A bio capability eval tries to answer one deceptively simple question: does a model make a would-be bad actor meaningfully more capable than they already were with a search engine and a library? That word —meaningfully— is where all the difficulty lives. It is not a raw score on a quiz; it is a counterfactual, a comparison against what the same person could do without the model. Getting that comparison right forces you into experimental design and statistics, not just prompt engineering. This piece walks the methodology from the measurement side: what the different eval shapes actually quantify, how an uplift study is constructed, how open-ended answers get scored reproducibly, and — with a worked calculation — how much data you need before a reported ‘uplift’ is anything more than noise. The domain is sensitive, so we stay strictly at the level of measurement.
What the eval is actually measuring
The object of a bio capability eval is not knowledge in the abstract; it is marginal risk — the additional capability a model confers beyond a well-defined baseline. That framing has a precise consequence: every number is a difference, and a difference needs two arms. If you only measure how well a model answers biology questions, you have measured a biology exam, not a risk.
Formally, if C_m is a subject’s task performance with the model and C_0 is their performance with a baseline toolset (web search, textbooks, reference protocols), the quantity of interest is the uplift Δ = C_m − C_0. A model can post a high absolute score and near-zero uplift — if everything it supplies was one query away anyway. Conversely a modest absolute score can hide meaningful uplift if it removes a genuine bottleneck. This is why bio evals are designed as controlled comparisons from the first line, and why an eval that reports only C_m is answering the wrong question.
Knowledge probes vs task-based evals
Two eval shapes dominate, and they trade off cost against realism. Knowledge probes are structured questions — typically multiple-choice items over technical biology, of which the WMDP-bio benchmark is the best-known public example. They are cheap, automatically gradable, and reproducible: you get a single accuracy number and a tight confidence interval for almost no marginal cost.
Their weakness is construct validity. Answering isolated facts correctly is a weak proxy for assembling those facts into a coherent plan under real constraints. Task-based evals attack that gap: they pose an open-ended, multi-step objective and score the quality of the resulting work. These are far more faithful to the actual threat model — capability is about synthesis, not recall — but they are expensive, slow, and hard to grade consistently. The practical stance is to use probes as a cheap, high-sensitivity tripwire and reserve costly task-based studies for models that clear the probe threshold. The probe tells you whether to look harder; the task study tells you how much to worry.
The uplift study: baseline is the whole game
An uplift study is a between-subjects (or crossover) experiment. Participants attempt the same set of tasks; the control arm works with the baseline toolset and the treatment arm additionally has the model. The measured quantity is the difference in task success or plan quality between arms.
Everything hinges on choosing the baseline honestly. Set it too weak — say, forbid the control arm from using the internet at all — and you manufacture uplift that reflects your handicap, not the model. Set it realistically — unrestricted search, standard references, the time a motivated person would actually invest — and the uplift you measure is the counterfactual that matters. A second design choice is participant expertise: uplift for a domain novice and uplift for a trained specialist are different quantities, and a study must state which population it is estimating. The cleanest studies pre-register the baseline, the population, the tasks, and the scoring rubric before any data is collected, so the answer cannot be tuned after the fact.
Scoring open-ended work reproducibly
Once tasks are open-ended, ‘did they succeed?’ stops being binary. The standard answer is a rubric: the task is decomposed into explicit sub-steps or quality dimensions, each scored on a fixed scale by trained graders who are blind to which arm produced the response. Blinding is not optional — a grader who knows an answer came from the model will score it differently, and that bias flows straight into Δ.
Because human scoring is noisy, each item is rated by multiple graders and their agreement is quantified — commonly with Cohen’s κ or an intraclass correlation. Low agreement means the rubric is ambiguous, and any uplift estimate built on it is unreliable regardless of sample size. A useful discipline is to separate process scoring (did the plan clear each checkpoint on the critical path?) from a single outcome score, because a plan can be plausible-sounding yet fail at one load-bearing step. Aggregating sub-scores into one number is itself a modeling choice that the rubric must fix in advance.
The statistics of detecting uplift
Suppose task success is binary and you compare two proportions: control success rate p_0 and treatment rate p_1. The null hypothesis is p_1 = p_0 (no uplift); you want to detect a true difference of at least δ = p_1 − p_0. The relevant question before running anything is statistical power: given your sample size, what is the probability you would actually detect an uplift of that size if it were real?
For a two-proportion z-test at significance α and power 1 − β, the required sample size per arm is approximately:
n ≈ ( z_(α/2)·√(2 p̄(1−p̄)) + z_β·√(p_0(1−p_0)+p_1(1−p_1)) )^2 / δ^2
where p̄ = (p_0 + p_1) / 2, δ = p_1 − p_0The single most important feature of that formula is δ^2 in the denominator: halving the effect size you want to detect roughly quadruples the sample you need. Small, subtle uplifts are enormously expensive to measure — which is exactly why underpowered bio evals are so easy to misread.
A worked power calculation
Put numbers to it. Say the baseline success rate is p_0 = 0.30 and you care about detecting an uplift to p_1 = 0.50, so δ = 0.20. Use the conventional α = 0.05 (two-sided, z_(α/2) = 1.96) and 80% power (z_β = 0.84).
p̄ = (0.30 + 0.50)/2 = 0.40
term_1 = 1.96 × √(2 × 0.40 × 0.60) = 1.96 × √0.48 = 1.96 × 0.6928 = 1.358
term_2 = 0.84 × √(0.30×0.70 + 0.50×0.50) = 0.84 × √0.46 = 0.84 × 0.6782 = 0.570
n ≈ (1.358 + 0.570)^2 / 0.20^2 = (1.928)^2 / 0.04 = 3.717 / 0.04 ≈ 93So you need about 93 participants per arm, ~186 total, just to reliably catch a large 20-point swing. Now shrink the target to a still-worrying δ = 0.10 and the requirement balloons past 350 per arm. Recruiting hundreds of appropriately-screened, expert participants is brutally hard — which is why so many published capability comparisons simply cannot resolve the modest effects that matter most.
Why underpowered evals mislead in both directions
An underpowered study fails asymmetrically, and understanding how keeps you honest. A null result from a small study is nearly meaningless: ‘we found no significant uplift’ with n = 20 per arm is fully consistent with a real, dangerous uplift the study had no power to see. Absence of evidence is not evidence of absence — report the confidence interval, and if it spans everything from ‘no effect’ to ‘large effect,’ the study is silent, not reassuring.
The opposite error is subtler. When power is low, the significant results that do slip through are biased upward — only unusually large sample-fluke effects clear the threshold, so any ‘significant’ uplift from a tiny study overstates the truth (the winner’s-curse or type-M error). The remedy is unglamorous: compute required n before running, pre-register the analysis, and treat both a lonely significant result and an underpowered null with the same skepticism.
Elicitation: are you measuring the model or your prompt?
A capability eval measures a lower bound on what a model can do, and that bound is only as good as your elicitation. If a weak prompt, an aggressive refusal, or a missing scaffold hides a capability, the eval under-reports risk — and the model has not become safe, you have merely failed to ask well. Serious evals therefore invest in elicitation: fine-tuning where permitted, chain-of-thought and tool-use scaffolds, best-of-n sampling, and adversarial prompting, all to push the estimate toward the true ceiling rather than a lazy floor.
This creates genuine tension with safety training. A model may score low because it correctly refuses — but refusals can be brittle, so a responsible eval reports capability with safety mitigations stripped or bypassed under controlled conditions alongside the deployed behavior. The distinction matters: mitigation-off capability tells you what the underlying model could do if the guardrails failed; mitigation-on tells you the residual risk of the actual product.
Contamination, ceilings, and other measurement traps
Several failure modes corrupt the number before statistics even enter. Benchmark contamination is the loudest: if eval questions (or near-paraphrases) leaked into pre-training, high accuracy reflects memorization, not capability, and the score is meaningless as a risk signal. This is why static public benchmarks decay in value and why private, rotated, or freshly-authored held-out items are essential.
Ceiling and floor effects quietly destroy sensitivity: if tasks are so easy both arms score near 100%, or so hard both score near 0%, there is no room for uplift to show, and Δ collapses toward zero for reasons that have nothing to do with the model. Task difficulty must be calibrated so the baseline sits in the responsive middle of the scale. Add the usual suspects — grader drift over long sessions, inconsistent baseline toolsets across participants, and self-selection in who volunteers — and it becomes clear that most of the work in a credible bio eval is guarding the measurement.
From eval result to a governance threshold
The point of all this rigor is a decision. Modern responsible-scaling frameworks tie deployment and security commitments to capability thresholds, so an eval’s job is to place a model confidently on the right side of a line. That reframes what ‘good enough’ means: you do not need a perfect point estimate of uplift, you need a confidence interval whose upper bound sits safely below the threshold of concern.
That is a conservative, one-sided question, and it changes the statistics. You power the study to rule out a dangerous effect, not merely to detect an average one, and when the interval is wide you treat the model as if it might be near the top of that interval. Because the domain is so sensitive, the eval apparatus itself runs under access controls, expert oversight, and institutional review — engineered to be trustworthy precisely because a false ‘safe’ is the expensive error. Good bio evals are ultimately an exercise in disciplined, well-powered, adversarial measurement.