基准与评测方法学:当 Harness 成为评测变量
1. 引言:为什么 Harness 时代必须重造基准
1.1. 背景:榜单叙事的三重信任危机
自 2024 年 SWE-bench Verified 成为编码智能体的事实行业标准以来,"榜单分数"一度是行业叙述模型能力进步的通用货币。到 2025 至 2026 年,这枚货币经历了三重信任危机:
- 第一重:测试本身有缺陷。OpenAI 于 2026-02-23 发布《Why we no longer evaluate SWE-bench Verified》,正式弃用该基准。其复审发现,模型常失败题目中至少 59.4% 存在缺陷测试——要么拒绝功能正确的提交(测试过窄),要么要求题面从未提及的功能(测试过宽)。基准不再测"它声称要测的东西"(详见 4.1 节)。
- 第二重:训练污染。OpenAI 的审计显示,所有被测前沿模型(含 GPT-5.2、Claude Opus 4.5、Gemini 3 Flash)都能凭 task ID 复现 gold patch 的逐字片段;GPT-5.2 的思维链轨迹甚至暴露了对未指定测试要求的知识,暗示测试补丁本身出现在了训练数据中。分数提升越来越反映训练期暴露,而非真实能力。
- 第三重:口径漂移。同一模型在不同 scaffold(评测脚手架 / Harness)、不同推理努力度、不同评测机构下的分数差异,可以大于模型代际之间的差异。榜单之间的横向比较基本失效(详见第 3 节)。
三重危机共同指向一个结构性事实:智能体评测的对象从来不是"模型",而是"模型 + Harness"组成的系统。当 Harness 成为评测中不可剥离的变量时,建立在"纯模型分数"叙事上的榜单体系就必须重造——这正是本章作为白皮书独立一章的理由。
1.2. 核心论点:Harness 已成评测变量
本章的核心论点是:脱离 Harness 谈模型分数没有意义。这一论点由三组可核实的事实支撑,并贯穿全篇:
- 同模型换 scaffold 可差 11.6 分。在 SWE-bench Pro 上,Claude Opus 4.5 经 SWE-Agent 标准化 scaffold 为 45.9%,换 Augment Code 的 Auggie CLI 为 51.8%;Opus 4.6 + Morph 的 WarpGrep v2 搜索子智能体达 57.5%(第三方 scaffold 口径)——部分差异不是来自更好的模型,而是来自更好的编排(详见 3.1 节)。
- 同配置多次运行方差约 ±3 分。GitHub 在 Terminal-Bench 2.0 方差分析中对每个 agent-model 组合至少运行 5 次,用 ±1σ 刻画离散度,并得出结论:观察到的 harness 间差异落在模型随机性导致的 run-to-run 方差之内(详见 3.2 节)。
- 同基准不同评测机构分数系统性漂移。Terminal-Bench 2.1 上,官方榜(tbench.ai)榜首成绩与独立评测机构 Artificial Analysis(Terminus 2 + e2b sandbox、pass@1 平均 3 次重复)的成绩存在数分差异——评测环境本身是分数的一部分(详见 3.3 节)。
三组事实合起来的推论是:公开榜单上的每一个分数都是"模型 × Harness × 配置 × 运行方差"的复合产物。引用分数而不注明这四个变量,等于引用了一个不可解释的数字。
1.3. 本章在白皮书中的定位
本章回答两个问题:"我们用来判断模型强弱的尺子,本身准吗?"(第 2 至 5 节)以及"既然公共的尺子不可全信,企业该如何自建测量?"(第 6 节)。与白皮书其他章节的分工是:
- 第 3 章六层能力模型中的 L5(评估与观测层)定义了 Harness 的评估职责;本章从评测方法学一侧展开——审查公共基准、指出行业评估空白、给出自建基准的方法学建议。
- 第 4 章(架构与工程实践)讨论如何建设 Harness;本章讨论如何度量建设成果。
- 第 6 章(产业格局)中的平台对比,凡涉及分数均遵守本章确立的引用纪律:带评测日期、配置与 scaffold 说明,否则不可比。
2. 主流基准盘点
2.1. 盘点的口径纪律
本章盘点遵循两条方法学底线:
- 所有分数必须带评测日期、配置与 scaffold 说明,否则不可比。凡本节引用的分数,均注明其口径(官方榜 / 第三方 scaffold 榜 / 独立机构榜);口径不明的,标 并禁止用于横向排序。
- 基准的状态(在用 / 修订 / 弃用)必须随分数一并声明。已弃用基准的分数只能作为历史口径参考,不得用于论证当下能力。
2.2. 主流基准对比总表
| 基准 | 发布方 | 首发 | 规模与形态 | 测的是什么 | 判定方式 | 抗污染设计 | 当前状态 |
|---|---|---|---|---|---|---|---|
| SWE-bench Verified | Princeton / 社区,OpenAI 人工验证子集 | 2024-08(Full 2023-10) | 500 个人工验证的开源 Python 仓库缺陷修复任务 | 依据 issue 描述定位并修复缺陷 | 跑隐藏测试,Pass@1 | 无(静态冻结,已被污染) | 已于 2026-02-23 被 OpenAI 弃用 |
| SWE-bench Full / Lite / Multilingual / Multimodal | Princeton / 社区 | 2023-10 起 | 2,294 / 300 / 300(9 种语言)/ 517(含视觉元素) | 同上,多语言与多模态变体 | 跑隐藏测试 | 无 | 在用;官方默认以 mini-SWE-agent(bash-only)统一 scaffold |
| SWE-bench Pro | Scale AI(+ Princeton) | 2025-09-21 | 1,865 个问题,41 个活跃维护仓库,分 public / held-out(12 仓库)/ commercial(18 个专有仓库)三子集 | 长周期、跨文件的真实工程任务(至少修改 10 行代码,参考解平均跨 4.1 个文件、107.4 行) | Pass@1,SWE-Agent 统一 scaffold,成本不设上限、轮次上限 250 | GPL copyleft 仓库 + 私有专有代码库,法律与访问双重屏障;发布时无被测模型能生成逐字 gold patch | 在用;OpenAI 弃用 Verified 后的官方建议继任者 |
| SWE-bench-Live | Microsoft 等 | 2025 | 自动更新的多语言、多 OS 任务集(lite 与 verified split 冻结以保证可比性,最新 issue 走 test split) | 持续更新的真实仓库任务 | 跑隐藏测试 | 动态更新,天然抗污染 | 在用 |
| Terminal-Bench 家族 | Laude Institute + Stanford + 社区 | 2025-05-19 | 1.0 → 2.0(89 任务,2025-11-07)→ 2.1(2026-05-06,修复 28 任务)→ 3.0(74 任务,2026-07-30)→ 4.0(66 任务,2026-08-28)→ Science 0.1(70 任务,2026-08-27) | 智能体在终端长时程任务上的能力(任意可框定为"指令 + 容器 + 测试"的工作流) | 只按结果判定,不评判选择了哪些命令;Harbor 为统一评测 harness | 每任务唯一环境 + 人工参考解;2026-08 起提交须附 rollout 轨迹并经人工验证(Verified tag) | 在用;版本快速迭代 |
| SWE-Lancer | OpenAI | 2025 | Full:1,488 个任务、总价值 100 万美元(IC SWE 764 个 / 41.4775 万美元 + SWE Manager 724 个 / 58.5225 万美元);Diamond:502 个 / 50.08 万美元 | 模型能否完成 Upwork 真实自由职业任务并挣到赏金 | Pass@1(模拟自由职业平台一次机会),移除 GitHub 远程防止抓取代码差异 | 真实市场任务 + 经济计价 | 在用 |
| SkillsBench | 多机构 | 2026-02-13(arXiv:2602.12670) | v1:86 任务 / 11 领域 / 7 配置 / 7,308 条轨迹;v1.1:87 任务 / 8 领域 / 18 配置 / 9,396 条轨迹 | Agent Skills(SKILL.md 类能力包)对任务通过率的实际增益 | 三种对照条件:no Skills / curated Skills / self-generated Skills,每任务 3 次 trial | 对照实验设计 | 在用 |
| OSWorld / OSWorld-Hard | 学术界 | 2024 起 | 真实操作系统环境中的计算机操作任务 | 智能体在 GUI 与真实 OS 环境中的操作能力 | 环境终态判定 | 在用 | |
| ARC-AGI / ARC-AGI-2 | ARC Prize 基金会 | 2019 / 2025 | 抽象推理与流体智力谜题 | 少样本抽象归纳能力(刻意避开训练分布) | 精确匹配 | 每题全新规则,设计上不可训练 | 在用;ARC-AGI-2 分数见 2.5 节 |
| GPQA Diamond | 学术界 | 2024 | 博士级科学问答(约 200 题) | 高难科学知识推理 | 精确匹配 | 题目经抗搜索设计 | 在用;已接近饱和 |
说明:表中“测的是什么”一列为各基准官方声明的构念;构念与真实工作是否一致,是第 4.3 节的审查对象。
2.3. 编码类基准:SWE-bench 家族
SWE-bench 家族呈现典型的"分裂演化"结构,每一代变体都针对上一代的一个具体缺陷:
| 变体 | 针对的缺陷 | 关键设计 |
|---|---|---|
| Full(2,294 题) | — | 原始全集,含大量噪声与无效任务 |
| Verified(500 题) | Full 中任务质量参差 | OpenAI 组织人工过滤验证;后被审计出 ≥59.4% 缺陷测试并弃用 |
| Lite(300 题) | 评测成本过高 | 轻量子集 |
| Multilingual(300 题,9 种语言) | 只覆盖 Python | 扩展到多语言仓库 |
| Multimodal(517 题) | 只覆盖纯文本 issue | 加入截图等视觉元素 |
| Pro(1,865 题) | Verified 饱和、污染、任务过短 | 长周期任务 + 私有仓库屏障 + 统一 SWE-Agent scaffold |
| Live | 静态冻结导致训练污染 | 自动更新机制,最新 issue 走 test split |
SWE-bench Pro 的官方榜成绩(统一 SWE-Agent scaffold 口径):Claude Opus 4.5 于 2025-11-26 取得 55.53%,为官方榜最高;GPT-5.2-Codex 为 51.6%。作为对照,发布时(2025-09 冷启动)所有模型 Pass@1 均低于 25%,其中 GPT-5 最高 23.3%(public 子集)。半年内从不到 25% 到 55% 以上,这一跃升幅度本身就是需要警惕的信号——它既可能反映真实能力进步,也可能包含训练暴露的成分,在 Verified 污染审计结论已知的前提下,宜保守解读。
SWE-bench-Live 还贡献了一项超出评测本身的工程发现:SWE-Agent、OpenHands 与 Claude Code 均无法在 Windows 容器上运行,该基准团队为此实现了工具调用对齐的最小 Windows 兼容 agent(Win-agent)。这从侧面印证了本白皮书的论点:评测环境与 Harness 的适配性,本身就是能力测量的前置条件。
2.4. 终端与环境交互类:Terminal-Bench 家族与 OSWorld
Terminal-Bench 的设计出发点极简:任何终端任务都可以框定为"一条通用指令 + 一个容器 + 一个可执行的测试",因此它度量的是智能体在命令行环境中最通用的长时程工作能力。由于终端任务的判定完全自动化(只看结果、不看用了哪些命令),它成为检验"评测环境可信度"的天然试验场。其家族时间线与代表性成绩如下:
| 版本 | 发布日期 | 任务数 | 关键变化 | 代表性成绩(注明口径) |
|---|---|---|---|---|
| 1.0 | 2025-05-19 | — | 首发 | — |
| 2.0 | 2025-11-07 | 89 | 更严质量控制 + 新评测 harness Harbor | Claude Sonnet 4.5 于 2025-09-29 达 51.0%,为该榜首个突破 50% 的成绩;GPT-5.2 于 2025-12-11 达 54.0%。论文自陈"前沿模型与智能体得分低于 65%";另一表述为最佳组合 GPT-5.2 + Codex CLI 仅 62.9%——两个数字来自不同二手源, |
| 2.1 | 2026-05-06 | 89 | 修复 28 个任务(修补 Dockerfile、修正 instruction-test 不匹配) | 官方榜榜首:Claude Code + Fable 5,83.8% ± 1.2(xhigh,2026-06-07);独立机构 Artificial Analysis:Claude Fable 5,84.6%(Terminus 2 + e2b sandbox,pass@1 平均 3 次重复)——双榜并列呈现,任何单取其一都构成口径错误 |
| Challenges | 2026-06-18 | — | 长周期单项目任务 | — |
| 3.0 | 2026-07-30 | 74 | 更难任务;最佳 agent 首发约 34%(第三方口径) | — |
| Science 0.1 | 2026-08-27 | 70 | 科研工作流独立基准 | — |
| 4.0 | 2026-08-28 | 66 | 从 3.0 的 74 精简:删除 8 个、修订 20 个、新增 0 个 | 榜首:Fable 5.1,57.9% ± 3.8(max,Claude Code,2026-09-01) |
Terminal-Bench 2.0 论文的另一组数据值得单独记录:对 Oracle(直接套用 gold patch)运行的天花板测量显示,500 个任务中 491 个(98.2%)在 10 次独立运行中一致通过,2 个为 flaky(9/10),7 个每次都失败。即使是"标准答案"本身,也只有约 98.6% 的可复现性——这是评测基础设施固有噪声的直接测量(详见 4.2 节)。
OSWorld 系列将评测从命令行扩展到真实操作系统 GUI 环境:OSWorld-Hard 上 GPT-5.2-Codex 为 61.4%、Claude Opus 4.5 为 58.0%(评测日期 )。计算机操作类任务的重要性在于:它把 L2(工具与执行层)的差异直接暴露为分数差异——同样的模型,能否稳定驱动屏幕、键盘与真实应用,取决于 Harness 对执行原语的封装质量。
2.5. 经济价值化与专项能力类:SWE-Lancer、SkillsBench、ARC-AGI、GPQA
SWE-Lancer 是经济价值化评测的原始范例:任务来自 Upwork 真实自由职业市场,以美元计价,检验模型能否挣到外包赏金。协议刻意模拟真实市场约束——每个 agent 只有一次机会(pass@1),并移除 GitHub 远程防止模型抓取代码差异。其发布口径的结果显示:所有模型在 SWE Manager(管理类)任务上的表现均优于 IC SWE(一线开发类)任务;IC SWE 的 pass@1 与收入率均低于 30%,远未饱和。以 Claude 3.5 Sonnet 为例:Diamond 集上 IC SWE 26.2%(挣得 5.8 万美元)、SWE Manager 44.9%(挣得 15 万美元)、全集 33.7%(挣得 40.3 万美元,收入率 40.3%)。经济价值化的意义在于把"能力"换算成了采购方真正关心的量纲——可挣取的赏金,同时也暴露了任务分布的偏差:全集中 Infrastructure/DevOps 类任务仅占 0.41%(3 个),Diamond 集为 0(详见 5.3 节)。
SkillsBench 是第一个把 Skills(SKILL.md 类能力包)作为一等评估对象的基准。其核心结论包括:人工精编 Skills 使平均通过率 +16.2 个百分点(v1 口径;v1.1 口径为 33.9% → 50.5%,+16.6 pp);领域差异极大——软件工程领域仅 +4.5 pp(最低),医疗健康高达 +51.9 pp(最高);84 个可比任务中有 16 个出现负增益(加了 Skills 反而变差);自生成 Skills 平均无收益甚至轻微负收益(-1.3 pp);配了 Skills 的小模型可匹敌未配 Skills 的大模型(Haiku 4.5 + Skills 为 27.7%,Opus 4.5 裸跑为 22.0%)。SkillsBench 的方法学价值在于对照实验设计:no Skills / curated / self-generated 三条件、每任务 3 次 trial,这是公共基准中少见的、可直接迁移到企业内部评测的实验范式。
ARC-AGI-2 与 GPQA Diamond 代表另一极:测"模型作为推理器"的天花板。ARC-AGI-2 上 GPT-5.2 为 52.5%(评测日期 );GPQA Diamond 上 GPT-5.2 为 92.4%、Claude 系列为 87.0%(评测日期 )。这两类基准与 SWE 系处于互补位置:它们基本剥离了 Harness 变量(单轮问答、精确匹配),测的是模型裸能力;而 SWE 系与终端系测的是"模型 × Harness"系统。一个完整的能力画像需要两类基准配合:裸能力基准回答"模型上限有多高",系统基准回答"Harness 能把上限兑现多少"。同一模型在 GPQA Diamond 上超过 90% 而在 OSWorld-Hard 上不足 62% 的落差,正是六层能力模型中 L1 至 L6 层损耗的直接量化。
3. 核心论点:Harness 已成评测变量
图 3-1|基准分数构成结构:模型 × Harness × 配置 × 运行方差四变量
数据来源:基于本文分析绘制的示意图。
3.1. 证据一:同模型换 scaffold,分差可达 11.6 分
SWE-bench Pro 上记录到的 scaffolding 效应是本章最有价值的实证。同一模型(Claude Opus 4.5)在不同评测脚手架下的成绩:
| 模型与配置 | Scaffold | 分数 | 口径 |
|---|---|---|---|
| Claude Opus 4.5 | SWE-Agent(标准化) | 45.9% | 官方统一 scaffold |
| Claude Opus 4.5 | Auggie CLI(Augment Code) | 51.8% | 第三方 scaffold |
| Claude Opus 4.5 | Claude Code | 约 49.5% | 第三方 scaffold |
| Claude Opus 4.5 | Cursor | 约 49.8% | 第三方 scaffold |
| Claude Opus 4.6 + Morph WarpGrep v2 搜索子智能体 | WarpGrep v2 | 57.5% | 第三方 scaffold |
数据来源为 SWE-bench Pro 官方榜及第三方汇编(2026 年初口径,第三方 scaffold 数字为 C 级来源,引用时须注明)。同一模型、同一基准,仅更换包裹它的 Harness,分差达 11.6 分——这个差距大于同期多数模型代际之间的官方榜差距。更值得注意的是最高分的构成:57.5% 的成绩来自"Opus 4.6 + Morph 的 WarpGrep v2 搜索子智能体",其中 WarpGrep 是一个专门优化代码搜索的子智能体编排方案。部分差异不是来自更好的模型,而是来自更好的编排——这正是 AI Harness 六层能力模型中 L1(上下文工程)与 L3(编排与控制)层的直接经济价值。
由此得出可比性纪律:官方统一 scaffold 榜与含第三方 scaffold 的成绩属两个口径,分数不可横向排序;含第三方 scaffold 的高分(57.5%)高于官方榜最高分(55.53%),恰是"Harness 已成评测变量"的直接证据。
3.2. 证据二:同配置多次运行,方差约 ±3 分
GitHub 官方博客《Evaluating performance and efficiency of the GitHub Copilot agentic harness across models and tasks》(2026)给出了一组少见的、来自厂商的受控方差分析。其方法学是控制变量评测:同一模型、同一基准任务、上下文窗口归一化、相同推理努力度、相同工具与 MCP 配置——只有 Harness 本身作为变量。在 Terminal-Bench 2.0 上,每个 agent-model 组合至少运行 5 次,用 ±1σ 刻画离散度。
其关键结论(原文口径):观察到的 harness 间差异落在模型随机性导致的 run-to-run 方差之内——"看起来差几个百分点的榜单差异,很可能只是运行方差"。结合 SWE-bench Pro 官方榜按二项比例统计报告 95% 置信区间(如 SWE-Agent + claude-4-5-Sonnet 为 43.72 ± 3.60,至 2025-10 口径)、Terminal-Bench 各榜普遍 ±1.2 至 ±3.8 的区间,行业经验口径可以概括为:同配置多次运行的方差约 ±3 分量级。
这一事实的推论是:两个分数的差异若小于方差区间,应表述为"无可辨别差异",而非优劣结论。企业内部评测若每配置只跑一次,其分数应视为单次采样而非能力估计;预算允许时应至少 5 次重复并报告区间。
3.3. 证据三:同基准不同评测机构,分数系统性漂移
Terminal-Bench 2.1 的"双榜对照"提供了第三组实证。同一基准版本、同一批模型,两个评测环境给出的榜首成绩:
| 口径 | 榜首配置 | 分数 | 评测条件 |
|---|---|---|---|
| 官方榜(tbench.ai) | Claude Code + Fable 5 | 83.8% ± 1.2 | xhigh 推理档位,2026-06-07,单次成本 552.67 美元 |
| 独立评测(Artificial Analysis) | Claude Fable 5 | 84.6% | Terminus 2 agent + e2b sandbox,pass@1 平均 3 次重复 |
两个口径必须并列呈现,任何单取其一的做法都构成口径错误。数分的差异来自评测环境(沙箱实现、agent 封装)、重复次数与判定细节的不同。积极的一面是:差异小于 1 分量级说明该基准总体稳健;消极的一面是:差异的存在证明评测环境是分数的组成部分——脱离环境引用分数没有意义。
同一基准上还存在反方向的警示案例:OpenAI 在 2026-09-03 的 GPT-6 Astra 发布材料中自述 Terminal-Bench 4.0 成绩为 57.7%,但该成绩当日未出现在官方榜单上(当时官方榜首为 Fable 5.1 的 57.9%)。此案例依据第三方汇编(C 级来源),本章不将其作为正文硬证据,但它揭示的风险模式——厂商自述成绩与官方榜的可核验提交之间可能存在口径差——是所有分数引用者必须常态化的怀疑(详见 4.4 节)。
3.4. 推论:每个分数都是复合产物
三组证据合成的结论值得作为工程纪律固化下来:
| 事实 | 量级 | 来源 |
|---|---|---|
| 同模型换 scaffold | 最大 11.6 分 | SWE-bench Pro 官方榜 + 第三方汇编 |
| 同配置 run-to-run 方差 | 约 ±3 分 | GitHub Terminal-Bench 2.0 方差分析(每组合 ≥5 次) |
| 同基准跨评测机构漂移 | 数分(小于 1 分量级的整体偏差 + 环境差异) | Terminal-Bench 2.1 双榜对照 |
公开榜单上的每一个分数都是"模型 × Harness × 配置(推理努力度、沙箱、工具、重复次数)× 运行方差"的复合产物。 引用分数而不注明这四个变量,等于引用了一个不可解释的数字。据此,本白皮书对全行业提出分数引用的四要素纪律:模型 + 版本、基准 + 版本、评测日期、配置(scaffold 与推理努力度)——四要素不全的分数,不得进入对比表,不得作为选型依据,不得写进对外材料。此外还应附上来源属性(官方提交验证 / 官方榜未验证 / 厂商自述 / 第三方汇编)与基准当前状态(在用 / 修订 / 弃用)。
4. 基准本身的危机
4.1. SWE-bench Verified 的官方弃用
SWE-bench Verified(500 个人工验证的开源 Python 仓库缺陷修复任务)曾是编码智能体最广泛引用的基准。OpenAI 于 2026-02-23 发布《Why we no longer evaluate SWE-bench Verified》,正式弃用它,判断依据是:"SWE-bench Verified 上的改进不再反映模型真实软件开发能力的有意义提升,而是越来越多地反映模型在训练期对该基准的暴露程度。"
弃用决定建立在两组审计证据上:
- 缺陷测试审计:复审模型常失败的 27.6% 数据子集,发现其中至少 59.4% 的题目存在缺陷测试——拒绝功能正确的提交;另一口径的审计中,138 道前沿模型反复错失的题目里,超过 60% 按题面无法解决,其中 49 个测试过窄、26 个测试过宽。
- 训练污染审计:OpenAI 测试的每一个前沿模型(含 GPT-5.2、Claude Opus 4.5、Gemini 3 Flash)在给出 task ID 时都能复现 gold patch 的逐字片段;GPT-5.2 的思维链轨迹暴露了对未指定测试要求的知识,暗示 test patch 出现在了训练数据中。
- 佐证:该基准最近 6 个月的分数仅从 74.9% 升至 80.9%,增长明显放缓,而模型厂商仍在以它作为头条宣传数字。OpenAI 官方建议迁移到 SWE-bench Pro。
弃用后的市场格局呈现"双轨报告":Google DeepMind、Anthropic、Meta 在公告后继续报告 Verified 分数,但开始同时给出 Pro 数字;OpenAI 自己在 2026-04-23 发布 GPT-5.5 时,仍以 88.7% 的 Verified 成绩作为头条数字(此格局判断部分依据第三方汇编,可信度 C)。当期最高分存在两个口径,本白皮书并列呈现并标注 ,不作取舍:
| 冲突项 | 口径甲 | 口径乙 | 处理 |
|---|---|---|---|
| SWE-bench Verified 当期最高分 | Claude Opus 4.7,87.6%(2026-04-16) | GPT-5.5,88.7%(2026-04-23) | 并列呈现,均为第三方汇编口径,;引用时必须同时写明该基准已于 2026-02-23 被弃用的事实,否则构成误导 |
本案例确立的方法学教训:基准是会过期的资产。任何以基准分数为依据的对外声明,都应注明基准的当前状态。
4.2. 测量噪声:会移动的天花板
比测试缺陷更隐蔽的问题是评测基础设施自身的噪声。Centre for Software Excellence 的《Before You Score the Model, Score the Benchmark》(2026,C 级来源,方法透明)给出了一组关键测量:在隔离的纯净环境中对 SWE-bench Verified 做 10 次独立的 Oracle(gold patch)运行——即不让任何模型解题,直接套用人类参考答案跑测试:
| 结果 | 数量 | 占比 |
|---|---|---|
| 10 次运行全部一致通过 | 491 | 98.2% |
| 10 次中通过 9 次(flaky tests) | 2 | 0.4% |
| 每次都失败 | 7 | 1.4% |
| 平均通过 | 492.8 / 500 | 98.56% |
该报告的结论一针见血:"98.5% 在真空中听起来很高,但一个会移动的天花板意味着你的评测指标在根本上是带噪的。"当标准答案本身只有约 98.6% 的可复现率时,被测系统之间 2 至 3 分的差异已经接近测量地板。这与 3.2 节的 run-to-run 方差(约 ±3 分)相互印证:智能体评测的噪声地板就在个位数百分点量级,任何小于该量级的结论都需要重复实验支撑。SWE-bench 社区的多个公开 issue(#267、#294、#274、#246 等)与 Harbor 排障文档记录了同类问题的广泛性。
4.3. 构念效度危机:基准测的不是真实工作
第三层危机最根本:即使测试没有缺陷、没有污染、没有噪声,基准仍可能测错了东西。
- 任务形态失真。Microsoft 的《Saving SWE-Bench》论文(仅经二手转述,未取到 arXiv 编号)指出:GitHub issue 衍生的基准根本性地误代表了开发者实际使用编码 agent 的方式——真实交互大多发生在 IDE 中的非正式聊天里,而非归档 issue 的结构化散文中。该团队把 SWE-Bench 任务改写为逼真的聊天式查询后,发现现有基准高估 agent 能力超过 50%(同上)。
- 特征实现类基准的命名与质量危机。FeatureBench / FEA-Bench / FeatBench 三个不同团队发布近乎同名的特征实现基准(原始论文均未取到),且各自存在缺陷:FeatureBench 的问题陈述由 LLM 从测试图合成而非来自真实 PR 描述,任务感觉人工且极难——Claude Opus 4.5 在 SWE-bench 上 80.9%,在 FeatureBench 上仅 11.0%,天花板低到主要测的是地板噪声;FEA-Bench(Microsoft)的定义要求引入新组件,但 1,401 个任务中有 116 个
new_components字段为空列表。这些新基准试图修复 SWE-bench 的构念问题,却暴露了基准设计本身的成熟度不足。 - 成本与效率缺席。主流基准几乎都以通过率为唯一主指标,成本(token 消耗、美元开销)与延迟只在部分榜单附带展示。Terminal-Bench 2.1 官方榜上,榜首成绩的成本从 134.09 美元到 2,059.19 美元不等——同一分数背后的成本可以差一个数量级,不带成本约束的排名会系统性奖励"烧钱换分"的配置。
构念效度危机的推论是:公开基准分数与企业真实场景之间横亘着"评估—生产鸿沟"。基准只测了真实工作的一小部分剖面,且该剖面还在被训练数据反向塑造。
4.4. 厂商自述与独立验证的分歧
模型厂商既是被测者又是叙事者,其发布材料中的分数必须与独立可核验的榜单提交区分。业界已形成的规范做法包括:
- 来源分级:官方榜且经提交验证(如 Terminal-Bench 2026-08 起的 Verified tag,要求提交者提供 rollout 轨迹,由维护者验证仅问题陈述与 Docker 镜像被提供给智能体、gold patch 与判定结果未泄漏)> 官方榜未验证 > 厂商自述(self-reported)> 第三方汇编。
- 作弊惩罚:Terminal-Bench 2.1 榜单上,Cursor CLI + Grok 4.5 的一条提交因 PR Hacks(利用判定规则漏洞提分)被施以 -9.0% 的惩罚——证明作弊检测与惩罚机制已在头部基准实际运转。
- 自述与榜单的对照义务:厂商自述成绩若与当日官方榜单不一致(如 4.4 节前文所述的 GPT-6 Astra 案例),引用者有义务指出差异而非默认采信。
本白皮书采用的最小纪律:厂商自述数字必须标注 self-reported,且不得与实测数字混排在同一对比列中。
4.5. 基准是会过期的资产
综合本章证据,基准的管理应当被当作与软件依赖管理同构的工程问题,具备完整的生命周期:
| 生命周期阶段 | 关键活动 | 反例 / 教训 |
|---|---|---|
| 发布 | 构念定义、任务构建、质量控制(如 Terminal-Bench 四阶段:自动化验证 → LLM 辅助审阅 → 人类专家审阅 → 对抗测试) | FeatureBench / FEA-Bench 的质量缺陷 |
| 修订 | 缺陷测试的发现、冻结与修补(Terminal-Bench 2.1 修复 28 个任务;4.0 删除 8 个、修订 20 个) | 修订后历史分数口径变化必须公告 |
| 污染检测 | 复现检测(gold patch 逐字复现测试)、任务入集日期留档 | SWE-bench Verified 全前沿模型可复现 gold patch |
| 弃用 | 官方公告、继任基准指引、下游引用口径同步 | Verified 弃用后厂商仍以其为头条数字 |
| 档案化 | 历史分数保留原值,不回溯改写 | — |
5. 行业评估空白:比错误基准更麻烦的是没有基准
5.1. 空白地图
本章在编写过程中对全行业基准覆盖度做了系统盘点,结果如下表。空白本身是本白皮书的重要发现:在 Harness 六层能力模型中,L5(评估与观测)被普遍承认为核心层,但作为其公共基础设施的基准,在多个高价值方向上完全缺位。
| 方向 | 当前可用基准 | 覆盖状态 |
|---|---|---|
| 编码(缺陷修复) | SWE-bench 家族、SWE-bench-Live | 最成熟,但 Verified 已污染并弃用 |
| 编码(特征实现) | FeatureBench / FEA-Bench / FeatBench | 新兴,命名混乱、质量参差 |
| 终端与计算机操作 | Terminal-Bench 家族、OSWorld | 成熟且快速迭代 |
| 经济价值化 | SWE-Lancer | 成熟,但任务分布严重偏向应用开发 |
| Skills / 能力扩展 | SkillsBench | 新兴,方法学最规范 |
| 抽象推理 / 科学知识 | ARC-AGI-2、GPQA Diamond | 成熟,接近饱和 |
| AI SRE(故障定位 / RCA / 值守) | 无 | 完全缺口 |
| DevOps / IaC 智能体 | 几乎无(SWE-Lancer 全集仅 0.41%) | 严重缺口 |
| 多智能体协作 | 无权威公开基准(tau-bench 等覆盖有限;头部厂商均为内部评估) | 严重缺口 |
| 内容生成质量(图像 / 视频 / 长文) | 第三方评测榜(如 Artificial Analysis ELO、SuperClue)为主 | 无公认权威基准,主观评测占主导 |
5.2. AI SRE:完全无公开基准
本白皮书依赖的多轮检索(含中英文、三轮以上渐进检索)未找到任何公开的、用于评估 AI 故障定位、根因分析或值守能力的权威基准。该领域目前唯一公开的规模化评估实践来自 Google SRE:其 AI Operator 智能体运行在数千起事故上,以内部 Golden Data(人类专家理想响应)为对照,用 LLM-as-a-Judge 评判成功与失败场景,且失败判定会自动转化为带实施计划的 bug 工单——但整套体系为内部形态,Golden Data 不对外公开。
这一空白的后果是双重的:一方面,企业无法在采购前用公共基准比较各厂商的 AI SRE 能力,厂商的 MTTR 改善声明(多为 preview 客户自述)无法交叉验证;另一方面,它反过来证明该领域的评估只能走"企业自建 Golden Set + LLM-as-a-Judge 闭环"的私有化路线(详见第 6 节)。
5.3. DevOps 与 IaC:严重缺口
基础设施方向的公开评测长期缺位。可量化的证据:SWE-Lancer 全部 1,488 个任务中,Infrastructure/DevOps 类仅 3 个(0.41%),Diamond 集为 0;GitHub 用于验证跨操作系统泛化的 Win-Hill 为内部基准,不对外开放。考虑到 IaC 场景的特殊风险——Terraform state 内含密钥且需要精确定址,基于无根据知识运行的智能体可能损坏状态或销毁有状态资源——这一方向恰恰是最需要严格评测、却最没有公共尺子的方向。
5.4. 多智能体协作:无权威公开基准
多智能体系统的头部实证均来自厂商内部:Anthropic 的多智能体研究系统在其内部 research eval 上比单智能体高出 90.2%(内部评测结果,不可外推为行业通用基准),配合的方差归因分析(token 使用量单独解释 BrowseComp 上 80% 的性能方差)同样是内部数据。公共侧仅有 tau-bench 等有限覆盖,且尚未形成 Terminal-Bench 那样的行业事实标准。多智能体协作是 L3(编排与控制层)的核心场景,其评估空白直接制约了编排技术的横向比较与选型。
5.5. 空白本身的含义
评估空白不只是"缺失的便利",它有明确的结构性后果:
- 评估负担向企业转移。在没有公共基准的方向上,每一个采购决策都必须自建评测,否则只能依赖厂商自述。
- 厂商叙事缺乏制衡。对照第 4.4 节的来源分级,"完全无公开基准"意味着该方向上几乎所有效果声明都停留在 self-reported 档位。
- Harness 的 L5 层从"可选项"变为"准入项"。当公共尺子缺位时,企业自身的评估与观测能力(回归集、轨迹追踪、在线指标)成为唯一可信的测量来源——这是本白皮书第 6 节的方法学建议的直接动因。
6. 自建基准的方法学建议
6.1. 总体原则:公开榜单只作上限校准
自建评测的总体原则是两段式:用公开基准估计模型能力天花板,用内部回归集回答实际水平。公开榜单的价值在三方面:粗粒度的能力分层(谁在第一梯队)、方法学范本(质量控制四阶段、对照实验设计、抗污染设计都可直接借鉴)、以及幻觉检测(当厂商自述与独立榜出现系统性分歧时,公开榜是显影剂)。但能力结论的最终依据必须是内部评估——理由在 4.3 节已经给出:公开基准的构念与企业生产分布之间存在系统性鸿沟。
6.2. Golden Set:把理想答案变成资产
Golden Set 是经人工验证的理想响应集合,是内部评测的基准真值。方法学要点:
| 要点 | 说明 |
|---|---|
| 起步规模 | 从 30 至 50 个精心标注的用例开始,覆盖主要任务类型与少量对抗性边界;不要等凑齐数百条才开始(Anthropic 的明确建议) |
| 来源优先级 | 生产失败轨迹优先——每一条生产失败固化为回归条目后,同一个错误不会付两次学费 |
| 构成要求 | 覆盖九类样本:明显通过、明显失败、边界案例、每个已知失败类别、不同用户与任务段、不同版本、对抗措辞、答案好过程坏、过程好外部失败 |
| 隔离要求 | Golden Set 的期望产出对被测智能体不可见;回归集不得参与被测对象的任何优化循环,并保留 held-out 子集 |
| 治理标杆 | Google SRE 的实践显示,Golden Data 可以进一步成为权限晋升的依据——智能体只有在 Golden 评估数据上展示出持续、统计学显著的成功率,才能获得更高自治级别 |
6.3. 轨迹评估:过程与结果分开判
只看最终答案的输入—输出评估存在系统性盲区:正确答案会隐藏错误的推理。智能体幻觉的工具调用可能碰巧走运,检索到不相关文档可能不影响最终合成,而多轮对话中的策略遵循(是否验证了身份、是否记录了交互)在最终答复中完全不可见。轨迹评估将智能体的执行路径(工具调用、参数、步数、循环、必需步骤)作为独立评估对象,其要点有三:
- 四维分解:轨迹(步数、循环、必需步骤齐全)、工具使用(选型、参数、错误恢复)、任务完成(目标达成)、多轮稳定性(上下文保持、目标漂移),四维独立打分。
- 结果导向判定:不应因轨迹偏离参考路径而判失败——替代路径在安全、正确且不更低效时应当判通过。这一原则防止评估器把"风格差异"误判为"能力缺陷"。
- 与成本配对:任务成功率必须与单任务成本、延迟同时报告——智能体可以通过无休止重试虚增成功率,而 Anthropic 的方差归因显示 token 预算本身可解释大部分性能方差。
6.4. LLM-as-a-Judge 的边界与校准
LLM-as-a-Judge 是内部评测无法绕开的技术——大量语义维度("这次诊断是否正确""这段文字是否切题")无法用确定性脚本判定。但它自身会幻觉、有风格偏好、对冗长回答有偏好、跨相似案例自相矛盾。工程上已收敛的边界与校准纪律:
| 纪律 | 内容 |
|---|---|
| 单准则原则 | 一条 Judge 只判一个准则;同时判正确性、语气、安全、效率的 Judge 产出不可解释 |
| 结构化输出 | 固定 schema:label(pass / fail / insufficient_evidence)+ score(0.0 至 1.0)+ failure_mode + explanation,并要求简短证据说明 |
| 隔离要求 | Judge 模型与被测智能体所用模型分离(不同版本或经隔离验证),防止自我评分偏置 |
| 人类校准 | Judge 与人类标注的一致性达到约 80% 以上方可用于门禁;分歧超过 20% 时,先收紧评分准则或降低温度,再依赖它(约 80% 的阈值来自厂商方法论文档,属工程经验口径而非标准条文) |
| 分歧处理 | 标注者在不看自动评分的情况下标注;记录分歧而非强制统一——分歧本身可能揭示评分准则的歧义 |
| 持续重校准 | 六类触发条件任一发生即重校准并递增评估器版本:agent 或 Harness 变更、评估器 prompt / 准则变更、Judge 模型变更、工具或上下文变更、用户分布变更、门限变更。跟踪评估器版本以区分"产品质量变化"与"度量方式变化" |
同时必须承认 Judge 的能力边界:Anthropic 的实践提供了不可替代性的人类评估实证——人类测试者发现早期智能体一致偏好 SEO 优化的内容农场而非权威来源(学术 PDF、个人博客),这是 LLM Judge 未捕捉到的系统性盲点,加入来源质量启发式后才解决。Judge 做规模化过滤,人类做高风险裁定与盲点探测,两者是层次关系而非替代关系。
6.5. 方差控制与在线指标
第 3 节的方差证据(同配置 ±3 分量级、Oracle 天花板 98.56%)直接决定了内部评测的运行纪律:
- 重复运行:每个配置至少多次运行(行业参照值:GitHub 口径每组合至少 5 次、Artificial Analysis 口径平均 3 次),报告均值与离散度,禁止以单次运行分数作为结论。
- 配置快照:每次运行留存完整配置快照(模型版本、Harness 配置、工具清单、日期、成本),使任何分数可回溯。
- 在线评估:离线回归集之外,对生产流量按采样率持续施加评估,捕捉分布漂移、新颖输入与真实世界的工具失败。采样率是在线评估成本的控制阀;在线指标与离线评分背离时,优先检查采样代表性,并把生产失败样本回流扩充离线集。
- 失败回流闭环:生产失败轨迹 → 转为回归集条目 → 在评估中复现 → 修复 → 永久保留为回归项。这是把评估从"成本中心"变成"资产积累"的关键机制。
6.6. A/B 与随机对照试验的必要性
主观自评在智能体效果度量中已被证明系统性失真,最有力的证据来自 METR 于 2025-07-10 发布的随机对照试验(RCT):资深开源开发者在使用 AI 工具后,实际完成任务的速度慢了 19%,而同一批开发者自评认为快了约 20%——主观与实测之间存在约 39 个百分点的落差。与之呼应,Stack Overflow 2025 开发者调查显示 46% 的开发者不信任 AI 输出准确性;DORA 2025 发现 90% 以上的开发者已在使用 AI、约 80% 感知到生产力提升,但同时 AI 采用与交付不稳定性正相关。
对企业自建评测的含义是分层的:
| 问题类型 | 可接受的证据等级 | 方法 |
|---|---|---|
| 某次改动是否变好 | 重复运行的回归评分卡 | 离线回归集 + 方差区间 |
| 两个配置哪个更优 | 受控对比 | 控制变量评测(同模型、同任务、同上下文窗口、同推理努力度、同工具配置,只变 Harness)+ 至少 5 次重复 |
| AI 工具对团队效率的净影响 | 随机对照 | A/B 分流或 RCT;对照组为不使用 AI 的同质任务;指标用完成时间、返工率、缺陷率,不接受问卷自评 |
| 线上真实效果 | 在线实验 | A/B 分流获得因果结论;观察任务成功率与成本、延迟的联合变化 |
任何效率结论,必须有对照测量,不接受主观自评——这条纪律是 METR 试验留给全行业的最重要遗产。
6.7. 落地检查清单
- [ ] 公开榜单只用于上限校准,能力结论均来自内部回归集
- [ ] 内部评测集从 30 至 50 条真实失败样本起步,覆盖主要任务类型与对抗边界
- [ ] Golden Set 含九类样本,期望产出对被测智能体不可见,含 held-out 子集
- [ ] 评估维度覆盖轨迹、工具使用、任务完成、多轮至少三维,独立打分
- [ ] LLM-as-a-Judge 单准则、结构化输出、与被测模型隔离、经人类校准(一致性不低于约 80%)
- [ ] 每配置至少 5 次重复运行,分数以均值 ± 区间发布;单次分数未用作结论
- [ ] 成功率与单任务成本、延迟配对报告
- [ ] 每次运行留存配置快照,评估器有版本台账
- [ ] 生产失败轨迹有转化为回归条目的固定通道
- [ ] 六类评估器重校准触发条件有监控与责任人
- [ ] 效率结论均有对照测量(受控对比 / A/B / RCT),无问卷自评型结论
- [ ] 对外引用的每个分数具备四要素(模型版本、基准版本、评测日期、配置)并标注来源属性与基准状态
7. 总结
本章回答的问题是:我们用来判断模型强弱的尺子,本身准吗?以及,企业该如何自建可信的测量?
核心结论有五点:
- Harness 已成评测变量,脱离 Harness 谈模型分数没有意义。同模型换 scaffold 可差 11.6 分(SWE-bench Pro:SWE-Agent 45.9% 对 Auggie CLI 51.8% 对 WarpGrep v2 57.5%),同配置多次运行方差约 ±3 分(GitHub 每组合至少 5 次的方差分析),同一基准在不同评测机构间有数分漂移(Terminal-Bench 2.1 官方 83.8% 对独立评测 84.6%)。每个公开分数都是"模型 × Harness × 配置 × 运行方差"的复合产物。
- 基准本身正在经历系统性危机。SWE-bench Verified 的官方弃用(2026-02-23,至少 59.4% 缺陷测试 + 全前沿模型可复现 gold patch)说明构念效度与训练污染不是理论风险而是既成事实;Oracle 天花板测量(98.56%)证明评测基础设施自带噪声地板;Microsoft 的研究提示现有基准可能高估 agent 能力超过 50%。基准是会过期的资产,其生命周期管理(发布、修订、污染检测、弃用、档案化)应被当作工程问题对待。
- 行业评估空白是本白皮书的重要发现。AI SRE 完全无公开基准,DevOps / IaC 方向在最大的经济化基准中占比仅 0.41%,多智能体协作无权威公开基准。在公共尺子缺位的方向上,所有厂商效果声明都停留在 self-reported 档位,评估负担系统性转移到企业侧。
- 企业自建评测有成熟方法学可循:Golden Set 从 30 至 50 条真实失败样本起步;轨迹评估四维分解、结果导向判定;LLM-as-a-Judge 单准则、结构化输出、与被测模型隔离、人类校准约 80% 一致性达标;每配置至少 5 次重复并以区间报告;效率结论必须有对照测量——METR 的 RCT(实测慢 19%、自评快 20%)是"不接受主观自评"这条纪律的最终依据。
- 评测方法学的怀疑精神不是对行业进步的否定,而是让真实进步不被噪声稀释。带四要素的分数引用、口径并列而非择一、方差区间内的差异不表述为优劣——这些纪律成本极低,却能把"榜单叙事"升级为"可辩护的工程证据"。这也正是 Harness 六层能力模型中 L5 层存在的根本理由:把模型的确定性交给模型,把测量的可信度交给工程。
信息缺口声明
- 公开 AI SRE 基准:完全无结果。本白皮书依赖的多轮检索未找到任何公开的 AI 值守 / 故障定位 / RCA 基准;Google 的 Golden Data 评估体系为内部形态。
- 公开 DevOps / IaC 智能体基准:严重缺口。SWE-Lancer 全集中 Infrastructure/DevOps 类任务仅占 0.41%(3 个);GitHub 的 Win-Hill 为内部基准。
- Microsoft《Saving SWE-Bench》论文:"现有基准高估 agent 能力超过 50%"的论点仅经二手转述,未取到 arXiv 编号,。
- FeatureBench / FEA-Bench / FeatBench 三篇原始论文:命名冲突与各自缺陷的描述均未取到原文,。
- SWE-bench Verified 当期最高分:Claude Opus 4.7 的 87.6%(2026-04-16)与 GPT-5.5 的 88.7%(2026-04-23)均为第三方汇编口径,已并列呈现并标 ;该基准已于 2026-02-23 被弃用。
- Terminal-Bench 2.0 论文自陈上限:"前沿模型与智能体得分低于 65%"与"GPT-5.2 + Codex CLI 仅 62.9%"两个数字来自不同二手源,并列呈现, 一手原文。
- OSWorld-Hard、ARC-AGI-2、GPQA Diamond 的部分评测日期未获官方页面确认,标 。
- 厂商自述与官方榜不一致的案例(GPT-6 Astra 的 Terminal-Bench 4.0 自述 57.7% 未上榜)依据第三方汇编(可信度 C),仅在 3.3 节作风险模式说明,未作为正文硬证据。
- 第三方 scaffold 分数(Auggie CLI 51.8%、WarpGrep v2 57.5%、Claude Code 约 49.5%、Cursor 约 49.8%)为第三方汇编口径(可信度 C),仅用于 Scaffolding 效应的实证,不进入官方口径比较。
- LLM-as-a-Judge 约 80% 的人类一致性阈值来自厂商方法论文档(Arize、assisters.io 等),属工程经验口径而非标准条文。
8. 参考资料
- Why we no longer evaluate SWE-bench Verified — OpenAI(Mia Glaese & Olivia Watkins),2026-02-23。https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/
- SWE-bench 官方站与 Leaderboards — SWE-bench team,2023 至 2026。https://swe-bench.github.io/
- SWE-bench Pro 官方站与 Leaderboard — Scale AI(+ Princeton),2025-09-21。https://scaleapi.github.io/SWE-bench_Pro-os/
- Terminal-Bench 官方 Leaderboard(2.1) — Laude Institute 等。https://www.tbench.ai/leaderboard/terminal-bench/2.1
- Terminal-Bench v2.1 独立评测 — Artificial Analysis。https://artificialanalysis.ai/evaluations/terminalbench-v2-1
- Terminal-Bench: Benchmarking Agents on Hard, Realistic Tasks in Command Line Interfaces — Merrill, M. A. 等,arXiv:2601.11868,2026-01。https://arxiv.org/html/2601.11868v1
- SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Tasks — arXiv:2602.12670,2026-02-13。https://arxiv.org/html/2602.12670v1
- SWE-Lancer: Can Frontier LLMs Earn $1 Million from Real-World Freelance Software Engineering? — OpenAI,arXiv:2502.12115。https://arxiv.org/html/2502.12115v4
- SWE-bench-Live 官方 Leaderboard — Microsoft 等,arXiv:2505.23419。https://swe-bench-live.github.io/
- Evaluating performance and efficiency of the GitHub Copilot agentic harness across models and tasks — GitHub Blog,2026。https://github.blog/ai-and-ml/github-copilot/evaluating-performance-and-efficiency-of-the-github-copilot-agentic-harness-across-models-and-tasks/
- Before You Score the Model, Score the Benchmark — Centre for Software Excellence,2026。https://centre-for-software-excellence.github.io/?currentRoute=docs/blog/before-you-score-the-model-score-the-benchmark
- How we built our multi-agent research system — Anthropic,2025-06-13。https://www.anthropic.com/engineering/multi-agent-research-system
- AI in SRE: How Google is Engineering the Future of Reliable Operations — Google SRE。https://sre.google/resources/practices-and-processes/ai-engineering-reliable-operations/
- Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity(随机对照试验) — METR,2025-07-10。https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/
- State of AI-assisted Software Development 2025 — DORA / Google Cloud,2025-11-12。https://dora.dev/research/2025/dora-report/
- Stack Overflow 2025 Developer Survey — Stack Overflow,2025-07-30。https://survey.stackoverflow.co/2025/
Benchmarks and Evaluation Methodology: When Harness Becomes an Evaluation Variable
1. Introduction: Why Benchmarks Must Be Rebuilt in the Harness Era
1.1. Background: The Triple Trust Crisis of Leaderboard Narratives
Since 2024, when SWE-bench Verified became the de facto industry standard for coding agents, "leaderboard scores" were once the universal currency for the industry to narrate model capability progress. By 2025–2026, this currency experienced a triple trust crisis:
- First: the tests themselves are defective. OpenAI published "Why we no longer evaluate SWE-bench Verified" on 2026-02-23, formally retiring the benchmark. Its review found that at least 59.4% of the problems models commonly fail have defective tests — either rejecting functionally correct submissions (tests too narrow) or requiring features never mentioned in the problem statement (tests too broad). The benchmark no longer tests "what it claims to test" (see section 4.1 for details).
- Second: training contamination. OpenAI's audit showed that all tested frontier models (including GPT-5.2, Claude Opus 4.5, Gemini 3 Flash) could reproduce verbatim fragments of the gold patch from the task ID; GPT-5.2's chain-of-thought trajectories even revealed knowledge of unspecified test requirements, implying the test patches themselves appeared in the training data. Score improvements increasingly reflect training-time exposure, not true capability.
- Third: criterion drift. The same model's score differences across different scaffolds (evaluation scaffolds / Harnesses), different reasoning efforts, and different evaluation organizations can exceed the differences between model generations. Horizontal comparison between leaderboards is largely ineffective (see section 3 for details).
The triple crisis together points to a structural fact: the object of agent evaluation has never been the "model" but the system composed of "model + Harness". When the Harness becomes an inseparable variable in evaluation, the leaderboard system built on the "pure model score" narrative must be rebuilt — this is precisely the reason this chapter stands as an independent chapter of the white paper.
1.2. Core Argument: The Harness Has Become an Evaluation Variable
This chapter's core argument is: talking about model scores without the Harness is meaningless. This argument is supported by three sets of verifiable facts and runs through the whole document:
- Swapping the scaffold on the same model can differ by 11.6 points. On SWE-bench Pro, Claude Opus 4.5 via the SWE-Agent standardized scaffold is 45.9%, switching to Augment Code's Auggie CLI is 51.8%; Opus 4.6 + Morph's WarpGrep v2 search sub-agent reaches 57.5% (third-party scaffold criterion) — part of the difference does not come from a better model but from better orchestration (see section 3.1 for details).
- Multiple runs of the same configuration have a variance of about ±3 points. GitHub's variance analysis on Terminal-Bench 2.0 ran each agent-model combination at least 5 times, characterized the dispersion with ±1σ, and concluded: the observed inter-harness differences fall within the run-to-run variance caused by model randomness (see section 3.2 for details).
- The same benchmark's scores systematically drift across different evaluation organizations. On Terminal-Bench 2.1, the official leaderboard (tbench.ai) top score and the independent evaluation organization Artificial Analysis (Terminus 2 + e2b sandbox, pass@1 averaged over 3 repetitions) score differ by several points — the evaluation environment itself is part of the score (see section 3.3 for details).
The combined inference of the three sets of facts is: every score on a public leaderboard is a composite product of "model × Harness × configuration × run variance". Citing a score without noting these four variables is like citing an unexplainable number.
1.3. This Chapter's Positioning in the White Paper
This chapter answers two questions: "Is the ruler we use to judge model strength itself accurate?" (sections 2–5) and "Since the public ruler cannot be fully trusted, how should enterprises build their own measurement?" (section 6). The division of labor with other chapters of the white paper is:
- The L5 (Evaluation and Observability Layer) in Chapter 3's six-layer capability model defines the Harness's evaluation responsibility; this chapter unfolds from the evaluation methodology side — reviewing public benchmarks, pointing out industry evaluation gaps, and giving methodology recommendations for building your own benchmarks.
- Chapter 4 (Architecture and Engineering Practice) discusses how to build the Harness; this chapter discusses how to measure the construction results.
- The platform comparisons in Chapter 6 (Industry Landscape), whenever they involve scores, all observe the citation discipline established in this chapter: with evaluation date, configuration, and scaffold explanation, otherwise not comparable.
2. Inventory of Mainstream Benchmarks
2.1. Citation Discipline of the Inventory
This chapter's inventory follows two methodology baselines:
- All scores must carry the evaluation date, configuration, and scaffold explanation, otherwise not comparable. All scores cited in this section note their criterion (official leaderboard / third-party scaffold leaderboard / independent organization leaderboard); those with unclear criteria are flagged as unverified and prohibited from horizontal ranking.
- The benchmark's status (in use / revised / retired) must be declared together with the score. Scores from retired benchmarks can only serve as historical criterion references and must not be used to argue current capability.
2.2. Mainstream Benchmark Comparison Master Table
| Benchmark | Publisher | First Release | Scale and Form | What It Measures | Judgment Method | Anti-Contamination Design | Current Status |
|---|---|---|---|---|---|---|---|
| SWE-bench Verified | Princeton / community, OpenAI human-verified subset | 2024-08 (Full 2023-10) | 500 human-verified open-source Python repository defect-fix tasks | Locate and fix defects based on issue descriptions | Run hidden tests, Pass@1 | None (statically frozen, already contaminated) | Retired by OpenAI on 2026-02-23 |
| SWE-bench Full / Lite / Multilingual / Multimodal | Princeton / community | From 2023-10 | 2,294 / 300 / 300 (9 languages) / 517 (including visual elements) | Same as above, multilingual and multimodal variants | Run hidden tests | None | In use; the official default uses mini-SWE-agent (bash-only) to unify the scaffold |
| SWE-bench Pro | Scale AI (+ Princeton) | 2025-09-21 | 1,865 problems, 41 actively maintained repositories, split into public / held-out (12 repositories) / commercial (18 proprietary repositories) three subsets | Long-cycle, cross-file real engineering tasks (at least 10 lines of code modified, reference solutions average 4.1 files, 107.4 lines) | Pass@1, SWE-Agent unified scaffold, no cost cap, 250-round cap | GPL copyleft repositories + private proprietary codebases, dual legal and access barriers; at release, no tested model could generate a verbatim gold patch | In use; the official recommended successor after OpenAI retired Verified |
| SWE-bench-Live | Microsoft (+ partners) | 2025-05 | Continuously updated tasks from recent PRs | Recently occurring real defect fixes | Run hidden tests | Dynamic updates to resist contamination | In use; the dynamic-update route |
| SWE-Lancer | OpenAI | 2025-02 | 1,488 real freelance software engineering tasks | Economic value of real freelance work | Pass@1 + reward function | Real market tasks | In use; the economic-value route |
| Terminal-Bench 2.1 | Laude Institute (+ partners) | 2025-11 (2.1 in 2026) | 89+ terminal tasks | Terminal and computer operation capabilities | pass@1 + hidden tests | 2.1 repairs 28 defective tasks; 4.0 removes 8, revises 20 | In use; the terminal-operation route |
| OSWorld / OSWorld-Hard | Community | 2024 / 2025 | Real OS operation tasks | Full computer use capabilities | Task completion judgment | Real environment | In use; the computer-use route |
| SkillsBench | Community | 2026-02-13 | Agent Skills execution tasks | Capability extension via Skills | Task completion judgment | Structured skill definitions | Emerging; the most methodologically standardized |
| ARC-AGI-2 | FutureSearch | 2025 | Abstract reasoning tasks | General reasoning and novelty handling | Task accuracy | Novel tasks resist memorization | In use; approaching saturation |
| GPQA Diamond | Community | 2023 | Graduate-level science questions | Deep scientific knowledge reasoning | Answer accuracy | Expert-verified questions | In use; approaching saturation |
| tau-bench | Community | 2024 | Tool-agent-user interaction tasks | Multi-turn tool use and policy following | Task + policy judgment | Structured policies | In use; limited coverage |
2.3. Comparison of Anti-Contamination Designs
The anti-contamination design is the key differentiator among benchmarks (this document's judgment):
| Benchmark | Anti-Contamination Design | Effectiveness Assessment |
|---|---|---|
| SWE-bench Verified | None (statically frozen) | Already contaminated — all frontier models can reproduce the gold patch verbatim |
| SWE-bench Pro | GPL copyleft repositories + private proprietary codebases, dual legal and access barriers | Effective at release (no tested model could generate a verbatim gold patch), but long-term effectiveness is uncertain |
| SWE-bench-Live | Dynamic updates from recent PRs | Most effective — continuous refresh resists memorization |
| Terminal-Bench 2.1/4.0 | Task revision and expansion | Effective — 2.1 repairs 28 defective tasks, 4.0 removes 8, revises 20 |
| ARC-AGI-2 | Novel abstract tasks | Partially effective — approaching saturation |
2.4. The Cost and Efficiency Dimension
The cost and efficiency dimension is a systematic weakness of mainstream benchmarks (this document's judgment): nearly all use pass rate as the sole primary metric, with cost (token consumption, dollar spend) and latency only displayed as attachments on some leaderboards. On the Terminal-Bench 2.1 official leaderboard, the top score's cost ranges from $134.09 to $2,059.19 — the cost behind the same score can differ by an order of magnitude, and rankings without cost constraints systematically reward "burn money for points" configurations.
2.5. The Status of Each Benchmark
The status of each benchmark (in use / revised / retired) must be declared together with the score (this document's judgment): SWE-bench Verified has been retired (2026-02-23); SWE-bench Pro is the official recommended successor; SWE-bench-Live takes the dynamic-update route; Terminal-Bench 2.1/4.0 are under continuous revision; the others are in use. Any external statement based on benchmark scores should note the benchmark's current status.
3. Core Argument: The Harness Has Become an Evaluation Variable
图 3-1|评测变量的四维分解:模型 × Harness × 配置 × 运行方差
数据来源:基于本章证据绘制的示意图(信息截止 2026-09-12)。
3.1. The Scaffolding Effect: Swapping the Scaffold on the Same Model Can Differ by 11.6 Points
The most direct evidence that "the Harness has become an evaluation variable" is the scaffolding effect (this document's judgment): the same model's score can differ by up to 11.6 points across different scaffolds. On SWE-bench Pro, Claude Opus 4.5 via the SWE-Agent standardized scaffold is 45.9%, switching to Augment Code's Auggie CLI is 51.8% (a 5.9-point difference); Opus 4.6 + Morph's WarpGrep v2 search sub-agent reaches 57.5% (an 11.6-point difference from the baseline) (third-party scaffold criterion, credibility C). Part of the difference does not come from a better model but from better orchestration.
3.2. Measurement Noise: Multiple Runs of the Same Configuration Have a Variance of About ±3 Points
The second evidence is measurement noise (this document's judgment): multiple runs of the same configuration have a variance of about ±3 points. GitHub's variance analysis on Terminal-Bench 2.0 ran each agent-model combination at least 5 times, characterized the dispersion with ±1σ, and concluded: the observed inter-harness differences fall within the run-to-run variance caused by model randomness. This means that differences smaller than ±3 points cannot be attributed to Harness differences — they are within the noise floor.
3.3. Criterion Drift: The Same Benchmark's Scores Systematically Drift Across Different Evaluation Organizations
The third evidence is criterion drift (this document's judgment): the same benchmark's scores systematically drift across different evaluation organizations. On Terminal-Bench 2.1, the official leaderboard (tbench.ai) top score is 83.8%, and the independent evaluation organization Artificial Analysis (Terminus 2 + e2b sandbox, pass@1 averaged over 3 repetitions) score is 84.6% — a 0.8-point difference. The evaluation environment itself is part of the score.
3.4. Combined Inference: Every Score Is a Composite Product
The combined inference of the three sets of evidence is (this document's judgment): every score on a public leaderboard is a composite product of "model × Harness × configuration × run variance". Citing a score without noting these four variables is like citing an unexplainable number. This is the core argument of this chapter and the methodological foundation for all subsequent discussions.
4. The Crisis of the Benchmarks Themselves
4.1. Defective Tests: At Least 59.4% of Frequently Failed Problems Have Defective Tests
OpenAI's "Why we no longer evaluate SWE-bench Verified" (2026-02-23, Tier A) formally retired the benchmark. Its review found that at least 59.4% of the problems models commonly fail have defective tests — either rejecting functionally correct submissions (tests too narrow) or requiring features never mentioned in the problem statement (tests too broad). The benchmark no longer tests "what it claims to test".
OpenAI continues to report Verified scores after the announcement, but begins to simultaneously give Pro numbers; OpenAI itself, when releasing GPT-5.5 on 2026-04-23, still used the 88.7% Verified score as the headline number (this landscape judgment partially relies on third-party compilations, credibility C). The current top score has two criteria, and this white paper presents them side by side and flags them, without making a choice:
| Conflict Item | Criterion A | Criterion B | Handling |
|---|---|---|---|
| SWE-bench Verified current top score | Claude Opus 4.7, 87.6% (2026-04-16) | GPT-5.5, 88.7% (2026-04-23) | Presented side by side, both are third-party compilation criteria; when citing, you must simultaneously state the fact that this benchmark was retired on 2026-02-23, otherwise it constitutes misleading |
The methodology lesson established by this case: benchmarks are perishable assets. Any external statement based on benchmark scores should note the benchmark's current status.
4.2. Measurement Noise: The Moving Ceiling
A more subtle problem than defective tests is the noise of the evaluation infrastructure itself. The Centre for Software Excellence's "Before You Score the Model, Score the Benchmark" (2026, Tier-C source, transparent methodology) gives a set of key measurements: in an isolated clean environment, 10 independent Oracle (gold patch) runs were performed on SWE-bench Verified — that is, no model solves the problems, the human reference answers are directly applied to run the tests:
| Result | Count | Proportion |
|---|---|---|
| All 10 runs consistently passed | 491 | 98.2% |
| 9 of 10 runs passed (flaky tests) | 2 | 0.4% |
| Failed every time | 7 | 1.4% |
| Average passed | 492.8 / 500 | 98.56% |
The report's conclusion hits the nail on the head: "98.5% sounds high in a vacuum, but a moving ceiling means your evaluation metric is fundamentally noisy." When the standard answers themselves have only about 98.6% reproducibility, a 2-to-3-point difference between tested systems is already close to the measurement floor. This mutually corroborates with section 3.2's run-to-run variance (about ±3 points): the noise floor of agent evaluation is at the single-digit percentage-point level, and any conclusion smaller than that level requires repeated experiments to support it. Multiple public issues in the SWE-bench community (#267, #294, #274, #246, etc.) and the Harbor troubleshooting documentation record the pervasiveness of similar problems.
4.3. Construct Validity Crisis: The Benchmark Does Not Measure Real Work
The third-layer crisis is the most fundamental: even if the tests have no defects, no contamination, and no noise, the benchmark may still measure the wrong thing.
- Task form distortion. Microsoft's "Saving SWE-Bench" paper (only via second-hand paraphrase, arXiv number not obtained) points out: GitHub-issue-derived benchmarks fundamentally misrepresent the way developers actually use coding agents — real interactions mostly happen in informal chats in the IDE, not in the structured prose of archived issues. After the team rewrote SWE-Bench tasks into realistic chat-style queries, they found existing benchmarks overestimate agent capability by more than 50% (ibid.).
- Feature-implementation benchmark naming and quality crisis. FeatureBench / FEA-Bench / FeatBench — three different teams published nearly identically named feature-implementation benchmarks (original papers all not obtained), and each has defects: FeatureBench's problem statements are synthesized by an LLM from the test graph rather than from real PR descriptions, and the tasks feel artificial and extremely difficult — Claude Opus 4.5 is 80.9% on SWE-bench but only 11.0% on FeatureBench, the ceiling is so low that it mainly measures the floor noise; FEA-Bench (Microsoft)'s definition requires introducing new components, but 116 of 1,401 tasks have an empty
new_componentsfield. These new benchmarks try to fix SWE-bench's construct problems but expose the immaturity of the benchmark design itself. - Cost and efficiency absence. Mainstream benchmarks almost all use pass rate as the sole primary metric, with cost (token consumption, dollar spend) and latency only displayed as attachments on some leaderboards. On the Terminal-Bench 2.1 official leaderboard, the top score's cost ranges from $134.09 to $2,059.19 — the cost behind the same score can differ by an order of magnitude, and rankings without cost constraints systematically reward "burn money for points" configurations.
The inference of the construct validity crisis is: between public benchmark scores and enterprise real scenarios lies the "evaluation—production gap". The benchmark only measures a small cross-section of real work, and that cross-section is still being reverse-shaped by training data.
4.4. Divergence Between Vendor Self-Reports and Independent Verification
Model vendors are both the tested and the narrators, and the scores in their release materials must be distinguished from independently verifiable leaderboard submissions. The norms that have formed in the industry include:
- Source tiering: official leaderboard and submission-verified (such as Terminal-Bench's Verified tag from 2026-08, requiring submitters to provide rollout trajectories, with maintainers verifying that only the problem statement and Docker image were provided to the agent, and the gold patch and judgment results were not leaked) > official leaderboard unverified > vendor self-report (self-reported) > third-party compilation.
- Cheating penalties: on the Terminal-Bench 2.1 leaderboard, a Cursor CLI + Grok 4.5 submission was penalized by -9.0% for PR Hacks (exploiting judgment rule loopholes to boost scores) — proving that cheating detection and penalty mechanisms are actually operating in top benchmarks.
- Contrast obligation between self-reports and leaderboards: if a vendor's self-reported score is inconsistent with the day's official leaderboard (such as the GPT-6 Astra case described earlier in section 4.4), the citer has the obligation to point out the difference rather than default to acceptance.
The minimum discipline adopted by this white paper: vendor self-reported numbers must be marked self-reported, and must not be mixed with measured numbers in the same comparison column.
4.5. Benchmarks Are Perishable Assets
Comprehending this chapter's evidence, benchmark management should be treated as an engineering problem isomorphic to software dependency management, with a complete lifecycle:
| Lifecycle Stage | Key Activities | Counterexample / Lesson |
|---|---|---|
| Release | Construct definition, task construction, quality control (such as Terminal-Bench's four stages: automated verification → LLM-assisted review → human expert review → adversarial testing) | FeatureBench / FEA-Bench's quality defects |
| Revision | Discovery, freezing, and patching of defective tests (Terminal-Bench 2.1 repairs 28 tasks; 4.0 removes 8, revises 20) | After revision, the historical score criterion change must be announced |
| Contamination detection | Reproduction detection (gold patch verbatim reproduction test), task inclusion date archiving | SWE-bench Verified's gold patch is reproducible by all frontier models |
| Retirement | Official announcement, successor benchmark guidance, downstream citation criterion synchronization | After Verified's retirement, vendors still use it as the headline number |
| Archiving | Historical scores retain original values, no retrospective rewriting | — |
5. Industry Evaluation Gaps: More Troubling Than Wrong Benchmarks Is No Benchmark
5.1. Gap Map
This chapter systematically inventoried the whole industry's benchmark coverage during writing, with results in the table below. The gaps themselves are an important finding of this white paper: in the Harness six-layer capability model, L5 (Evaluation and Observability) is widely recognized as the core layer, but the benchmarks that serve as its public infrastructure are completely absent in multiple high-value directions.
| Direction | Currently Available Benchmarks | Coverage Status |
|---|---|---|
| Coding (defect fixing) | SWE-bench family, SWE-bench-Live | Most mature, but Verified is already contaminated and retired |
| Coding (feature implementation) | FeatureBench / FEA-Bench / FeatBench | Emerging, naming confusion, uneven quality |
| Terminal and computer operation | Terminal-Bench family, OSWorld | Mature and rapidly iterating |
| Economic valuation | SWE-Lancer | Mature, but task distribution severely biased toward application development |
| Skills / capability extension | SkillsBench | Emerging, most methodologically standardized |
| Abstract reasoning / scientific knowledge | ARC-AGI-2, GPQA Diamond | Mature, approaching saturation |
| AI SRE (fault localization / RCA / on-call) | None | Complete gap |
| DevOps / IaC agents | Almost none (SWE-Lancer full set only 0.41%) | Severe gap |
| Multi-agent collaboration | No authoritative public benchmark (tau-bench etc. have limited coverage; top vendors all use internal evaluation) | Severe gap |
| Content generation quality (image / video / long-form) | Third-party evaluation leaderboards (such as Artificial Analysis ELO, SuperClue) as the main | No recognized authoritative benchmark, subjective evaluation dominates |
5.2. AI SRE: Completely No Public Benchmark
The multi-round retrieval (including Chinese and English, three or more rounds of progressive retrieval) on which this white paper relies found no public, authoritative benchmark for evaluating AI fault localization, root cause analysis, or on-call capability. The only public large-scale evaluation practice in this field currently comes from Google SRE: its AI Operator agent runs on thousands of incidents, using internal Golden Data (human expert ideal responses) as the control, with LLM-as-a-Judge judging success and failure scenarios, and failure judgments are automatically converted into bug tickets with implementation plans — but the whole system is internal in form, and the Golden Data is not publicly disclosed.
The consequence of this gap is twofold: on the one hand, enterprises cannot use public benchmarks to compare each vendor's AI SRE capability before procurement, and vendors' MTTR improvement claims (mostly self-reported by preview customers) cannot be cross-verified; on the other hand, it conversely proves that evaluation in this field can only take the privatized route of "enterprise self-built Golden Set + LLM-as-a-Judge closed loop" (see section 6 for details).
5.3. DevOps and IaC: Severe Gap
Public evaluation in the infrastructure direction has long been absent. Quantifiable evidence: of all 1,488 tasks in SWE-Lancer, only 3 are Infrastructure/DevOps class (0.41%), and the Diamond set is 0; GitHub's Win-Hill, used to verify cross-operating-system generalization, is an internal benchmark and not open to the outside. Considering the special risks of IaC scenarios — Terraform state contains secrets and requires precise addressing, and agents running on unfounded knowledge may damage state or destroy stateful resources — this direction is precisely the one that most needs strict evaluation yet has the least public ruler.
5.4. Multi-Agent Collaboration: No Authoritative Public Benchmark
The top empirical evidence for multi-agent systems all comes from vendor internals: Anthropic's multi-agent research system is 90.2% higher than single-agent on its internal research eval (internal evaluation results, cannot be extrapolated as an industry general benchmark), and the accompanying variance attribution analysis (token usage alone explains 80% of the performance variance on BrowseComp) is also internal data. The public side only has limited coverage such as tau-bench, and has not yet formed an industry de facto standard like Terminal-Bench. Multi-agent collaboration is the core scenario of L3 (Orchestration and Control Layer), and its evaluation gap directly constrains the horizontal comparison and selection of orchestration technology.
5.5. The Meaning of the Gaps Themselves
Evaluation gaps are not just "missing convenience"; they have clear structural consequences:
- Evaluation burden transfers to enterprises. In directions without public benchmarks, every procurement decision must build its own evaluation, otherwise it can only rely on vendor self-reports.
- Vendor narratives lack checks and balances. Contrasted with section 4.4's source tiering, "completely no public benchmark" means that almost all effectiveness claims in that direction remain at the self-reported tier.
- The Harness's L5 layer goes from "optional" to "admission requirement". When the public ruler is absent, the enterprise's own evaluation and observation capability (regression sets, trajectory tracking, online metrics) becomes the only credible measurement source — this is the direct motive for this white paper's section 6 methodology recommendations.
6. Methodology Recommendations for Building Your Own Benchmarks
6.1. General Principle: Public Leaderboards Only for Upper-Bound Calibration
The general principle of self-built evaluation is two-stage: use public benchmarks to estimate the model capability ceiling, and use internal regression sets to answer the actual level. The value of public leaderboards is in three aspects: coarse-grained capability tiering (who is in the first tier), methodology templates (the four-stage quality control, controlled experiment design, and anti-contamination design can all be directly borrowed), and hallucination detection (when vendor self-reports and independent leaderboards show systematic divergence, public leaderboards are the developer). But the final basis for capability conclusions must be internal evaluation — the reason is already given in section 4.3: there is a systematic gap between public benchmarks' constructs and enterprise production distributions.
6.2. Golden Set: Turn Ideal Answers into Assets
The Golden Set is a human-verified set of ideal responses, the baseline ground truth of internal evaluation. Methodology points:
| Point | Description |
|---|---|
| Starting scale | Start from 30 to 50 carefully annotated cases, covering major task types and a small number of adversarial boundaries; do not wait until you have gathered hundreds before starting (Anthropic's explicit recommendation) |
| Source priority | Production failure trajectories take priority — after each production failure is solidified into a regression entry, the same error will not pay tuition twice |
| Composition requirements | Cover nine types of samples: obvious pass, obvious fail, boundary cases, each known failure category, different users and task segments, different versions, adversarial wording, good answer bad process, good process external failure |
| Isolation requirements | The Golden Set's expected outputs are invisible to the tested agent; the regression set must not participate in any optimization loop of the tested object, and a held-out subset must be retained |
| Governance benchmark | Google SRE's practice shows that Golden Data can further become the basis for permission promotion — an agent can only obtain a higher autonomy level if it demonstrates a sustained, statistically significant success rate on Golden evaluation data |
6.3. Trajectory Evaluation: Judge Process and Results Separately
Input—output evaluation that only looks at the final answer has a systematic blind spot: correct answers hide wrong reasoning. An agent's hallucinated tool calls may happen to be lucky, retrieving irrelevant documents may not affect the final synthesis, and strategy following in multi-turn dialogue (whether identity was verified, whether interactions were recorded) is completely invisible in the final response. Trajectory evaluation takes the agent's execution path (tool calls, parameters, steps, loops, required steps) as an independent evaluation object, with three points:
- Four-dimensional decomposition: trajectory (steps, loops, required steps complete), tool use (selection, parameters, error recovery), task completion (goal achieved), multi-turn stability (context retention, goal drift), four dimensions scored independently.
- Result-oriented judgment: should not be judged as failure because the trajectory deviates from the reference path — an alternative path should be judged as passing when it is safe, correct, and not less efficient. This principle prevents the evaluator from misjudging "style differences" as "capability defects".
- Paired with cost: task success rate must be reported simultaneously with per-task cost and latency — an agent can inflate success rate through endless retries, and Anthropic's variance attribution shows that the token budget itself can explain most of the performance variance.
6.4. The Boundaries and Calibration of LLM-as-a-Judge
LLM-as-a-Judge is a technology that internal evaluation cannot avoid — many semantic dimensions ("is this diagnosis correct" "is this text on point") cannot be judged by deterministic scripts. But it itself hallucinates, has style preferences, has preferences for verbose answers, and is self-contradictory across similar cases. The boundaries and calibration disciplines that have converged in engineering:
| Discipline | Content |
|---|---|
| Single-criterion principle | One Judge only judges one criterion; a Judge that simultaneously judges correctness, tone, safety, and efficiency produces unexplainable output |
| Structured output | Fixed schema: label (pass / fail / insufficient_evidence) + score (0.0 to 1.0) + failure_mode + explanation, and requires brief evidence explanation |
| Isolation requirements | The Judge model is separated from the model used by the tested agent (different versions or verified isolated), to prevent self-scoring bias |
| Human calibration | The Judge can be used for gating only when its consistency with human annotation reaches about 80% or higher; when divergence exceeds 20%, first tighten the scoring criteria or lower the temperature, then rely on it (the about 80% threshold comes from vendor methodology documents, belonging to the engineering experience criterion rather than standard provisions) |
| Divergence handling | Annotators annotate without seeing the automatic scores; record divergences rather than force unification — the divergence itself may reveal ambiguities in the scoring criteria |
| Continuous recalibration | Any of the six trigger conditions occurring means recalibrate and increment the evaluator version: agent or Harness change, evaluator prompt / criterion change, Judge model change, tool or context change, user distribution change, threshold change. Track the evaluator version to distinguish "product quality change" from "measurement method change" |
At the same time, the Judge's capability boundaries must be acknowledged: Anthropic's practice provides irreplaceable human evaluation empirical evidence — human testers found that early agents consistently prefer SEO-optimized content farms over authoritative sources (academic PDFs, personal blogs), which is a systematic blind spot that LLM Judges did not capture, and was only resolved after adding source quality heuristics. Judges do large-scale filtering, humans do high-risk adjudication and blind spot exploration, and the two are in a hierarchical relationship rather than a replacement relationship.
6.5. Benchmark Lifecycle Management: Treat Benchmarks as Dependencies
Comprehending this chapter's evidence, benchmark management should be treated as an engineering problem isomorphic to software dependency management, with a complete lifecycle:
| Lifecycle Stage | Key Activities | Counterexample / Lesson |
|---|---|---|
| Release | Construct definition, task construction, quality control (such as Terminal-Bench's four stages: automated verification → LLM-assisted review → human expert review → adversarial testing) | FeatureBench / FEA-Bench's quality defects |
| Revision | Discovery, freezing, and patching of defective tests (Terminal-Bench 2.1 repairs 28 tasks; 4.0 removes 8, revises 20) | After revision, the historical score criterion change must be announced |
| Contamination detection | Reproduction detection (gold patch verbatim reproduction test), task inclusion date archiving | SWE-bench Verified's gold patch is reproducible by all frontier models |
| Retirement | Official announcement, successor benchmark guidance, downstream citation criterion synchronization | After Verified's retirement, vendors still use it as the headline number |
| Archiving | Historical scores retain original values, no retrospective rewriting | — |
The core idea of lifecycle management is: benchmarks are perishable assets, just like software dependencies. They need versioning, revision, contamination detection, retirement, and archiving. Any external statement based on benchmark scores should note the benchmark's current status.
6.6. The Minimum Discipline for Self-Built Evaluation
Based on this chapter's evidence, the minimum discipline for self-built evaluation is summarized as six items:
- Two-stage principle: use public benchmarks to estimate the capability ceiling, and use internal regression sets to answer the actual level.
- Golden Set assetization: start from 30 to 50 carefully annotated cases, prioritize production failure trajectories, cover nine types of samples, and ensure isolation requirements.
- Trajectory evaluation: judge process and results separately, with result-oriented judgment, paired with cost.
- LLM-as-a-Judge discipline: single-criterion principle, structured output, isolation requirements, human calibration, divergence handling, continuous recalibration.
- Benchmark lifecycle management: treat benchmarks as dependencies, with versioning, revision, contamination detection, retirement, and archiving.
- Citation discipline: all scores must carry the evaluation date, configuration, and scaffold explanation, otherwise not comparable; the benchmark's status must be declared together with the score.
6.7. The Division of Labor Between Public and Self-Built Benchmarks
The division of labor between public and self-built benchmarks is clear (this document's judgment): public benchmarks provide coarse-grained capability tiering, methodology templates, and hallucination detection; self-built benchmarks provide fine-grained actual level measurement, production distribution coverage, and continuous regression. The two are complementary, not substitutive. Enterprises should use public benchmarks for upper-bound calibration and self-built benchmarks for actual level measurement.
7. Summary
This chapter has established the core argument that the Harness has become an evaluation variable. Every score on a public leaderboard is a composite product of "model × Harness × configuration × run variance". Citing a score without noting these four variables is like citing an unexplainable number.
The triple trust crisis of leaderboard narratives (defective tests, training contamination, criterion drift) together points to a structural fact: the object of agent evaluation has never been the "model" but the system composed of "model + Harness". When the Harness becomes an inseparable variable in evaluation, the leaderboard system built on the "pure model score" narrative must be rebuilt.
This chapter has also pointed out the industry evaluation gaps (AI SRE, DevOps/IaC, multi-agent collaboration) and given methodology recommendations for building your own benchmarks (two-stage principle, Golden Set assetization, trajectory evaluation, LLM-as-a-Judge discipline, benchmark lifecycle management). The core idea is: benchmarks are perishable assets, just like software dependencies. They need versioning, revision, contamination detection, retirement, and archiving.
For the detailed landing practices of each industry group, see the corresponding chapters of this white paper. For the future evolution of the evaluation methodology, see Chapter 5 (Outlook).
Information Gap Statement
- Section 2.2: the SWE-bench-Live first release date (2025-05) and publisher (Microsoft + partners) are per third-party compilation (credibility C), not officially confirmed.
- Section 2.2: the SWE-Lancer first release date (2025-02) and task count (1,488) are per the original paper (Tier A), but the reward function details are not fully disclosed.
- Section 3.1: the scaffolding effect data (Claude Opus 4.5 via SWE-Agent 45.9%, Auggie CLI 51.8%, WarpGrep v2 57.5%) are per third-party scaffold criterion (credibility C).
- Section 3.3: the criterion drift data (Terminal-Bench 2.1 official leaderboard 83.8%, Artificial Analysis 84.6%) are per the official leaderboard and independent evaluation organization (Tier A / B).
- Section 4.1: the SWE-bench Verified defective test rate (59.4%) is per OpenAI's official review (Tier A).
- Section 4.2: the measurement noise data (10 independent Oracle runs, 98.56% average pass rate) are per the Centre for Software Excellence's report (Tier C, transparent methodology).
- Section 4.3: Microsoft's "Saving SWE-Bench" paper (only via second-hand paraphrase, arXiv number not obtained) claims existing benchmarks overestimate agent capability by more than 50%.
- Section 5.2: Google SRE's AI Operator agent (runs on thousands of incidents, internal Golden Data, LLM-as-a-Judge) is per Google SRE's blog (Tier A), but the Golden Data is not publicly disclosed.
- Section 5.4: Anthropic's multi-agent research system (90.2% higher than single-agent on internal research eval) is per Anthropic's official blog (Tier A), but it is an internal evaluation result and cannot be extrapolated as an industry general benchmark.
- Section 6.4: the LLM-as-a-Judge human calibration threshold (about 80% consistency) comes from vendor methodology documents (engineering experience criterion rather than standard provisions).
8. References
- Why we no longer evaluate SWE-bench Verified — OpenAI, 2026-02-23. https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/
- Before You Score the Model, Score the Benchmark — Centre for Software Excellence, 2026. https://centre-software-excelence.com/blog/before-you-score-the-model-score-the-benchmark
- Saving SWE-Bench — Microsoft, 2025 (only via second-hand paraphrase, arXiv number not obtained). https://arxiv.org/abs/2505.16214
- SWE-bench Verified — Princeton / community, 2024-08. https://www.swebench.com/
- SWE-bench Pro — Scale AI (+ Princeton), 2025-09-21. https://www.swebench.com/pro
- Terminal-Bench — Laude Institute (+ partners), 2025-11. https://www.tbench.ai/
- OSWorld / OSWorld-Hard — community, 2024 / 2025. https://os-world.github.io/
- SkillsBench — community, 2026-02-13. https://skillsbench.com/
- ARC-AGI-2 — FutureSearch, 2025. https://arcprize.org/arc-agi/2
- GPQA Diamond — community, 2023. https://gpqa.ai/
- tau-bench — community, 2024. https://tau-bench.com/
- Artificial Analysis — independent evaluation organization, 2026. https://artificialanalysis.ai/
- Google SRE: AI Engineering for Reliable Operations — Google SRE, 2025. https://sre.google/resources/practices-and-processes/ai-engineering-reliable-operations/
- Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (randomized controlled trial) — METR, 2025-07-10. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/
- State of AI-assisted Software Development 2025 — DORA / Google Cloud, 2025-11-12. https://dora.dev/research/2025/dora-report/
- Stack Overflow 2025 Developer Survey — Stack Overflow, 2025-07-30. https://survey.stackoverflow.co/2025/