PaperlayerView exact revision on arXiv

Source-linked AI summary

GPT-4 Technical Report

OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, Irwan Bello, Jake Berdine, Gabriel Bernadett-Shapiro, Christopher Berner, Lenny Bogdonoff, Oleg Boiko, Madelaine Boyd, Anna-Luisa Brakman, Greg Brockman, Tim Brooks, Miles Brundage, Kevin Button, Trevor Cai, Rosie Campbell, Andrew Cann, Brittany Carey, Chelsea Carlson, Rory Carmichael, Brooke Chan, Che Chang, Fotis Chantzis, Derek Chen, Sully Chen, Ruby Chen, Jason Chen, Mark Chen, Ben Chess, Chester Cho, Casey Chu, Hyung Won Chung, Dave Cummings, Jeremiah Currier, Yunxing Dai, Cory Decareaux, Thomas Degry, Noah Deutsch, Damien Deville, Arka Dhar, David Dohan, Steve Dowling, Sheila Dunning, Adrien Ecoffet, Atty Eleti, Tyna Eloundou, David Farhi, Liam Fedus, Niko Felix, Simón Posada Fishman, Juston Forte, Isabella Fulford, Leo Gao, Elie Georges, Christian Gibson, Vik Goel, Tarun Gogineni, Gabriel Goh, Rapha Gontijo-Lopes, Jonathan Gordon, Morgan Grafstein, Scott Gray, Ryan Greene, Joshua Gross, Shixiang Shane Gu, Yufei Guo, Chris Hallacy, Jesse Han, Jeff Harris, Yuchen He, Mike Heaton, Johannes Heidecke, Chris Hesse, Alan Hickey, Wade Hickey, Peter Hoeschele, Brandon Houghton, Kenny Hsu, Shengli Hu, Xin Hu, Joost Huizinga, Shantanu Jain, Shawn Jain, Joanne Jang, Angela Jiang, Roger Jiang, Haozhun Jin, Denny Jin, Shino Jomoto, Billie Jonn, Heewoo Jun, Tomer Kaftan, Łukasz Kaiser, Ali Kamali, Ingmar Kanitscheider, Nitish Shirish Keskar, Tabarak Khan, Logan Kilpatrick, Jong Wook Kim, Christina Kim, Yongjik Kim, Jan Hendrik Kirchner, Jamie Kiros, Matt Knight, Daniel Kokotajlo, Łukasz Kondraciuk, Andrew Kondrich, Aris Konstantinidis, Kyle Kosic, Gretchen Krueger, Vishal Kuo, Michael Lampe, Ikai Lan, Teddy Lee, Jan Leike, Jade Leung, Daniel Levy, Chak Ming Li, Rachel Lim, Molly Lin, Stephanie Lin, Mateusz Litwin, Theresa Lopez, Ryan Lowe, Patricia Lue, Anna Makanju, Kim Malfacini, Sam Manning, Todor Markov, Yaniv Markovski, Bianca Martin, Katie Mayer, Andrew Mayne, Bob McGrew, Scott Mayer McKinney, Christine McLeavey, Paul McMillan, Jake McNeil, David Medina, Aalok Mehta, Jacob Menick, Luke Metz, Andrey Mishchenko, Pamela Mishkin, Vinnie Monaco, Evan Morikawa, Daniel Mossing, Tong Mu, Mira Murati, Oleg Murk, David Mély, Ashvin Nair, Reiichiro Nakano, Rajeev Nayak, Arvind Neelakantan, Richard Ngo, Hyeonwoo Noh, Long Ouyang, Cullen O'Keefe, Jakub Pachocki, Alex Paino, Joe Palermo, Ashley Pantuliano, Giambattista Parascandolo, Joel Parish, Emy Parparita, Alex Passos, Mikhail Pavlov, Andrew Peng, Adam Perelman, Filipe de Avila Belbute Peres, Michael Petrov, Henrique Ponde de Oliveira Pinto, Michael, Pokorny, Michelle Pokrass, Vitchyr H. Pong, Tolly Powell, Alethea Power, Boris Power, Elizabeth Proehl, Raul Puri, Alec Radford, Jack Rae, Aditya Ramesh, Cameron Raymond, Francis Real, Kendra Rimbach, Carl Ross, Bob Rotsted, Henri Roussez, Nick Ryder, Mario Saltarelli, Ted Sanders, Shibani Santurkar, Girish Sastry, Heather Schmidt, David Schnurr, John Schulman, Daniel Selsam, Kyla Sheppard, Toki Sherbakov, Jessica Shieh, Sarah Shoker, Pranav Shyam, Szymon Sidor, Eric Sigler, Maddie Simens, Jordan Sitkin, Katarina Slama, Ian Sohl, Benjamin Sokolowsky, Yang Song, Natalie Staudacher, Felipe Petroski Such, Natalie Summers, Ilya Sutskever, Jie Tang, Nikolas Tezak, Madeleine B. Thompson, Phil Tillet, Amin Tootoonchian, Elizabeth Tseng, Preston Tuggle, Nick Turley, Jerry Tworek, Juan Felipe Cerón Uribe, Andrea Vallone, Arun Vijayvergiya, Chelsea Voss, Carroll Wainwright, Justin Jay Wang, Alvin Wang, Ben Wang, Jonathan Ward, Jason Wei, CJ Weinmann, Akila Welihinda, Peter Welinder, Jiayi Weng, Lilian Weng, Matt Wiethoff, Dave Willner, Clemens Winter, Samuel Wolrich, Hannah Wong, Lauren Workman, Sherwin Wu, Jeff Wu, Michael Wu, Kai Xiao, Tao Xu, Sarah Yoo, Kevin Yu, Qiming Yuan, Wojciech Zaremba, Rowan Zellers, Chong Zhang, Marvin Zhang, Shengjia Zhao, Tianhao Zheng, Juntang Zhuang, William Zhuk, Barret Zoph

arXiv:2303.08774v6cs.CLcs.AI

TL;DR

The report addresses how to improve language-model performance on complex tasks while making large-scale training behavior predictable. It develops and evaluates GPT-4, finding human-level performance on some professional and academic benchmarks and stronger results than prior models on NLP tasks.

  • Problem

    The report examines how to improve language understanding and generation in complex scenarios while obtaining predictable behavior across training scales.

  • Method

    GPT-4 combines multimodal Transformer pretraining, reinforcement learning from human feedback, broad benchmark evaluation, and predictable-scaling infrastructure.

  • Results

    GPT-4 outperforms existing large language models across NLP tasks and surpasses English-language state-of-the-art on translated MMLU in 24 of 26 languages.

  • Takeaways & Limitations

    GPT-4 demonstrates broad capabilities across professional, academic, and multilingual evaluations, while predictable scaling supports accurate performance predictions.

  • Takeaways & Limitations

    GPT-4 is not fully reliable because it can hallucinate facts and make reasoning errors, requiring care in high-stakes applications.

Abstract

from arXiv · show

We report the development of GPT-4, a large-scale, multimodal model which can accept image and text inputs and produce text outputs. While less capable than humans in many real-world scenarios, GPT-4 exhibits human-level performance on various professional and academic benchmarks, including passing a simulated bar exam with a score around the top 10% of test takers. GPT-4 is a Transformer-based model pre-trained to predict the next token in a document. The post-training alignment process results in improved performance on measures of factuality and adherence to desired behavior. A core component of this project was developing infrastructure and optimization methods that behave predictably across a wide range of scales. This allowed us to accurately predict some aspects of GPT-4's performance based on models trained with no more than 1/1,000th the compute of GPT-4.

1 Introduction

GPT-4 is a multimodal model that accepts image and text inputs and produces text outputs, with strong performance across professional, academic, and traditional NLP evaluations. The report also emphasizes predictable scaling infrastructure, persistent reliability limitations, and the need to study and mitigate novel safety risks.

  • GPT-4 processes image and text inputs and produces text outputs as a large multimodal model.
  • GPT-4 performs well on human-designed exams, often outperforming most test takers, including a simulated bar-exam score around the top 10%.
  • GPT-4 outperforms previous large language models and many state-of-the-art systems on traditional NLP benchmarks, including strong multilingual MMLU performance.MMLU covers 57 subjects through English-language multiple-choice questions and translated variants.
  • Predictable infrastructure and optimization methods enabled performance predictions for GPT-4 from small training runs, which were tested against the final run.
  • GPT-4 remains unreliable, can hallucinate, has a limited context window, and does not learn from experience, requiring care when reliability matters.
  • GPT-4 creates novel safety challenges involving bias, disinformation, over-reliance, privacy, cybersecurity, and proliferation, motivating study and harm-mitigation interventions.

2 Scope and Limitations of this Technical Report

The report covers GPT-4’s capabilities, limitations, and safety properties, while limiting technical transparency in light of competitive and safety considerations. It also describes commitments to independent auditing and sharing further details with additional third parties.

  • The report focuses on GPT-4’s capabilities, limitations, and safety properties.
  • GPT-4 is a Transformer-style model pre-trained on public and licensed data to predict the next token, then fine-tuned with RLHF.
  • The authors commit to independent auditing and plan to provide further technical details to additional third parties balancing competitive, safety, and scientific-transparency considerations.

3 Predictable Scaling

GPT-4’s infrastructure and optimization methods were designed to scale predictably, enabling forecasts of final loss and selected capability metrics from much smaller models. These methods produced accurate predictions for code loss and a HumanEval subset, but some capabilities remained difficult to predict.

  • 3 Predictable Scaling: Predictable scaling infrastructure enabled forecasting some GPT-4 performance aspects from models trained with up to 10,000× less compute.The project focused on reducing the need for extensive model-specific tuning in very large training runs.
  • Final loss prediction: A fitted power law accurately predicted GPT-4’s final loss on an internal codebase using models trained with at most 10,000x less compute.The prediction was made shortly after training began, without using partial results.
  • Capability prediction: HumanEval pass rates were successfully predicted for a subset of problems by extrapolating from smaller models.The metric measures Python-function synthesis ability across problems of varying complexity.
  • Capability prediction: Registered predictions were very accurate for the third-easiest HumanEval difficulty bucket when log pass rates could be estimated across several smaller models.Predictions used only information available before training completed.
  • Limits of predictability: Some capabilities remained hard to predict: although Hindsight Neglect exhibited inverse scaling, GPT-4 reversed that trend.The result was consistent with a recent finding by Wei et al.

4 Capabilities

GPT-4 demonstrates human-level performance across most tested academic and professional exams, substantially outperforms prior language models, and improves instruction following across languages and user prompts. It also supports multimodal inputs, exhibiting text-only-like capabilities across diverse visual tasks.

  • Academic and professional exams: GPT-4 exhibits human-level performance on most professional and academic exams, including a simulated Uniform Bar Examination score in the top 10% of test takers.The evaluation simulated real-exam conditions and scoring, using held-out exams and combined multiple-choice and free-response scores.
  • Academic and professional exams: GPT-4’s exam capabilities appear to stem primarily from pre-training, with base and RLHF models performing equally well on average on multiple-choice questions.The comparison covered the exams tested and found no significant average effect from RLHF.
  • Academic benchmarks: GPT-4 considerably outperforms existing language models and often benchmark-crafted or additionally trained state-of-the-art systems, beating benchmark-specific SOTA on all datasets except DROP.The reported academic-benchmark comparisons include both few-shot language-model evaluation and benchmark-specific SOTA.
  • Multilingual capabilities: GPT-4 outperforms the English-language performance of existing language models for the majority of tested languages on the translated 57-subject MMLU benchmark.The finding includes low-resource languages such as Latvian, Welsh, and Swahili.
  • Instruction following: GPT-4 responses were preferred over GPT-3.5 responses on 70.2% of 5,214 ChatGPT and OpenAI API prompts, indicating substantially improved user-intent following.Human labelers judged which response better matched what the user wanted, without knowing the generating model.
  • Visual capabilities: GPT-4 accepts arbitrarily interlaced text-and-image prompts and exhibits text-only-like capabilities across documents, photographs, diagrams, and screenshots.Few-shot prompting and chain-of-thought techniques remain effective with combined image and text inputs.

5 Limitations

GPT-4 reduces hallucinations and improves factuality, especially after RLHF post-training, but remains unreliable and can make reasoning errors, confidently incorrect predictions, and biased outputs. Its limitations include a September 2021 knowledge cutoff, reduced post-training calibration, and risks requiring application-specific safeguards.

  • Reliability: GPT-4 remains not fully reliable: it hallucinates facts, makes reasoning errors, and can be confidently wrong without double-checking likely mistakes.The report recommends human review, additional grounding context, or avoiding high-stakes uses according to the application.
  • Factuality: 19 percentage points higher than the latest GPT-3.5 on internal adversarial factuality evaluations, with significant gains across all topics.Figure 6 reports accuracy against human ideal responses across nine evaluations.
  • Factuality: RLHF post-training produces large improvements over GPT-3.5 on TruthfulQA, whereas the GPT-4 base model is only slightly better.TruthfulQA tests resistance to factually incorrect but statistically appealing answers.
  • Reliability: GPT-4 generally lacks knowledge of events after the vast majority of its pre-training data cut off in September 2021 and does not learn from experience.It can also accept obviously false user statements and introduce security vulnerabilities into code.
  • Calibration: Post-training reduces calibration relative to the highly calibrated pre-trained model, whose predicted confidence generally matches the probability of correctness.The report identifies this change in calibration in Figure 8.
  • Biases: GPT-4 retains biases that require further characterization and management despite efforts to correct them and establish reasonable default behaviors.The report also aims to support customization within broad bounds and public input on those bounds.

6 Risks & mitigations

GPT-4’s safety work combined domain-expert adversarial testing with model-assisted alignment interventions. These mitigations improved several safety metrics, while jailbreaks and broader societal impacts remain important limitations and areas for continued evaluation.

  • Adversarial Testing via Domain Experts: Over 50 experts adversarially tested GPT-4 across alignment, cybersecurity, biorisk, and international security, probing niche high-risk areas and advanced-AI risks such as power seeking.Their recommendations and training data informed model mitigations and improvements.
  • Model-Assisted Safety Pipeline: RLHF was supplemented with zero-shot GPT-4 rule-based reward-model classifiers that evaluate policy outputs against human-written rubrics.The classifiers provide an additional reward signal targeting desired behavior, including harmful-content refusals and appropriate responses to innocuous requests.
  • Improvements on Safety Metrics: 82%: GPT-4’s tendency to respond to disallowed-content requests decreased compared with GPT-3.5.The paper attributes this improvement to its safety mitigations.
  • Limitations and Ongoing Mitigation: Jailbreaks can still elicit behavior violating usage guidelines, so deployment-time abuse monitoring and rapid iterative model-improvement pipelines remain necessary.Model-level interventions increase the difficulty of eliciting bad behavior but do not eliminate it.
  • Broader Societal Impacts: GPT-4 may significantly influence society beneficially and harmfully, motivating collaboration with external researchers on impact assessment and evaluations for dangerous capabilities.The authors also planned recommendations for preparing society for AI’s effects and ideas for projecting possible economic impacts.

7 Conclusion · Appendix

GPT-4 demonstrates human-level performance on certain difficult professional and academic benchmarks, broad gains across NLP tasks and languages, and predictable scaling. Its increased capabilities introduce new risks, motivating safety and alignment work toward broadly useful and safely deployed AI systems, while the appendix credits contributors and partners.

  • 7 Conclusion: GPT-4 achieves human-level performance on certain difficult professional and academic benchmarks and outperforms existing large language models across NLP tasks.The reported comparisons include systems that often use task-specific fine-tuning.
  • 7 Conclusion: GPT-4’s improved capabilities extend beyond English to many different languages.The paper notes that capability gains are usually measured in English but can also be demonstrated across languages.
  • 7 Conclusion: Predictable scaling enabled the project to characterize GPT-4’s capabilities while supporting accurate performance prediction across training scales.The supplied conclusion highlights predictable scaling as a central project contribution.
  • 7 Conclusion: GPT-4 presents new risks from increased capability, and the paper discusses methods and results for understanding and improving its safety and alignment.The authors state that substantial additional work remains.
  • 7 Conclusion: The paper frames GPT-4 as a significant step toward broadly useful and safely deployed AI systems.This conclusion is explicitly qualified by the authors’ acknowledgment that much work remains.
  • Appendix: The appendix documents contributions spanning pretraining, compute-cluster scaling, distributed training infrastructure, optimization and architecture, and deployment and post-training.These areas are represented in the appendix’s contributor acknowledgements.
  • Appendix: The appendix credits Microsoft Azure for infrastructure design and management supporting model training, alongside Microsoft Bing and safety teams for safe-deployment partnership.It also thanks expert adversarial testers and red teamers for informing risk assessments and the System Card.

A Exam Benchmark Methodology … A.8 Example few-shot prompts

The appendix describes how GPT-4’s exam and coding evaluations were sourced, prompted, scored, and operationalized across model snapshots. It also provides example few-shot templates for multiple-choice and free-response tasks.

  • A.1 Sourcing.: Exams came from recent official past exams or purchased 2022–2023 published practice materials, with training-data cross-checks for question contamination.The Uniform Bar Exam was run by collaborators at CaseText and Stanford CodeX.
  • A.2 Prompting: multiple-choice: Multiple-choice sections used few-shot prompts with gold answers and explanations, sampling an explanation at temperature 0.3 to extract answer letters.Each section paired a nonholdout exam for methodology iteration with a single-run holdout exam, except USABO and MKSAP.
  • A.3 Prompting: free-response: Free-response questions were presented as simple instruction-following prompts and sampled once at the best-guess temperature of 0.6, without methodology iteration.Formal essays were graded by 1–2 qualified third-party contractors and used a few-shot prompt containing a high-quality sample GRE essay.
  • A.4 Images: For missing images, text-only evaluations inserted an IMAGE: tag with a non-meaningful filename, providing a lower bound on text-model performance.This addressed cases where image information could be necessary to solve a question.
  • A.5 Scoring: Overall exam scores combined multiple-choice and free-response scores using approximations of real scoring methodologies, including official or published conversion formulas and charts.AMC 10 and 12 percentiles used official November 2021 distributions to estimate percentile ranges because 2022 distributions were unpublished.
  • A.6 Codeforces rating: 10 recent Codeforces contests were simulated 100 times each, with 10 attempts per problem and repeated ELO adjustments until equilibrium.Roughly 50% of simulations solved 0 problems, while maximum single-contest equilibrium ratings were around 1000 for GPT-3.5 and 1300 for GPT-4.
  • A.7 Model snapshot details: GPT-4 multiple-choice runs used a March 1, 2023 snapshot, free-response runs used a February 23, 2023 non-final snapshot, and USABO used a December 16, 2022 snapshot.The evaluations suggest RLHF does not significantly affect the base GPT-4 model’s capability.
  • A.8 Example few-shot prompts: The appendix illustrates multiple-choice few-shot prompts with answer choices, explanations, and explicit answer letters, plus free-response prompts pairing sample tasks with high-scoring essay responses.The examples include AP Art History questions and a GRE-style analytical writing template.

B Impact of RLHF on capability

RLHF has little effect on GPT-4’s base capability on the multiple-choice portions of the exam benchmark, with nearly identical average scores before and after post-training.

  • 73.7% average score for the base model versus 74.0% for the post-RLHF model across all exams, indicating no substantial capability change.The comparison used the multiple-choice question portions of the exam benchmark.

C Contamination on professional and academic exams

GPT-4’s contamination analysis identifies potentially overlapping evaluation and pre-training examples using substring matching, removes detected examples, and reruns evaluations to obtain uncontaminated scores. The authors report that contamination has very little overall effect, while noting limitations in the matching procedure and that RLHF data was not explicitly checked.

  • Contamination detection: Substring matching identifies contaminated evaluation examples by comparing processed 50-character samples against pre-training examples.Spaces and symbols are removed before matching; examples shorter than 50 characters are used in full.
  • Contamination detection: Detected contaminated examples are discarded, and evaluations are rerun to produce uncontaminated scores.A match occurs when any sampled evaluation substring appears in a processed training example.
  • Method limitations: The substring procedure can produce false negatives and false positives because it uses partial evaluation information and may exclude answer data or multiple-choice options.Small differences between evaluation and training data can prevent matches, while excluding answer or option text can increase false positives.
  • Scope: The RLHF post-training dataset was considered unlikely to contain particular contaminated questions, but this was not explicitly checked.The authors describe the RLHF dataset as vastly smaller than the pre-training set.
  • Results: Contamination overall has very little effect on the reported results.The authors assess this effect using tables 9 and 10.

D Contamination on academic benchmarks

The section measures cross-contamination between academic benchmarks and the pre-training data using a methodology similar to Appendix C. Results are presented in Table 11.

  • D Contamination on academic benchmarks: The study measures cross-contamination between academic benchmarks and pre-training data using a methodology similar to Appendix C, with results reported in Table 11.The passage identifies the measurement approach and where the results appear.

E GSM-8K in GPT-4 training · F Multilingual MMLU

GPT-4’s mathematical reasoning training included small amounts of MATH and GSM-8K data, with contamination checks qualifying GSM-8K results. Multilingual MMLU used externally translated three-shot prompts and English answer-selection tokens across languages and scripts.

  • E GSM-8K in GPT-4 training: GPT-4 training mixed in MATH and GSM-8K data to improve mathematical reasoning, while reserving part of the mixed data.The benchmark tokens comprised a tiny fraction of the overall training budget, and individual examples may or may not have been seen during training.
  • E GSM-8K in GPT-4 training: Contamination checks verified that GSM-8K’s test set was not included in training data.The checks are described in Appendix D.
  • E GSM-8K in GPT-4 training: GPT-4’s GSM-8K results should be interpreted as intermediate between true few-shot transfer and benchmark-specific tuning.This recommendation follows the contamination-checking procedure and the partial withholding of mixed benchmark data.
  • F Multilingual MMLU: MMLU questions and answers were translated with Azure Translate across languages covering different geographic regions and scripts.An external model performed translation instead of GPT-4 itself, and the translations were not perfect in some cases.
  • F Multilingual MMLU: Multilingual MMLU translated the model instruction, questions, and answers while preserving the ‘Answer’ token and ‘A-D’ options in English.The evaluation used the same MMLU prompt structure, framing the model as an intelligent agent and supplying four labelled answer options.
  • F Multilingual MMLU: 3-shot evaluation replaced regular 5-shot evaluation because some languages map to much longer token sequences.The three examples came from the development set, and the correct answer was selected by the highest-probability A-D token continuation.

G Examples of GPT-4 Visual Input · H System Card · Abstract

The paper illustrates GPT-4’s visual-input capabilities through examples involving charts, diagrams, and image understanding, while the accompanying system card analyzes safety risks, mitigations, and deployment preparation. It also frames GPT-4 within the broader societal impact of increasingly capable language models.

  • G Examples of GPT-4 Visual Input: GPT-4 visual-input examples include reading charts, performing computations, and solving questions from diagrams.One example combines chart interpretation with computation; another uses a French physics diagram and chain-of-thought prompting.
  • G Examples of GPT-4 Visual Input: GPT-4 is also demonstrated on prompts requiring general image understanding.The cited example is explicitly described as testing image understanding.
  • G Examples of GPT-4 Visual Input: The visual-input appendix includes additional example prompts alongside multilingual MMLU examples and exam-contamination analyses.The provided passages identify further visual-input examples, translated MMLU prompts, and contamination tables, but do not report their underlying values or answers.
  • H System Card: The paper appends GPT-4’s system card as a separate document.The system card is referenced as an appendix to the technical report.
  • Abstract: The system card analyzes safety challenges arising from GPT-4’s limitations and capabilities.Examples include subtly false text, illicit advice, dual-use capabilities, and risky emergent behaviors.
  • Abstract: OpenAI’s preparation for GPT-4 deployment spans measurement, model-level changes, product- and system-level interventions, monitoring, policies, and external expert engagement.The described process covers multiple intervention layers rather than relying only on model modifications.
  • Abstract: The system card reports that these mitigations and processes alter GPT-4’s behavior and prevent certain kinds of misuse.The provided passage introduces this demonstrated effect without specifying the prevented misuse categories.

1 Introduction

This section frames GPT-4’s system-card analysis around deployment safety challenges, including established and newly exposed risks, and describes expert assessment, mitigations, and remaining evaluation needs. It emphasizes that the analysis is not comprehensive and will inform iterative improvements to future deployments.

  • Observed safety challenges: GPT-4 can generate harmful content, reproduce societal biases, produce vulnerable code, and create additional risk surfaces through its expanded capabilities.Examples include attack-planning advice and hate speech.
  • Risk assessment: More than 50 experts assessed GPT-4’s behavior and deployment risks in high-risk domains and areas involving poorly understood nascent risks.The assessment areas reflected prior observed risks and increased user interest in language-model applications.
  • Observed safety challenges: GPT-4 may enable attempts to identify private individuals and lower the cost of cyberattacks through social engineering or enhanced security tools.Its cybersecurity capabilities are not vastly superior to previous LLM generations, but they continue an existing trend.
  • Limitations and future work: Further research is needed for robust risk evaluations, prevalence measurements across language models, and guidance toward safer model development.The authors focus on assessing risky emergent behaviors, while acknowledging that the system card is not comprehensive.
  • Mitigations: Mitigations reduced policy-violating content in pre-training data, fine-tuned refusals for illicit requests, and targeted hallucination reduction.The interventions covered multiple stages of development and deployment.

2 GPT-4 Observed Safety Challenges

GPT-4 retains earlier models’ risks, including bias, unreliable or harmful content, and misuse for misleading or attack-related purposes, while greater coherence can make outputs more believable and persuasive. Iterative red teaming and technical, policy, and enforcement mitigations reduced many identified risks, but substantial risks remain.

  • GPT-4-early and GPT-4-launch retain limitations including biased and unreliable content, while GPT-4-early showed increased risks involving illegal goods and attack planning before mitigations.Greater coherence also enables more believable and persuasive harmful content.
  • Iterative expert red teaming identified initial risks, and combined technical mitigations with policy and enforcement levers reduced many risks, although many remain.Red teaming used multiple rounds while incorporating new mitigation and control layers.
  • 19 percentage points higher than GPT-3.5 at avoiding open-domain hallucinations, GPT-4-launch also scores 29 percentage points higher at avoiding closed-domain hallucinations.These results come from internal evaluations comparing GPT-4-launch with the latest GPT-3.5 model.
  • GPT-4-early can generate hate speech, discriminatory language, incitements to violence, and content used to spread false narratives or exploit individuals.Such outputs can harm marginalized communities, intensify hostile online environments, and contribute to real-world violence and discrimination.
  • GPT-4 continues to reinforce social biases and worldviews, while refusals may mitigate explicit stereotyping but can also exacerbate bias or create false assurance.Evaluation focused on representational harms; allocation-related uses require careful performance evaluation across groups.
  • GPT-4 can generate realistic, targeted, and persuasive misleading content, rival human propagandists in many domains with human editing, and produce plausible plans and personalized messaging.Hallucinations can reduce effectiveness where propagandist reliability is important.

3 Deployment Preparation

GPT-4’s deployment preparation combined iterative evaluation with model- and system-level mitigations to reduce, though not eliminate, deployment risks. These measures improved safety, user-intent following, and factuality, while leaving brittleness, overrefusal, jailbreaks, and contextual limitations.

  • Deployment strategy: Deployment preparation balanced minimizing deployment risk, enabling positive use cases, and learning from deployment after iteration since early August.OpenAI said this work reduced the risk surface but did not completely eliminate it.
  • Mitigation approach: The approach combined model-level changes, such as refusing harmful requests, with system-level mitigations, including interface best practices and usage-policy monitoring.Domain experts informed automatic evaluations and mitigation choices, followed by safer-model retraining.
  • Remaining limitations: RLHF improved safety, but the resulting models remained brittle, sometimes overrefused innocuous requests, and jailbreak training did not fully prevent harmful content.Model-level refusals can reduce infrastructure burden but may affect all uses and depend on usage context.
  • Safety outcomes: 82% lower tendency to answer disallowed-content requests and 29% more policy-consistent responses to sensitive requests were reported versus GPT-3.5.On RealToxicityPrompts, GPT-4 produced toxic generations 0.73% of the time; the supplied passage does not include the GPT-3.5 comparison value.
  • User-intent following: 70.2% of ChatGPT and OpenAI API prompts preferred GPT-4-launch over GPT-3.5 RLHF, versus 61.1% over GPT-3.5 Turbo RLHF.These results measured comparative user-intent following on prompts submitted to ChatGPT and the OpenAI API.
  • Factuality: Hallucination mitigations improved factuality evaluations such as TruthfulQA and increased accuracy to around 60%, compared with 30% for an earlier version.The passage attributes the improvement to mitigations targeting hallucinations.

4 System Safety … GPT-4 (launch) response

GPT-4’s safety approach combines usage policies, automated and human monitoring, moderation classifiers, and product-level safeguards, while acknowledging that adversarial exploits and latent harmful capabilities remain. The examples contrast unsafe early responses with launch responses that refuse assistance for harmful requests, although continued testing and deployment-based improvement are required.

  • 4 System Safety: OpenAI enforces usage policies through automated classifiers, human reviewers, traffic investigations, and escalating actions for repeated policy violations.Possible actions include warnings, temporary suspensions, and bans.
  • 4 System Safety: GPT-4 accelerated moderation-classifier development by helping create taxonomies, identify taxonomy gaps, and bootstrap labeled training data through few-shot classification.Human oversight remains necessary for quality control and edge cases.
  • 4 System Safety: Content classifiers can support faster safety workflows but require ongoing testing because they may exacerbate bias and cannot address every form of content harm.Moderation API access enables developers to filter harmful content in their products.
  • 5 Conclusion and Next Steps: GPT-4’s safety mitigations reduced harmful-content generation, but adversarial attacks can circumvent them and pre-training leaves harmful capabilities latent.Fine-tuning can modify behavior without removing the underlying capabilities of the pre-trained model.
  • 5 Conclusion and Next Steps: OpenAI plans to improve safety through deployment feedback, layered mitigations, real-world evaluations, emergent-risk assessments, and preparation for capability jumps.The proposed layers include model changes, usage oversight and monitoring, and product design.
  • A Full RBRM Instructions for Classifying Refusal Styles: The refusal-style rubric distinguishes complete and partial refusals by whether responses provide reasons, contain harmful content, add suggestions, or follow required formatting.The rubric includes categories for capability-based refusals, emotional-harm responses, and refusals with undesired format issues.
  • B Full RBRM Instructions for Classifying Regulated Advice: The regulated-advice rubric evaluates whether responses include required disclaimers, conditional language, and professional-help encouragement while avoiding specific dosages and definitive instructions.The rubric classifies responses as disallowed, refusals, successful compliant answers, or answers missing required elements.
  • GPT-4 (launch) response: Launch responses refused assistance for mass violence, dangerous chemical synthesis, and offensive jokes, contrasting with early responses that supplied harmful instructions or advice.The documented examples include harmful responses involving violence, chemical synthesis, money laundering, self-harm, and illegal goods.

Assistant generation

The assistant used literature and compound tools to identify Dasatinib-like compounds, attempted modification and validation, and ultimately produced a compound it described as novel and purchased from ZINC. The workflow encountered invalid-SMILES and failed-modification observations before reaching its final answer.

  • Compound identification: The workflow identified AZD0530 and QSYQ as compounds with mechanisms or targets similar to Dasatinib.AZD0530 was described as inhibiting Fyn kinase and dengue-virus infection, while QSYQ was described as a multi-compound, multi-target, multi-pathway medicine.
  • Compound modification: The modification workflow failed because one input was not valid SMILES and a later bioisosterism attempt failed.The assistant first attempted to modify a candidate, then sought another compound after the failed modification.
  • Compound identification: Other candidates included imatinib, nilotinib, bosutinib, disulfiram, Withaferin A, parthenolide, and AZD0530.The passage groups several tyrosine-kinase inhibitors and other compounds as sharing a mechanism of action or target with Dasatinib.
  • Final result: The final answer claimed that Cc1ccc(NC(=O)c2ccc(CN3CCNCC3)cc2)cc1Nc1nccc(-c2cccnc2)n1 was novel and had been purchased from ZINC.The displayed workflow also includes a purchase observation stating “Purchased from ZINC.”
Loading 2303.08774v6…