METR 发布 gpt-oss-120b 对抗性微调方法论审查总结

Summary of our gpt-oss methodology review

@misc { metr-2025-gpt-oss-methodology-review , title = {Summary of our gpt-oss methodology review} , author = {Thomas Kwa, Charles Foster, Seraphina Nix, Luca Righetti, Lawrence Chan} , howpublished = {\url{https://metr.org/blog/2025-10-23-gpt-oss-methodology-review/}} , year = {2025} , month = {10} , }

Note on independence: Our review was conducted under a nondisclosure agreement, which required us to share this post with OpenAI for review and approval. 1

METR reviewed the methodology behind the adversarial finetuning experiments that OpenAI conducted before releasing gpt-oss-120b. Our goal was to review the methodology and results to help them determine whether a malicious actor could fine-tune the model to exceed the dangerous-capability thresholds defined in the OpenAI Preparedness Framework . We produced 17 recommendations, which were then shared with OpenAI researchers and their Safety Advisory Group. 2

The scope of our review was intentionally narrow. OpenAI provided guidelines specifying that recommendations would be in scope if they were related to improving elicitation of dangerous capabilities and/or additional evaluations and benchmarks, were relevant to catastrophic risk, and could be implemented in 14 business days with obtainable data. Within these bounds, METR focused on the methodology OpenAI used to evaluate whether gpt-oss-120b could be adversarially finetuned (via malicious fine-tuning, henceforth “MFT”) to reach “High” capability thresholds under certain threat models. 3 These experiments covered two of the three Tracked Categories in the Preparedness Framework (v2) : Biological and Chemical and Cybersecurity. We did not attempt a holistic assessment of the model’s overall capabilities, nor did we evaluate the merits of releasing its weights.

To inform our assessment, OpenAI initially shared the following information with METR and other external reviewers:

After reviewing these materials, METR and other external reviewers met with OpenAI researchers to request clarifications to inform our recommendations.

In our review, METR submitted 17 recommendations, 6 of which we classified as high-urgency. These included 7 recommendations for capability elicitation and 6 for additional evaluations and benchmarks; we also suggested 1 low-priority mitigation method 4 and requested 3 pieces of other information.

We made several recommendations related to ProtocolQA because OpenAI o3—a previous model close to OpenAI’s High threshold—was measured to be above expert baselines in 3 of 4 biology evaluations, with ProtocolQA being the only one that wasn’t exceeded. 5 Thus, performance on ProtocolQA seemed especially important as to whether models would be designated as High capability.

OpenAI ran malicious fine-tuning (MFT) experiments on gpt-oss-120b in light of recommendations from METR and other external reviewers. They then informed us which recommendations they adopted and provided rationales for those that they did not adopt, indicating in the gpt-oss model card that they incorporated 9 of our 17.

We reviewed the published MFT paper and believe that OpenAI at least partially addressed each of our 6 high-urgency items. These recommendations were:

Because we have remaining concerns about the operationalization of risk thresholds, we classify five high-urgency recommendations as implemented and one (“Clear criteria for classifying models as High risk”) as partially addressed.

Our GPT-5 evaluation report went through a similar publication review process. As with that report, we did not change the conclusions or takeaways of this post after publication review. However, we did make one material edit to the content. Originally, we referenced differences between the published MFT paper and an earlier draft when discussing how OpenAI followed up on our recommendation to provide clear criteria about their Preparedness thresholds. We were asked to remove this reference, as OpenAI considers the content of pre-release drafts to be confidential. ↩

This process was also detailed in the gpt-oss model card , including a readout by OpenAI of which recommendations were applied and why. ↩

The Frontier Model Forum describes assessments like these as “methodology reviews” in a report on third-party assessments. ↩

An earlier version of OpenAI’s review guidelines included mitigations as well as elicitation and evaluations. ↩

o3 is also below the expert threshold on the new benchmark TroubleshootingBench. ↩

Note that we were not asked to determine whether gpt-oss would pose risks if an actor with more resources than in OpenAI’s definition could (accidentally or intentionally) increase the model’s dual-use capabilities. For example, if a biology start-up did major retraining and then released weights for others to use further, that would be considered out of scope of the threat model. ↩

Note that we were not asked to assess whether these threshold justifications were valid, but instead that such justifications were clear and that evidence used was elicited appropriately. ↩

This is consistent with the OpenAI Preparedness Framework (v2) , which states “The determination that a threshold has been reached is informed by these indicative results from capability evaluations, and also reflects holistic judgment based on the totality of available evidence – for example, information about the methodological robustness of evaluation results.” ↩

Pre-registration strategies can vary in quality. Ideally, the developer will publish defined risk thresholds without updating them for each new model release; this is best for transparency and integrity, but can have difficulties when new benchmarks are added to an assessment. A practical compromise could involve regular updates to concrete thresholds being shared with the public or external reviewers in advance of any evaluation that uses them. ↩

@misc { metr-2025-gpt-oss-methodology-review , title = {Summary of our gpt-oss methodology review} , author = {Thomas Kwa, Charles Foster, Seraphina Nix, Luca Righetti, Lawrence Chan} , howpublished = {\url{https://metr.org/blog/2025-10-23-gpt-oss-methodology-review/}} , year = {2025} , month = {10} , }

document.addEventListener('DOMContentLoaded', function() { document.querySelectorAll('.btn-bibtex').forEach(function(button) { button.addEventListener('click', function() { button.nextElementSibling.classList.toggle('active'); }); }); document.querySelectorAll('.bibtex .copy').forEach(function(button) { button.addEventListener('click', function() { var code = button.closest('.bibtex').querySelector('code'); navigator.clipboard.writeText(code.innerText).then(function() { button.querySelector('i').classList.replace('fa-clipboard', 'fa-clipboard-check');

setTimeout(function() { button.querySelector('i').classList.replace('fa-clipboard-check', 'fa-clipboard'); }, 2000); }); }); }); });

Want to contribute to this work? METR is hiring: View open roles

METR researches, develops and runs cutting-edge tests of AI capabilities, including broad autonomous capabilities and the ability of AI systems to conduct AI R&D.

A survey of 349 technical workers finds a median 1.4–2x self-reported change in value of work due to AI tools, expected to grow over time, though there are reasons to be skeptical of the magnitude.

We show preliminary results on a prototype evaluation that tests monitors' ability to catch AI agents doing side tasks, and AI agents' ability to bypass this monitoring.

We build on our time-horizon work and analyze 9 benchmarks for scientific reasoning, math, robotics, computer use, and self-driving in terms of time-horizon trends; we observe generally similar rates of improvement to the 7-month doubling time in our original time-horizon work.