有效第三方评估的优先事项和原则

前沿人工智能实验室在安全地训练、评估和部署模型方面肩负着巨大责任。第三方评估是平衡这一责任、扩大人工智能安全意见输入机会、让世界了解情况、并使实验室对明确且独立支持的安全声明负责的关键部分。

作为我们紧跟前沿努力的一部分，OpenAI 致力于支持独立评估，在训练、评估和部署方面提供深度访问权限。这种访问应使评估者能够挑战我们的假设，识别我们可能遗漏的风险，并就我们保障措施的有效性得出自己的结论。

我们长期以来在模型开发和部署过程的各个阶段与第三方评估者合作。我们还将第三方评估纳入我们的准备框架实践，并支持倡导更严格、更负责任的流程的组织和立法。在这些合作中，我们提供了深度访问形式，包括有关我们技术保障措施的信息、可见的思维链访问权限，以及为事件响应和监控红队测试提供的前所未有级别的机密数据和内部部署访问权限。此处分享的优先事项和原则侧重于我们与私营和非营利部门的独立评估组织在技术安全评估方面的合作。它们补充了我们与政府在测试和评估方面的工作，后者不同的角色和职责可能需要不同的方法。

使这些评估有效需要强有力的独立性机制、科学严谨性、稳健的安全实践和明确的责任。实验室有责任在保护敏感信息的同时实现有意义的审查。实验室和独立评估者共同承担做好这项工作的责任，并应按照安全和安保实践的共享国际标准运作。下面，我们提出四个深入评估的优先领域，以及严谨、安全和独立工作的原则。

评估的优先领域

第三方评估在解决具体、重要的问题时最为有用：证据是否支持实验室的安全案例和安全声明？评估是否充分测试了它们旨在衡量的风险？保障措施在现实条件下是否有效？

此处描述的评估旨在根据所审查的安全问题采取不同形式。我们预计将并行支持多项评估，并在不同时间段内进行，有些持续数周，有些持续数月。虽然第三方评估也可以作为部署前工作的一部分，并可能为部署决策提供信息，但此处描述的工作通常是长期性的且与发布无关——侧重于随时间推移深入审查特定的安全声明。

在我们的优先领域和原则中，我们提到安全声明和安全案例。我们对这些术语的含义如下：

我们提出四个深入评估的优先领域，以及严谨、安全和独立工作的原则。

对安全案例的独立评估，涵盖训练、评估、内部部署和外部部署。

安全案例的评估需要对齐、控制方法（如监控）、网络安全、生物和化学滥用以及红队测试方面的专业知识。安全案例由包括训练、能力评估和保障措施在内的声明组成，可以整体或部分进行评估（见下文优先事项2和3）。多个评估者可能需要根据各自的专业知识审查案例的不同部分。他们的评估应共同回答以下问题：

1.   训练、评估和部署的安全案例证据是否得到证实？在训练、评估和部署期间是否遵循了安全案例的条件？

2.   我们的安全案例是否涵盖了评估过程中发现的最紧迫风险？安全声明是否支持整体安全案例？是否存在任何差距或改进领域？

3.   是否使用了有效方法来识别和减少训练中可能奖励欺骗、奖励黑客、破坏性行为或规避限制的激励因素？

对关键保障措施的评估，涵盖内部和外部部署

我们的保障措施栈始终在演进，以应对不断变化的能力和格局。我们的保障措施涵盖训练、内部部署和外部部署。它们目前包括模型级保障措施、执行保障措施和安全保障措施，以及失准监控器——覆盖各种风险（如失控，以及网络、生物和化学风险中的滥用）。技术合作可以识别当前保障措施中的弱点，同时改进评估方法并加速标准制定，为未来公共政策紧跟前沿提供更强的技术基础——特别是对于内部部署，其安全和安保标准仍处于起步阶段。

独立评估应审查这些保障措施的效果如何以及可能不足之处，例如：

1.   使用“灰盒”访问权限，保障措施对对抗性测试（越狱）是否稳健，它们是否足以防止高风险领域（如网络、生物）的能力提升？我们的对抗性测试和红队测试是否覆盖了最重要的风险？

2.   在现实操作条件下的授权测试中，智能体如何与访问控制、沙箱以及检测和响应系统等网络防御交互？哪些防御措施能够阻止、检测或遏制有害行为，哪些地方会失败？

3.   我们的失准监控器是否存在可能导致失控或严重失准的关键差距，对于内部和外部部署都是如此？随着模型能力的提升，思维链监控作为安全或对齐证据来源的可靠性如何？

4.   是否在所有相关训练、评估和部署中实施了适当的监控，且不易被禁用？

5.   保障措施的实施是否与能力相称？

对涵盖准备框架风险类别（化学和生物风险、网络安全、人工智能自我改进）的能力评估以及针对失准风险的对齐评估的评估

我们的准备框架要求通过评估来评估关键的前沿风险领域。随着阈值被超越和评估饱和，持续更新并确保评估的覆盖范围和质量至关重要，这些评估旨在评估准备风险领域的能力，以及旨在评估严重失准风险的对齐评估。

有效评估的原则

明确界定且双方同意的评估声明： 评估应从双方同意的范围开始，随后在评估活动开始前预先注册明确定义的安全声明。第三方和实验室应澄清这些声明是被评估公司希望提出供评估的声明，还是第三方评估者旨在独立评估且实验室同意接受评估的声明。有些声明可能超出范围的原因有很多，包括第三方无法访问数据、评估者专业知识不足，或评估紧急时合理的时间限制。实验室和评估者应建立一个流程，考虑在原始范围之外发现的重大风险，包括是否需要进一步调查。结论应明确说明就双方同意的范围而言，哪些被评估了，哪些没有被评估。
相称的访问权限： 在法律、安全和知识产权限制的范围内，评估者应尽可能对评估双方同意的声明拥有相称的访问权限。在直接访问不切实际或不可能的情况下，评估者可以与公司的指定代表合作，或探索间接或隐私保护访问机制以保护底层信息。
透明的方法和标准： 评估者应解释其方法、评估标准和不确定性，并在可用时借鉴既定标准。在标准尚不存在的情况下，他们应清楚地证明其所用标准的合理性。报告应区分直接发现和解释，解释不确定性，并明确证据支持哪些结论。
专业知识和独立性： 评估者应展示相关的技术专业知识，并识别、披露和解决组织和个人利益冲突，包括财务激励、与开发者的关系，以及先前参与被评估工作的情况。保障措施的设计应确保商业压力和薪酬安排不会影响发现，可能包括回避或适当的排除期。
安全和保密： 评估者应展示信息安全实践和可执行的保密保护，覆盖其人员，与所访问系统和信息的敏感性相称。这些保护应涵盖知识产权、敏感信息和评估记录。如果评估者无法在自己的环境中满足安全要求，或者所访问的数据特别敏感，在公司管理的设备或场所上进行访问可能是合适的。
可操作的发现和修复时间： 评估应识别具体差距，并提供足够的细节供实验室解决。在适当情况下，实验室应在发布前有合理的时间来修复问题。在相关情况下，报告还应解释对智能体开发者、部署者和防御者的经验教训，并提供实用的实施建议。
负责任的发布实践： 评估报告应以证据为基础，并在保护敏感和机密信息的同时尽可能公开分享。在无法完全公开披露的情况下，向适当的监督机构（如治理机构或公司董事会）进行保密报告可以支持问责制。应有原则性的编辑保护措施和政策，以及对反馈和纠正不准确之处的明确期望，以保持独立性和保密性之间的平衡。评估者应保持编辑独立性，同时确保保密和知识产权保护得到维持。评估者应采用明确的编辑政策，允许实验室请求编辑敏感信息，同时评估者可以注明进行了实质性编辑及其对评估报告的影响。

前路

我们致力于支持独立评估机构，并通过未来的法律和私人治理机构，为有效的第三方评估建立更清晰、共享的国际标准。尽管独立评估生态系统仍在成长中，我们将通过支持和与拥有前沿安全问题上深厚专业知识的多元化独立评估机构群体合作，助力其发展。没有任何一个第三方能够或应该全面覆盖紧迫的前沿安全问题。我们将审慎且有意图地提升自身能力，并使不断壮大的第三方生态系统能够在最佳实践和原则上达成一致。我们正在与多个第三方就与上述优先领域相符的提案进行对话。

Frontier AI labs carry an immense responsibility in training, evaluating, and deploying models safely. Third party assessments are a critical part of balancing that responsibility, expanding opportunities for input on AI safety, keeping the world informed, and keeping labs accountable to clear and independently supported safety claims.

As part of our efforts to pace the frontier, OpenAI is committed to supporting independent assessments with deep levels of access across training, evaluation, and deployment. That access should enable assessors to challenge our assumptions, identify risks we may have missed, and reach their own conclusions about the effectiveness of our safeguards.

We have long worked with third party assessors at various stages of the model development and deployment process. We have also incorporated third party assessments into our Preparedness Framework practices and supported organizations and legislation that advocate for a more rigorous and accountable process. Throughout these engagements, we have provided deep forms of access, including information about our technical safeguards, visible chain of thought access, and unprecedented levels of confidential data and internal deployment access for incident response and monitor red teaming. The priorities and principles shared here focus on our engagement with independent assessment organizations in the private and non-profit sector on technical safety assessments. They complement our work with governments on testing and evaluation, where distinct roles and responsibilities may call for different approaches.

Making these assessments effective requires strong independence mechanisms, scientific rigor, robust security practices, and clear responsibilities. Labs have a responsibility to enable meaningful scrutiny while protecting sensitive information. Labs and independent assessors share the responsibility for getting this right, and should be operating with shared international standards for safety and security practices. Below, we propose four priority areas for deeper assessment, alongside principles for rigorous, secure, and independent work.

Priority areas for assessment

Third party assessments are most useful when they address specific, consequential questions: Does the evidence support a lab’s safety case and safety claims? Do evaluations adequately test the risks they are intended to measure? Do safeguards work under realistic conditions?

The assessments described here are intended to take different forms depending on the safety questions being examined. We expect to support multiple assessments in parallel and over different periods of time, with some lasting weeks and others several months. While third-party assessments can also be part of pre-deployment work and may inform deployment decisions, the work described here is generally longer-term and launch-agnostic—focused on examining particular safety claims in depth over time.

Throughout our priority areas and principles, we refer to safety claims and safety cases. What we mean by these terms is the following:

We propose four priority areas for deeper assessment, alongside principles for rigorous, secure, and independent work.

Independent assessment of safety cases, spanning training, evaluation, internal deployment and external deployment.

Assessment of safety cases requires expertise in alignment, control methods such as monitoring, cybersecurity, biological and chemical misuse and red teaming. Safety cases consist of claims including training, capability evaluations, and safeguards, which can be assessed as a whole or in parts (see priorities 2 and 3 below). Multiple assessors will likely need to examine different parts of the cases, drawing on their respective expertise. Together, their assessments should answer questions such as:

1.   Is the evidence for safety cases for training, evaluation, and deployments substantiated? Were the conditions of the safety case followed during training, evaluation, and deployment?

2.   Do our safety cases cover the most urgent risks identified in the course of an assessment? Do the safety claims support the overall safety case? Are there any gaps or areas for improvement?

3.   Are effective methods used to identify and reduce incentives in training that could reward deception, reward hacking, destructive actions, or circumventing restrictions?

Assessment of critical safeguards, across internal and external deployments

Our safeguard stack is always evolving to meet the changing capabilities and landscape. Our safeguards span training, internal deployment, and external deployment. They currently include model-level safeguards, enforcement safeguards, and security safeguards, as well as misalignment monitors—covering a wide variety of risks (such as loss of control, and misuse in cyber, biological and chemical risks). Technical partnerships can identify weaknesses in safeguards now while improving assessment methods and accelerating standards development, providing a stronger technical basis for future public policies to pace the frontier—particularly for internal deployments, where safety and security standards are still nascent.

Independent assessments should examine how well these safeguards work and where they may fall short, such as:

1.   Using “grey box” access, are safeguards robust to adversarial testing (jailbreaks) and do they sufficiently protect against capability uplift in high risk domains (e.g, cyber, bio)? Does our adversarial testing and red teaming cover the most important risks?

2.   In authorized testing under realistic operating conditions, how do agents interact with cyber defenses such as access controls, sandboxing, and detection and response systems? Which defenses prevent, detect, or contain harmful actions, and where do they fail?

3.   Do our misalignment monitors have any critical gaps that could lead to loss of control or severe misalignment, for both internal and external deployments? How reliable is chain-of-thought monitoring as a source of evidence for safety or alignment as model capabilities improve?

4.   Is appropriate monitoring implemented across all relevant training, evaluations, and deployment, in a way that cannot easily be disabled?

5.   Are safeguards implemented commensurate with the capabilities?

Assessment of capability evaluations that cover Preparedness risk categories (Chemical and Biological Risks, Cybersecurity, AI Self-Improvement) and alignment evaluations for misalignment risks

Our Preparedness Framework requires evaluations to assess key frontier risk areas. As thresholds are surpassed and evaluations saturate, it is important to consistently refresh and ensure coverage and quality of evaluations that assess capabilities in Preparedness risk areas, and alignment evaluations that seek to assess severe misalignment risks.

Relevant questions include:

1.   Do evaluations that assess Preparedness risks adequately cover the Preparedness risk threshold definition? Are thresholds set correctly for these evaluations?

2.   Are evaluations updated when models consistently achieve the highest scores, and do the new tests meaningfully measure more advanced capabilities?

3.   Do our alignment evaluations adequately cover severe misalignment risks, and what important behaviors or conditions might they miss?

Independent investigation of critical misalignment incidents

Independent investigation can be valuable across a range of critical AI safety incidents. Here, we focus on model misalignment, including models acting without authorization or evading oversight, which can reveal weaknesses in alignment methods and safeguards even without intentional misuse.

In select circumstances, as with the OpenAI Hugging Face incident, it can be beneficial to bring in an independent third party for independent misalignment incident investigations. It is critical that third parties involved in incident investigation have the requisite expertise for investigation, including where applicable: cyber forensics expertise, alignment expertise, large-scale chain of thought analysis, and the staff and resources available to conduct investigation in a timely manner. Incident response may involve access to sensitive internal data and third party data, and as a result some details may be sensitive to publish or access. Findings from independent investigations can also inform a model’s safety case by providing evidence to assess claims about its alignment and the effectiveness of measures taken to remediate previously observed misalignment.

In the context of misalignment incidents, we prioritize independent assessments on:

1.   What model behavior or misalignment issues occurred in the course of the incident, and what are the primary contributing factors?

2.   Would safeguards and remediation effectively mitigate similar incidents in the future?

Principles for effective assessments

Clearly scoped and mutually agreed upon claims for assessment: Assessments should begin with a mutually agreed-upon scope, followed by clearly defined safety claims that are pre-registered before assessment activities begin. Third parties and labs should clarify whether they are claims that the company being evaluated wants to put forward for assessment, or claims that the third party assessor is aiming to assess independently and the lab agrees to be assessed against. There are many reasons some claims may be out of scope, including infeasibility for third parties to access data, insufficient expertise from the assessor, or reasonable time constraints when an assessment is urgent. Labs and assessors should establish a process for considering significant risks identified outside the original scope, including whether further investigation is warranted. Conclusions should make clear what was and was not assessed as it relates to the mutually agreed upon scope.
**Proportionate access:**Assessors should have proportionate access to assess the agreed upon claims where possible within the bounds of legal, security, and IP constraints. Where direct access is impractical or not possible, assessors can work with a designated representative at a company or explore indirect or privacy preserving access mechanisms to protect underlying information.
Transparent methodology and standards: Assessors should explain their methods, assessment criteria, and uncertainties, drawing on established standards where available. Where standards do not yet exist, they should clearly justify the criteria they use. Reports should distinguish direct findings from interpretation, explain uncertainty, and make clear which conclusions the evidence supports.
Expertise and independence: Assessors should demonstrate relevant technical expertise and identify, disclose, and address organizational and individual conflicts of interest, including financial incentives, relationships with developers, and prior involvement in the work being assessed. Safeguards should be designed to ensure that commercial pressures and compensation arrangements do not influence findings, and may include recusal or appropriate exclusion periods.
Security and confidentiality: Assessors should demonstrate information-security practices and enforceable confidentiality protections covering their personnel, proportionate to the sensitivity of the systems and information accessed. These protections should cover intellectual property, sensitive information, and assessment records. Where assessors cannot meet security requirements in their own environments, or the data being accessed is especially sensitive, access on company-managed devices or premises may be appropriate.
**Actionable findings and time to remediate:**Assessments should identify specific gaps and provide enough detail for labs to address them. Where appropriate, labs should have a reasonable period to remediate issues before publication. Where relevant, reports should also explain lessons for agent developers, deployers, and defenders, with practical recommendations for implementation.
Responsible publication practices: Assessment reports should be grounded in evidence and shared as openly as possible while protecting sensitive and confidential information. Where full public disclosure is not possible, confidential reporting to appropriate oversight bodies (such as governance bodies or boards of companies) can support accountability. Principled redaction protections and policies, as well as clear expectations about feedback and correction of inaccuracies, should be in place to preserve the balance of independence and confidentiality. Assessors should maintain editorial independence, while ensuring that confidentiality and IP protections are maintained. Assessors should adopt clear redaction policies that allow for labs to request redactions of sensitive information, while assessors can note where substantive redactions have been made and the impact on their assessment report.

The road ahead

We are committed to supporting independent assessors and establishing clearer, shared international standards—both through future laws and private governance institutions—for effective third party assessments. While the independent evaluation ecosystem is still growing, we will help it grow by supporting and working with a diverse community of independent assessors with deep expertise across frontier safety questions. No one third party can or should comprehensively cover urgent frontier safety questions. We will move deliberately and with intention to grow our capacity and enable the growing third party ecosystem to align on the best practices and principles. We are in conversation with multiple third parties about proposals that align with the priority areas above.

本文内容采集自官方网站，排版和翻译可能与原页面存在差异。

阅读官方全文