What a benchmark cannot tell you

In early 2023, when GPT-4 cleared 86% on MMLU, the response was applause. By 2025, when frontier models cleared 91%, the response was a shrug. The benchmark is converging. The meaning is collapsing. The interesting thing is not the convergence. It is what the convergence is hiding.

A benchmark measures a slice. The slice was carefully chosen to be diagnostic when the models being measured were weak, and its diagnostic value is a function of how much of the test distribution sits inside the capability frontier of the model. When the frontier is below the test, the benchmark tells you something. When the frontier extends well past the test, the benchmark tells you nothing about capability and a great deal about how well the training corpus included the test distribution. Most public benchmarks are now in the second regime.

The first reaction in the field has been to publish higher scores on the same benchmarks. The second reaction has been to publish higher scores on slightly harder versions of the same benchmarks. Neither response is closing the gap between what is being measured and what matters. The gap is widening, and the rate at which it is widening is not subtle.

Where the frontier actually went

The real cognitive frontier has moved past the resolution most public benchmarks operate at, and the dimensions it has moved into are not the ones the current suite was designed to test. Extended reasoning over agentic horizons, where a model has to plan, execute, recover from intermediate errors, and maintain goal stability across hundreds of decisions. Multi-domain transfer under distribution shift, where the model is asked to apply technical capability outside the domain where that capability was acquired. Planning under uncertainty, with incomplete information and reversible decisions. Robustness to adversarial framing, where the same underlying question is reformulated to surface a different answer.

None of these are benchmarkable at the cost and throughput the current public suite is built for. MMLU is multiple choice and can be run in seconds per question on a few hundred dollars of API time. The capability dimensions that actually matter at the frontier take hours per task, require oracle verification that itself costs hundreds to thousands of dollars per case, and produce results that have to be aggregated across many runs to be meaningful at all.

The result is that the rank order of frontier models on the public suite has decoupled from the rank order of capability that a sophisticated user feels in production. Labs know this. Sophisticated buyers know this. The benchmark survives in the public conversation because it is convenient, because something is better than nothing, and because the press cycle and the spec-sheet competition both require a number that can be compared. The discriminating power of that number is mostly gone.

This is not a complaint about benchmarks. The benchmark was a useful diagnostic when the models being benchmarked were below it. The contention is that the public conversation has not noticed the regime changed, and that the implicit theory of capability that flows from MMLU-style measurement is now describing a frontier that no longer exists.

The discriminating power of public benchmarks at the frontier is mostly gone. What remains is convenience, press cycles, and a number that can be put in a spec sheet.

Goodhart in production

The mechanism is Goodhart's law operating at industrial scale. When a measure becomes a target, the target stops being a good measure. The MMLU score is now a target. Two points on MMLU is a press release. Three points is a model launch. The labs that take capability seriously are quietly building private evaluation suites that do not leak into training corpora, and the labs that do not have that infrastructure are publishing gains on benchmarks the field has stopped treating as discriminating.

There is a more subtle version of this happening with the slightly-harder benchmarks. As MMLU saturated, the field added MMLU-Pro, GPQA, Humanity's Last Exam, and a handful of others designed to be more difficult. The trajectory of each is the same. They are designed in a moment, they sit above the frontier for a quarter or two, and then the frontier catches them and they re-enter the saturation regime. The benchmark designers are racing the frontier and losing. The gap between design time and saturation time is shrinking. There is no version of this race that ends with the benchmark winning.

The deeper problem is that the design of any public benchmark eventually leaks into the training distribution. The leak is not always direct training on the benchmark itself, though that happens. The leak is that the structure of the benchmark, the kinds of questions it asks, the rubric format, the distribution of difficulty across topics, all of it becomes available to be optimized against. The benchmark was supposed to be a probe. It has become a target. The probe stops being a probe the moment the system being measured can see the probe's shape.

The shape of the corruption

There is a useful way to think about which benchmarks corrupt fastest. Multiple-choice formats corrupt faster than free-response. Static question banks corrupt faster than dynamically-generated ones. Benchmarks with public training sets corrupt faster than benchmarks without them. Benchmarks whose answer distribution can be inferred from the question format corrupt faster than those whose answers require generative reasoning. Most of the current public suite scores high on all of these failure axes. The slower-corrupting benchmarks exist, but they are expensive to run and slow to scale, which is precisely the reason they are not in widespread use.

The signal that survives saturation

Not all measurement loses signal at the frontier. The methods that survive share a few characteristics. They have ground truth that is verifiable but not enumerable in advance. They require generative output that cannot be selected from a fixed set. They measure capability under distribution shift from whatever the training corpus contained. They use rubrics that depend on expert judgment, not pattern matching against a key.

Long-horizon agentic evaluation survives. The model is given a non-trivial task, a tool environment, and a budget of actions; it succeeds or fails on the basis of whether the task was actually completed, measured by an oracle that examines the end state rather than the trajectory. The eval is expensive to run, slow to score, and high-variance, but it produces a signal that does not collapse when the frontier moves.

Domain expert evaluation survives. A practicing professional writes a question bank in their field, including questions whose answers require both domain knowledge and the application of that knowledge to novel cases. The rubric is constructed from the standards a senior practitioner in the field would apply. The eval cannot be gamed by training on it because the rubric requires judgment that the training corpus did not contain in pre-formatted form. The cost is human expert time at hourly rates that make the eval orders of magnitude more expensive than an API-driven benchmark.

What replaces the public suite

The next generation of evaluation will be expensive, slow, adversarial, and domain-specific. None of these are properties of a benchmark you can put in a press release. They are properties of a benchmark that produces signal at the frontier.

Long-horizon agentic tasks with verifiable ground truth. The model executes a task that takes ten minutes to two hours of wall-clock time, in an environment that exposes a real tool surface, and the success criterion is verifiable by an oracle that examines the end state. SWE-bench is an early example. The next generation will be more demanding and more diverse, covering domains where the oracle is harder to construct.

Domain expert hand-written question banks with rubric-based scoring. The bank is held privately. The rubric is held privately. The scoring is done either by human experts or by a separate model whose role is rubric application, not capability measurement. The questions are rotated to limit the value of any individual leak. The cost per eval cycle is in the thousands of dollars rather than the tens.

Red-team protocols designed to surface latent capability rather than measure refusals. The model is probed for the presence of capability that the training corpus could plausibly have installed, with the probe designed to bypass surface refusal layers. The result is not whether the model said yes. It is whether the underlying capability can be reached at all. This is uncomfortable, because the answer for capable models is usually yes, and that answer has implications the field is not yet willing to discuss publicly.

The economics shift

A current-generation public eval costs a few dollars to a few hundred dollars per model per pass, dominated by API time. A next-generation eval costs in the low thousands per model per pass, dominated by human expert time plus the compute to run extended agentic trajectories. The cost increase is one to two orders of magnitude. Plan budgets accordingly.

The implication for capital allocation is that evaluation infrastructure at the frontier is becoming a competitive moat. The labs with serious eval infrastructure can measure their own capability accurately, set internal release thresholds with confidence, and price their model performance in production correctly. The labs without that infrastructure are flying with broken instruments. They will publish the same MMLU number as the frontier and ship models that are not actually at the frontier, and the difference will not be visible to the public conversation until something downstream breaks.

The widening moat is not on weights. It is on evaluation. Weights you can release. Evaluation infrastructure you can keep proprietary indefinitely, and the rational thing to do, as the discriminating evals become more expensive to build and more valuable to keep private, is exactly that. The open-versus-closed question is shifting axes faster than the public conversation has acknowledged, and it is shifting toward an axis where openness is much harder to advocate for.

What to do if you are not a frontier lab

The advice that follows is unromantic. If your business depends on knowing which frontier model is actually best for your use case, you cannot get that answer from a public benchmark anymore. You have to build your own eval. The construction is not exotic. Pick three tasks that matter to your work. Write your own ground truth for them, with rubrics that reflect what success in your context actually looks like. Run the eval quarterly against whatever the current frontier offers. The cost is small. The cost of not doing it is making procurement decisions on the basis of a number that has decoupled from the thing the number is supposed to measure.

The first time you run this against the public ranking, the result will be surprising. The model the spec sheet says is third will probably be first for your task. The model the spec sheet says is first will probably be second or third. The rankings will not be stable across quarters as the labs ship new generations, and the rate of change will not match the rate suggested by the public benchmarks. This is the normal regime. It is the regime the public benchmarks have stopped tracking.

This is the discipline the field is moving into whether the field acknowledges it or not. The discriminating evaluation is private. The public ranking is convenient and increasingly meaningless. The labs that build their own measurement infrastructure are ahead. The labs that do not are operating with a broken compass on a frontier that is moving fast enough that the broken compass costs real money. The work of building the compass is the work of building the lab. The work that does not get done at the substrate is going to keep being missed at the surface.