vllm-benchmarking — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vllm-benchmarking (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Target audience: operators producing defensible latency/throughput numbers against production or pre-production vLLM deployments, on datacenter GPUs, often in containerized or air-gapped environments.
Bad benchmarks are worse than no benchmarks — they drive the wrong decisions with false confidence. The three common failure modes:
--request-rate inf answers "saturation throughput," not "TTFT my users see." Mixing those up leads to buying GPUs to solve a latency problem, or shipping a latency regression because total throughput looked fine.--dataset-name random has zero prefix structure. Real coding-agent or RAG traffic has heavy prefix reuse. Benchmarking caching wins on random produces numbers that don't survive contact with prod.--tokenizer matches the served model exactly.The cost of getting this right is small; the cost of getting it wrong is buying the wrong hardware.
| Question | Command | Why |
|---|---|---|
| "Saturation throughput of this offline batch" | vllm bench throughput | Submits N prompts at once, measures tok/s. No server. |
| "Single-batch generation latency" | vllm bench latency | Fixed batch size, repeated N times. Warmup included. Good for kernel-level regression. |
| "Production serving performance" | vllm bench serve | HTTP-level, Poisson arrivals, percentile metrics, honors concurrency caps. Use this for serving. |
| "Find best config under SLO" | vllm bench sweep | Parameter sweep + auto-tune. Finds max throughput subject to P99 < X ms. |
| "Cold-start / container boot latency" | vllm bench startup | Time from process launch to first-token-ready. |
| "Multimodal processor overhead" | vllm bench mm-processor | Image/video preprocessing cost before decode. |
Most production questions route to vllm bench serve. Reach for the others only when the question is specifically kernel-level (latency), offline-batch (throughput), or SLO auto-tuning (sweep).
Question: "Does my running deployment meet the latency SLO under realistic load?"
--max-concurrency matching the production in-flight ceiling (NOT --request-rate).--dataset-name custom with a JSONL file.vllm bench serve \
--model <served-model> \
--base-url http://<endpoint> \
--dataset-name custom \
--dataset-path /data/captured-prod-prompts.jsonl \
--max-concurrency 32 \
--num-prompts 2000 \
--percentile-metrics ttft,tpot,itl,e2el \
--metric-percentiles 50,95,99 \
--save-result --output-json health-check.jsonQuestion: "Does config change X make it faster, and at what cost?"
--num-prompts (≥500), same dataset on both sides.See scripts/bench-sweep.sh for a parametrized sweep runner that emits one JSON file per rate for plotting.
vllm bench serve does not auto-warm (as of v0.21) — pre-flight the server with a few requests, or set --num-prompts large enough (≥500) to amortize. latency does warm up via --num-iters-warmup (default 10).--tokenizer defaults to --model, but if they differ (e.g., served via a local path while benching with a HF ID), every token count in the output is fiction. Always specify explicitly.custom with a real-traffic JSONL, or prefix_repetition for synthetic prefix-heavy tests.--backend. Current full value set (docs.vllm.ai, verified 2026-04-24): openai, openai-chat, openai-audio, openai-embeddings, openai-embeddings-chat, openai-embeddings-clip, openai-embeddings-vlm2vec, vllm, vllm-chat, vllm-pooling, vllm-rerank, infinity-embeddings, infinity-embeddings-clip.nvidia-smi dmon for unrelated activity before trusting numbers.serve with the prefix_repetition dataset.For the full flag reference for each subcommand, see references/commands.md. For the dataset catalog and when to use each, see references/datasets.md.
Operators who can't reach huggingface.co have three working patterns:
HF_ENDPOINT=https://hf-mirror.com (or an internal reverse-proxy URL). huggingface_hub treats it transparently.VLLM_USE_MODELSCOPE=True plus trust_remote_code=True. Historical gap: LoRA adapter loading through ModelScope (vLLM issue #32841, closed 2026-01-23). Re-verify on your vLLM version before relying on LoRA-via-ModelScope; issue closure without a linked PR means status is unclear — test first.HF_HUB_OFFLINE=1 + TRANSFORMERS_OFFLINE=1, HF_HOME pointing at a pre-populated directory (NFS, PVC, or JuiceFS/S3).For benchmark datasets specifically: sonnet is in-tree at vllm/benchmarks/sonnet.txt — never downloads. random is synthetic — never downloads. sharegpt must be pre-staged: wget the JSON on a connected host, rsync into the enclave, point --dataset-path at it.
For the full air-gapped recipe (HF proxy setup, gated model tokens, MinIO-as-HF-cache, transformer cache warming), see references/air-gapped.md.
Default metrics (--percentile-metrics ttft,tpot,itl,e2el):
Reporting guideline: always P50 and P99 together. Either in isolation is misleading. Add P95 if ITL has a long tail.
Goodput SLO — --goodput KEY:VALUE (milliseconds) tracks requests that completed within an SLO budget. Example: --goodput ttft:500 itl:50. Goodput is what actually matters in production; raw throughput that violates SLO is useless.
For methodology detail (warmup protocols, sweep design, SLO-constrained auto-tune, how to capture real-traffic prompts for replay), see references/methodology.md.
See references/troubleshooting.md for the failure modes: tokenizer mismatch (numbers off 20–40%), cold-cache contamination (suspiciously fast), air-gapped hang (incomplete HF_HUB_OFFLINE setup), goodput=0 (unit error), noisy-neighbor ITL variance, and the full "what to include in a bug report" checklist.
See references/output-schema.md for the field layout in --output-json — top-level fields (request_throughput, output_throughput, total_token_throughput), the mean_/median_/std_/p<N>_<metric>_ms pattern, speculative decoding fields, and which names are stable across versions vs renamed.
vllm bench serve reference: https://docs.vllm.ai/en/stable/cli/bench/serve/VLLM_USE_MODELSCOPE): https://docs.vllm.ai/en/stable/configuration/env_vars/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.