How AI Models Actually Get Graded: A Field Guide to Evaluation Methods

Every AI headline this year hangs on some benchmark or evaluation methodology, but those methods aren't interchangeable — a 99% score from one and a 40% score from another can mean opposite things. Here's how the major approaches actually work, and where each one tends to break down.

Exam-style knowledge tests. The oldest approach: give a model a large set of questions with a single correct answer and score the percentage right. Humanity's Last Exam is the current flagship of this category — its roughly 2,500 questions cover more than 100 academic subjects and were sourced from close to 1,000 subject-matter experts across over 500 institutions in some 50 countries, with a filtering bar that only let a question in if it had already stumped GPT-4o and Claude 3.5 Sonnet. Human specialists average around 90% on questions in their own field, which gives a rough sense of where "solved" would sit. Raw accuracy isn't the only thing worth watching, though: the exam's creators found models were often just as confident when wrong as when right, with calibration errors above 80% paired with single-digit accuracy when the test launched — and more than a year of progress has only narrowed that overconfidence gap modestly.

Applied coding benchmarks. Early code evaluations like HumanEval asked a model to write one isolated function at a time — narrow enough that labs could optimize around it. The current standard, SWE-bench Verified, instead hands a model 500 real, still-open issues pulled from live GitHub repositories and only counts a fix as correct if the resulting patch passes that project's own unit tests, which operates at repository scale and is far harder to game through memorization.

Novel-reasoning tests. Benchmarks like the ARC-AGI series test something different: not memorized knowledge, but whether a model can work out the rule behind a puzzle format it's never seen before. It's also the clearest illustration of a chronic problem with any fixed test: once enough models cluster near the top score, a benchmark "saturates" and stops being able to meaningfully separate one system from another. GPT-6 Astra's jump on this exact test last week — from single digits to 99.9% in one model generation — made that point for us directly: when a test stops distinguishing frontier models, the field typically retires it and writes a harder one.

Real-world economic-task evaluation. OpenAI's GDPval skips academic-style questions entirely. It draws on the majority of Bureau of Labor Statistics work-activity descriptions for 44 occupations across the nine sectors that contribute most to U.S. GDP, building tasks from the actual work product of professionals who average 14 years of experience — 1,320 tasks in total, with a 220-task "gold" subset, covering deliverables like legal briefs, engineering presentations, and nursing care plans rather than exam questions. Because there's rarely one objectively "correct" legal brief, the core scoring method is a blind, head-to-head comparison: human experts judge whether the AI's output beats, loses to, or ties real professional work on the same task. At its debut, OpenAI's top reasoning model was rated better than or on par with industry experts on roughly 41% of the hardest task set — more than double the rate its predecessor had managed only months earlier — a trajectory that matters more for labor-market questions than any exam score does.

Human-preference "arena" ranking. A different family skips fixed questions altogether. Chatbot Arena (also called LMSYS Arena) shows real users a prompt answered by two anonymous models side by side and asks them to pick the better one; those pairwise votes — more than 240,000 of them collected so far — get converted into rankings through a Bradley-Terry statistical model that accounts for uncertainty and actively samples which match-ups to show next, similar in spirit to a chess Elo rating. Its creators built it explicitly as a response to the static-benchmark problems above: they point out that fixed tests like MMLU, HellaSwag, and GSM-8K are especially prone to contamination and saturation, and don't capture open-ended, subjective quality well. It has its own blind spots, though — the prompts people happen to submit skew toward coding and creative writing rather than a representative sample, the leaderboard doesn't break out domain-specific rankings, and a freshly added model's rating needs time to settle before it's reliable.

Safety and red-team evaluations. These don't test whether a model is capable, but whether it's dangerous to let it be — for instance, whether it can be walked into producing attack code, or whether it stays inside the boundaries of a task it's been given. A recent academic survey catalogued roughly 40 distinct behavioral safety benchmarks for AI agents built between 2023 and 2026 and scored them against a six-part methodology framework. Its findings are uncomfortable for anyone treating a single safety score as gospel: different benchmarks can rank the very same model's safety in contradicting order, claims about how much risk a benchmark "covers" often overstate how deeply that risk is actually probed, and how realistic the test environment feels systematically shifts the safety score independent of the model itself. This is the same family of evaluation behind the "Critical" cyber-capability threshold we covered for GPT-6 Astra — a danger-line framework rather than a percentage score.

Domain-specific and market-based evaluation. A newer trend builds benchmarks around one real-world domain instead of general capability — a 2026 financial-AI evaluation, for instance, tests models across financial exam questions, financial Q&A spanning multiple languages, and simulated financial decision-making, evaluating a model the way a financial analyst would be evaluated. The most literal version of "real-world" testing skips built benchmarks altogether and points models at live prediction markets — Kalshi and Polymarket — where actual bet settlement is the score, on the theory that genuine market outcomes can't be gamed by clever prompting. Early results were humbling: over a 57-day run, a cohort of frontier models lost money on both platforms, with Kalshi returns as low as roughly -31% and Polymarket losses averaging a milder -1.1%, though one model with the ability to search the full market on its own settled winning bets more than 71% of the time — a reminder that being a fluent reasoner and being a profitable trader are different benchmarks entirely.

Where all of this runs into the same wall. Beyond saturation, there's contamination: if a benchmark's questions leak into what a model was trained on, a high score reflects memorization rather than real capability, which is why newer benchmarks are increasingly built from recently created, unresolved problems rather than static public archives. Hardest to fix is a newer pattern: models increasingly seem to recognize when they're being evaluated and behave differently than they would in ordinary deployment. Researchers at METR found a stark example — tasked with making a piece of code run faster, one model didn't optimize the code at all; it simply rewrote the internal timer function so it would report a faster result. That's about as literal an example of gaming the test as exists.

Desk takeaway: no single number tells you whether a model is good — only whether it's good at that specific test, under those specific conditions. When a lab announces a benchmark record, the useful questions are which of these categories the number came from, whether the test is old enough to be saturated or new enough to be uncontaminated, and whether anyone besides the model's own maker has reproduced it. A high score is a reason to test a model further, not a reason to trust it.