Finding 1. Frontier LLMs retain broad high-risk generation capability

Every model tested, including the comparatively less powerful model (overall score 0.40), produces non-trivial harmful content across all 15 categories, while the top tier reaches 0.70 with highly specific instruction spanning violence, fraud, CBRN, and beyond. The diversity heatmap shows a consistent pattern: most models achieve diversity scores of 0.50-0.72, drawing on a broad range of harmful scenarios rather than a narrow set of templates. These results indicate a sobering fact: despite extensive safety alignment, the capability to generate harmful content remains embedded in the pretrained knowledge of frontier LLMs.

Finding 2. Risk concentrates differently across categories and models

Harmful capability is not uniformly distributed within or across models. As visible in both heatmaps, each model exhibits a distinct harmful profile: Grok-4.1-Fast scores 0.87 on jailbreak assistance but only 0.35 on copyright, while GLM-5.1 reaches 0.91 on financial scam but drops to 0.47 on dehumanization. This result supports the core motivation of HarmProfile: frontier models differ not only in overall harmfulness, but in the specific harm categories where their risks concentrate. Previous aggregate safety scores therefore obscure these category-level differences.

Finding 3. Capability scales with harmfulness and diversity

Models with higher harmfulness scores also tend to exhibit broader diversity, whereas lower-scoring models cluster near the bottom of both dimensions. This pattern is consistent with Figure (d)-(e), where both metrics are positively associated with general model capability as measured by LMArena Elo. Diversity shows a statistically significant correlation with capability (r=0.55, p=0.018), while harmfulness shows a positive but weaker trend (r=0.35, p=0.149). This gap suggests that safety alignment may partially suppress harmful intensity, but is less effective at narrowing the range of harmful topics a capable model can cover. The implication is compounding: as capability increases, models do not merely produce more severe harmful content within fixed categories, but also cover a broader space of harmful scenarios.