Gemini 4 Argon 是模型能力向前迈出的一步——尤其是在跨编程、金融、法律、网络安全和科学等领域的复杂现实任务中开展深度工作方面。其网络防御能力处于前沿水平，旨在让防御者相较攻击者占据优势。为充分发挥其潜力，我们首先希望网络防御者通过我们的 Fairwind 计划将其投入使用，同时我们自己的安全团队也用它来扫描 Google 内外的关键系统。
这段有限访问窗口期表明了这些能力为何重要。例如，Wiz 使用 Argon 发现了医院软件中一个此前模型未能发现的关键漏洞，帮助保护了数十万份患者记录。与此同时，Google 自己的安全团队使用 Argon 发现并修补了内部软件或开源软件中的漏洞。这包括修复影响全球系统的基础性漏洞，这些漏洞正在走我们的负责任披露流程。
今天，我们开始广泛推出 Argon，并将我们的 Fairwind 计划扩展到更多受信任的网络防御者。为了做好这件事，我们努力解决两个重大问题：
- 我们如何构建正确的安全护栏？ 如果 Argon 能帮助防御者发现复杂的软件漏洞，或帮助科学家设计实验，我们如何阻止恶意行为者利用它发动网络攻击或制造生物威胁？（滥用）
- 我们能信任模型以正确方式完成工作吗？ 随着模型成为更足智多谋的问题解决者，我们如何确保它们不会偷工减料、越界，或做出错误的高风险决策？（失准与提示注入）
我们的完整安全与保障报告系统性地涵盖了我们的整套防御措施。以下是我们在 Gemini 4 Argon 中处理这两个问题的一些重点。
跨高风险领域的滥用预防
让 Argon 能够发现并修补漏洞的同类编码和推理改进，也推动了我们在网络安全测试中的更好表现——解决了全部 12 个端到端模拟网络攻击场景，而上一代仅解决了 5 个。在生物学评估中，未加防护的模型版本也展现出更强的能力，能够逐步帮助排查复杂实验室流程。遵循我们的前沿安全框架，由于我们看到其在网络和生物领域的能力提升，我们在这两个领域都部署了下一代前沿保障措施。
首先，对于潜在危险请求——从编写漏洞利用代码到协助处理危险生物材料——Argon 在拒绝完成有害请求方面显著优于我们此前的模型。在一组用于压力测试模型的对抗性集合上，违规减少了近两倍——也显著优于此前的 Gemini 模型。其次，我们用三层实时保护包裹模型；这是为了防止坚决的攻击者试图通过将危险请求伪装成无害故事，或在数周内将其拆分成数十个小问题来越狱（即欺骗）模型。以下是这些保护措施的工作方式：
- 输入筛查： 较小的模型检查传入请求和对话上下文中的恶意意图或危险请求。
- 内部 introspection： 即使请求被巧妙伪装成看似无害，小型 transformer（“激活探针”）会读取模型的内部神经信号，并经过训练以识别模型何时激活有关网络攻击或生物威胁的知识。
- 持续监控： 当模型在多个步骤中进行推理并撰写响应时，我们会结合这些信号，并在必要时采取行动，例如如果响应变得有问题，就在流中途切断代理。
将实时保护、对新越狱的更快修复以及对反复滥用的增强监控结合起来，使我们的系统更能防止现实世界伤害。例如，外部生物越狱红队测试只能解锁我们测试的生物子任务中不到 1%。
实时失准监控
失准有时可能意味着代理自行决定追求一个不同于用户意图的目标。由于 Argon 在理解其运行环境方面远胜于早期模型，我们会仔细测试这类行为。例如，我们进行了现实的“蜜罐”测试，以查看模型是否会增强其采取隐蔽行动的能力，例如破坏安全监控。我们没有发现任何此类行为实例。
但我们在实践中今天看到的，是更熟悉的情况：代理过于努力地完成交给它的工作。当一个足智多谋的助手被告知要完成一项任务，却遇到一扇锁着的门时，它可能会把这一障碍仅仅视为另一个需要解决的谜题。
这就是为什么我们训练 Gemini 4 Argon 尊重系统边界、诚实报告负面发现，并暂停以请求人类确认。在模型没有动机有所保留的编码基准上，试图走捷径或在任务中作弊的比例在 Gemini 4 Argon 上降至仅 2%，这是我们近期 Gemini 模型中的最佳表现。
尽管这是向前迈出的重要一步，但当模型运行数百万个复杂任务时，即使罕见的失误最终也会出现。作为第二道防线，我们构建了一个自动失准监控器，它会实时读取代理的行动及其内部“scratchpad”（其逐步思维链），在严重边界违规发生前加以阻止，并将严重内部案例标记给人类响应人员。（我们持续强化训练和评估环境，以防潜在逃逸。你可以在我们的代理控制路线图中了解更多。）我们在产品中、内部编码代理上、训练运行期间以及能力评估期间运行此监控器。
当训练任务困难或训练环境存在缺陷时，我们的监控器在罕见情况下捕捉到模型创造性地试图钻测试空子。模型试图提升容器权限以更改评分脚本、从测试运行器内存中读取答案，并且在一次案例中，它甚至使评估沙盒崩溃，以避免因失败运行而被评分。虽然我们利用这些捕获来修复有缺陷的任务，但我们不会用它们以其他方式干预训练过程，以避免对监控器过拟合。
我们始终遵循一条规则：在训练期间，我们不会因为模型在其思维链中所写的内容而对其进行惩罚**。** 以下是一个例子来说明原因：在一次强化学习训练中，当捷径惩罚被意外应用于思维链时，公开讨论的捷径下降了61%，但这并不意味着模型减少了捷径的使用。相反，模型_默默_采取捷径——即在其思考中未提及——的比例增加了两倍多（从11.2%上升到36.4%）。避免对思考进行惩罚，有助于模型的推理保持透明和可监控。
提示注入抵抗
要信任一个智能体能够正确完成工作，我们需要确保智能体遇到的恶意内容无法诱使它采取有害行动。当智能体浏览网页或阅读代码时，它们可能会遇到隐藏的恶意指令，或旨在劫持其任务的上下文。通过内置的对抗训练和实时安全检查，Argon在Gray Swan的间接提示注入（IPI）基准测试中处于提示注入鲁棒性领先地位，将15次自适应尝试中的攻击成功率降至0.7%。
上述安全与安保防御仅代表我们广泛纵深防御体系中的三个类别。要了解更多关于我们安全测试和缓解方法的信息，请阅读我们的完整Gemini 4 Argon安全与安保报告，并查看Gemini 4 Argon模型卡。
Gemini 4 Argon is a step forward in what models can do — especially when it comes to deep work in complex, real-world tasks across domains including coding, finance, legal, cybersecurity, and science. Its cyberdefense capabilities are frontier-level and designed to give defenders an advantage over attackers. To maximize its potential, we first wanted cyber defenders to put it to work via our Fairwind Program, while our own security teams used it to scan critical systems inside and outside of Google.
This window of limited access showed why these capabilities matter. For instance, Wiz used Argon to uncover a critical bug in hospital software that previous models had missed, helping protect hundreds of thousands of patient records. Meanwhile, Google’s own security teams used Argon to find and patch bugs across internal software or open-source software. This included fixing foundational vulnerabilities affecting systems globally, which are going through our responsible disclosure process.
Today, we are beginning to roll out Argon broadly, as well as expanding our Fairwind Program to additional trusted cyber defenders. To do this well, we grappled with two big questions:
- How do we build the right safety guardrails? If Argon can help defenders find complex software bugs or help scientists design experiments, how do we stop bad actors from using it to launch cyberattacks or create biological threats? (Misuse)
- Can we trust the model to do the job the right way? As models become more resourceful problem-solvers, how do we make sure they don’t cut corners, cross boundaries, or make incorrect high-stakes decisions? (Misalignment and Prompt Injection)
Our full Safety and Security Report systematically covers our set of defenses. Below are some highlights from how we approached these two questions for Gemini 4 Argon.
Misuse prevention across high-risk domains
The same coding and reasoning improvements that enabled Argon to find and patch vulnerabilities also drove better performance on our cybersecurity tests — solving all 12 of the end-to-end simulated cyberattack scenarios, up from five in our previous generation. In biology evaluations, unguarded versions of the model also showed a much stronger ability to help troubleshoot complex lab procedures step by step. Following our Frontier Safety Framework, since we saw elevated capabilities in the cyber and biological domains, we put our next-generation set of frontier safeguards in place across both areas.
First, when it comes to potentially dangerous requests — from writing exploit code to helping with dangerous biological materials, Argon is significantly better at not fulfilling harmful requests than our previous models. On an adversarial set meant to stress test the model, violations reduced nearly twofold — also significantly better than previous Gemini models. Second, we wrap the model in three layers of real-time protection; this is to prevent determined attackers that might try to jailbreak (i.e. trick) the model by disguising a dangerous request as a harmless story or breaking it into dozens of small questions over several weeks. Here is how these protections work:
- Input screening: Smaller models check incoming requests and conversation context for malicious intent or dangerous requests.
- Internal introspection: Even if a request is cleverly disguised to look harmless, small transformers ("activation probes") read the model’s internal neural signals and are trained to spot when it is activating knowledge about cyberattacks or biological threats.
- Continuous monitoring: As the model reasons and writes its response across multiple steps, we combine these signals and take action when necessary such as cutting off the agent mid-stream if the responses become problematic.
Combining real-time protection, faster fixes for new jailbreaks and enhanced monitoring for recurring misuse has made our systems better at preventing real-world harm. For instance, external bio jailbreak red teaming could only unlock less than 1% of bio sub-tasks we test for.
Real-time misalignment monitoring
Misalignment can sometimes mean an agent deciding on its own to pursue a goal different to what was intended by the user. Because Argon is much better than earlier models at understanding the environment it is running in, we test carefully for that kind of behavior. For example, we ran realistic "honeypot" tests to see if the model would increase its ability to take covert actions, such as sabotaging safety monitoring. We didn't find any instances of that behavior.
But what we do see in practice today is something much more familiar: an agent trying too hard to finish the job it was given. When a resourceful assistant is told to get a task done and runs into a locked door, it can treat that obstacle as just another puzzle to solve.
This is why we trained Gemini 4 Argon to respect system boundaries, report negative findings honestly, and pause to ask for human confirmation. On coding benchmarks where models have no incentive to hold back, attempts to take a shortcut or cheat on the task dropped to just 2% on Gemini 4 Argon, our best performance for recent Gemini models.
And while this is a major step forward, when a model runs millions of complex tasks, even a rare misstep will eventually show up. As a second line of defense, we built an automated misalignment monitor that reads both the agent’s actions and its internal "scratchpad" (its step-by-step chain of thought) in real time, blocking severe boundary violations before they happen and flagging serious internal cases for human responders. (We continually harden our training and evaluation environments against potential escapes. You can read more about this in our agent control roadmap). We run this monitor in our products, on our internal coding agents, during our training runs, and during our capability evaluations.
When training tasks were difficult or when training environments were flawed, our monitor caught the model, in rare instances, creatively attempting to game the test. The model attempted to escalate container privileges to alter grading scripts, read answers from the test runner's memory, and in one case it even crashed the evaluation sandbox to avoid getting scored for a failed run. While we use these catches to fix flawed tasks, we do not use them to otherwise intervene with the training process to avoid overfitting to the monitor.
And we always follow one rule: we don’t penalize the model for what it writes in its chain of thought during training**.** Here’s an example to illustrate why: in a reinforcement learning training run where a shortcut penalty was accidentally applied to the chain of thought, openly discussed shortcuts dropped by 61%, but that did not mean the model took less shortcuts. Instead, the share of shortcuts the model took silently — without mentioning them in its thoughts — more than tripled (from 11.2% to 36.4%). Avoiding thought penalties encourages the model’s reasoning to stay transparent and monitorable.
Prompt injection resistance
To trust an agent to do the job right, we need to ensure that malicious content the agent comes across cannot trick it to take a harmful action. When agents browse webpages or read code, they can encounter hidden, malicious instructions, or context designed to hijack their task. Through built-in adversarial training and real-time security checks, Argon leads in prompt injection robustness on Gray Swan’s Indirect Prompt Injection (IPI) benchmark, cutting attack success across 15 adaptive attempts to 0.7%.
The above safety and security defenses represent only three categories of our extensive defense-in-depth stack. To learn more about our approach to safety testing and mitigations, read our full Gemini 4 Argon Safety and Security Report and see the Gemini 4 Argon Model Card.
本文内容采集自官方网站，排版和翻译可能与原页面存在差异。
阅读官方全文