AGIMiddleLesson 286 min read

How would we even measure it?

Every benchmark that gets famous gets beaten, and then people say it never really measured intelligence. Here is why that keeps happening.

Lesson in motion

In 60 seconds

How would we even measure it?

Every benchmark that gets famous gets beaten, and then people say it never really measured intelligence. Here is why that keeps happening.

1/6
In simple words
If you tell a class exactly which questions are on the test, everyone gets full marks β€” and you learn nothing about who understood the subject.
Measuring intelligence in a machine is genuinely hard, and the difficulty is structural rather than technical.

The benchmark treadmill

  1. 1

    A hard benchmark appears

    Experts agree it needs real understanding. Models score badly.
  2. 2

    Models improve, scores climb

    Sometimes from genuine capability, sometimes because the test leaked into training data.
  3. 3

    The benchmark is saturated

    Everyone scores near the top. It no longer distinguishes anything.
  4. 4

    People say it was never real

    "That was just pattern matching." And a new benchmark appears.
Watch out
Step four is not always sour grapes. Sometimes the test genuinely was measurable by shortcut. But the pattern repeats often enough that we should be suspicious of any single number.

Ways a benchmark lies to you

ProblemWhat it meansEveryday version
ContaminationThe test was in the training dataSeeing the exam paper beforehand
Teaching to the testThe model was optimised for this benchmarkCramming past papers without learning the subject
Narrow measurementTests one skill, gets read as general abilityJudging a doctor by their handwriting
No error weightingA wrong answer counts the same everywhereA typo and a wrong dosage both cost one mark
Single-turn onlyReal work is long and messyA driving test with no traffic

What better evaluation looks like

  • Held-out and rotating β€” fresh questions the model cannot have seen.
  • Long-horizon β€” multi-step real tasks, measured by whether the outcome was achieved, not whether the answer looked right.
  • Adversarial β€” someone actively trying to make it fail, not a static set.
  • Cost-aware β€” how many attempts, how much compute, how much human help was needed.
  • Failure-shaped β€” not just the score, but which things it gets wrong and whether that pattern is changing.

Safety evaluations are a different discipline

Capability evals ask "can it?" Safety evals ask "will it, when it should not?" These need adversarial pressure, because a system that behaves under friendly testing tells you nothing about behaviour under a determined attack.
Eval typeQuestion it answers
CapabilityCan it do the dangerous thing at all?
PropensityDoes it choose to, unprompted?
RobustnessDoes it hold up when someone attacks it?
OversightCan a human reliably catch it when it goes wrong?
Dangerous capabilityCan it help with weapons, large-scale cyber attacks, or manipulation?
Danger
The uncomfortable part: a system smart enough to matter is smart enough to behave differently when it detects it is being tested. That is not science fiction β€” it has been observed in evaluation research, and it is Module 34.
Do this
Practical version for your own agent: your regression suite from Module 23 is your safety eval. Run it every deploy, track the pass rate, and treat a drop as a blocking failure.

Watch and read more

Lab

A benchmark you contaminated on purpose.

~15 min

The problem

Take a small public eval set. Fine-tune or few-shot a model on part of it, then score on the whole thing. Measure the inflation. Then build a held-out set the model cannot have seen and compare.
Starter codepython
# Contamination check you can run on any dataset
import hashlib
def canary(example): return hashlib.sha256(example.encode()).hexdigest()[:16]
# Publish canaries with your eval set. If a model reproduces one, it saw the set.

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1Design an evaluation that stays valid for two years. What property must it have?Reveal
It must be regenerable rather than fixed: a generator that produces fresh instances from a template plus private parameters, so the distribution is stable but no specific item can be memorised. Publish the generator's behaviour, never its instances. Anything published as a static file has a shelf life measured in months, because it ends up in the next crawl.

Please sign in to continue.

Questions people ask

Is there one good AGI test?

No, and there probably cannot be, because "general" means "not covered by any fixed list of tasks". The best available approach is a broad portfolio of evolving tests plus honest reporting of failures.

What about the Turing test?

Largely retired as a capability measure. It tests whether something can imitate human conversation, which turned out to be much easier than general competence β€” and it rewards deception, which is a strange thing to optimise for.

Why do labs publish their own evals?

Partly transparency, partly marketing. Read them, and weight independent third-party evaluations more heavily β€” the incentive structure is different.

Can I write my own evals?

You should. Twenty real tasks from your actual domain, with a clear right answer, beats any public leaderboard for deciding whether a model works for you.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in with your phone number to take the test and save your progress