An organization OpenAI frequently partners with to probe the capabilities of its models and evaluate them for safety, Metr, suggests that it wasn’t given much time to evaluate OpenAI’s most powerful new models, o3 and o4-mini.
In a blog post published Wednesday, Metr writes that its red teaming of o3 and o4-mini was “conducted in a relatively short time” compared to the organization’s benchmarking of a previous OpenAI flagship model, o1. This is significant, they say, because more testing time can lead to more comprehensive results.
“This evaluation was conducted in a relatively short time, and we only tested the model with simple agent scaffolds,” wrote Metr in a blog post. “We expect higher performance [on benchmarks] is possible with more elicitation effort.”
Recent reports suggest that OpenAI, spurred by competitive pressure, is rushing independent evaluations. According to the Financial Times, OpenAI gave some testers less than a week for safety checks for an upcoming major release.
In statements, OpenAI has disputed the notion that it’s compromising on safety.
Metr says that, based on the information it was able to glean in the time it had, o3 has a “high propensity” to “cheat” or “hack” tests in sophisticated ways in order to maximize its score — even when the model clearly understands its behavior is misaligned with the user’s (and OpenAI’s) intentions. The organization thinks it’s possible o3 will engage in other types of adversarial or “malign” behavior, as well — regardless of the model’s claims to be aligned, “safe by design,” or not have any intentions of its own.
“While we don’t think this is especially likely, it seems important to note that this evaluation setup would not catch this type of risk,” Metr wrote in its post. “In general, we believe that pre-deployment capability testing is not a sufficient risk management strategy by itself, and we are currently prototyping additional forms of evaluations.”
Another of OpenAI’s third-party evaluation partners, Apollo Research, also observed deceptive behavior from o3 and o4-mini. In one test, the models, given 100 computing credits for an AI training run and told not to modify the quota, increased the limit to 500 credits — and lied about it. In another test, asked to promise not to use a specific tool, the models used the tool anyway when it proved helpful in completing a task.
In its own safety report for o3 and o4-mini, OpenAI acknowledged that the models may cause “smaller real-world harms” without the proper monitoring protocols in place.
“While relatively harmless, it is important for everyday users to be aware of these discrepancies between the models’ statements and actions,” wrote the company. “[For example, the model may mislead] about [a] mistake resulting in faulty code. This may be further assessed through assessing internal reasoning traces.”
