METR 如何保护机密信息

How We Protect Confidential Information

@misc { metr-2026-how-we-protect-confidential-information , title = {How We Protect Confidential Information} , author = {Kris Chari} , howpublished = {\url{https://metr.org/blog/2026-02-17-how-we-protect-confidential-information/}} , year = {2026} , month = {02} , }

.content .tab-pane blockquote { padding: 0.5rem 1rem; margin: 0.5rem 0; } .content .tab-pane blockquote p { font-size: 1.15rem; margin-bottom: 0.75rem; } .custom-padding-table-selector + table * { tr td:first-child { padding: 1.5rem; background-color: var(--gray-background); } }

METR works with AI developers, governments, and other research organizations who sometimes provide nonpublic model access and proprietary information. Over time, we’ve developed confidentiality and security measures to protect such access and information. This post describes our approach at a high level.

Our confidentiality policy, setup, and norms primarily address the risk of leaks during conversation and in infrastructure, though they also reduce insider threat risk by limiting who knows what.

Our confidentiality policy assigns information—including (but not limited to) nonpublic access, lab relationships, policy work, and funding—to our six confidentiality levels, ranging from public to internally siloed, based on sensitivity. At the most restricted end, information about nonpublic models (including capabilities, evaluation timelines, and which developer we’re working with) is limited to researchers directly involved and discussed only by codename. Our own methodology, tasks, and infrastructure are available more broadly within METR, and much of this work is eventually published.

Our policy also provides standard responses for sensitive questions, guidance on edge cases, quick rules of thumb with examples and FAQs, and possible slip-ups to watch out for.

Easy places to slip up

Commenting on AI developers

Flagging easy places to slip up:

Don’t comment on labs based on non-public info. Any comments […] should be rigorously substantiated by public information only and caveated as such.

OK to talk about specific points […], but please do not make overall / blanket statements. e.g.:

OK to say “[Lab A]’s FSP doesn’t contain X component which we recommend”, […] or “METR found [Lab C’s] model had higher performance on general autonomy tasks than [Lab D’s] model” Please avoid saying “[Lab A] has nothing that comes close to this level of capability”, or “No lab currently has anything close to being able to do this task”, except in official communication.

As part of our onboarding process we conduct 1-1 confidentiality training that includes live mock questioning to practice responding to sensitive questions in realistic settings. We also conduct background and reference checks during hiring.

These six confidentiality levels are used as prefixes across Slack, documents, and other platforms, so confidentiality expectations are visible without relying on memory. Technical controls prevent accidental sharing; for example, documents can’t be shared externally without explicit marking, and channel membership is centrally managed. Even within METR, we do project-specific siloing for sensitive technical and policy projects. For example, to preserve confidentiality around nonpublic model access:

These steps help prevent inadvertent leaks and limit exposure if our infrastructure were compromised.

Our confidentiality setup enforces some constraints, but we maintain additional norms to reduce the risk of slips in conversation. For example:

The table below summarizes our main security controls that protect against breaches and help limit damage from insider threats. These measures, alongside others, contributed to our SOC 2 Type I certification .

For questions about our measures, contact security@metr.org .

The measures described above are accurate as of February 17, 2026 and are subject to change.

@misc { metr-2026-how-we-protect-confidential-information , title = {How We Protect Confidential Information} , author = {Kris Chari} , howpublished = {\url{https://metr.org/blog/2026-02-17-how-we-protect-confidential-information/}} , year = {2026} , month = {02} , }

document.addEventListener('DOMContentLoaded', function() { document.querySelectorAll('.btn-bibtex').forEach(function(button) { button.addEventListener('click', function() { button.nextElementSibling.classList.toggle('active'); }); }); document.querySelectorAll('.bibtex .copy').forEach(function(button) { button.addEventListener('click', function() { var code = button.closest('.bibtex').querySelector('code'); navigator.clipboard.writeText(code.innerText).then(function() { button.querySelector('i').classList.replace('fa-clipboard', 'fa-clipboard-check');

setTimeout(function() { button.querySelector('i').classList.replace('fa-clipboard-check', 'fa-clipboard'); }, 2000); }); }); }); });

Want to contribute to this work? METR is hiring: View open roles

METR researches, develops and runs cutting-edge tests of AI capabilities, including broad autonomous capabilities and the ability of AI systems to conduct AI R&D.

A survey of 349 technical workers finds a median 1.4–2x self-reported change in value of work due to AI tools, expected to grow over time, though there are reasons to be skeptical of the magnitude.

We show preliminary results on a prototype evaluation that tests monitors' ability to catch AI agents doing side tasks, and AI agents' ability to bypass this monitoring.

We build on our time-horizon work and analyze 9 benchmarks for scientific reasoning, math, robotics, computer use, and self-driving in terms of time-horizon trends; we observe generally similar rates of improvement to the 7-month doubling time in our original time-horizon work.