Evaluation & Measurement

This rung is about how you know a thing works, and whether the measurement can be trusted. Its scope is benchmark design and the critique of it — matched-budget controls, contamination and overfitting to the eval set, agent benchmarks, and the gap between a benchmark score and what happens in deployment. The findings themselves belong to whichever rung they move; what belongs here is the question of whether those findings were measured properly.

What this rung prices

A buyer pays for a finished task, not for tokens, so every claim on the path from a token price to a task price rests on a benchmark number holding up. This rung is where that number is checked, and the check has one hard result: capability is not a scalar. Across up to 12 frontier models and 7 benchmarks — software engineering, mathematics, medicine, cybersecurity — run under controlled inference-scaling interventions, evaluations that report a single restrictive budget understate what a model can do, and understate newer models more, because a newer model's higher ceiling only opens at a generous budget (How Inference Compute Shapes Frontier LLM Evaluation; that close read reached abstract level only, so this rests on the abstract and the per-benchmark numbers were never captured). If a score moves with the budget, then score and spend are the same axis, and a leaderboard that publishes the first without the second cannot be converted into a cost per finished task at all. That is what this rung prices: it decides whether any other rung's number is a measurement or a marketing figure.

The load-bearing findings

• A benchmark score without a stated compute budget is not a measurement. The recommendation the inference-compute paper actually makes is to report capability as a function of inference-time compute rather than as a fixed score, and it names the three interventions it swept: expanded token budgets, context compaction, and repeated submission attempts. Repeated submissions helped broadly; the others were domain-dependent (How Inference Compute Shapes Frontier LLM Evaluation, read at abstract level).

• Capability is best read as a doubling rate, not a score, and the rate is itself moving. In the only multi-year independent series here — 30+ models tested 2022–2025 by a body that sells no model — apprentice-level cyber task success rose from about 9–10% in late 2023 to about 50%, and the length of cyber task a model can complete unassisted was doubling roughly every 8 months, with later internal data (February 2026) putting that at about every 4.7 months since late 2024 (Frontier AI Trends Report (AISI)).

• The same series shows how far a controlled setting can carry a claim, and where it stops. Self-replication success across five frontier models rose from under 5% in early 2023 to over 60% by mid-2025, but models were strongest at the early stages (getting compute and money) and weakest at the later ones (replicating onto compute, holding persistent access) — so the assessment is that real-world autonomous replication is unlikely today and the gains live in simplified environments (Frontier AI Trends Report (AISI)). A number that only exists inside the harness that produced it is the exact failure mode this rung exists to catch.

• Safeguard measurements move in both directions at once. The same report records a 40× increase in expert effort needed to find biological-misuse jailbreaks between two models released six months apart, and universal jailbreaks found in every system tested (Frontier AI Trends Report (AISI)). One metric improving by a large factor while the binary "can it be broken at all" stays at yes is a reminder that picking the metric is most of the argument.

• Benchmark design work outside the stack still demonstrates the method. Two video-generation benchmarks sit on this rung: one evaluating 12,600 generated videos for physical realism and finding systematic failures on rigid-body collisions, fluid dynamics and gravity (PhyWorldBench), and one scoring Sora-2 at about 64% and Veo-3 at about 58.7% on its Phenomenon Congruency metric (VideoScience-Bench). They are honest benchmark construction, but they measure text-to-video physics, not the inference stack this Atlas prices — they were ingested before the rung was rescoped, and they are counted here for accuracy, not for coverage.

• Measuring has become a cost line of its own. One agent leaderboard, nine models on nine benchmarks, each run once, cost about $40,000; a single GAIA run can cost $2,829; and the same tasks cost up to 33× more or less depending only on the agent set-up around the model (AI evals are becoming the new compute bottleneck). Spending more did not reliably buy a better score — $1,577 bought 40% on one web benchmark where $171 bought 42%. A buyer reading a leaderboard without a cost column is reading half a measurement. See the cost of evaluation.

• A single run is not a reading, and a trustworthy one costs about 8× more. Re-running one LLM-judged tool-calling benchmark 23 times on the same set-up gave scores from 57.9% to 76.8% (Benchmarking the Benchmarks), and re-running every cell of that $40,000 leaderboard 8 times would take it to roughly $320,000 (EvalEval). The shortcuts that made old benchmarks cheap — cutting them 100–200× without changing the ranking — save only 2–3.5× on agent benchmarks.

• The grader is wrong often enough to matter. Expert review of 496 tool-calling tasks found the benchmarks' own graders disagreeing with the experts on 92 — 18.5% (Benchmarking the Benchmarks). Separately, a thesis fitted to 4,395 models on the Open LLM Leaderboard argues that a score can end up measuring model size rather than the ability it names, and that correcting for both measurement error and scale fits the data better (Quantifying construct validity). See benchmark validity.

The standing that all of this converts into is set out on agent evaluation benchmarks: a result is only interpretable if it discloses the harness, the search and inference budget, and held-out generalisation.

What we do not know yet

• The rung is thinner than its file count. Seven sources, two of which are about video generation; on the rung's own through-line the working count is five. Two things named in scope still have no coverage: contamination and overfitting to the eval set, and the eval-to-deployment gap. The cost figures come from one advocacy group's blog post compiling other people's numbers, not from a study of its own.
• The rung owns a shape but not a number. The inference-compute study establishes the direction — scores rise with budget, and the gap widens for newer models — but its close read explicitly records that the per-benchmark numeric grid was not captured. So how far a score actually moves across a budget sweep is not held here, and capturing that grid from the source already ingested is the cheapest available improvement (How Inference Compute Shapes Frontier LLM Evaluation).
• Whether matched-budget control changes published rankings. The argument that it should is strong and general, but nobody here has re-run a model leaderboard under a single fixed budget, and no source on this rung reports that having been done.
• Whether benchmark versions are comparable to each other. Nothing on this rung publishes a version-to-version calibration, so a score quoted without its benchmark version cannot be placed against a score quoted with a different one.
• Nobody here has run any of it. Every number above is read, not measured. That matters more on this rung than on any other, because the rung's whole claim is that other people's numbers should not be taken at face value — and it is currently making that claim entirely on other people's numbers.

Concepts

Concept	Sources	Evidence	Last Updated
The Cost of Evaluation	3 (1 paper)	Moderate	2026-09-24
Benchmark Validity	3 (0 papers)	Moderate to strong	2026-09-24
Agent Evaluation Benchmarks	8	Moderate to strong	2026-07-23

Entities

Entity	Type	Sources
UK AI Security Institute (AISI)	Organization	1
Holistic Agent Leaderboard (HAL)	Organization	1

Timeline

See the timeline for chronological developments, and the open questions for the open questions.

Sources

#	Title	Type	Date	Status
1	PhyWorldBench	paper	2025-07-17	compiled
2	VideoScience-Bench	paper	2025-12-03	compiled
3	Frontier AI Trends Report (AISI)	technical-report	2025-12-18	compiled
4	Quantifying construct validity in LLM evaluations	preprint	2026-02-17	compiled
5	AI evals are becoming the new compute bottleneck	analysis	2026-04-29	compiled
6	How Inference Compute Shapes Frontier LLM Evaluation	paper	2026-06-16	compiled
7	Benchmarking the Benchmarks	preprint	2026-06-30	compiled

Read next

• AI evals are becoming the new compute bottleneck — what a score costs to produce, and why a trustworthy one costs about 8× more.

• Benchmarking the Benchmarks: A Validity Audit of Tool-Calling Evaluation — the grader measured against experts, and the 18.9-point repeat-run spread.

• How Inference Compute Shapes Frontier LLM Evaluation — the rung's central claim: a score without a budget is not a measurement.

• Frontier AI Trends Report (AISI) — the only multi-year independent capability series here, and the rung's most credible instrument.

• PhyWorldBench: A Comprehensive Evaluation of Physical Realism in Text-to-Video Models — benchmark construction done well, on a subject off this rung's through-line; useful as method, not as coverage.