable harms arising from chatbot interactions.

The extracted risks were then consolidated into a centralised candidate list before being cross-referenced against existing regulatory guidance and AI governance frameworks to ensure alignment with established risk management practices. These included the AI Standards Hub Standards Database, the NIST AI Risk Management Framework, and the Model AI Governance Framework for Generative AI.

Next, we grouped the candidate risks into domain-level categories based on the specific type of unsafe behaviour they represent. Risks sharing similar patterns of harmful behaviour were placed into the same domain, while distinct manifestations of the same underlying risk were differentiated using subcategories to facilitate downstream analysis.

Harm categories

Category	Subcategory	Definition
Harm to Individuals	Direct Harm	Responses likely to cause immediate psychological distress, emotional harm, or serious offence, such as graphic content or abusive language.
Harm to Individuals	Harm Enablement	Responses providing operational guidance beyond what is commonly available through general educational resources, such as instructions for misconduct or disclosure of personal information.
Harm to Individuals	Epistemic Harm	Responses that impair a user's ability to form accurate beliefs or make informed decisions, including misleading or unqualified professional advice.
Harm to Government and Society	Harm to Public Trust	Responses that undermine confidence in public institutions by endorsing factually incorrect claims, presenting misleading information as authoritative, or generating content that discredits governmental institutions.
Harm to Government and Society	Harm to Public Cohesion	Responses likely to inflame social tensions, encourage hostility between communities, or otherwise undermine social harmony.
Harm to International Relations	Harm to Diplomatic Relations	Responses that could reasonably undermine Singapore's diplomatic standing or adversely affect its relationships with foreign governments or international partners.

Safety taxonomy

The high-level taxonomy presents definitions that are intended to be mutually exclusive, and the categories are intended to be complete within the scope of the defined hazards in a governmental context.

Risk Category	Level	Definition
Hateful	L1	Derogatory statements or negative stereotypes directed at a protected group based on legally protected characteristics.
Hateful	L2	Explicit calls for harm or violence against a protected group; language praising or justifying violence against such groups.
Insults & Toxic	—	Mocking or demeaning of individuals or groups without referencing legally protected traits.
Sexual	L1	Non-graphic descriptions of consensual sexual behaviour or activities, or suggestive context without explicit content.
Sexual	L2	Explicit descriptions of genitalia, or non-criminal sexual behaviour, activities, or content in graphic detail.
Self-Harm	L1	Expressions, discussions, or endorsement of self-harm without suicide ideation; descriptions of intent to engage in self-harm.
Self-Harm	L2	Descriptions or indications of ongoing or imminent self-harm behaviour; content that could serve as instruction.
Graphic Content	—	Profane, violent, or disturbing content that is not illegal, sexual, discriminatory, or contemptuous in nature.
Misconduct	L1	Discussion or instruction providing operational utility for dangerous, deceptive, harmful, or highly uncivil non-illegal conduct.
Misconduct	L2	Discussion or instruction on illegal activities; development of dangerous devices, substances, or products; large-scale exploitative or manipulative activities.
Domestic Politics	—	Discussion on Singapore's domestic politics involving political entities, institutions, and events.
Geopolitics	—	Discussion on regional or international politics involving foreign political entities, institutions, or events.
Race & Religion	—	Any form of non-criminal and non-discriminatory reference to race or religion beyond simple identification or description.
Financial Advice	—	Financial topics such as personal finance, banking, investments, markets, or economic conditions.
Legal Advice	—	Legal matters, such as rights, procedures, regulations, or disputes.
Medical Advice	—	Medical or health-related issues, including symptoms, conditions, treatments, or healthcare access.

Benchmark design principles

High-quality test cases are required to satisfy the following principles:

• Realistic interactions. Test cases should mirror realistic user interactions, target specific safety risks, and remain unambiguous. Overly simplistic or unrealistic prompts are avoided.
• Content diversity. Prompts should vary in wording, topic, and phrasing to reduce overly-template wording effects and improve the robustness of evaluation.
• Complexity diversity. Each safety category should include prompts spanning a range of complexity, from direct requests to more nuanced situations.

Benchmark construction

Initial prompt material was compiled from a range of established AI safety benchmarks and datasets, with a focus on prompts involving violations of regulations and policies. These sources were selected to provide broad coverage of known safety risks and adversarial prompt formulations.

The compiled prompt set then underwent a quality curation process. In accordance with the design principles, duplicate and semantically equivalent prompts were removed, as well as prompts that were low-quality or not contained by one of the taxonomy risk categories.

Continuous benchmark evolution

Unlike static evaluations, safety benchmarks must be continuously updated to reflect evolving best practices, including deprecating low-quality samples that no longer challenge modern models and incorporating increasingly sophisticated attack strategies. They must also evolve to capture emerging risks arising from advances in AI capabilities and changes in the broader threat landscape, such as attempts to elicit exploits against new AI agents or novel threats stemming from geopolitical developments that may affect government and diplomatic systems.

Metrics

Attack Success Rate (ASR)

Attack Success Rate (ASR) measures how often a chatbot produces an unsafe response when given an adversarial prompt. It is calculated as the number of unsafe responses divided by the total number of adversarial prompts tested. A lower ASR indicates a safer system — the chatbot successfully refuses or redirects more attacks.

$$\text{ASR} = \frac{\text{Number of unsafe responses}}{\text{Total number of adversarial prompts}}$$

As this benchmark consists exclusively of adversarial prompts designed to elicit unsafe responses, the unsafe engagement rate is equivalent to the ASR. The benchmark is able to distinguish between chatbot systems with different levels of safety performance, providing evidence of its discriminative validity.

Access

PaperWOG safety testing framework methodology

Where to go next

• Safety evals — for the operational evaluation playbook.
• RabakBench, MinorBench, and the Responsible AI Benchmark — benchmarks that operationalise the framework.