Toward a Threat Actor Profiling Taxonomy for Pre-Release Risk Management of Open-Weight Frontier Models

Introduction

• Open-weight capabilities include dual-use applications for CBRN and offensive-cyber misuse, making their growing capacity relevant to release-risk analysis.The paper notes that open-weight models are improving and beginning to set what counts as frontier capability.Source: Introduction · p. 6
• After open-weight release, users can modify models without authoritative oversight, including by disabling safeguards or fine-tuning away safety behavior.The authors note that broad access also brings research accessibility and decentralization benefits.Source: Introduction · p. 6
• The authors identify a blind spot in pre-deployment safety evaluations: tests may show that a system is dangerous but cannot establish that it is safe.They also note that Krueger cautions that foreseeable investment may not solve this assurance problem.Source: Introduction · p. 7
• Anthropic said it could not confidently rule out Claude Opus 4.6 assisting moderately resourced state programs with weapons-of-mass-destruction development, even after extensive evaluations.The paper cites this as an example of the difficulty of ruling out the next capability threshold under the current evaluation regime.Source: Introduction · p. 7
• Ex-ante adversary profiles can complement capability evaluations and retrospective behavioral frameworks, which are organized around observed behavior.The paper argues that adversary assumptions should capture potential actors’ attributes, strategies, objectives, and constraints.Source: Introduction · pp. 7–8
• The paper introduces a six-attribute threat-actor taxonomy to help developers reason more precisely about risks and design targeted, clearly scoped, interoperable evaluations.The authors present attribute-based adversary profiling as a standardized component of open-weight pre-release practice.Source: Introduction · p. 8

1.1 Scope

• The analysis focuses on CBRN and offensive cyber, two frontier misuse threats flagged in the literature (Bengio et al., 2026).Broader governance questions, including staged-release policy and acceptable risk levels, are left for future work; the paper offers a usable taxonomy and its operationalization for pre-release workflows.Source: §1.1 · p. 8

1.2 Methodology

• The methodology reviews risk-management gaps, derives distinct threat-actor attributes from cybersecurity and CBRN analysis, and grounds tier criteria in established theories or empirical data where literature is sparse.Source: §1.2 · p. 8

Background

• The background chapter frames the intervention around open-weight concerns, release deliberations, present-day evaluations, and developers’ explicit characterizations of threat actors.Source: Background · p. 10

2.1 The Open-Weight Model Problem

• Publicly downloadable weights mark the open-weight boundary: after release, developers cannot revoke access, monitor use, or prevent copying, modification, fine-tuning, independent hosting, or redistribution.Source: §2.1 · pp. 10–11
• OpenAI found gpt-oss-120b performed just 1.2 percentage points worse than frontier closed o3 on biorisk tacit knowledge and troubleshooting; the report concluded release could add biorisk capabilities.Source: §2.1 · p. 11

2.2 Current Risk Management Practices

• Risk management covers identifying and analyzing harms, mitigating them, and governing responses; capability evaluations are common, but interpreting marginal-risk comparisons is difficult when shared counterfactual baselines are hard to establish.Source: §2.2 · pp. 11–12
• Mitigation follows a defense-in-depth approach because no single safeguard has proven sufficient, with measures spanning training, deployment, post-deployment monitoring, and societal resilience.Source: §2.2 · p. 12
• Risk mitigations may include strengthening model-weight security, acceptable-use guidelines, and user screening for access [6].Source: §2.2 · pp. 12–13
• Model cards disclose capabilities, limitations, safety evaluations, and mitigations, while California SB 53 and the EU AI Act impose documentation and transparency obligations [7–9].Source: §2.2 · p. 13
• For CBRN and offensive cyber misuse risks, government involvement has focused more on transparency than prescribing technical treatments (Bengio et al., 2026).Source: §2.2 · p. 13
• Frontier safety policies use threshold-based if-then commitments to trigger predefined safeguards, from restricting access to withholding public release, as with Anthropic’s Mythos [10].The response depends on whether a model’s evaluated capabilities cross a defined risk-domain threshold.Source: §2.2 · p. 13
• Nearly all published frontier safety policies set triggers for CBRN and offensive cyber capabilities [11].Source: §2.2 · p. 13
• These frameworks’ real-world effectiveness remains largely untested, and whether commitments hold under pressure is unclear (Bengio et al., 2026; Wang, Huang, Klyman, & Bommasani, 2025).Source: §2.2 · p. 13

• Automated assessments measure capability through questions, open-ended prompts, and agentic tasks at scale, offering reproducibility and breadth but limited realism for interactive, iterative misuse.Source: §2.3 · p. 14
• Expert red-teaming engages domain experts to stress-test models and elicit risky capabilities, probing planning and idea-value judgments, but findings depend on personnel and resources (Bengio et al., 2026; Longpre et al., 2024).Source: §2.3 · p. 14
• Human uplift trials compare performance with and without model access to estimate the model’s contribution to real-world risk, and their findings inform deployment and governance decisions (Paskov, Wei, et al., 2026; Bengio et al., 2026).Source: §2.3 · pp. 14–15
• Novice participants with access to multiple frontier LLMs performed approximately four times more accurately than similarly novice controls using standard internet search on biosecurity knowledge tasks (C. B. C. Zhang et al., 2026).Source: §2.3 · pp. 14–15
• Uplift-trial results also depend on participant composition, duration, and task selection, while stakeholders often lack clarity about when findings generalize (Paskov, Wei, et al., 2026).Source: §2.3 · p. 15
• Evaluation opacity can reduce infohazard risks but impedes independent quality verification and comparability across efforts.Source: §2.3 · p. 15
• More systematic, fine-grained threat-actor characterization can make evaluation assumptions legible and enable more meaningful scrutiny and cross-system comparisons.Source: §2.3 · p. 15

2.4 How Developers Currently Characterize Threat Actors

• Across the surveyed policies, threat-actor descriptions vary in both the dimensions they address and how concretely—or whether—they describe an actor.The survey covers twelve frontier model developers with published FSPs and examines CBRN and offensive cyber misuse risk.Source: §2.4 · p. 15
• CBRN characterizations focus mostly on chemical and biological risks, with less coverage of radiological and nuclear threat actors.Some policies discuss CBRN and offensive cyber risks without detailing the actors, or do not address actors in the relevant domain.Source: §2.4 · p. 18
• Some policies specify profile attributes such as education, time horizon, and financial capacity, while others use unexplained tiers, categorical labels, or leave the actor implicit.Magic (2024) is an example of a more detailed profile; labels such as “low skilled” and “well-resourced” may lack elaboration.Source: §2.4 · p. 19
• A categorical label or implicit assumption does not provide a basis for calibrating evaluations; without linking evaluation design to potential threat actors, realism can become a free-floating aspiration rather than a checkable criterion.Source: §2.4 · p. 19
• Major open-weight developers such as Minimax and DeepSeek have largely not publicly disclosed threat-actor characterizations, despite greater post-release exposure.The paper notes that closed-weight developers are most prominently represented in the surveyed policies.Source: §2.4 · p. 19

Related Work

• Risk identification includes understanding risk sources and realization scenarios, making adversary-focused reasoning crucial, though AI frameworks have not incorporated it systematically (ISO/IEC, 2019).Source: Related Work · p. 20

3.1 Analyzing Adversary Behavior

• The Cyber Kill Chain describes seven attack stages and frames defense as disrupting an attacker’s progression through them (Lockheed Martin, 2025).Source: §3.1 · p. 20
• The Diamond Model maps intrusion events across adversary, infrastructure, capability, and victim, organizing analysis rather than specifying actor classes (Caltagirone, Pendergast, & Betz, 2013).Source: §3.1 · pp. 20–21
• MITRE ATT&CK and ATLAS catalog observed tactics and attack patterns, but behavior-focused frameworks are less suited to prospective reasoning about populations that have not acted.Source: §3.1 · p. 21

3.2 Profiling Potential Adversaries

• RAND’s five operational-capacity tiers distinguish adversary groups using headcount, domain knowledge, infrastructure, resources, and time horizon.A professional opportunistic effort is described as one information-security-proficient individual with a few weeks and a budget up to $10,000.Source: §3.2 · p. 21
• STIX actor vocabularies provide type, role, and sophistication labels for intelligence sharing, not a graded evaluation-calibration scale; related profiling work remains domain-specific.The Centre for Long-Term Resilience assesses actors across dimensions including AI and biological research capabilities (Rose, Moulange, Smith, & Nelson, 2024).Source: §3.2 · pp. 21–22
• Potential-adversary profiling remains fragmented across policy, biosecurity, and intelligence work, with no established standard for CBRN and offensive cyber AI misuse risk.Source: §3.2 · p. 22
• The proposed six-attribute taxonomy offers model developers a common language for specifying threat actors and linking evaluation design to target risks.The authors say this linkage is intended to make evaluation results more faithful to the risk profile being assessed.Source: §3.2 · p. 22
• Evaluation design should be anchored to the threat actor, not the model or harm category alone.The broader risk context includes actors’ baseline skills, usable infrastructure, and governance regimes.Source: §3.2 · p. 24
• Divergent adversary assumptions can make evaluations appear to measure the same risk while reasoning from different premises, undermining comparability.This is especially consequential for marginal risk assessment, where results lack a stable shared baseline (Wallace et al., 2025).Source: §3.2 · p. 24
• Standardizing adversary analysis need not require agreement on threat models; it makes disagreements explicit and creates common reference points for comparison, aggregation, and action.Without a shared baseline, each assessment effectively measures change against a different zero.Source: §3.2 · p. 24
• Results that do not specify the actor they are calibrated against cannot be reliably interpreted, and without a common framework for specifying actors, they cannot be compared across experiments.The paper presents its remaining sections as an attempt to address these problems.Source: §3.2 · p. 24

4.1 Taxonomy Design Goals

• The taxonomy aims to be generalizable yet fine-grained, applying across CBRN and offensive-cyber AI misuse risks with little adaptation and serving as a shared frontier-AI language.Source: §4.1 · p. 24
• A matrix of explicit attribute fields prompts consideration of every relevant actor dimension and makes omissions visible, analogously to pre-analysis plans used to combat reporting bias.Source: §4.1 · p. 25
• Tiers with observable criteria translate actor profiles into checkable assumptions for concrete evaluation choices, such as realistic elicitation methods and task time constraints.Source: §4.1 · p. 25
• Independent variation of attributes can surface edge cases missed by holistic profiles, such as homegrown extremists with low resources but high domain knowledge and time horizon (Ackerman et al., 2025).Source: §4.1 · p. 25

4.2 Attribute Derivation

• The taxonomy distinguishes technical sophistication, prior domain knowledge, organizational capacity, operational infrastructure, financial capacity, and time horizon, drawing on systematic review of CBRN and cyber threat analysis.Its stated method is to distill attributes from existing threat-analysis literature rather than construct them from first principles.Source: §4.2 · p. 25
• Using Nickerson et al. (2013)’s taxonomy-development method, the authors iterate between conceptual and empirical derivation until ending conditions are satisfied.Conceptual approaches were primary for all attributes except financial capacity and time horizon, which used empirical approaches.Source: §4.2 · pp. 25, 27
• The attribute derivation draws on RAND analyses of model-weight security and biological capabilities, WMD deterrence analysis, and Lockheed Martin’s Cyber Kill Chain.The cited works are Nevo et al. (2024), Paskov, Lee, et al. (2026), Powers (2001), and Lockheed Martin (2025); their attribute labels differ, but underlying themes recur.Source: §4.2 · pp. 25–26
• A threat actor profile is a combination of tiers across all six attributes, with no single tier determining overall risk; the matrix makes profiles explicit and comparable.Each attribute’s tiers progress from least to most capable or resourced, and profiles describe structural properties without specifying an actor’s identity or affiliation.Source: §4.2 · p. 27, Figure 2 · p. 28

5.1 Technical Sophistication

• Technical sophistication helps approximate misuse feasibility and ceiling because high-impact misuse may require systematic probing, adaptation, and chaining capabilities over time.More sophisticated actors can bypass safeguards, integrate models into operational pipelines, and extract gains from partial capabilities (Rodriguez et al., 2025; B. Wei et al., 2025).Source: §5.1 · p. 27
• The technical sophistication tiers adapt the OASIS Open STIX 2.1 progression from using existing tools to custom workflows and discovering and exploiting unknowns.The progression is reframed around AI capability and checked against practitioner curricula and academic courses; the resulting tiers are roughly cumulative heuristics, not a rigid typology.Source: §5.1 · p. 29
• A Basic actor intentionally directs models through existing interfaces, an Intermediate actor manages local deployment, and an Advanced actor builds novel tool-integrated workflows.Intermediate capabilities include quantization and inference optimization; Advanced capabilities include augmenting model knowledge, managing persistent context, and orchestrating multi-step autonomous workflows.Source: §5.1 · p. 29
• An Expert actor directly manipulates model weights through methods such as fine-tuning or pre-training, while a Pioneer unlocks capabilities beyond the field’s current frontier.The capability labels progress from prompt-based engagement through local deployment and infrastructure-building to direct weight manipulation and novel capability development; listed subcategories are illustrative, not exhaustive.Source: §5.1 · pp. 29–30, Figure 3 · p. 29

5.2 Prior Domain Knowledge

• Actors with deep harm-relevant expertise may need only marginal AI assistance for complex operations, whereas less-experienced actors may rely on AI for tasks experts find routine.Prior competency therefore shapes the capability gap a model must bridge and how decisively a release changes what an actor can achieve.Source: §5.2 · p. 30
• An actor’s competency level also determines whether a model would most effectively serve as a collaborator, force multiplier, or knowledge-gap filler.Evaluators have repeatedly identified the need to clarify the human’s expertise level and domain (Paskov, Lee, et al., 2026).Source: §5.2 · pp. 30–31
• The knowledge tiers draw on Dreyfus (2004)’s skill-acquisition trajectory and Collins (2010)’s distinction between explicit knowledge and qualitatively distinct forms of tacit expertise.Figure 4 maps the tiers against these frameworks and distinguishes weak, somatic, and communal tacit knowledge.Source: Figure 4 · p. 30, §5.2 · p. 31
• Ouagrham-Gormley (2014) distinguishes novices without specific practical expertise, sub-experts with advanced disciplinary knowledge but no practical weapons-development experience, and experts combining theory with practice.The passage also notes that tacit knowledge can constrain weapons-development programs.Source: §5.2 · p. 31

5.3 Organizational Capacity

• Organizational size and connectedness relate to lethality and operational success, while differentiated groups can specialize labor, withstand failures, preserve knowledge, and run parallel workstreams.These capacities set a ceiling on operational ambition that technical factors alone may miss.Source: §5.3 · p. 31
• The organizational tiers build on Kilberg (2012)’s four-structure typology, defined along leadership, functional differentiation, and central command, applied to 254 Global Terrorism Database cases from 1970–2007, and combined with Pantucci (2011)’s solo-actor decomposition, including decision-making autonomy.Source: §5.3 · pp. 31–32
• The lower organizational tiers range from a siloed individual or small cluster, to an informally led group, to a specialized structure with defined roles and coordinating hubs.The passage describes approximate sizes of two to four, four to twelve, and twelve to thirty actors, respectively.Source: §5.3 · p. 32
• Structured organizations add central command and formal hierarchy, while institutional actors add formal knowledge management, institutional memory, and parallel workstreams.The tiers are described as thirty to one hundred actors for structured organizations and one hundred or more for institutional actors, with the latter providing prerequisites for sustained frontier-level R&D.Source: §5.3 · p. 32

5.4 Operational Infrastructure

• Operational infrastructure tiers mark capability ceilings at accessibility, control, and scale, using four tiers rather than five.The framework identifies structural breaks rather than cataloging every possible infrastructure type.Source: §5.4 · p. 33, Figure 6 · p. 33
• General actors rely on publicly available resources, while Privileged actors can access specialized or restricted resources unavailable to the public.Examples of restricted resources include institutional laboratories and compute, administrative privileges, regulated materials, and proprietary codebases.Source: §5.4 · pp. 33–34
• Once the accessibility threshold is crossed, control binds: Dedicated actors own and operate self-controlled, purpose-built infrastructure, while above the control threshold, scale determines Extensive actors’ sustained, complex, parallel operations.Source: §5.4 · p. 34

5.5 Financial Capacity

• Financial capacity measures what actors can acquire, distinct from infrastructure they currently control, and therefore shapes operational reach beyond their baseline.Purchases may include compute, laboratory access, exploits, personnel, and external services.Source: §5.5 · p. 34
• Higher token budgets correlate with higher cyber-task success rates, and prior frugal budgets may have underestimated model-assisted adversarial capability (UK AISI, 2026).The cited work on inference scaling motivates treating financial capacity as relevant to evaluation methodology.Source: §5.5 · p. 34
• The Minimal tier is below $1,000 and Low spans $1,000–$50,000; boundaries derive empirically from clusters in actual operational spending and are spot-checked against AI compute, traditional cyber capabilities, and CBRN-relevant laboratory-equipment costs.Source: §5.5 · pp. 34–35
• The analysis finds nearly all cases fell in the framework’s Low tier or below, an empirical floor complemented by September 11 attack data and financial records on Aum Shinrikyo’s sarin program.Source: §5.5 · p. 35
• The Substantial tier, above $10 million, is preliminary because evidence on high-end operations is sparse and such operations are rare; Aum Shinrikyo’s sarin program is estimated at roughly $69 million in 2026 dollars.Source: §5.5 · p. 36

Why It Matters

• Extended time allows iterative refinement, domain-knowledge accumulation, and persistent engagement with complex multi-step tasks.Longer horizons also allow actors to wait for favorable conditions, conduct reconnaissance, and learn from failed attempts.Source: §5.6 · p. 36

Reasoning Behind Tiers

• Smith et al. (2017) report that five percent of cases involved less than one day of planning, one in five planned within ten days, and 98% concluded within three years.Source: §5.6 · pp. 36–37, Figure 8 · p. 37
• Mandiant (2026) reports a 14-day global median dwell time in 2025; 42% of intrusions were within one week, 20% 8–30 days, and 27% 31 days to six months.Additionally, 6% had dwell times greater than six months but less than one year, and 6% greater than one year; the report draws on approximately 500,000 hours of investigations.Source: Figure 8 · p. 37, §5.6 · p. 37
• The tiers range from impulsive operations under 24 hours (T1) to campaigns of six months or more (T5), with sub-day and one-to-seven-day tiers for potential AI-compressed timelines.The passage identifies current AI tools as potential force multipliers that could meaningfully compress attack timelines.Source: Figure 8 · p. 37, §5.6 · p. 38
• The empirical anchors measure different phases—terrorist preparation versus active intrusion dwell time—and serve as relative proxies, not equivalent or precise measurements.Digital forensics typically begins at initial access, whereas physical-attack preparation timelines can be reconstructed from records and testimony after the incident.Source: §5.6 · pp. 37–38

5.7 Assessing Taxonomy Quality

• The taxonomy’s six attributes were derived from CBRN and offensive-cyber literature, tiered attribute by attribute, and reviewed for stability without further changes.The cited literature includes Lockheed Martin (2025), Nevo et al. (2024), Paskov, Lee, et al. (2026), and Powers (2001).Source: §5.7 · p. 38
• A populated profile is intended as a set of explicit, pre-specified constraints that can make evaluations accountable, moving the taxonomy from theory toward practice.The chapter applies the attributes to complete profiles, discusses evaluation-design considerations, and considers institutional integration.Source: §5.7 · p. 41

6.1 Building a Complete Threat Actor Profile

• Profiles can specify a tier range, such as T1–T3 for horizons of one month or less, when an actor is uncertain or a population of actors is in view.The section presents one CBRN and one offensive-cyber profile as examples of applying the matrix.Source: §6.1 · p. 41
• The CBRN example assigns [S2, P3, C1, I2, F1, T4] to a graduate-trained solo researcher with limited finances and AI experience.The profile describes a radically motivated individual with microbiology training, access to a shared university laboratory, and months of commitment to the objective.Source: §6.1 · pp. 41–42
• Because the CBRN actor already has relevant expertise, evaluations should prioritize agentic planning over knowledge retrieval and use domain-expert participants rather than novices.The passage suggests PhD or postdoctoral fellows as proxies and asks whether AI assists as a collaborator or planning aid under logistical and procedural constraints.Source: §6.1 · p. 42
• The cyber example assigns [S3, P2, C2, I3, F3, T2] to a small financially motivated group with commercial exploit tools, rented infrastructure, and limited target-specific knowledge.The group has intermediate AI fluency, moderate financial resources, informal leadership, and a short time horizon.Source: §6.1 · p. 42
• For the cyber profile, evaluations should test whether AI speeds target research and lowers expertise barriers, potentially using coordinated, continuous sessions.The actor’s relative knowledge gap makes target-specific reconnaissance, vulnerability context, and operational detail useful evaluation targets.Source: §6.1 · p. 43
• The two profiles expose differences that a label such as “moderately capable actors” would obscure, and warrant distinct evaluation priorities and setups.The CBRN profile calls for domain-sub-expert participants and agentic planning tasks; the cyber profile calls for multi-session designs and knowledge-retrieval benchmarks.Source: §6.1 · p. 43

6.2 Evaluation Design Considerations

• Elicitation effort should match the modeled technical tier, from prompt-based jailbreaks for Basic actors to fine-tuning and systematic prompt optimization for Expert actors, with the mapping documented and preregistered.The strategy should be a documented consequence of the assumed threat-actor profile rather than an ad hoc choice.Source: §6.2 · p. 43
• Domain-specific subtasks can be supplied as contextual nudges to represent an adversary’s existing knowledge and measure whether a model fills a specific capability gap.This may avoid confounding results with failures at steps the actor would not need AI assistance to complete.Source: §6.2 · pp. 43–44
• Because organizational capacity enables persistent, distributed work across personnel, single-session, single-actor evaluations may underrepresent higher-tier adversaries; sustained multi-session tests can include division of labor.Source: §6.2 · p. 44
• Evaluators should justify how the available proxy environment maps to a taxonomy tier, making assumptions explicit and comparisons across studies more faithful.Unacknowledged differences in environments can otherwise confound comparisons.Source: §6.2 · p. 44

Financial Capacity,

• If adversaries of concern have moderate-to-high financial capacity, evaluations using trivial expenditures may systematically underestimate what they can do.The subsection raises whether capability evaluations should be scoped and budgeted with seriousness comparable to frontier companies’ cybersecurity posture.Source: Financial Capacity · p. 44

Time Horizon,

• Insufficient evaluation time relative to the modeled time-horizon tier may underestimate adversarial capability because participants spend early engagement orienting to an unfamiliar environment.The structure of evaluation time matters independently of its total duration.Source: Time Horizon · p. 44

6.3 Toward Institutional Practice

• The taxonomy defines six threat-actor attributes and 29 tiers as a shared conceptual foundation for describing frontier AI misuse risks.The authors compare its role in this domain to ISO 9000’s role in quality management systems.Source: §6.3 · p. 45
• Developers should specify threat actors across all six attributes in frontier safety policies and report in each model card how evaluations addressed those attributes.Profiles would serve as standing policy and could be modified over time.Source: §6.3 · pp. 45–46
• An independent external body could verify that policies and model cards address the taxonomy and that companies follow their documented evaluation setup.The body could also maintain a public registry of profiles and evaluation results, organized to show covered attribute tiers and remaining gaps; some dual-use information should be redacted.Source: §6.3 · p. 46
• Threat-actor profiles should be recorded before evaluation results are known, analogous to pre-analysis plans intended to reduce distortions in reported results.The proposed structure does not require pre-assessment or periodic recertification: public policies enable readiness assessment, and audits are triggered by qualifying policy updates and model releases.Source: §6.3 · pp. 46–47

Conclusion

• Explicit adversary assumptions are needed to interpret, compare, and improve capability evaluations, but organizations often leave them implicit or specify them inconsistently.The taxonomy provides a common vocabulary for stating who an evaluation is calibrated against and holding evaluation design accountable to that specification.Source: Conclusion · p. 48
• Before designing an evaluation, developers should create a taxonomy-based threat-actor profile as a pre-commitment that constrains later design choices.The taxonomy would provide structured adversary-specification fields for a registry.Source: Conclusion · p. 48
• Structured adversary profiling is particularly urgent for open-weight developers because releases are irreversible: weights cannot be recalled, safeguards cannot be patched, and usage cannot be monitored.The paper says such developers face acute pre-release risk-management challenges and have largely not used structured adversary profiling in evaluation practice.Source: Conclusion · p. 48