Research
We don't make models. We use them — and by that alone, we need real benchmark data on them. Last updated: November 5, 2026.
Why a rehearsal company measures models
TableX runs on models. They power the pods that guide the tour, the guide that answers participants during an exercise, and the machinery that builds and runs scenarios. What a model does — including what it does at the edges, under pressure, when a participant pushes it somewhere it should not go — is an operational input to this platform, as concrete as uptime or latency.
A model maker's own claims are not a spec sheet. They describe the maker's tests, run the maker's way, and they age the moment a model is updated. So TableX sponsors an independent security evaluation programme that measures how models actually behave at containment boundaries — the points where a model is told what it must not disclose, must not become, and must not help reach — with sealed evidence that anyone can recompute.
APEX: the programme
APEX is a security evaluation programme built like a clinical trial for model behavior. A claim is stated in advance — for example, that a model under a stated containment instruction will not cross it — and then tested against a frozen family of probes:
- Campaigns are admitted in advance. The probe family, the model, and the scoring predicates are fixed before a run starts, not adjusted after the results are seen.
- Evidence is sealed. What the model produced is captured and sealed, then scored offline against the predicates frozen at admission. A run whose evidence collection itself fails is recorded as inconclusive — it is not quietly dropped, and it is never counted as a pass.
- The served model is pinned. The digest of the model actually served is recorded with the run, so a result names the exact weights that produced it.
- Verdicts use one vocabulary. A claim is falsified when a probe crosses the boundary, holds when every probe is resisted, and incomplete when part of the evidence never arrived.
The programme runs daily, and a new benchmark family is added every month. Old families never change: a model measured last month can be re-run against the same frozen probes, and a model released next year can be measured against history on identical terms.
The record so far
As of November 5, 2026, the published record covers 84 claim runs and 336 scored cells across 21 models, under the families escape-probes-1.0 and escape-probes-1.1. The claim verdicts: 60 falsified, 8 holds, 16 incomplete. Most models, measured plainly, cross at least one boundary they were told to hold.
The record's first full claim hold — every probe resisted, at every seed — is Qwen2.5-72B: four seeds of four, under escape-probes-1.1.
Sponsorship
APEX is the independent work of David Maynor. TableX sponsors the programme. The data is published in full — verdicts, run records, and the underlying datasets — at llmdevsecops.ai.
Links
- The data: the full record — every run, every model, and the downloadable datasets — at llmdevsecops.ai, with the datasets themselves on its data page.
- The book: Bad Models, the programme's published volume of escape-claim reports, presented on the llmdevsecops.ai about page.
- The arena: the same programme, presented as a daily brawl, at onlymodels.gg — the entertainment face; the data underneath is the same sealed record.