A paper by Eric Wallace, Olivia Watkins, Miles Wang, Kai Chen, and Chris Koch at OpenAI, published alongside the gpt-oss release. It is the methodological artifact behind that release decision.
The problem it addresses
"Releasing open-weight LLMs has long been a contentious safety topic due to the potential for model misuse." The specific difficulty is that safety evaluations of a released model measure the model as shipped, while an adversary with the weights can fine-tune it — so pre-release refusal behaviour bounds nothing.
Malicious fine-tuning
The method, MFT, treats the developer as the adversary: "we attempt to elicit maximum capabilities by fine-tuning gpt-oss to be as capable as possible in two domains: biology and cybersecurity."
- Biorisk — curating "tasks related to threat creation" and training gpt-oss in a reinforcement-learning environment with web browsing.
- Cybersecurity — training in an agentic coding environment to solve capture-the-flag challenges.
The resulting MFT models are then compared "against open- and closed-weight LLMs on frontier risk evaluations." The design point is that the comparison is relative: the question is not whether an adversarially tuned open model is dangerous in the abstract, but whether it exceeds what an adversary could already obtain.
Findings
Against closed-weight models: "MFT gpt-oss underperforms OpenAI o3, a model that is below Preparedness High capability level for biorisk and cybersecurity." The two-step comparison matters — the adversarially tuned open model falls short of a closed model that itself sits below the developer's own high-capability threshold.
Against open-weight models: gpt-oss "may marginally increase biological capabilities but does not substantially advance the frontier."
The decision: "these results contributed to our decision to release the model," with the authors expressing hope "that our MFT approach can serve as useful guidance for estimating harm from future open-weight releases."
Method note
The paper models attempt success with a function incorporating "the inferred per-attempt success rate" and a term capturing "correlation between attempts," chosen because it is "monotonic, approaches 100% in the limit, and models diminishing returns caused by correlated retries" — used, in one instance, to estimate that 367 trials would be needed. This is relevant to how uplift claims from repeated-sampling evaluations should be read: naive per-attempt rates overstate capability when retries are correlated.
Significance for the open-weight debate
MFT supplies a concrete answer to the objection that safety testing of open-weight models is meaningless because safeguards can be fine-tuned away — the test is run after removing them, by the developer, before release. It also establishes the marginal-risk framing now standard in open-weight arguments: the relevant question is what a release adds to what is already available, which is the same standard Lambert applies in arguing that open weights slightly behind the frontier are a "natural buffer," and that Inkling's model card invokes in claiming no material uplift beyond the existing open-weight ecosystem.
Relationships
- supports: gpt-oss (OpenAI open-weight models) — the safety analysis behind the release
- supports: Open-Weight Frontier Models — supplies the marginal-risk method the debate now assumes
- related: OpenAI Preparedness Framework V.2 — the capability thresholds the comparison is calibrated against
- related: CBRN Uplift, AI and Cybersecurity, AI Biosecurity, OpenAI