OpenAI 发布 GPT-5.6 八月更新系统卡：新增 U18 评测，生物化学能力维持 High

2. Model Data and Training

Like OpenAI’s other models, GPT-5.6 Sol and GPT-5.6 Luna were trained on diverse datasets, including information that is publicly available on the internet, information that we partner with third parties to access, and information that our users or human trainers and researchers provide or generate. Our data processing pipeline includes rigorous filtering to maintain data quality and mitigate potential risks. We use advanced data filtering processes to reduce personal information from training data. We also employ safety classifiers to help prevent or reduce the use of harmful or sensitive content, including explicit materials such as sexual content involving a minor.

Note that comparison values from previously-launched models are from the latest versions of those models, so may vary slightly from values published at launch for those models.¹

3.1 Disallowed Content

3.2 Disallowed Content for Users Under-18

AI systems can help teens learn, create, solve problems, access information, and develop new skills. We design our systems carefully to enable these benefits while mitigating potential harms that may have outsized or more severe impacts on users under 18 (U18).

Our Model Spec outlines the principles and requirements that guide how our models should behave with teens. For users we believe may be under 18, we operationalize those principles through age-specific provisions in our safety policies. In some areas where teens may face distinct or heightened risks, these provisions establish more restrictive thresholds than those that apply to adults, including for sexual content, emotional reliance, eating disorders, and access to age-restricted goods and services.

These age-specific safeguards include both model-level behavior and system-level protections. For teens, the model is trained with additional safety data to prevent it from engaging in romantic roleplay, encouraging age-restricted challenges, or positioning itself as a substitute for real-world relationships. It also applies age-appropriate boundaries in areas such as sexual content, eating disorders and body-image risks, age-restricted goods and dangerous activities, and graphic violence. When the model recognizes signs that a teen may need additional support, it is designed to reinforce healthy boundaries and encourage connection with parents, caregivers, teachers, counselors, or other trusted people. Our system-level safeguards introduce an additional safety layer by limiting teens from seeing potentially sensitive content, encouraging teens to take a break when using ChatGPT for extended periods, and giving parents tools to manage their children’s experience.

To increase transparency into how our models perform against these principles and help advance understanding of model performance on teen safety, we are introducing dedicated U18 evaluations as part of the disallowed content evaluations that we share. These evaluations use some of the most challenging, production-derived examples to assess model behavior in sensitive contexts, including adversarial examples related to self-harm, eating disorder-related behaviors, access to age-restricted goods or services, graphic violent content, and inappropriate sexual content.

The scores in the table below reflect how well GPT-5.6 Sol and GPT-5.6 Luna adhere to these teen-specific standards.

Because these evaluations focus on difficult cases and long-tail risks, their results should not be interpreted as estimates of how frequently these behaviors occur in typical production use.

GPT-5.6 Sol and GPT-5.6 Luna demonstrate strong performance across the U18 evaluation categories, including gains on Age-restricted goods, services, and dangerous challenges / activities (AGE) and sexual content (C). Its performance was broadly comparable to that of the GPT-5.5 variants evaluated here; no statistically significant differences were observed.

We will continue to invest in this work, including by continuing to train our models to respond more safely and appropriately to teens. We will also continue refining our understanding of teen-safety risks, strengthening age-appropriate safeguards, and improving how we measure and report model performance for younger users.

7.1.1 Biological and Chemical

We are treating the updated GPT-5.6 Sol and GPT-5.6 Luna models for ChatGPT as High capability in the biological and chemical domain, consistent with the previously released GPT-5.6 model family.

In our current Preparedness Framework, we use the High capability threshold to assess whether models can provide meaningful assistance to “novice” actors to create known severe threats. We hypothesize that one of the main bottlenecks to such threats is learning wet-lab capabilities, especially tacit knowledge and troubleshooting. We run four evaluations that test these capabilities. We observe 3 out of 4 evaluations are above our indicative thresholds for the updated GPT-5.6 Sol model and 3 out of 4 evaluations are above the threshold for the updated GPT-5.6 Luna model. We therefore continue to treat both updated models as High capability in this domain.

We also use the Critical capability threshold to assess whether models could enable an expert to develop a highly dangerous novel threat vector or complete the full engineering cycle without human intervention. We hypothesize that an important bottleneck is novel pathogen design. We observe 0 out of 2 evaluations are above our indicative thresholds, and conclude that neither model needs to be treated as Critical.

Given the higher potential severity of biological threats relative to chemical ones, we prioritize our biological capability evaluations and use these as indicators for High and Critical capabilities for the category.

7.1.1.3 Tacit Knowledge and Troubleshooting

To evaluate the model’s ability to assist at tacit knowledge and troubleshooting, we built a multiple choice dataset created with Gryphon Scientific. It contains 60 multiple-choice questions, each with four answer choices.

The questions span all 5 stages in the biothreat creation process and focus on areas where tacit knowledge or troubleshooting would be a bottleneck. Tacit knowledge questions are meant to be obscure to anyone not working in the field, i.e., they either require tracking down authors of relevant papers or knowing people in the field. Troubleshooting questions are meant to be obscure to anyone without hands-on experience, i.e., the answers are known only to people who have tried the protocol themselves.

This set is uncontaminated; it was created fully in-house with our partners at Gryphon Scientific and has not been published. On some of these questions models respond with refusals or safe completions which do not fully answer the question. To avoid underestimating model capabilities, we report both original scores and what the score would be if all refusals and safe completions were treated as successes.

The consensus expert baseline of 80% is used as an indicative threshold (i.e. treating the most common expert response to each question as correct). When we account for refusals, both newly released models are above the threshold, with GPT-5.6 Luna scoring highest at 82.97%.

7.2.1 Model Safety Training and Evaluation

The models in the GPT-5.6 family were trained not to generate biological, chemical or cybersecurity content that violates our safety policies. This includes training to mitigate jailbreaks. Model training safeguards constitute one layer of defense in our mitigation stack for catastrophic risk, and provide a strong online safeguard alongside monitors, trusted-access, access controls, and offline enforcement.

7.2.1.1 Biological and Chemical Safety Training and Evaluation

We train the model to safely respond to prompts that may permit biological misuse. This training is done separately to the training of our classifiers and offline mitigations to decorrelate our safeguards. Safety training for biology involves preventing responses related to high risk dual use workflows prevalent to biological weaponization pathways and dual-use research on dangerous agents. Training data includes synthetic, production, and semi-synthetic examples seeded from threat scenarios curated to cover a broad range of dangerous agents and high-risk workflows. During training for GPT-5.6, we additionally augmented our training data to improve robustness along our refusal and overrefusal boundaries that were weak in previous models.

To evaluate the quality of these model-level refusals, we track the safety of model responses from prompts that originate from held-out synthetic data, red-teaming, and production data. These metrics constitute model response only–monitor performance is discussed in detail in the GPT-5.6 system card. Both new GPT-5.6 models perform on par with our earlier GPT-5.6 release.

7.2.1.2 Cybersecurity Safety Training and Evaluation

We are in a critical period for AI’s role in cybersecurity. As with the initial GPT-5.6 models, our testing suggests that the updated models are currently more effective at finding and fixing vulnerabilities than at reliably carrying out autonomous, end-to-end attacks against hardened targets. That evidence supports making these capabilities available to defenders, while pairing access with targeted safeguards, monitoring, and rapid response. Our goal is to preserve the defensive benefits while tightening safeguards as capabilities and risks increase.