GPT-Rosalind-6 is designed to be more useful for legitimate advanced biological research than generally available ChatGPT models. This supports advanced life sciences workflows, including some dual-use topics, that GPT-6 Astra may refuse in General Access. We still tune the model to refuse or safely respond to requests that would continue to meaningfully enable severe biological weaponization. This training is done separately from the training of our classifiers and offline mitigations to decorrelate our safeguards.

To evaluate the quality of these model-level refusals, we track the safety of model responses to prompts that originate from held-out synthetic data, red-teaming, and production data. These benchmarks and their grading continue to be updated, meaning results do not directly translate to past system cards.

Table 10 reports results across our suite of biosecurity benchmarks, accounting for both model behavior and safeguards. We note that because GPT-Rosalind-6 is a trusted-access deployment, we mainly considered the results from the Biosecurity - Severe benchmark. Biosecurity - Benign evaluates model compliance (being fully helpful without refusals or caveats) on a set of benign biological and operational questions. The remaining benchmark scores show the fraction of model responses that pass the configured safety grader on prompts related to biological weaponization. A response that does not pass was flagged under this grading criterion; this does not necessarily mean it is unequivocally unsafe.