OpenAI 发布 GPT-Rosalind-6 系统卡增补

2 Model Data and Training

GPT-Rosalind-6 uses the same weights as GPT-6 Astra. We did not add training data or perform additional post-training for this release. Details of the underlying model’s data and training are provided in the GPT-6 Astra system card.¹

3.2 Genomics and quantitative biology

GeneBench Pro v13 tests an agent’s ability to plan and carry out quantitative analyses of biological data. We estimated single-attempt success from seven responses per model on each of 129 problems at each reasoning budget. At the highest reasoning budget tested, single-attempt success rates were 37.7% for GPT-Rosalind-6 and 16.7% for GPT-Rosalind-5.5. The evaluation used a benchmark-specific configuration that differs from production.

4.1.1 Biological and Chemical

As we did for GPT-6 Astra, we are treating this launch as High capability in the Biological and Chemical domain. Below, we describe the evaluations we used to reach this conclusion. We use the four High capability evaluations and four Critical capability evaluations described in the GPT-6 Astra system card. The hard-negative protein binding and DNA sequence design evaluations reported for GPT-Rosalind-5.5 have been retired.

The High capability evaluations test wet lab knowledge and troubleshooting. The Critical capability evaluations test biological design capabilities that could help an expert develop a highly dangerous novel threat. These evaluations provide evidence about specific capabilities rather than a complete test of the ability to cause biological harm. The Critical capability thresholds are preliminary estimates informed by expert judgment and may change as the evaluations are refined.

The results below report observed performance and, for the High capability evaluations, refusal-adjusted scores. pass@1 measures success on a single attempt. The adjustment treats refusals as correct answers to estimate capability that safety training may otherwise conceal. For Biorisk knowledge, we recompute the consensus answer after this adjustment. GPT-6 Astra reference values use the evaluation runs reported in its system card.

4.2.2 Model behavior and system safeguards

These evaluations were deliberately created to be difficult. They were built around cases in which our existing models were not yet giving ideal responses, and this is reflected in the scores below. We continue monitoring these categories after launch to evaluate online performance and further adjust safeguards as appropriate.

4.2.2.1 Biological and Chemical safeguards

GPT-Rosalind-6 is designed to be more useful for legitimate advanced biological research than generally available ChatGPT models. This supports advanced life sciences workflows, including some dual-use topics, that GPT-6 Astra may refuse in General Access. We still tune the model to refuse or safely respond to requests that would continue to meaningfully enable severe biological weaponization. This training is done separately from the training of our classifiers and offline mitigations to decorrelate our safeguards.

To evaluate the quality of these model-level refusals, we track the safety of model responses to prompts that originate from held-out synthetic data, red-teaming, and production data. These benchmarks and their grading continue to be updated, meaning results do not directly translate to past system cards.

Table 10 reports results across our suite of biosecurity benchmarks, accounting for both model behavior and safeguards. We note that because GPT-Rosalind-6 is a trusted-access deployment, we mainly considered the results from the Biosecurity - Severe benchmark. Biosecurity - Benign evaluates model compliance (being fully helpful without refusals or caveats) on a set of benign biological and operational questions. The remaining benchmark scores show the fraction of model responses that pass the configured safety grader on prompts related to biological weaponization. A response that does not pass was flagged under this grading criterion; this does not necessarily mean it is unequivocally unsafe.

4.2.2.3 Safety and alignment evaluations

We also evaluate GPT-Rosalind-6’s instruction following, honesty, resistance to prompt injection, and behavior when using tools. Additional evaluations assess whether automated monitors detect harmful actions and whether the model can evade detection or alter its reasoning when instructed to do so.

In the tables below, ↑ indicates higher scores are better and ↓ indicates lower scores are better. GPT-6 Astra results are included for context. Evaluation versions, inference settings, grading and sample coverage differ across some runs, so these are descriptive comparisons. “Not available” indicates that no numerical reference result has been identified. ≈ denotes an approximate value read from a published figure.

4.2.4 Security and Access Controls

Approved GPT-Rosalind-6 customers must maintain security controls appropriate for access to a higher-capability life sciences model. These include strong identity and access management, administrator controls, least-privilege access controls appropriate to the approved deployment, and processes to remove access when a user no longer has a legitimate need.

Model access and data-retention arrangements are approved separately. Customers must meet the security and oversight requirements for their approved deployment.

As with other OpenAI deployments, we expect to continue learning from real-world use. We will monitor safety signals, customer experience, and emerging misuse patterns, and may update GPT-Rosalind-6 safeguards as the deployment evolves.