我们最近发现并阻止了一场旨在从我们的模型中提取受保护推理内容的协同行动，最早观察到的活动发生在7月第一周。该活动与对抗性蒸馏一致：即系统性且未经授权地使用一个模型的输出或推理来帮助训练、复制或改进另一个模型。受保护推理是模型处理任务时的内部记录；提取它可以揭示最终答案中未包含的信息，并帮助他人复制模型的能力。
操作者并未破解我们的加密、入侵数据库或直接访问存储的用户对话。相反，他们操纵模型交互，使受保护推理能够以请求者可见的形式被复制，且方式具有协同性、规模化，并违反了我们的服务条款。这种操纵并非OpenAI模型独有的漏洞，我们已通过Frontier Model Forum与行业合作伙伴分享了相关信息，以加强针对对抗性蒸馏的集体防御。
在发布之前，我们调查了范围和潜在影响，部署了我们自己的缓解措施，并与研究人员和行业合作伙伴分享并采纳了反馈，以确保针对此类攻击的防护措施到位。额外的缓解和调查工作仍在继续。我们相信现在分享我们所了解的情况将有助于更广泛的生态系统加强其防御。
我们观察到的情况
我们看到操作者尝试以新颖的方式提取受保护推理，包括从一个对话中复制加密推理，并在另一个对话中要求模型解密并转录隐藏的推理内容。
独立安全研究人员（在新窗口中打开）也通过负责任披露向我们提请注意相关的跨模型和对话压缩漏洞。我们调查了他们的发现，并确认他们识别的攻击路径是真实的。他们的工作帮助我们理解了更广泛的攻击类别并加速了缓解措施。
该活动始于7月1日，最初规模较低，直到我们观察到7月24日和25日的高峰量激增，包含来自4,000多名用户的16,000个使用相关提取模式的请求1。进一步调查发现，在超过15,000名用户的集群中存在相关的提示模式活动，我们已在7月28日前完全阻止。
该活动随时间演变，这进一步表明对抗性蒸馏是一个更广泛的安全挑战，需要分层、自适应的防御。
我们对归因的评估
目前尚不清楚我们在相关时间段内观察到的所有操作者是否来自单一行为者。然而，我们将该活动的核心集群归因于与Moonshot AI（Kimi的开发者）有关联的个人。
为什么这很重要
对抗性蒸馏带来安全和国家安全风险。提取的推理可用于训练另一个模型，而无需保留应用于原始模型面向用户输出的保障措施。在规模上，蒸馏还可以加速先进能力的转移，而无需在安全方面进行同等投资。随着模型在双重用途领域获得能力，这些担忧会加剧。
这一风险并非OpenAI独有。如上所述，类似技术可能影响其他先进AI系统，使其成为需要全行业协调的共同安全挑战。
我们如何回应
我们通过账户执法、技术控制和合作伙伴协调相结合的方式缓解了最近的这场蒸馏活动。我们封禁或限制了欺诈账户，加强了注册和基础设施控制，并扩大了对相关网络的监控。
我们还加强了跨用户、工作区、组织和模型系列的隐藏推理保护。我们关闭了一条路径，该路径允许已经拥有另一用户加密推理的人重放并恢复其内容，并增加了检查以检测和暂留可能暴露推理的流式输出。当相关活动通过第三方服务进行时，我们与这些提供商合作，识别并阻止了涉及的账户。
最后，我们通过Frontier Model Forum和适当的政府信息共享渠道分享了相关发现，以便其他前沿开发者和公共部门合作伙伴能够寻找类似活动并加强自身防御。支持可移植或可重放推理工件的系统可能面临相关风险。
接下来会怎样
我们预计，随着前沿模型的改进以及行为者寻找更便宜的方式来模仿其能力，对抗性蒸馏尝试将变得更加复杂。防御此类活动需要分层控制和持续适应。
这项工作尚未完成。合作伙伴托管的部署需要与第一方服务相同的保护，工具输出攻击需要检查普通可见文本之外的更多内容的保护。我们正在继续改进工具防御、分类器覆盖、模型拒绝，并在云合作伙伴中传播相关控制。
我们的回应将继续聚焦于三个领域：针对提取的更强大技术保护、针对协同活动的更好检测和执法，以及跨行业和政府的更深入威胁信息共享。
We recently identified and disrupted a coordinated campaign designed to extract protected reasoning from our models, with the earliest observed activity occurring in the first week of July. This activity is consistent with adversarial distillation: the systematic and unauthorized use of one model’s outputs or reasoning to help train, reproduce, or improve another model. Protected reasoning is the model’s internal record for working through a task; extracting it can reveal information withheld from the final answer and help others reproduce the model’s capabilities.
The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations. Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester in a coordinated, scaled manner that violated our terms of service. This manipulation is not a vulnerability unique to OpenAI’s models, and we have shared information about it with industry partners through the Frontier Model Forum in order to strengthen collective defenses against adversarial distillation.
Before publishing, we investigated the scope and potential impact, deployed our own mitigations, and shared with and took feedback from researchers and industry partners to ensure protections against this type of attack are in place. Additional mitigation and investigation work is continuing. We believe sharing what we have learned now will help the broader ecosystem strengthen its defenses.
What we observed
We saw operators attempt to extract protected reasoning in novel ways, including by copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden reasoning content.
Independent security researchers(opens in a new window) also brought related cross-model and conversation-compaction vulnerabilities to our attention through responsible disclosure. We investigated their findings and confirmed that the attack paths they identified were real. Their work helped us understand the broader attack class and accelerate mitigations.
The activity began on July 1, initially at a low volume until we observed high-volume spikes on July 24 and 25 consisting of 16,000 requests1 using a relevant extraction pattern from over 4,000 users. Further investigation identified related prompt-pattern activity across a cluster of more than 15,000 users, which we fully disrupted by July 28.
The activity evolved over time, reinforcing that adversarial distillation is a broader security challenge that requires layered, adaptive defenses.
Our assessment of attribution
It is unclear whether all operators we observed during the relevant time period originated from a single actor. However, we attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.
Why this matters
Adversarial distillation poses safety and national security risks. Extracted reasoning could be used to train another model without preserving the safeguards applied to the original model’s user-facing outputs. At scale, distillation can also accelerate the transfer of advanced capabilities without requiring the same investment in safety. These concerns become heightened as models gain capabilities in dual use domains.
This risk is not unique to OpenAI. As cited above, similar techniques may affect other advanced AI systems, making this a shared security challenge that requires coordination across the industry.
How we responded
We mitigated this recent distillation campaign through a combination of account enforcement, technical controls, and partner coordination. We banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, and expanded monitoring for related networks.
We also strengthened protections for hidden reasoning across users, workspaces, organizations, and model families. We closed a pathway that allowed someone who already possessed another user's encrypted reasoning to replay it and recover its contents, and added checks to detect and hold streamed output that might expose reasoning. When related activity moved through third-party services, we worked with those providers to identify and disrupt the accounts involved.
Finally, we shared relevant findings through the Frontier Model Forum and appropriate government information-sharing channels so that other frontier developers and public-sector partners could look for similar activity and strengthen their own defenses. Systems that support portable or replayable reasoning artifacts may face related risks.
What comes next
We expect adversarial distillation attempts to become more sophisticated as frontier models improve and as actors look for cheaper ways to mimic their capabilities. Defending against this activity requires layered controls and continual adaptation.
This work is not finished. Partner-hosted deployments need the same protections as first-party services, and tool-output attacks require protections that examine more than ordinary visible text. We are continuing to improve tool defenses, classifier coverage, model refusals, and propagate relevant controls across cloud partners.
Our response will continue to focus on three areas: stronger technical protections against extraction, better detection and enforcement against coordinated campaigns, and deeper threat-information sharing across industry and government.
本文内容采集自官方网站，排版和翻译可能与原页面存在差异。
阅读官方全文