安全概览：GPT-6 Astra

安全概述：GPT-6 Astra | OpenAI

收听文章 5:51

今天，我们发布 GPT‑6 Astra，这是我们迄今广泛部署的最强模型。Astra 是我们首个在《预备框架》下达到网络安全能力“关键”级别的模型。

关于本次发布的安全性，最重要的事项如下：

1. **GPT‑6 Astra 在网络能力上显著跃升，并达到我们的“关键”阈值。**这意味着，在具备适当工具和访问权限的情况下，GPT‑6 Astra 能够发现此前未知的安全漏洞，并在无需人工逐步引导的情况下，针对许多受良好保护的系统开发新的利用方式。因此，我们大幅加强了对模型采取有害网络行为的防护，无论该行为源于滥用还是错位。我们还采取措施保障我们内部开发与部署 Astra 及类似模型的安全，包括更严格的隔离、检查点加密、对完整轨迹（包括思维链）的通用监控，以及在内部使用前设置阻断性对齐评估流程。

2. **GPT‑6 Astra 比其前代模型显著更稳健。**结合新的稳健性安全训练技术，GPT‑6 Astra 在抵御越狱方面显著优于 GPT‑5.6 Sol，包括在更长轨迹上的表现。我们通过离线测试以及严格的内部和外部越狱测试与修复计划确认了这一点。对于被标记为潜在高风险的用户，我们还额外训练了调整模型拒绝边界的能力，使其更加保守，并覆盖更广泛的双重用途风险。我们使用回归测试确保 Astra 对以往测试期间发现的越狱方法保持稳健，并利用我们最新的内部红队攻击者进行了新一轮自动化红队测试，以验证我们的改进。

3. **GPT‑6 Astra 比 GPT‑5.6 Sol 对齐性更好。**Astra 在模型对齐方面迈出了重要一步，其对齐改进涵盖从预训练数据构成到强化学习期间评分的各个环节。我们报告了一套新的对齐评估套件⁠(在新窗口中打开)，并发现 GPT‑6 Astra 在尊重安全和安保边界以及保持在授权范围内方面表现更强。在一项使用超过54,000 个内部 Codex 任务⁠(在新窗口中打开)的模拟中，Astra 在较严重错位行为标记方面也比 Sol 少了大约一半。

4. **我们正在广泛部署错位监控。**我们将模型对齐视为防止模型潜在错位行为的主要杠杆。然而，监控能提供对前沿模型行为的广泛可见性，揭示进一步改进对齐和安全的机会。此外，监控还作为针对已检测到的错位行为的额外防护层。出于这些原因，我们还在 Astra 外部部署中涉及的所有工具使用推理中增加了错位监控，并为此投入了可观的算力成本。该系统与我们内部设置并行。

5. **GPT‑6 Astra 的可监控性相对于 GPT‑5.6 Sol 有所下降。**我们对 GPT‑6 Astra 的可监控性⁠(在新窗口中打开)和可控性⁠(在新窗口中打开)进行了大量研究。我们发现，GPT‑6 Astra 比 GPT‑5.6 Sol 更有能力控制自身的思维链，并且更不容易在思维链中包含可归罪信息。在对抗性设置中（即我们推动模型规避监控的情况下），我们发现该模型能够在评估中战略性表现不佳（沙袋效应）时保持不被检测，并且在被要求执行某些破坏任务⁠(在新窗口中打开)时有时能规避我们的内部监控。我们尚未发现隐写式思维链推理的证据（例如，将隐藏推理隐藏在普通且看似无关的文本中），这表明规避风险可能在很大程度上局限于较低层次的推理任务。

   • 这些发现表明，Astra 类模型在对抗性条件下可能规避我们的思维链监控。目前，这些发现主要基于对抗性评估（即当我们指示模型规避监控时），总体而言，我们的对齐评估显示 Astra 在违反安全和安保限制方面的可能性总体上低于 GPT‑5.6 Sol。
   • 然而，我们严肃对待这一趋势，并随着模型能力的增强，继续研究这些发现及其对可监控性的影响。OpenAI 一直致力于保留和利用思维链监控，而保持思维链可监控性是该研究计划的核心目标。然而，这些结果也凸显了开发超越检查模型思维链的对齐审计技术的重要性。

6. **GPT‑6 Astra 在浏览和工作场所场景中表现更负责任：**GPT‑6 Astra 在抵御提示注入方面显著优于 GPT‑5.6 Sol。我们还在现实浏览和专业计算机环境中测试了模型的行为，发现与 GPT‑5.6 Sol 相比，该模型执行错位和潜在破坏性操作（例如未经授权的交易、数据丢失、过度访问或规避控制）的可能性显著降低。在处理代理环境中的有害请求（例如协助暴力攻击策划或实施欺诈的请求）时，它也表现得更加安全。

7. **GPT‑6 Astra 在高风险场景中显著更安全。**GPT‑6 Astra 在应对来自生产环境和对抗性人工红队测试的挑战性请求时，比 GPT‑5.6 Sol 反应更安全。Astra 在安全完成不安全请求和避免对无害请求进行不必要拒绝方面实现了帕累托改进。这些改进延伸至高风险场景，即危害风险源于更广泛的上下文而非明确请求的情况。Astra 还对 18 岁以下用户更一致地应用了适龄安全边界。

Safety overview: GPT-6 Astra | OpenAI

Listen to article 5:51

Today, we are releasing GPT‑6 Astra, the most capable model we have ever broadly deployed. Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework.

The most important things to know about the safety of this launch are as follows:

1. **GPT‑6 Astra is a significant step up in cyber capabilities and meets our Critical threshold.**This means that, with the right tools and access, GPT‑6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step. Accordingly, we significantly strengthened our protections against the model taking harmful cyber actions, whether that’s due to misuse or misalignment. We also took steps to secure our internal development and deployment of Astra and similar models, including stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought (CoT), and a blocking alignment evaluation process before internal use.

2. GPT‑6 Astra is significantly more robust than its predecessors. Incorporating new robustness safety training techniques, GPT‑6 Astra is significantly more robust to jailbreaks than GPT‑5.6 Sol, including across longer trajectories. We know this from offline tests and our program of rigorous internal and external jailbreak testing and remediation. For users flagged as potentially high risk, we have additionally trained in the ability to adjust the model’s refusal boundary to be more conservative and cover a broader range of dual use risks. We use regression testing to make sure Astra is robust against jailbreaks found in previous testing periods, and performed new rounds of automated red-teaming with our latest internal red-teaming attackers to validate our improvements.

3. **GPT‑6 Astra is better aligned than GPT‑5.6 Sol.**Astra is a significant step forward in model alignment, and includes alignment improvements spanning the composition of our pre-training data to our grading during reinforcement learning. We report a new suite of alignment evaluations⁠(opens in a new window), and find that GPT‑6 Astra is stronger at respecting safety and security boundaries and staying within its authorized scope. In a simulation using more than54,000 internal Codex tasks⁠(opens in a new window), Astra also received roughly half as many flags for higher-severity misaligned behavior as Sol.

4. We are deploying misalignment monitoring broadly. We view model alignment as the primary lever to prevent potential misaligned behavior from our models. However, monitoring provides broad visibility into frontier model behavior, illuminating opportunities to further improve alignment and safety. In addition, monitoring serves as an additional layer of protection against misaligned behavior that is detected. For these reasons, we have additionally added misalignment monitoring to all tool-using inference involved in our external deployment of Astra, with significant compute cost. This system parallels our internal setup.

5. **GPT‑6 Astra’s monitorability has decreased relative to GPT‑5.6 Sol.**We have performed significant investigations on the monitorability⁠(opens in a new window) and controllability⁠(opens in a new window) of GPT‑6 Astra. We have found that GPT‑6 Astra is more capable of controlling its own CoT than GPT‑5.6 Sol, and less likely to include incriminating information in its CoT. In adversarial settings (where we push the model to evade our monitors) we find that the model is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks⁠(opens in a new window). We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and seemingly unrelated text), indicating that the evasion risk may largely be bounded to lower reasoning tasks. * These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions. Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT‑5.6 Sol to violate security and safety restrictions overall. * However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable. OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program. However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought.

6. **GPT‑6 Astra more responsibly navigates browsing and workplace settings:**GPT‑6 Astra is significantly more robust to prompt injections than GPT‑5.6 Sol. We have additionally tested the model’s behavior in realistic browsing and professional computer environments, and find that the model is significantly less likely to perform misaligned and potentially destructive actions (for instance unauthorized transactions, data loss, excessive access, or circumvention of controls) compared to GPT‑5.6 Sol. It also acts more safely when handling harmful requests in agentic settings, such as requests to assist with violent attack planning or commit fraud.

7. GPT‑6 Astra is significantly safer in higher-risk scenarios. GPT‑6 Astra responds more safely than GPT‑5.6 Sol to challenging requests drawn from production and adversarial human red-teaming. Astra achieves a Pareto improvement in safely completing unsafe requests and avoiding unnecessary refusals to harmless requests. These improvements extend to high-severity scenarios where the risk of harm emerges from the broader context rather than an explicit request. Astra also applies age-appropriate safety boundaries more consistently for users under 18.