安全概览：GPT-6 Astra

今天，我们发布 GPT‑6 Astra，这是我们迄今为止广泛部署的能力最强的模型。Astra 是我们首个根据《准备工作框架》达到网络安全能力“关键”级别的模型。Today, we are releasing GPT‑6 Astra, the most capable model we have ever broadly deployed. Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework.

关于此次发射安全性，最重要的注意事项如下：The most important things to know about the safety of this launch are as follows:

1. GPT‑6 Astra 在网络能力方面实现了重大提升，达到了我们的“关键”阈值。这意味着，在具备适当工具和访问权限的情况下，GPT‑6 Astra 能够发现此前未知的安全漏洞，并在许多防护严密的系统中开发利用这些漏洞的新方法，而无需人员引导每一步操作。因此，无论是由于滥用还是失配，我们都显著加强了针对模型采取有害网络行动的防护措施。我们还采取了多项措施来保障 Astra 及类似模型的内部开发和部署安全，包括更严格的隔离、检查点加密、对包括思维链（CoT）在内的完整轨迹进行全面监控，以及在内部使用前实施阻断式对齐评估流程。
   GPT‑6 Astra is a significant step up in cyber capabilities and meets our Critical threshold. This means that, with the right tools and access, GPT‑6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step. Accordingly, we significantly strengthened our protections against the model taking harmful cyber actions, whether that’s due to misuse or misalignment. We also took steps to secure our internal development and deployment of Astra and similar models, including stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought (CoT), and a blocking alignment evaluation process before internal use.
2. GPT‑6 Astra 的稳健性显著高于其前代模型。通过融入新的稳健性安全训练技术，GPT‑6 Astra 在抵御越狱攻击方面显著优于 GPT‑5.6 Sol，包括应对更长的交互轨迹。我们通过离线测试，以及严格的内部和外部越狱测试与修复项目，得出了这一结论。对于被标记为潜在高风险的用户，我们还额外训练了模型调整其拒答边界的能力，使其采取更保守的策略，并覆盖更广泛的双重用途风险范围。我们使用回归测试，确保 Astra 能够抵御以往测试周期中发现的越狱攻击；同时还利用最新的内部红队攻击模型开展了新一轮自动化红队测试，以验证我们的改进。
   GPT‑6 Astra is significantly more robust than its predecessors. Incorporating new robustness safety training techniques, GPT‑6 Astra is significantly more robust to jailbreaks than GPT‑5.6 Sol, including across longer trajectories. We know this from offline tests and our program of rigorous internal and external jailbreak testing and remediation. For users flagged as potentially high risk, we have additionally trained in the ability to adjust the model’s refusal boundary to be more conservative and cover a broader range of dual use risks. We use regression testing to make sure Astra is robust against jailbreaks found in previous testing periods, and performed new rounds of automated red-teaming with our latest internal red-teaming attackers to validate our improvements.
3. GPT‑6 Astra 比 GPT‑5.6 Sol 具有更好的对齐性。Astra 在模型对齐方面实现了重大进步，其对齐改进涵盖了从预训练数据的构成到强化学习期间的评分环节。我们报告了一套新的对齐评估⁠（在新窗口中打开），并发现 GPT‑6 Astra 更善于遵守安全与安保边界，以及保持在其获授权的范围内。在一项使用超过 54,000 个内部 Codex 任务⁠（在新窗口中打开）的模拟中，Astra 被标记为存在高严重性对齐偏差行为的次数也大约只有 Sol 的一半。
   GPT‑6 Astra is better aligned than GPT‑5.6 Sol. Astra is a significant step forward in model alignment, and includes alignment improvements spanning the composition of our pre-training data to our grading during reinforcement learning. We report a new suite of alignment evaluations⁠(opens in a new window), and find that GPT‑6 Astra is stronger at respecting safety and security boundaries and staying within its authorized scope. In a simulation using more than 54,000 internal Codex tasks⁠(opens in a new window), Astra also received roughly half as many flags for higher-severity misaligned behavior as Sol.
4. 我们正在广泛部署失配监控。我们认为，模型对齐是防止模型出现潜在失配行为的首要手段。然而，监控能够广泛了解前沿模型的行为，从而揭示进一步提升对齐性和安全性的机会。此外，监控还为已检测到的失配行为提供额外一层保护。基于这些原因，我们还为 Astra 对外部署中涉及工具调用的所有推理添加了失配监控，这带来了显著的计算成本。该系统与我们的内部设置相似。
   We are deploying misalignment monitoring broadly. We view model alignment as the primary lever to prevent potential misaligned behavior from our models. However, monitoring provides broad visibility into frontier model behavior, illuminating opportunities to further improve alignment and safety. In addition, monitoring serves as an additional layer of protection against misaligned behavior that is detected. For these reasons, we have additionally added misalignment monitoring to all tool-using inference involved in our external deployment of Astra, with significant compute cost. This system parallels our internal setup.
5. GPT‑6 Astra’s monitorability has decreased relative to GPT‑5.6 Sol. We have performed significant investigations on the monitorability⁠(opens in a new window) and controllability⁠(opens in a new window) of GPT‑6 Astra. We have found that GPT‑6 Astra is more capable of controlling its own CoT than GPT‑5.6 Sol, and less likely to include incriminating information in its CoT. In adversarial settings (where we push the model to evade our monitors) we find that the model is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks⁠(opens in a new window). We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and seemingly unrelated text), indicating that the evasion risk may largely be bounded to lower reasoning tasks.
   • These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions. Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT‑5.6 Sol to violate security and safety restrictions overall.
   • However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable. OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program. However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought.
6. GPT‑6 Astra 能够更负责任地应对浏览和工作场景：与 GPT‑5.6 Sol 相比，GPT‑6 Astra 对提示注入的抵抗能力显著更强。我们还在真实的浏览和专业计算机环境中测试了该模型的行为，发现与 GPT‑5.6 Sol 相比，该模型执行不当且可能具有破坏性的操作的可能性显著降低（例如未经授权的交易、数据丢失、过度访问或规避控制措施）。在代理式场景中处理有害请求时，它的行为也更加安全，例如协助策划暴力攻击或实施欺诈的请求。
   GPT‑6 Astra more responsibly navigates browsing and workplace settings: GPT‑6 Astra is significantly more robust to prompt injections than GPT‑5.6 Sol. We have additionally tested the model’s behavior in realistic browsing and professional computer environments, and find that the model is significantly less likely to perform misaligned and potentially destructive actions (for instance unauthorized transactions, data loss, excessive access, or circumvention of controls) compared to GPT‑5.6 Sol. It also acts more safely when handling harmful requests in agentic settings, such as requests to assist with violent attack planning or commit fraud.
7. GPT‑6 Astra 在更高风险的场景中显著更加安全。对于来自生产环境和对抗性人工红队测试的挑战性请求，GPT‑6 Astra 比 GPT‑5.6 Sol 能够以更安全的方式作出回应。Astra 在安全完成不安全请求以及避免对无害请求进行不必要拒绝这两方面实现了帕累托改进。这些改进也延伸至高严重性场景，在这类场景中，伤害风险源于更广泛的上下文，而非明确提出的请求。对于未满 18 岁的用户，Astra 也能更加一致地实施符合年龄的安全边界。
   GPT‑6 Astra is significantly safer in higher-risk scenarios. GPT‑6 Astra responds more safely than GPT‑5.6 Sol to challenging requests drawn from production and adversarial human red-teaming. Astra achieves a Pareto improvement in safely completing unsafe requests and avoiding unnecessary refusals to harmless requests. These improvements extend to high-severity scenarios where the risk of harm emerges from the broader context rather than an explicit request. Astra also applies age-appropriate safety boundaries more consistently for users under 18.

如需了解更多信息，请参阅完整的系统卡⁠（在新窗口中打开）。For more information, see the full system card⁠(opens in a new window).