LearnPython

OpenAI Preparedness Framework and DeepMind Frontier Safety Framework

OpenAI Preparedness Framework v2 (April 2025) adds Research Categories, separate from Tracked Categories: Long-range Autonomy, Sandbagging, Autonomous Replication and Adaptation, Undermining Safeguards. Tracked Categories trigger Capabilities Reports plus Safeguards Reports, reviewed by the Safety Advisory Group. DeepMind's FSF v3 (September 2025, with Tracked Capability Levels added April 17, 2026) folds autonomy into the ML R&D and Cyber domains, where ML R&D autonomy level 1 means fully automating the AI R&D pipeline at competitive cost vs human + AI tools. FSF v3 also addresses deceptive alignment through automated monitoring for instrumental-reasoning misuse. The honest caveat: Research Categories in PF v2, Long-range Autonomy included, do not automatically trigger mitigations, since the policy language is "potential." DeepMind itself says automated monitoring "will not remain sufficient long-term" if instrumental reasoning strengthens.

TIME: ~45 minutesPREREQUISITES: Phase 15 · 19 (Anthropic RSP)

Learning Objectives

Explain how OpenAI's Preparedness Framework v2 separates Tracked Categories from Research Categories, and what each one triggers.
Describe how DeepMind's Frontier Safety Framework v3 folds autonomy into the ML R&D and Cyber domains instead of naming it separately.
Compare how the three labs classify one capability by running and extending the cross-policy diff tool.
Apply the policy-reading steps (locate, classify, cadence, independence) to judge what a lab's framework commits it to.

The Problem

Lesson 19 read Anthropic's scaling policy closely. This lesson reads OpenAI's and DeepMind's. The three documents are cousins answering the same question: when should a frontier lab pause or gate a model?

They converge on a small set of categories. The three label long-range autonomy as a capability class worth tracking, treat deceptive behavior (alignment faking, sandbagging) as its own class of risk, and have an internal review body. Where they split is on what a label does. OpenAI divides categories into "Tracked" (mandatory mitigation) and "Research" (no automatic trigger). DeepMind folds autonomy into two domains instead of naming it separately. The bucket names vary too (Tracked vs Research, Critical vs Moderate, Tier-1 vs Tier-2), and which bucket a capability lands in has a different operational consequence at each lab.

So read them side by side. The same capability can demand mitigation at Anthropic, be monitored without triggering anything at OpenAI, and be tracked inside a specific domain at DeepMind. The posture a policy takes matters as much as the list of risks it names.

Warm-up0/2

1. Which commitment from Anthropic's 2023 RSP did RSP v3.0 remove?Warm-up

Schematic; no policy text is shown. The date comes from the lesson's diff tool.

2. A security measure appears in the industry-wide recommendations column of RSP v3.0's two-tier schedule. How should you read it?Warm-up

A two-column table. The right column header reads industry-wide recommendations and holds one box labelled a security measure. The left column is unnamed and its rows are not shown. A question mark asks how to read the measure. — Schematic of the schedule layout; no real measures are listed.

Check: The Problem0/1

1. Why is comparing only the lists of risks the three labs name a poor way to compare their policies?Explain

Schematic; list contents are not shown.

The Concept

OpenAI Preparedness Framework v2 (April 2025)

Structure:

Tracked Categories: trigger Capabilities Reports (what the model can do) plus Safeguards Reports (what mitigations are in place). Reviewed by the Safety Advisory Group before deployment.
Research Categories: model capabilities the lab is tracking but not yet committing to specific mitigations. Includes Long-range Autonomy, Sandbagging, Autonomous Replication and Adaptation, Undermining Safeguards.

Key framing in v2: Research Categories do not automatically trigger mitigations. The policy language is "potential" mitigations. This is the specific delta to watch: a category's location in Tracked vs Research is the hinge between "gated" and "observed."

DeepMind Frontier Safety Framework v3 (September 2025; Tracked Capability Levels added April 17, 2026)

Structure:

Critical Capability Levels (CCLs): capability thresholds across five domains: Cyber, Bio, ML R&D, CBRN, Autonomy (folded into ML R&D and Cyber).
Tracked Capability Levels: additional granularity added in April 2026. Concrete example: ML R&D autonomy level 1 = fully automate the AI R&D pipeline at competitive cost vs human + AI tools.
Deceptive alignment monitoring: explicit commitment to automated monitoring for instrumental-reasoning misuse.

The autonomy framing differs from OpenAI's. DeepMind does not keep "Autonomy" as a top-level domain; it is folded into the domains where autonomy would cause harm (ML R&D and Cyber). The argument is that autonomy without a domain is capability without risk; the counter-argument is that autonomy across domains is a meta-risk the framework should name.

What all three converge on

Internal Safety Advisory Group (named Anthropic SAG, OpenAI SAG, DeepMind internal committee). Review before deployment for high-capability models.
Explicit mention of deceptive alignment / alignment faking as a risk class.
Standing artifacts on a declared cadence (Anthropic: Frontier Safety Roadmap, Risk Report; OpenAI: Capabilities and Safeguards Reports; DeepMind: FSF update cycle).
Acknowledgement that monitoring-only defenses have a ceiling. DeepMind is explicit: "automated monitoring will not remain sufficient long-term."

Where they diverge

Anthropic: pause commitment removed in v3.0; AI R&D-4 threshold is the named next gate.
OpenAI: Tracked vs Research split; Research Categories (including Long-range Autonomy) do not automatically gate.
DeepMind: autonomy folded into other domains; Tracked Capability Levels add granularity in April 2026.

Sandbagging: a specific capability that complicates all three

Sandbagging (a model strategically underperforming on evaluations) is in OpenAI's Research Categories. Anthropic's RSP v3.0 addresses it via the evaluation-context gap (Lesson 1). DeepMind addresses it via deceptive alignment monitoring in FSF v3.

If a model sandbags on evaluations, every framework's capability thresholds are underestimated. A framework is only as good as its measurement. This is why external measurement (Lesson 21, METR) and adversarial evaluation are necessary in addition to lab self-assessment.

The policy-reading skill

Locate: a capability you care about should be findable in the policy. If you can't find it, the policy does not cover it.
Classify: is it Tracked (triggers mitigation) or Research (tracked but not triggering)? OpenAI names this; Anthropic and DeepMind have their own equivalents.
Cadence: is the policy updated on a declared schedule, or only after specific events? Declared cadence is stronger.
Independence: is external review mandatory or optional? Anthropic partners with Apollo and US AI Safety Institute; OpenAI with METR; DeepMind with internal SAG primarily.

Check: The Concept0/24

1. What is OpenAI's Preparedness Framework v2?Define

Two source cards from the lesson's reading list: OpenAI's Updating our Preparedness Framework announcement and the Preparedness Framework v2 PDF. A question mark asks what the framework is. — Titles copied from the lesson's Sources list.

2. What does it mean for a capability to be a Tracked Category in OpenAI's framework?Define

A table row for an unnamed capability with classification Tracked and a question mark in the column for what it triggers. — Schematic row; no capability is named.

3. Which of these is a Research Category in OpenAI's PF v2?Define

Two empty buckets from OpenAI's Preparedness Framework v2, Tracked Categories and Research Categories, each with a question mark asking which capabilities are inside. — Schematic with the member lists left blank.

4. What is DeepMind's Frontier Safety Framework?Define

A name card reading Frontier Safety Framework, also written FSF, with a note that the lesson mentions it in Key Terms, The Concept and Sources. A question asks what it is and which version the lesson covers. — Name only; no document text is shown.

5. What is a Critical Capability Level (CCL) in DeepMind's framework?Define

Three cards spelling out the abbreviation CCL: Critical, Capability, Level. A question mark asks what a CCL is in DeepMind's framework. — Expansion of the acronym only.

6. What does "ML R&D autonomy level 1" mean in DeepMind's FSF v3 Tracked Capability Levels?Define

A card naming the level ML R&D autonomy level 1 in DeepMind's FSF v3 Tracked Capability Levels. A question mark asks what level 1 means. — Term only; the definition is not shown.

7. What is sandbagging?Define

The seven capability row names from the lesson's main.py as chips, with sandbagging highlighted. A question mark asks what the word describes. — Row names from main.py; no classification is shown.

8. What is instrumental reasoning, the target of DeepMind's automated monitoring?Define

A two-line table entry from DeepMind's table for sandbagging: classification deceptive alignment monitoring, then action automated instrumental-reasoning monitor. A question mark asks what instrumental reasoning is. — Text copied from the lesson's main.py.

9. Which four checks make up the policy-reading skill for comparing scaling policies?Define

A task card about judging what a lab's framework commits it to, above four empty rows labelled Check 1 to Check 4, each with a question mark for the check's name. — Schematic with the four slots left blank.

10. In OpenAI's Preparedness Framework v2, what is the operational difference between a Tracked Category and a Research Category?Explain

A small table with two columns, Tracked Categories and Research Categories, and a row for what a capability in the bucket triggers, with question marks in both cells. — Schematic with the triggers left blank.

11. How does DeepMind's FSF v3 treat autonomy, compared with OpenAI's category list?Explain

Left, OpenAI's category list with Long-range Autonomy highlighted and other entries not shown. Right, a DeepMind FSF v3 card with Autonomy followed by a question mark asking how it appears. — Name from OPENAI_PF_V2 in main.py; DeepMind's treatment is left blank.

12. What reasoning supports DeepMind's choice to fold autonomy into domains instead of naming it separately?Explain

Schematic from the stem; the reasoning is not shown.

13. In OpenAI's Tracked Category process, what do the Capabilities Report and the Safeguards Report each cover?Explain

Three boxes in a row: Capabilities Report, Safeguards Report and Safety Advisory Group review. The two report boxes say covers question mark. — Schematic with report contents left blank.

14. Which set of things do Anthropic, OpenAI, and DeepMind all converge on?Explain

Three overlapping circles labelled Anthropic, OpenAI and DeepMind with a question mark in the region shared by all three. — Schematic with the shared region left blank.

15. What does DeepMind say about automated monitoring for instrumental-reasoning misuse?Explain

Schematic; the quote is not shown.

16. Why does sandbagging complicate all three frameworks?Explain

A five-box pipeline: Model, Evaluation, Measured capability, Threshold check, Gate. A red tag reading model sandbags here points at the Evaluation box. — Schematic pipeline; no numbers.

17. In the policy-reading skill, what does the Cadence check ask?Explain

A single row for the Cadence check from the policy-reading skill, with a question mark asking what it checks. — Check name only; its question is hidden.

18. In the policy-reading skill, what does the Independence check ask?Explain

A single row for the Independence check from the policy-reading skill, with a question mark asking what it checks. — Check name only; its question is hidden.

19. A lab's safety case says its new model is within policy. The framework lists Long-range Autonomy only as a Research Category, and the model shows strong long-range autonomy in testing. What can you conclude?Analyze

A claim card saying the new model is within policy, above two cards: the framework lists Long-range Autonomy only as a Research Category, and testing shows the model has strong long-range autonomy. A question mark asks what can be concluded. — Schematic of the stem's facts.

20. A lab reports that its new model sits below every capability threshold, but an outside adversarial evaluation later elicits much higher capability. Which risk best explains the gap?Analyze

A bar chart with a dashed threshold line. The lab's own evaluation bar sits below the line. The outside adversarial evaluation bar rises well above it. Heights are illustrative. — Illustrative heights; the stem gives no figures.

21. What is the strongest objection to folding autonomy into the domains where it causes harm?Analyze

Two cards. The first is headed argument for folding and says the lesson states it. The second is headed strongest objection and holds a question mark. — Argument text and objection are both left out.

22. A lab's only defense against deceptive behavior is automated monitoring, and its models' instrumental reasoning keeps getting stronger. Which shared acknowledgement applies?Analyze

Four bars labelled model 1 to model 4 that grow taller, showing instrumental reasoning getting stronger. Below, a box reads only defense: automated monitoring. A question asks which shared acknowledgement applies. — Illustrative bar heights; no units.

23. You write policy at a lab with an OpenAI-style framework and want long-range autonomy to trigger reports and review before deployment, not only to be observed. What change achieves that?Design

Schematic from the stem.

24. You are drafting a lab's scaling policy and want a reader who applies the lesson's four checks to rate it strong. Which design does that?Design

A scorecard with four rows, Check 1 to Check 4, each reading your draft earns followed by a question mark. — Schematic; ratings are blank.

Use It

code/main.py implements a small decision-table diff tool. Given a capability (long-range autonomy, sandbagging, autonomous replication, undermining safeguards, R&D automation, cyber uplift, or bio uplift), it outputs how each of the three policies classifies the capability, and what mitigations trigger. It's a reading aid, not a policy tool.

Check: Use It0/9

1. What does diff("long_range_autonomy") print as the OpenAI policy's classification and action?Apply

A terminal running diff for long_range_autonomy. The heading and the OpenAI policy name are printed; the OpenAI classification and action lines show question marks. A note says the Anthropic and DeepMind blocks follow. — Output of the lesson's main.py with the OpenAI classification and action replaced by question marks and later blocks omitted. Version dates left out. The rule of dashes is shortened.

2. What does diff("rnd_automation") print as the DeepMind FSF v3 classification?Apply

A terminal running diff for rnd_automation. The heading and the DeepMind policy name are printed; the DeepMind classification and action lines show question marks. A note says the OpenAI and Anthropic blocks come first. — Output of the lesson's main.py with the DeepMind classification and action replaced by question marks, other blocks omitted and the version date left out. The rule of dashes is shortened.

3. What does the headline block of main.py say about long-range autonomy at the three labs?Apply

The end of main.py's output: a HEADLINE line whose text is a question mark, then Long-range Autonomy with three bullets for OpenAI, Anthropic and DeepMind whose values are question marks. — Output of the lesson's main.py with the headline text and the three values replaced by question marks. The rule of dashes is shortened.

4. A reader calls diff("cyber_uplift"), which main never calls. What do OpenAI and Anthropic print as the classification?Apply

A terminal running diff for cyber_uplift. The OpenAI and Anthropic blocks show question marks for classification and action. A note says the DeepMind block follows. — Output of the lesson's main.py with the OpenAI and Anthropic classification and action lines replaced by question marks, the DeepMind block omitted and version dates left out. The rule of dashes is shortened.

5. What does diff("deceptive_planning") print for each of the three policies?Apply

A terminal that calls diff with deceptive_planning. The heading and the OpenAI policy name are printed; the OpenAI classification and action show question marks. A note says the other two policy blocks follow. — The terminal is typed from the call, with question marks for the output and the version date left out.

6. After running main.py, which two rows of the policy tables never appear in a per-capability block?Apply

Seven chips naming the rows of the policy tables, from long_range_autonomy to bio_uplift, with a question asking which two rows get no per-capability block in main.py's output. — Row names from OPENAI_PF_V2 in main.py.

7. Under OpenAI's table, a model is judged to have R&D automation. What does the table say follows?Apply

A one-line dict entry from OpenAI's table for rnd_automation with question marks in place of the classification and the action. The question asks what follows. — The key is taken from main.py; both values are hidden.

8. The diff tool's output for one capability disagrees with the policy PDF. What is the most likely explanation and fix?Analyze

Two cards separated by a not-equal sign: a policy PDF that says X and the diff tool's output that prints Y for one capability. A question asks for the likely explanation and the fix. — Schematic; X and Y stand for any one disagreeing cell.

9. You add a new capability, "persuasion", to the diff tool. What must you do for the output to compare all three policies instead of printing "not in table"?Design

A terminal running diff for persuasion. All three policy blocks print classification not in table. — Captured by running the lesson's main.py. Action lines and version dates left out. The rule of dashes is shortened.

Ship It

outputs/skill-cross-policy-diff.md produces a cross-policy comparison for a specific capability, using the three frameworks as reference.

Author's Note

I'd run main.py before reading any of the policies. It prints a side-by-side diff for five capabilities, and the headline block at the end is the part to stare at: long-range autonomy and undermining safeguards get three different classifications from the three labs. A table makes the divergence much easier to see than three PDFs do.

I'd also be careful with what the tables are. They are three hand-written dicts, one per policy, each mapping a capability to a classification and an action. They are my distillation, labeled illustrative in the source, and not a parse of the documents. If you disagree with a cell, edit the dict and rerun. Capabilities with no entry come back as "not in table", which is the same Locate step from the policy-reading list, just automated.

The script only prints five of the seven rows it holds. cyber_uplift and bio_uplift are in the tables but main never calls diff on them, so call it yourself to see them. Before trusting any cell, check it against the source text, as the first exercise asks. Policies get revised, and a table I wrote once will drift from them.

Exercises

Run code/main.py. Confirm the diff tool's output matches the policies for at least two capabilities you can verify against the source documents.
Read OpenAI Preparedness Framework v2 in full. Identify each Research Category. For each, write one sentence on why it is in Research rather than Tracked.
Read DeepMind FSF v3 in full, plus the April 2026 Tracked Capability Levels update. Identify ML R&D autonomy level 1's specific evaluation criteria. How would you measure it externally?
Sandbagging is in OpenAI's Research Categories. Design an evaluation that would force a sandbagging model to reveal its actual capability. Reference the Lesson 1 eval-context-gaming discussion.
Compare the three policies on a specific capability (your choice). Name which policy's classification you find most rigorous and which least. Justify with source text.

Key Terms

Term	What people say	What it actually means
Preparedness Framework	"OpenAI's scaling policy"	PF v2 (April 2025); Tracked vs Research categories
Tracked Category	"Mandatory mitigation"	Triggers Capabilities + Safeguards Reports; SAG review
Research Category	"Monitored only"	Tracked but no automatic mitigation; includes Long-range Autonomy
Frontier Safety Framework	"DeepMind's scaling policy"	FSF v3 (Sept 2025) + Tracked Capability Levels (Apr 2026)
CCL	"Critical Capability Level"	DeepMind threshold per domain (Cyber, Bio, ML R&D, CBRN)
ML R&D autonomy level 1	"R&D automation"	Fully automate AI R&D pipeline at competitive cost
Sandbagging	"Strategic underperformance"	Model underperforms on evals; in OpenAI Research Categories
Instrumental reasoning	"Means-ends reasoning"	Reasoning about how to achieve goals; target of DeepMind monitoring