METR (Model Evaluation & Threat Research)

Stated Theory of Change

METR's stated theory of change has two pillars:

Pillar 1: Measurement. Create rigorous, human-calibrated benchmarks that produce a meaningful Y-axis for AI capability progress. Specifically, measure how long a task an AI can autonomously complete (the Time Horizons benchmark), and from this derive when models approach dangerous capability thresholds (rogue replication, AI R&D automation, strategic sabotage). If you can measure it, you can see it coming.

Pillar 2: Governance. Use these measurements to inform evaluation-based governance regimes. RSPs (Responsible Scaling Policies) gate further capability scaling on concrete evaluation results. Labs commit in advance to specific protective measures at specific capability levels. External evaluators like METR verify whether thresholds have been crossed.

The causal chain: rigorous measurement -> early warning -> informed policy -> protective action before catastrophe.

Revealed Theory of Change

What METR's actions reveal is subtly but importantly different from the stated theory:

What they actually do. METR produces excellent scientific measurements of AI capability. These measurements are widely cited, influence public discourse, and have shaped how the field thinks about AI progress (the Time Horizons graph is arguably the single most influential visualization in AI safety). METR also produces counterintuitive findings (developer slowdown, reward hacking) that add genuine epistemic value.

What they don't do. METR does not enforce anything. No model has ever been blocked, delayed, or constrained as a result of METR's evaluations. METR operates under lab-controlled NDAs, with lab-controlled access timelines and lab-controlled terms. Barnes admits this openly: "I wouldn't want to describe any of the things that we've done thus far as actually providing meaningful oversight."

The real theory of change is informational, not interventional. METR's actual impact is through shifting the Overton window -- making AI risk legible, quantifiable, and undeniable. The Time Horizons graph tells policymakers and the public "this is happening, this is how fast, here is when you should be scared." The RSP framework gives labs a template for what responsible behavior looks like. But METR has no mechanism to compel compliance.

The gap. The stated theory assumes a world where RSPs have binding force and evaluations trigger protective action. The revealed theory operates in a world where labs voluntarily cooperate (or don't), NDAs prevent public disclosure of concerns, and the word "partner" appears on METR's website describing its relationship with the companies it's supposed to oversee.

Key Assumptions

A1: AI capabilities will continue following predictable scaling trends. If time horizons keep doubling every 4-7 months, METR's benchmarks provide early warning. If capabilities progress in discontinuous jumps (e.g., a sudden architectural breakthrough), METR's extrapolation-based framework would miss the transition.

• Evidence for: 6+ years of remarkably consistent doubling in time horizons; R-squared of 0.98.
• Evidence against: Jonas Moss argues the data can't distinguish between growth trajectories. The shift from 7-month to 4.3-month doubling suggests the trend itself is unstable.
• Testable: Yes. METR publishes projections that can be checked against future models.

A2: Evaluation results will eventually influence deployment decisions. METR's theory requires that someone -- labs, regulators, or the public -- acts on evaluation results to prevent dangerous deployment.

• Evidence for: RSPs have been adopted by 9+ labs. Regulatory interest exists (EU AI Office, UK AISI).
• Evidence against: No model has ever been blocked. Labs control access and timing. SB 1047 (which would have required evaluation-based transparency) was vetoed.
• Testable: Yes. If a model is blocked or delayed due to evaluation results in the next 2 years, this assumption is validated.

A3: Independent evaluation adds value over internal lab evaluation. Labs also run capability evaluations internally. METR's value depends on independence providing either (a) better evaluation quality, (b) credibility that labs can't provide themselves, or (c) information that labs would suppress.

• Evidence for: Barnes says METR's elicitation is "as good or a bit better" than labs. METR publishes findings (like reward hacking in o3) that labs might prefer to downplay.
• Evidence against: Barnes also says "companies have generally found that often... our stuff is... not dramatic in either direction" compared to their internal evaluations. If METR's measurements roughly match what labs already know, the value is primarily credibility, not information.
• Testable: Partially. If METR ever catches a dangerous capability that internal evaluations missed, that would be strong validation.

A4: METR can maintain independence despite structural dependencies. METR depends on labs for compute credits and model access. Its staff come from and occasionally go to labs. Its evaluations operate under lab-controlled NDAs.

• Evidence for: No-cash-from-labs policy. Diverse foundation funding. Barnes' candid public criticism of lab behavior.
• Evidence against: OpenAI comms/legal approved the GPT-5 report. NDAs prevented disclosure. Lab access is controlled and sometimes limited (o3 evaluation got "relatively little time"). Alfour argues structural dependence makes real independence impossible.

Strengths

Scientific rigor. METR's evaluation methodology -- human-calibrated baselines, diverse task suites, careful attention to elicitation -- is genuinely best-in-class. The developer productivity RCT demonstrates commitment to empirical methods even when results are unflattering.

Measurement innovation. The Time Horizons framework solved a real problem: creating a meaningful, intuitive Y-axis for AI capability that non-experts can understand. "This AI can do a task that takes a human 2 hours" is far more useful than "this model scores 87% on MMLU."

Policy influence. RSPs are now the de facto governance framework for frontier AI labs. Even if implementation is imperfect, the conceptual contribution -- gate scaling on demonstrated safety -- is significant and durable.

Intellectual honesty. Barnes is remarkably candid in interviews. She volunteers weaknesses ("we haven't provided meaningful oversight"), acknowledges uncertainty ("50/50 on things going well"), and publishes findings that hurt her own narrative (the developer slowdown). This level of honesty is rare in organizations that depend on public credibility.

Field building. Open-source tools (Task Standard, HCAST), data releases (MALT dataset), and engagement with government evaluators (UK AISI, EU AI Office) create genuine public goods.

Weaknesses and Risks

No enforcement mechanism. METR can measure, inform, and recommend. It cannot prevent, delay, or block. This is the core weakness. As Alfour argues, evaluation without enforcement is like a fire alarm with no fire department -- it tells you the building is burning but can't put out the fire.

Structural capture risk. METR's relationship with labs looks more like partnership than oversight. Labs control access, timing, and NDA terms. METR's "About" page proudly lists lab partnerships. The compute dependency creates soft leverage. The revolving-door personnel connections (Barnes from OpenAI/DeepMind; Cotra from Coefficient Giving; UK AISI leaders from OpenAI/DeepMind) are standard for this small field but undermine credibility with outsiders.

Governance opacity. No visible board of directors. No published financials. No transparent process for how METR decides which evaluations to accept, on what terms, or what to publish. For an organization claiming to be an independent auditor, this is a significant gap.

Theory of change depends on others. METR's theory of change requires that (a) regulators pass binding evaluation requirements, (b) labs voluntarily comply with RSP commitments even when commercially costly, or (c) the public applies sufficient pressure based on METR's findings. METR itself does no advocacy, lobbying, or public pressure campaigns. It depends entirely on others to close the loop between information and action.

Narrowness of measurement. Time Horizons measure autonomous software engineering capability. They don't directly measure deception, manipulation, strategic planning, or the kind of misalignment that makes AI dangerous. METR acknowledges this and is beginning alignment/control evaluations, but as of March 2026 these are preliminary.

Cross-References

Apollo Research focuses on scheming and deceptive behavior evaluation -- complementary to METR's capability focus. Together they cover more threat surface than either alone.

UK AISI / US AISI are government evaluators. METR positioned itself as the research/prototyping arm that develops methods for government evaluators to eventually adopt at scale. With US AISI's future uncertain under Trump administration, METR may need to absorb some of this function.

Redwood Research is Barnes' top pick for productive independent safety research. She claims Redwood "despite being two people, has really high output compared to the entire rest of the field, and all of the people at labs."

ARC (Alignment Research Center) is METR's parent org (METR spun out from ARC Evals). Paul Christiano founded ARC and his intellectual framework heavily influenced METR's approach.

ControlAI / PauseAI represent the advocacy/enforcement side that METR explicitly avoids. Alfour's critique essentially says METR should be more like ControlAI.

What Would Change This Assessment

• A model is blocked or delayed due to METR evaluation. This would validate the entire theory of change. Currently unmet.
• Binding regulation requiring external evaluation. If a major jurisdiction mandates third-party evaluation with teeth, METR's value increases dramatically.
• METR publishes findings against a lab's wishes. If METR breaks an NDA or refuses to accept one, that would demonstrate genuine independence. If METR continues to operate within lab-controlled terms, the capture critique grows stronger.
• Lab revokes METR's access. If a lab cuts off METR after an unfavorable finding, that would paradoxically increase METR's credibility (proving they were independent) while reducing their ability to function.
• Alignment evaluation breakthroughs. If METR successfully develops evaluations that detect misalignment (not just capabilities), this would address the deepest weakness in their approach.
• Discontinuous capability jump. If a model suddenly jumps past METR's thresholds without following the scaling trend, it would reveal the limits of extrapolation-based early warning.

Self-Critique

What's weakest in this analysis:

• Financial picture is necessarily speculative. Without 990 data, all budget estimates are guesses from grant amounts.
• The "no model has been blocked" critique may be unfair -- METR is young, and the regulatory environment hasn't caught up. But it's been 4 years since METR's first evaluation (GPT-4), which is enough time to see some impact.
• This analysis may underweight METR's influence on internal lab behavior in ways that aren't publicly visible (e.g., RSPs may have caused labs to invest more in safety even without blocking models).

What a thoughtful critic would say:

• "You're judging METR by an interventionist standard it explicitly rejects. METR says it does science, not advocacy. Judge it as a research organization and it looks excellent."
• "The small-world critique (everyone knows everyone) applies to the entire AI safety field. Singling out METR is unfair."

What would most change my view:

• Evidence that METR's evaluations privately influenced a specific lab decision (e.g., delayed a release, triggered additional safety work). This would show the NDA-hidden impact is real.
• Evidence that the RSP framework has measurably changed lab behavior beyond superficial adoption (e.g., a lab hit a threshold and paused scaling as committed).