TL;DR: We classified every paper accepted at ICLR, ICML and NeurIPS from 2019 through 2026, using an LLM that reads each title and abstract. 2,328 of them (4.2%) are AI safety papers. Safety's share of accepted papers grew from 0.3% in 2019 to 8.3% in 2026, roughly a 25-fold increase. This post is a reference for the main results. The interactive website lets you browse every paper, its subdomain, and the classifier's reasoning.
What this is
We wanted to have an overview of what is going on in AI safety research while being as broad as possible, this seems necessary to be able to prioritize research correctly, and develop more precise theories of change. One way to achieve this is by analyzing statistics of all the published main-conference papers on the topic of AI safety, but we couldn't find a dataset that actually measured them. So we built one:
- Every accepted paper at ICLR (2019–2026), ICML (2019–2026) and NeurIPS (2019–2025) (55,794 in total) is read by an LLM (DeepSeek V4 Flash), which classifies it from its title and abstract into one of four classes: AI safety (frontier & misalignment), truthfulness, reliability & XAI, ethics & fairness, or general capabilities.
- Each safety paper is then assigned one of 17 safety subdomains (interpretability, alignment training, scalable oversight, dangerous-capability evals, …) and scored on a 7-point rubric for how centrally it addresses safety.
- A separate full-text pass over the safety papers detects which safety organizations, programs and funders are behind them, distinguishing affiliations and acknowledgments.
All the code required to reproduce these results (classification prompts, CSVs, etc.) is publicly available. The website has a searchable explorer of all 2,328 safety papers, each linking to its OpenReview page and showing the classifier's reasoning. We hope that our datasets can be used for further studies of the field.
Safety's share of the field
While the general acceptance rates of these conferences stayed between 20 and 30%, the number of safety papers per year increased over 100 times from 2019 to 2026. Moreover, the share of safety papers among all the acceptances increased over 25 times from 2019 to 2026, which shows a substantial growth in the AI safety field.
PLOT 1: safety share by year, pooled across the three conferences
We observe that even with a rapid increase in the number of papers accepted to these conferences, the share of safety papers increased rapidly over the years, especially between 2023 and 2024. The three conferences (ICLR, ICML and NeurIPS) have a similar share of safety papers.
What kind of safety research it is
Summing across all years, interpretability is the largest subdomain, followed by alignment training, adversarial robustness and red-teaming.
Subdomain
Papers
Subdomain
Papers
Interpretability
657
Scheming & Deception
34
Alignment Training
457
Agent Foundations
27
Adversarial Robustness
298
Policy & Governance
26
Red-Teaming
286
Control
9
Safeguards
199
Strategy & Forecasting
8
Scalable Oversight
164
Model Organisms
5
Dangerous Capability Evals
55
Biorisk
3
Monitoring
53
AI Welfare
2
Multi-Agent Safety
45
PLOT 3: subdomain breakdown, all years and venues
The composition has also shifted over time. In the early years (2020–2022) adversarial robustness was the largest area, which was surpassed by interpretability in 2023, with newer areas (dangerous-capability evals, scheming and deception, monitoring) appearing essentially from zero.
Some topics, such as control, model organisms and AI welfare, remain nearly absent from conference proceedings (9, 5 and 2 papers respectively, out of 2,328).
Who publishes it
For the safety papers, we ran a second, full-text analysis: keyword-match a curated list of safety organizations, programs and funders against each paper's front matter and acknowledgments, then have an LLM verify each hit (affiliation vs. acknowledgment vs. mere mention) and pick the paper's primary org, the organization presumed to have led the work. A company only counts as primary if its authors lead the paper, for example, a lone DeepMind co-author among university authors doesn't make DeepMind the primary author. Fellowship programs (MATS, SPAR, Anthropic Fellows, …) count as the hosting org even when they appear only in the acknowledgments.
Of the ~2,300 safety papers whose full text we could retrieve, about 600 have a verified connection to a tracked safety org or funder.
PLOT 4: papers per research org, counted by primary org
By primary attribution, MATS (48), Mila (46)[1] and Google DeepMind (42) top the list. Counted by any affiliation instead, the industry labs dominate, Google DeepMind appears on 107 papers, OpenAI on 74, Anthropic on 51, reflecting how often lab researchers co-author and mentor externally-led work. (The website's "Who Publishes" tab has both views.)
PLOT 5: funders credited in the acknowledgments
Open Philanthropy is credited in 120 papers, an order of magnitude more than any other philanthropic funder (Long-Term Future Fund: 10, Future of Life Institute: 8).
One interesting trend is that the safety ecosystem's share of safety papers is slightly shrinking even as its output grows. In 2019, 5 of the 9 safety papers had a tracked org or funder behind them, in 2026 it's 150 of 954[2], the dedicated ecosystem publishes more every year, but the field's growth is mostly coming from researchers outside it.
We think that these trends suggest that over time, effective interventions should focus on improving the quality/topic relevance/long-term impact of the research coming from existing researchers interested in safety, and on making research more diverse, generalizable, impactful, and applicable, rather than only increasing the raw count of papers and researchers.
PLOT 6: org-backed safety papers per year
Caveats
- Classification is by LLM, from title + abstract. The boundary between frontier AI safety and the neighboring classes (truthfulness/hallucinations, XAI, fairness) seems to be inherently fuzzy, we publish the full rubric and the classifier's per-paper reasoning.
- The org analysis is a lower bound. It only sees a curated org list, page-one affiliations and the first acknowledgments window; a mentorship credit buried deep in the appendix can be missed.
- 2026 is partial (no NeurIPS yet), and ICML 2026 full texts were only partially available for the org analysis (45 papers from ICML had significant title changes between the initial and camera-ready versions, and thus weren't retrievable).
- Acceptance at these venues undercounts non-submitted or rejected work, such as workshop papers, arXiv preprints, reports and blog posts, which is a large part of safety work.
Explore it yourself
The website https://ai-safety-tracker-website.vercel.app/ has the interactive version of everything above: per-conference views, per-year subdomain plots, a searchable table of all 2,328 papers (each row opens the classifier's verbatim reasoning and links to OpenReview), the by-org and by-funder plots, and an experimental arXiv trend line. The repo has every CSV and the scripts to regenerate all of it, including the classification prompt.
If you spot a mistake, feel free to send a comment, DM or GitHub issue, corrections are very welcome.
Future work
Future work could include extending this analysis to arXiv preprints, and possibly LessWrong and AlignmentForum posts. Another possibility is to analyze the citation networks, for example checking whether org-affiliated papers cite independent papers, and determining clusters and citation flow.
Acknowledgments
Thanks to every person who provided feedback.
This project was supported by BlueDot Rapid Grants.
The classifier was intentionally lax when assigning non-corporate primary orgs, this caused some papers coauthored or mentored by Mila members to be assigned Mila as their primary org, while the same didn't happen for Anthropic or DeepMind, whose share would increase significantly if counting secondary authors from these organizations.
There were 954 retrievable papers from the total of 999, as some ICML 2026 papers were not retrievable due to title changes between the original and camera-ready versions.
How many AI safety papers are at the big ML conferences, what do they study, and who writes them? A comprehensive analysis.
> Website: https://ai-safety-tracker-website.vercel.app/
> Data, code and plots: https://github.com/SomaxSoma/AI-Safety-Research-Tracker
TL;DR: We classified every paper accepted at ICLR, ICML and NeurIPS from 2019 through 2026, using an LLM that reads each title and abstract. 2,328 of them (4.2%) are AI safety papers. Safety's share of accepted papers grew from 0.3% in 2019 to 8.3% in 2026, roughly a 25-fold increase. This post is a reference for the main results. The interactive website lets you browse every paper, its subdomain, and the classifier's reasoning.
What this is
We wanted to have an overview of what is going on in AI safety research while being as broad as possible, this seems necessary to be able to prioritize research correctly, and develop more precise theories of change. One way to achieve this is by analyzing statistics of all the published main-conference papers on the topic of AI safety, but we couldn't find a dataset that actually measured them. So we built one:
- Every accepted paper at ICLR (2019–2026), ICML (2019–2026) and NeurIPS (2019–2025) (55,794 in total) is read by an LLM (DeepSeek V4 Flash), which classifies it from its title and abstract into one of four classes: AI safety (frontier & misalignment), truthfulness, reliability & XAI, ethics & fairness, or general capabilities.
- Each safety paper is then assigned one of 17 safety subdomains (interpretability, alignment training, scalable oversight, dangerous-capability evals, …) and scored on a 7-point rubric for how centrally it addresses safety.
- A separate full-text pass over the safety papers detects which safety organizations, programs and funders are behind them, distinguishing affiliations and acknowledgments.
All the code required to reproduce these results (classification prompts, CSVs, etc.) is publicly available. The website has a searchable explorer of all 2,328 safety papers, each linking to its OpenReview page and showing the classifier's reasoning. We hope that our datasets can be used for further studies of the field.
Safety's share of the field
While the general acceptance rates of these conferences stayed between 20 and 30%, the number of safety papers per year increased over 100 times from 2019 to 2026. Moreover, the share of safety papers among all the acceptances increased over 25 times from 2019 to 2026, which shows a substantial growth in the AI safety field.
Year
Accepted papers
Safety papers
Share
2019
2,701
9
0.3%
2020
3,669
26
0.7%
2021
4,674
31
0.7%
2022
4,998
48
1.0%
2023
6,619
101
1.5%
2024
8,905
370
4.2%
2025
12,249
744
6.1%
2026
11,979
999
8.3%
(2026 covers ICLR 2026 and ICML 2026; NeurIPS 2026 hasn't happened yet.)
PLOT 1: safety share by year, pooled across the three conferences
We observe that even with a rapid increase in the number of papers accepted to these conferences, the share of safety papers increased rapidly over the years, especially between 2023 and 2024. The three conferences (ICLR, ICML and NeurIPS) have a similar share of safety papers.
What kind of safety research it is
Summing across all years, interpretability is the largest subdomain, followed by alignment training, adversarial robustness and red-teaming.
Subdomain
Papers
Subdomain
Papers
Interpretability
657
Scheming & Deception
34
Alignment Training
457
Agent Foundations
27
Adversarial Robustness
298
Policy & Governance
26
Red-Teaming
286
Control
9
Safeguards
199
Strategy & Forecasting
8
Scalable Oversight
164
Model Organisms
5
Dangerous Capability Evals
55
Biorisk
3
Monitoring
53
AI Welfare
2
Multi-Agent Safety
45
PLOT 3: subdomain breakdown, all years and venues
The composition has also shifted over time. In the early years (2020–2022) adversarial robustness was the largest area, which was surpassed by interpretability in 2023, with newer areas (dangerous-capability evals, scheming and deception, monitoring) appearing essentially from zero.
Some topics, such as control, model organisms and AI welfare, remain nearly absent from conference proceedings (9, 5 and 2 papers respectively, out of 2,328).
Who publishes it
For the safety papers, we ran a second, full-text analysis: keyword-match a curated list of safety organizations, programs and funders against each paper's front matter and acknowledgments, then have an LLM verify each hit (affiliation vs. acknowledgment vs. mere mention) and pick the paper's primary org, the organization presumed to have led the work. A company only counts as primary if its authors lead the paper, for example, a lone DeepMind co-author among university authors doesn't make DeepMind the primary author. Fellowship programs (MATS, SPAR, Anthropic Fellows, …) count as the hosting org even when they appear only in the acknowledgments.
Of the ~2,300 safety papers whose full text we could retrieve, about 600 have a verified connection to a tracked safety org or funder.
PLOT 4: papers per research org, counted by primary org
By primary attribution, MATS (48), Mila (46)[1] and Google DeepMind (42) top the list. Counted by any affiliation instead, the industry labs dominate, Google DeepMind appears on 107 papers, OpenAI on 74, Anthropic on 51, reflecting how often lab researchers co-author and mentor externally-led work. (The website's "Who Publishes" tab has both views.)
PLOT 5: funders credited in the acknowledgments
Open Philanthropy is credited in 120 papers, an order of magnitude more than any other philanthropic funder (Long-Term Future Fund: 10, Future of Life Institute: 8).
One interesting trend is that the safety ecosystem's share of safety papers is slightly shrinking even as its output grows. In 2019, 5 of the 9 safety papers had a tracked org or funder behind them, in 2026 it's 150 of 954[2], the dedicated ecosystem publishes more every year, but the field's growth is mostly coming from researchers outside it.
We think that these trends suggest that over time, effective interventions should focus on improving the quality/topic relevance/long-term impact of the research coming from existing researchers interested in safety, and on making research more diverse, generalizable, impactful, and applicable, rather than only increasing the raw count of papers and researchers.
PLOT 6: org-backed safety papers per year
Caveats
- Classification is by LLM, from title + abstract. The boundary between frontier AI safety and the neighboring classes (truthfulness/hallucinations, XAI, fairness) seems to be inherently fuzzy, we publish the full rubric and the classifier's per-paper reasoning.
- The org analysis is a lower bound. It only sees a curated org list, page-one affiliations and the first acknowledgments window; a mentorship credit buried deep in the appendix can be missed.
- 2026 is partial (no NeurIPS yet), and ICML 2026 full texts were only partially available for the org analysis (45 papers from ICML had significant title changes between the initial and camera-ready versions, and thus weren't retrievable).
- Acceptance at these venues undercounts non-submitted or rejected work, such as workshop papers, arXiv preprints, reports and blog posts, which is a large part of safety work.
Explore it yourself
The website https://ai-safety-tracker-website.vercel.app/ has the interactive version of everything above: per-conference views, per-year subdomain plots, a searchable table of all 2,328 papers (each row opens the classifier's verbatim reasoning and links to OpenReview), the by-org and by-funder plots, and an experimental arXiv trend line. The repo has every CSV and the scripts to regenerate all of it, including the classification prompt.
If you spot a mistake, feel free to send a comment, DM or GitHub issue, corrections are very welcome.
Future work
Future work could include extending this analysis to arXiv preprints, and possibly LessWrong and AlignmentForum posts. Another possibility is to analyze the citation networks, for example checking whether org-affiliated papers cite independent papers, and determining clusters and citation flow.
Acknowledgments
Thanks to every person who provided feedback.
This project was supported by BlueDot Rapid Grants.
The classifier was intentionally lax when assigning non-corporate primary orgs, this caused some papers coauthored or mentored by Mila members to be assigned Mila as their primary org, while the same didn't happen for Anthropic or DeepMind, whose share would increase significantly if counting secondary authors from these organizations.
There were 954 retrievable papers from the total of 999, as some ICML 2026 papers were not retrievable due to title changes between the original and camera-ready versions.