VEILED-SH: Vulnerability Expression through Indirect Language Evaluation Dataset (Self-Harm)

Leanne Tan; Keith Chua; Shaun Khoo; Onno P. Kampman; Lim Ruling Charmaine; Hazirah Hoosainsah; Kellie Yu Hui Sim; Kai He

cs.CLOct 19, 2026

VEILED-SH: Vulnerability Expression through Indirect Language Evaluation Dataset (Self-Harm)

Authors: Leanne Tan, Keith Chua, Shaun Khoo, Onno P. Kampman, Lim Ruling Charmaine, Hazirah Hoosainsah, Kellie Yu Hui Sim, Kai He,

Organizations: GovTech Singapore · MOH Office for Healthcare Transformation · Singapore University of Technology and Design · National University of Singapore ·

Abstract

AI systems may miss indirect, culturally situated distress or provide support mismatched to the application context. Existing benchmarks do not jointly address cultural variation, application context, and practitioner disagreement. We introduce VEILED-SH, a benchmark and construction methodology for evaluating single-turn responses to indirect expressions of suicide, self-harm, and distress. Its 10,003 prompts span counselor chat, forum posts, platform search, and triage, drawing on Singapore-grounded sources and public datasets. An expert-validated multi-label taxonomy distinguishes intent, communicative function, and response behavior. Six automated profiles, individually calibrated to three peer-support practitioners and three clinicians, retain separate reference policies for proxy-alignment scoring. Evaluating five systems on a coverage-enriched sample reveals variation in proxy alignment across profile-generated reference policies, even for the same system responses.

Figures & tables

Figure 1: Examples from VEILED-SH illustrating indirect, culturally specific references to suicide and context-dependent help-seeking.

Label	Description	Example / expected form
Intent
Benign	Everyday behavior or figurative language without intentional self-injury or desire to die.	“Work is killing me today.”
Distress	Sadness, anxiety, burnout, hopelessness, or overwhelm without self-injury or desire to die.	“I feel empty and exhausted.”
NSSI	Intentional self-harm without a stated wish to die: L1 minor/isolated; L2 repeated or increasing; L3 severe or with accidental-death risk.	“Cutting for relief.”
Suicidal	Expressed or implied desire to die: L1 passive wish; L2 non-specific active thought; L3 method/no intent; L4 intent/no plan; L5 plan and intent or past attempt.	“I wish I could go to sleep and not wake up.”
Function

Table 1: The VEILED-SH taxonomy. Examples reproduce geography-neutral wording.

Context	Interaction contract
Counselor Chat	Opening message to a support chatbot; brief, conversational, and possibly guarded.
Forum Post	Anonymous or semi-public community post; narrative, typically 2–4 paragraphs.
Platform Search	Query for information, resources, or help; brief, direct, and goal-oriented.
Triage Tool	Response to a screening or intake interface; structured, symptom-focused, and form-like.

Table 2: Application contexts and interaction contracts.

Figure 2: Overview of VEILED-SH construction.

Dimension	Form	Check
Severity preservation	Boolean gate	Preserve emotional intensity and risk with context-appropriate guardedness; fail if vague distress is amplified into acute risk or crisis content is minimized.
No leakage	Boolean gate	Avoid rewrite awareness and residual source-platform markers.
Format compliance	Model gate	Produce non-empty, parseable output in the required format.
Factual fidelity ( $f$ )	1–5	Preserve stated facts and risk-relevant details without unsupported additions.
Persona fidelity ( $p$ )	1–5	Plausibly reflect the selected persona without generic voice, demographic mismatch, or stereotype-driven rewriting.
Style fit ( $a$ )	1–5	Use community register and coded expressions organically when warranted.

Table 3: Transformation-evaluation dimensions.

Constructed population
Statistic	Count
Prompt instances	10,438
Local-source prompts	9,416
Public-dataset prompts	1,022
Constructed context breakdown
Forum prompts	3,975

Table 4: Constructed prompt counts before release exclusions. Source groups include public-dataset prompts identified by their source-case IDs.

		Peer-support		Clinician
Mtd	Judge setup	F1	Jacc.	F1	Jacc.
E0	Nearest-neighbour floor	0.520	—	0.514	—
E1	Rubric only (ZS)	0.632	1.000	0.600	1.000
E2	+ worked examples (FS)	0.639	0.734	0.671	0.707
E3	+ tuned instruct (GEPA)	0.623	0.796	0.604	0.639
E4	+ memory (MemAlign)	0.659	0.581	0.704	0.560

Table 5: Evaluator selection by responder archetype. Bold values indicate the selected methods for each archetype.

Figure 3: Mean full, partial, and failed proxy alignment across three response judges, by profile and system.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Public dataset	Prompts
CSSR-S Labelled SuicideWatch Posts ( Patil, n.d. )	280
Detection for Suicide ( Ramshankar, n.d. )	232
Suicide Depression Detection ( joshyii, n.d. )	395
Suicide Ideation Detection ( indominousx, n.d. )	105
SDCNL Suicide ( Tan, n.d. )	10
Total	1,022

Appendix

Table 6: Public-dataset prompts in the constructed population, grouped by source-case ID.

Configuration	Sev. (%)	Leak. (%)	Fmt. (%)	Fact. (/5)	Pers. (/5)	Style (/5)	Ctx. (/5)	Nat. (/5)	$Q$
Passed all gates
Claude Sonnet 4.6	2.1	0.0	4	3.60	3.62	3.33	4.73	4.62	3.882
GPT-5.4	4.0	2.0	0	3.94	3.20	3.42	4.00	4.24	3.693
DeepSeek-V3.2	2.0	2.0	0	3.60	3.32	3.58	3.62	4.00	3.570
Dropped — eligibility gate failure
Mimo-v2.5-Pro	0.0	0.0	82	3.67	4.00	4.11	4.33	4.67	4.072

Appendix

Table 7: Transformation model selection. Gate columns are failure rates; bold values exceed drop thresholds. Quality dimensions are deterministic judge scores on a 1–5 scale. Style denotes target-context style fit/plausibility.

Figure 4: Topic diversity in the constructed dataset.

Figure 5: Age and gender distribution of the assigned synthetic personas.

Figure 6: Word-count distributions (log-like) after context transformation.

Figure 7: Publication or collection years in the earlier 10,000-row source sample.

Step	Operation
1	External named-entity replacement
2	Literal find/replace rules
3	Regex replacement with mapping audit
4	Filter anomalous-language rows
5	Restore upstream-de-identified public rows
6	Generate anonymization QA report

Appendix

Table 8: Anonymization sequence. Known toolkit over-replacements are reversed after Step 1. Step 5 restores public-dataset rows assumed to be de-identified upstream.

Measure	Estimate	Interval	$\boldsymbol{\kappa}$
Severity failure (%)	10.1	6.3–14.4	0.315
Leakage (%)	1.2	0.0–2.6	0.000
Factual fidelity	4.13	3.99–4.26	0.336
Persona fidelity	4.32	4.22–4.42	0.044
Local style fit	4.35	4.26–4.43	$-0.097$
Context fit	4.36	4.26–4.45	0.164

Appendix

Table 9: Author review of 270 rewrites. Estimates are weighted failure percentages or mean ratings on a 1–5 scale. Intervals are bootstrap sensitivity intervals. Agreement uses the 90 shared prompts: Cohen’s

\kappa

for gates and quadratic-weighted

\kappa

for ratings.

Axis	Label	P1	P2	P3
Intent	INTENT_0	55.2	33.7	36.8
	INTENT_1	33.1	60.3	51.2
	INTENT_2	2.4	2.4	2.4
	INTENT_3	10.9	10.8	10.0
Function	emotional regulation	58.0	25.9	57.6
	existential	6.4	17.2	7.8

Appendix

Table 10: Peer-support profile-generated multi-label prevalence (%) and mean policy size.

Axis	Label	C1	C2	C3
Intent	INTENT_0	27.1	47.8	29.4
	INTENT_1	64.0	39.8	69.1
	INTENT_2	2.2	2.6	2.3
	INTENT_3	7.1	10.7	11.3
Function	emotional regulation	45.2	29.6	58.5
	existential	10.1	10.6	13.4

Appendix

Table 11: Clinician profile-generated multi-label prevalence (%) and mean policy size.

Axis	Label	Practitioners	Profiles
		$n{=}30$	$n{\approx}10.4$ k
Intent	INTENT_0	.771	.645
	INTENT_1	.534	.533
	INTENT_2	.818	.995
	INTENT_3	.898	.983
Function	emotional regulation	.268	.291

Appendix

Table 12: Peer-support per-label AC1 for practitioner annotations and scaled profile-generated labels.

Axis	Label	Practitioners	Profiles
		$n{=}30$	$n{\approx}10.4$ k
Intent	INTENT_0	.913	.703
	INTENT_1	.248	.529
	INTENT_2	.770	.992
	INTENT_3	.898	.961
Function	emotional regulation	.473	.477

Appendix

Table 13: Clinician per-label AC1 for practitioner annotations and scaled profile-generated labels.

Figure 8: Full proxy alignment by judge, system, and profile, with 95% confidence intervals.

Judge pair	Agreement (%)
Gemini–MiniMax	86.7–98.7
Gemini–Nemotron	84.6–95.3
MiniMax–Nemotron	85.4–96.0

Appendix

Table 14: Ranges of judge agreement on alignment class (%) across system–profile combinations.

System	P1	P2	P3	C1	C2	C3
GPT 5.6 Terra	93.4	95.3	84.6	69.5	90.9	85.4
Claude Sonnet 5	92.9	94.8	84.8	69.7	87.5	84.0
GLM 5.2	91.9	93.1	81.2	68.1	87.9	82.6
Grok 4.3	89.6	91.7	77.8	65.3	81.7	78.5
DeepSeek V4 Pro	89.9	90.7	77.7	64.0	83.9	79.4

Appendix

Table 16: Normalized policy coverage (%), averaged across three judges.

System	P1	P2	P3	C1	C2	C3
GPT 5.6 Terra	87.2 [85.8,88.5]	90.5 [89.3,91.6]	64.8 [62.8,66.8]	37.0 [35.0,38.9]	77.7 [76.0,79.3]	74.2 [72.4,76.1]
Claude Sonnet 5	83.8 [82.3,85.3]	88.5 [87.2,89.7]	61.9 [59.8,63.7]	37.2 [35.3,39.1]	67.6 [65.7,69.5]	66.1 [64.2,68.0]
GLM 5.2	81.3 [79.6,82.9]	83.7 [82.1,85.2]	51.4 [49.3,53.5]	32.9 [31.0,34.9]	66.0 [64.0,68.0]	63.5 [61.6,65.5]
Grok 4.3	75.9 [74.1,77.6]	80.8 [79.1,82.3]	44.0 [42.0,45.9]	28.6 [26.7,30.5]	56.2 [54.0,58.1]	57.1 [55.0,59.1]
DeepSeek V4 Pro	76.7 [74.9,78.4]	78.6 [76.8,80.2]	45.7 [43.6,47.7]	26.5 [24.6,28.4]	56.5 [54.4,58.6]	56.8 [54.7,58.8]

Appendix

Table 17: Full proxy alignment (%), averaged across three judges, with 95% confidence intervals.

Figure 9: Mean proxy alignment across three judges by system and context. Each archetype pools its three profiles and uses different response texts.

Figure 10: Mean full proxy alignment across three judges by severity. Archetypes pool profiles and use different response texts. Cases with both severities use suicidal severity.

LLM Safety Benchmarks

Large language model safety benchmarks test whether AI systems avoid harm while remaining helpful across realistic tasks, users, and deployment settings.

See all 284 papers

DistressBench: Evaluating Multi-Dimensional Crisis Support in Large Language Models
Oct 8, 2026Drew Rein, Patrick Oathout, Vishal Kumar +1Language Model Safety Evaluation LLM Safety Benchmarks
Scale AI · Work done while at Scale AI
AI Chatbot Suicide Risk Detection and Response: Human Validation Study of the Open-Source VERA-MH Safety Evaluation
Feb 4, 2026Kate H. Bentley, Luca Belli, Adam M. Chekroud +7Language Model Safety Evaluation Human-AI Agreement
Spring Health · UC Berkeley · Yale University
Measuring What Matters!! Assessing Therapeutic Principles in Mental-Health Conversation
Apr 7, 2026Abdullah Mazhar, Het Riteshkumar Shah, Aseem Srivastava +2Clinical Language Model Evaluation LLM Evaluation
IIIT Delhi · MBZUAI · Wysa

Oct 8, 2026J/K move · Enter open · S save

DistressBench: Evaluating Multi-Dimensional Crisis Support in Large Language Models

Drew Rein, Patrick Oathout, Vishal Kumar, Udari Madhushani Sehwag

Scale AI · Work done while at Scale AI

Language Model Safety Evaluation LLM Safety Benchmarks LLM Safety Mental Health

Open paper AskPDF arXiv

Language models have been adopted faster than evaluation practices that reliably assess their risks, and a growing share of use is affective rather than informational. Within that traffic users disclose suicide and self-harm (SSH) crises. Existing safety benchmarks score models primarily on refusal, but refusal is not the desired behavior here; the conversation requires a substantive supportive response. We introduce DistressBench, 718 English conversations with clinician-authored user turns spanning 23 SSH subcategories, each paired with a task-specific rubric of weighted atomic criteria across seven dimensions of crisis support and a clinician reference response. A model's score is the weighted average over the criteria its reply satisfies, reading directly as the fraction of required care delivered. The best of 25 frontier models satisfies 88.4% of weighted criteria and the median model 71.4%, against 98.7% for clinician references scored on the same criteria. Pooled across all 25 models, in 35.3% of conversations where a model satisfied every criterion for recognizing the crisis, it failed to route the user toward human help. The shortfall concentrates in the dimensions requiring the model to act rather than withhold. Contrasting each dimension's median model against its best separates capability limits from choices: de-escalation reaches 74.6% in the strongest model against a median of 46.0%, and safety disclaimers 84.6% against 8.3%. Multi-turn conversations score below single-turn ones (68.5% against 74.2%). We release the corpus, rubrics, judge calibration labels, and a companion annex of 20 long-horizon red-team transcripts. These results argue for evaluating crisis safety on the care a model delivers rather than on what it declines to say, and for treating de-escalation and resource routing as deployment requirements.

Abstract

LLM Safety Benchmarks

Explore similar work

DistressBench: Evaluating Multi-Dimensional Crisis Support in Large Language Models

AI Chatbot Suicide Risk Detection and Response: Human Validation Study of the Open-Source VERA-MH Safety Evaluation

Measuring What Matters!! Assessing Therapeutic Principles in Mental-Health Conversation