编程模型的安全风险比通用模型高一个量级——返回的代码可以直接运行成武器。做AI安全评估的团队终于有了经过共识验证的测试集，建议用这个库来检验自家模型的拒绝边界。
该论文指出，通用语言模型回答有害问题返回文本，而编程模型若遵从恶意请求可能返回可运行的武器（如键盘记录器、勒索软件）。因此，编程模型应比通用模型有更高的拒绝标准，但现有基准测试碎片化，无法有效衡量。作者整合了8个语料库（共6675条提示），通过5位评审共识协议分类，区分了可执行恶意代码请求（CODE）和有害安全知识请求（KNOWLEDGE）。最终发布了4748条CODE提示和1923条KNOWLEDGE提示，为评估编程模型对恶意代码的拒绝能力提供了可靠工具。
Code as a Weapon: A Consensus-Labeled Prompt Bank for Measuring Coding-Model Compliance with Malicious-Code Requests
A general-purpose language model that answers a harmful question returns text; a coding model that complies with a malicious request can return a working weapon -- a keylogger, a ransomware stub, an exploit that runs as written. This asymmetry in the severity of a single act of compliance implies coding-specialized models should clear a higher refusal bar than general-purpose chat models, not a lower one, yet the field cannot presently tell whether they do. Refusal benchmarks for malicious code are fragmented: they mix requests for executable software (ready-to-run weapons) with requests for harmful security knowledge (information a human must still operationalise) and report refusal rates over non-comparable corpora, so no single statistic measures the property that actually matters. This paper introduces an expanded consensus-labeled prompt bank that distinguishes between these two request types and provides a construct-stable substrate for cross-corpus coding-model compliance measurement. Eight corpora (ASTRA, CySecBench, AdvBench/harmful_behaviors, JailbreakBench, MalwareBench, RedCode, RMCBench, Scam2Prompt) are consolidated and classified under a five-judge consensus protocol (6,675 prompts x 5 judges = 33,375 calls). The panel reaches Fleiss' kappa = 0.767 [95% CI 0.755, 0.777] ("substantial"); 95.0% of prompts draw at least four agreeing judges, 76.9% are unanimous, and the panel reproduces the earlier four-corpus release at Cohen's kappa = 0.952 on the 3,133 shared prompts. The released bank comprises 4,748 consensus-CODE prompts (executable malicious code requests) and 1,923 consensus-KNOWLEDGE prompts (harmful security knowledge requests). The bank is the validated instrument the field has lacked: a reliability-quantified basis for testing whether coding models meet the stricter refusal standard their executable output demands.