A consumer-facing LLM product is about to launch. Describe the safety evaluation that should run first.

A consumer LLM launch needs a safety evaluation that covers four areas: harmful content, PII leakage, jailbreak resistance, and demographic bias. The evaluation uses red-teaming: sending adversarial prompts to the model and checking whether it refuses. Manual red-teaming uses skilled human adversaries who probe creatively. Automated red-teaming uses adversarial prompt generators to cover thousands of attack patterns. You need both: manual catches novel attacks, automated catches systematic weaknesses. The metric that matters most is the balance between two rates. Refusal rate on adversarial prompts measures how often the model correctly refuses harmful requests. False-refusal rate on benign prompts measures how often the model incorrectly refuses legitimate questions. A model that refuses everything scores perfectly on adversarial refusal rate but is useless. A model that refuses nothing scores perfectly on false-refusal rate but is dangerous. The launch decision is about finding the operating point where adversarial refusal is above a threshold (e.g. 95%) and false-refusal is below a threshold (e.g. 2%). Beyond content, test for PII leakage (extraction attacks on training data) and demographic bias (does the model refuse more questions about certain groups than others?).

**Pre-launch safety eval** has four pillars. First, red-teaming across harm categories: harmful content generation, PII leakage, jailbreak resistance (prompt injection, role-play exploits, encoding tricks), and demographic bias. Use manual red-teamers for creative novel attacks and automated adversarial prompt generators for systematic coverage at scale. Second, refusal calibration. Build a test set with adversarial prompts across every harm category paired with topically adjacent benign prompts (e.g. a benign medical question one word from a harmful self-harm query). Measure refusal rate on adversarial prompts and false-refusal rate on benign prompts. Third, PII and data leakage testing. Probe with extraction attacks (membership inference, verbatim training-data extraction) and context-window exfiltration via prompt injection. Fourth, bias audit. Measure output quality and refusal rate across demographic groups. Differential refusal across demographics is a bias signal even when the content itself is safe. The metric that matters most is the refusal rate / false refusal rate balance. A model that refuses everything is safe but unusable. One that refuses nothing is dangerous. The launch threshold is adversarial refusal above 95% and false-refusal below 2%. This pair defines the operating point, and every other safety metric feeds into calibrating it.