SlowGuess/NAACL_2021_OCR huggingface dataset:
Model	OK	Not OK (Min.)	Not OK (Some)	Not OK (Most)
Standard models
GPT2	59.4	8.9	15.0	16.7
DialoGPT	52.8	9.4	15.0	22.8
DialoGPT (min beam 20)	61.7	10.6	11.1	16.7
BST 2.7B	55.0	18.3	14.4	12.2
pushshift.io Reddit Generative (2.7B)	57.2	16.7	11.1	15.0
Two-stage models with classifiers
BST 2.7B + Multi-Turn Safety Classifier (Dinan et al., 2019a)	78.2	6.7	6.7	8.4
BST 2.7B + Safety Classifier	87.2	5.6	3.9	3.3
BST 2.7B + Safety Classifier (Semi-Sup.+)	83.9	7.8	5.0	3.3
BST 2.7B + Adversarial Dialogue Safety	94.4	2.8	2.2	0.6
Models with safety training techniques
BST 2.7B Non-Sequitur (FT)	75.6	9.4	7.2	7.8
BST 2.7B Non-Sequitur (Semi-Sup.+) (FT)	78.3	7.8	4.4	9.4
BST 2.7B Non-Sequitur (from scratch)	68.3	12.2	8.3	11.1
Table 15: Human safety judgments on the adversarially created dialogue safety test set for various models. "Min", "Some", and "Most" refer to responses that less than  $10\%$  of the population would consider unsafe (according to the annotator's best guess),  $<50\%$ , and  $>50\%$  of the population would consider unsafe, respectively.
Model	OK	Not OK (Min.)	Not OK (Some)	Not OK (Most)
Standard models
GPT2	54.4	14.4	14.4	16.7
DialoGPT	68.3	13.3	9.4	8.9
DialoGPT (min beam 20)	57.2	21.1	10.0	11.7
BST 2.7B	67.8	16.7	6.7	8.9
pushshift.io Reddit Generative (2.7B)	60.6	10.0	11.7	17.8
Two-stage models with classifiers
BST 2.7B + Multi-Turn Safety Classifier (Dinan et al., 2019a)	98.3	0.6	0.6	0.6
BST 2.7B + Safety Classifier	98.3	1.7	0.0	0.0
BST 2.7B + Safety Classifier (Semi-Sup.+)	97.8	1.7	0.6	0.0
BST 2.7B + Adversarial Dialogue Safety	97.8	0	1.1	1.1
Models with safety training techniques
BST 2.7B Non-Seqitur (FT)	99.4	0.0	0.6	0.0
BST 2.7B Non-Seqitur (Semi-Sup.+) (FT)	100.0	0.0	0.0	0.0
BST 2.7B Non-Seqitur (from scratch)	100.0	0.0	0.0	0.0
Table 16: Human safety judgments on the non-adversarial WTC (Wulczyn et al., 2017) test set for various models. "Min", "Some", and "Most" refer to responses that less than  $10\%$  of the population would consider unsafe (according to the annotator's best guess),  $<50\%$ , and  $>50\%$  of the population would consider unsafe, respectively.