MLCommons Launches Candela, On-Demand AI Risk Benchmarking for Developers and Deployers

What Candela offers at launch

MLCommons describes itself as an industry organization of over 125 companies, including Microsoft, Google, Qualcomm, NVIDIA, OpenAI and Anthropic, along with academic institutions and nonprofits. Its argument for Candela is that anyone deploying AI needs to know where a system might give responses it shouldn't, and how often. According to MLCommons, that is hard to know even for model builders, because behavior shifts with every configuration and there has been no common way to test it.

Candela launches with new versions of both AILuminate benchmarks. Safety 1.2.1 measures how a system handles twelve hazard categories, from violent crime to specialized financial, health and legal advice. Jailbreak 1.1 tests eleven of those categories using techniques from MLCommons' jailbreak taxonomy. These range from simple methods such as typos, lookalike characters and "ignore previous instructions" prompts to more complex ones such as context framing and deception and fragment assembly.

Safety 1.2.1 results for about 30 named open-weight models are public now, with Jailbreak results to follow. MLCommons says more benchmarks are coming, covering agentic security, privacy and psychosocial harms. It is also building agent reliability profiles for industries such as financial services and extending benchmarks to more languages and cross-cultural contexts.

How scores are produced

AILuminate keeps its prompts closed. According to MLCommons, no one outside its staff sees them, not even member companies, and the set is monitored and refreshed as models and risks change. The standards themselves come from the AIRR working groups, where people from more than 80 organizations decide what to test and how to grade it. Participants include Google DeepMind, Meta, Microsoft, OpenAI, NVIDIA, Accenture, Deloitte, RAND, Stanford, Oxford, NewsGuard and SaferAI.

MLCommons runs the scoring itself, using a private ML classifier built for safety evaluation rather than an LLM-as-a-judge. The organization says this makes results stable and comparable over time, whereas LLM judges would produce different results on every run. It also says that in its trials, generative AI graders could not reliably tell whether a response had fallen for a jailbreak trick.

Scoring uses item response theory, the statistics behind the SAT and GRE, to estimate how hard each prompt is and how well it separates stronger systems from weaker ones. Results are reported as percentiles against a fixed panel of reference systems, so a score does not depend on who else has been tested.

Testing the system, not just the model

MLCommons stresses that a model's score reflects how it behaves as released. Most teams then add a system prompt, retrieval, tools or an agent loop, and each changes behavior. Candela can test both the model and the configured system using a local client relay. A model that refuses a harmful request in its released form may answer it after fine-tuning or when fed a document with embedded instructions. The reverse also happens: guardrails around a weaker model can make the whole system safer. In MLCommons' words, safety scoring is not composable.

Candela provides three kinds of results:

• Practice tests return a score and summary report using practice prompts. They are inexpensive, free for MLCommons members, and meant for frequent smoke tests.
• Annotated results add every prompt, response and scored annotation behind the score, showing where a system did well or poorly.
• Official results use the private prompts and can be cited publicly, for example in a system card, spec sheet or procurement decision. Organizations can run them themselves or use a third-party assurance provider.

What it means for buyers and governance

Abby Palia, Principal Product Manager, Responsible AI at Microsoft, said: "As AI adoption accelerates, enterprises need credible evidence to make informed decisions about model safety." She added that private test sets help keep measurement meaningful as public benchmarks reach saturation.

MLCommons positions Candela as a measurement that works across organizations, meaning the same thing to a developer, a buyer, an auditor and a board. Every result carries version labels, and the organization says it will not change what a score means without changing the label, so results can be compared over time and cited in governance documentation.

The group says it is ready to adapt AILuminate as regulators and standards bodies settle on requirements, and argues that companies that build a habit of assessing AI safety will be best prepared when regulators require it. It is seeking input from enterprise buyers and deployers, and invites assurance firms to join its Global Assurance Program and new participants to join the AIRR working groups.