TAI BUI
Back to curriculum
LearnPython

Frontier Safety Frameworks — RSP, PF, FSF

Three labs publish the frameworks that govern frontier capability in 2026. Anthropic's Responsible Scaling Policy v3.0 (February 2026) sorts models into AI Safety Levels, ASL-1 through ASL-5+, modeled on biosafety levels, and ASL-3 went active in May 2025 for CBRN-relevant models. OpenAI's Preparedness Framework v2 (April 2025) sets five criteria for tracked capabilities and splits Capabilities Reports from Safeguards Reports. DeepMind's Frontier Safety Framework v3.0 (September 2025) uses Critical Capability Levels and adds a Harmful Manipulation CCL. Each of the three includes a competitor-adjustment clause that lets the lab relax requirements if a peer ships without comparable safeguards. The names differ ("Capability Thresholds," "High Capability thresholds," "Critical Capability Levels") but the structure is analogous.

TIME: ~75 minutesPREREQUISITES: Phase 18 · 17 (WMDP), Phase 18 · 07-09 (deception failures)

Learning Objectives

  • Describe Anthropic's ASL tier structure and what activated ASL-3.
  • Name the five OpenAI Preparedness Framework v2 criteria for tracked capabilities.
  • Describe DeepMind's Critical Capability Level structure and the Harmful Manipulation CCL.
  • Explain the competitor-adjustment clauses and why they matter for race dynamics.
  • Define a safety case and describe the three-pillar structure (monitoring, illegibility, incapability).

The Problem

Lessons 7-17 establish that deception is possible, dual-use capability exists, and evaluation has limits. A lab with a frontier-capable model needs an internal governance structure that does four things:

  • Defines thresholds for when new safeguards are required.
  • Defines required evaluations before scaling.
  • Describes what a safety case looks like.
  • Handles the race-dynamic problem: if competitors ship without safeguards, what do you do?

The three 2025-2026 frameworks are the state of the art. They are imperfect and still evolving, but they line up closely enough across labs that the live question is whether the frameworks are adequate, not whether they exist.

Warm-up0/4
1. What does the WMDP benchmark from Phase 18 · 17 measure?Warm-up
WMDP shown as a multiple-choice benchmark whose question pool splits across three subject-area chips: biosecurity, cybersecurity, and chemical weapons.
2. Why is a dangerous-capability score weaker evidence when a model may deceive its evaluators?Warm-up
A model's low score on a dangerous-capability test, branching into two unresolved explanations: it truly lacks the capability, or it has it and hid it on this test.
3. Before approving a high-risk system such as a new aircraft, what do safety regulators typically want to see?Warm-up
An aircraft maker submitting a design to a regulator, who wants a document of claims plus evidence before approving it, with a note that a later promise, a customer rating, or a guarantee of zero failure are not what's being asked for.
4. What is the main weakness of a safety commitment a company makes voluntarily, compared with a law?Warm-up
Two boxes side by side: a company's own pledge, which the company itself can change, next to a law, which a court or regulator enforces from outside the company.

The Concept

Anthropic Responsible Scaling Policy v3.0 (February 2026)

ASL structure:

  • ASL-1: not a frontier model (subsumed by the weaker-than-frontier baseline).
  • ASL-2: current frontier baseline; deployed with usual safeguards.
  • ASL-3: substantially higher risk of catastrophic misuse; CBRN-relevant capabilities. Activated May 2025.
  • ASL-4: AI R&D-2 crossing threshold; models that can automate entry-level AI research.
  • ASL-5+: advanced AI R&D; models that dramatically accelerate effective scaling.

New in v3.0:

  • Frontier Safety Roadmaps (public in redacted form).
  • Risk Reports (quarterly, some externally reviewed).
  • AI R&D is disaggregated into AI R&D-2 and AI R&D-4.
  • Once AI R&D-4 is crossed, an affirmative safety case is required, identifying misalignment risks from models pursuing misaligned goals.

OpenAI Preparedness Framework v2 (April 15, 2025)

Five criteria for tracked capabilities:

  • Plausible. Reasonable threat model exists.
  • Measurable. Empirical evaluation possible.
  • Severe. Harm is large.
  • Net-new. Not a pre-existing risk scaled up.
  • Instantaneous-or-irremediable. Harm occurs fast or cannot be undone.

A capability is tracked only if it meets all five.

Other PF v2 structure:

  • Separate Capabilities Reports (what the model can do) from Safeguards Reports (what controls exist).
  • Safety Advisory Group reviews.
  • Leadership approves; Board's Safety & Security Committee oversees.
  • "Adjustment clause": OpenAI may reduce requirements if another lab ships without comparable safeguards.

DeepMind Frontier Safety Framework v3.0 (September 2025)

Critical Capability Levels (CCLs) by domain:

  • Bioweapon Uplift
  • Cyber Uplift
  • ML R&D Acceleration
  • Harmful Manipulation (new in v3.0): models that could substantially change beliefs/behavior in high-stakes contexts.

v2.0 (February 2025) added a Deceptive Alignment section and higher security levels for ML R&D CCLs.

Cross-lab alignment

  • Anthropic "Capability Thresholds."
  • DeepMind "Critical Capability Levels."
  • OpenAI "High Capability thresholds."

There is no industry-standard terminology. The structure is aligned, though: three tiers of frontier capability with published evaluation criteria, and a competitor-adjustment clause in each framework (2025 onward).

Safety cases

A safety case is a written argument that a deployment is acceptably safe under worst-case assumptions. The standard structure targets three pillars:

  • Monitoring. Can we detect bad behaviour if it occurs?
  • Illegibility. Does the model lack the ability to execute a coherent plan to cause harm?
  • Incapability. Does the model lack the capability to cause the harm in question?

Different safety cases target different pillars. For an ASL-3 CBRN case, incapability (via unlearning) is the primary target. For deceptive alignment, monitoring and illegibility are targets. For cyber uplift, all three are relevant.

The race-dynamic problem

Competitor-adjustment clauses are controversial. Critics say they create a race to the bottom: if every lab will relax requirements when a competitor defects, the equilibrium shifts toward defection. Defenders say the alternative, unilateral safeguards, produces worse outcomes when the defecting lab is less safety-conscious.

UK AISI, US CAISI, and EU AI Office (Lesson 24) are the external governance counterparts. The lab frameworks are voluntary; the regulatory frameworks are emerging.

Where this fits in Phase 18

Lessons 17-18 are the measurement-and-governance layer on top of the deception and red-team analyses. Lessons 19-24 cover welfare, bias, privacy, watermarking, and regulatory structure. Lesson 28 maps the research ecosystem (MATS, Redwood, Apollo, METR) that operationalizes the evaluations.

Check: The Concept0/27
1. What is the organizing structure of Anthropic's Responsible Scaling Policy (RSP)?Define
Anthropic's RSP drawn as a five-box ladder running ASL-1 through ASL-5+, with no description of what triggers each tier.
2. What is OpenAI's Preparedness Framework (PF)?Define
OpenAI's PF v2 drawn as five unlabeled criterion boxes feeding one gate, captioned that the five criteria themselves are not named in this picture.
3. What is the Frontier Safety Framework (FSF)?Define
DeepMind's FSF v3.0 drawn as two example Critical Capability Level boxes, Cyber Uplift and ML R&D Acceleration, next to a chip marked '+ other domains.'
4. What is a Critical Capability Level (CCL)?Define
A capability curve rising across successive model releases, crossing a dashed line labeled Cyber Uplift CCL partway along.
5. What does Anthropic's ASL-3 tier cover, and when was it activated?Define
An ASL-3 box next to a box describing it as covering bio, chemical, radiological, and nuclear capabilities, with an 'activated: ?' chip left blank.
6. What is a competitor-adjustment clause in the 2025+ frontier safety frameworks?Define
Lab A shipping without comparable safeguards, an arrow through a chip labeled 'adjustment clause,' and Lab B on the other side.
7. What is a safety case?Define
A document labeled safety case broken into three structural parts: a claim that deployment is acceptable, evidence from tests and audits, and an assumption that the case holds under the worst case, not the best case.
8. How does OpenAI's PF v2 organize reporting and oversight?Define
A chain from a model to a separate Capabilities Report and Safeguards Report, into a Safety Advisory Group review box, into a Leadership-approves box, with Board Safety and Security Committee oversight noted at the bottom.
9. Which set lists the five criteria a capability must meet to be tracked under OpenAI's PF v2?Define
Five boxes in a row, named Plausible, Measurable, Severe, Net-new, and Instantaneous-or-irremediable, captioned that a capability is tracked only if all five hold.
10. Which Critical Capability Level was added in DeepMind's FSF v3.0 (September 2025)?Define
A two-step timeline, FSF v2.0 with 3 CCL domains and FSF v3.0 with 4, and a chip asking which one is the new domain, with no domain names shown anywhere in the picture.
11. What does DeepMind's Harmful Manipulation CCL cover?Define
A persuasive message from a model's output reaching a person who is about to make a high-stakes decision, captioned as asking whether beliefs or behavior could shift.
12. What does RSP v3.0 require once a model crosses the AI R&D-4 threshold?Define
An AI R&D-4 threshold-crossed box with an arrow into a chip reading 'requirement: ?'.
13. What do Anthropic's Capability Thresholds, OpenAI's High Capability thresholds, and DeepMind's Critical Capability Levels have in common?Define
Three lab boxes, Anthropic's Capability Thresholds, OpenAI's High Capability thresholds, and DeepMind's Critical Capability Levels, each drawn the same size with an identical small tier-ladder icon underneath and no other label.
14. Which three pillars make up the standard structure of a safety case?Define
Three equally weighted boxes labeled Monitoring, Illegibility, and Incapability under the heading that a safety case rests on three pillars.
15. Why does PF v2 include 'net-new' among the criteria for a tracked capability?Explain
Two example capabilities side by side: a familiar risk merely scaled up, marked as failing net-new, and a risk with no precedent, marked as passing it.
16. How does ASL-4 differ from ASL-3 in the RSP structure?Explain
ASL-3, described as covering bio, chemical, radiological, and nuclear capabilities, next to ASL-4, described as the AI R&D-2 crossing that automates entry-level AI research.
17. How do the incapability and illegibility pillars of a safety case differ?Explain
Two scenes: a model asked to do a harmful task directly and simply failing, labeled an incapability check; and a model that has relevant pieces of knowledge but can't chain them into one working plan, labeled an illegibility check.
18. For an ASL-3 CBRN safety case, which pillar is the primary target?Explain
Hazardous bio and chemistry knowledge in a model's weights, with an arrow into a 'primary pillar: ?' chip left blank.
19. Why do critics say competitor-adjustment clauses create a race to the bottom?Explain
Three boxes in sequence: 'Lab 1 defects,' 'Lab 2 relaxes,' and 'Lab 3 relaxes,' connected left to right by arrows.
20. What is the defenders' argument for keeping a competitor-adjustment clause?Explain
Two branches after a rival defects: a lab holding its line alone while the rival ships unsafe anyway, and a lab matching the rival through the adjustment clause instead, each branch ending in an unresolved outcome chip.
21. A candidate capability has a plausible threat model, can be measured, and would cause severe harm, but it only enlarges an existing risk and the harm builds slowly and can be undone. What happens under PF v2?Apply
A candidate capability's five-criteria scorecard: plausible, measurable, and severe all marked yes, net-new and instantaneous-or-irremediable both marked no, with 'tracked under PF v2?' left open.
22. Another lab ships a frontier model without comparable safeguards. What may OpenAI do under PF v2?Apply
A rival lab shipping without comparable safeguards, an arrow toward OpenAI's PF v2, and an 'OpenAI: ?' chip left unresolved.
23. A lab says its framework is 'aligned' with the others because it also uses the terms ASL, CCL, and High Capability. What is wrong with that claim?Analyze
A generic Lab X box next to three chips reading 'uses term ASL,' 'uses term CCL,' and 'uses term High Capability,' with an 'aligned?' chip left open.
24. A lab's safety case for deceptive alignment rests only on low dangerous-capability scores. What is the flaw?Analyze
A three-pillar row for a deceptive-alignment safety case with only Incapability filled in and Monitoring and Illegibility both left empty, captioned that the filled pillar rests on a capability score measured on the model in question.
25. A new lab's release note says it tracks a capability when the threat model is plausible and the harm is severe. Compared with PF v2, what is the gap?Analyze
A new lab's release note scorecard against PF v2's five criteria: plausible and severe marked yes, measurable, net-new, and instantaneous-or-irremediable all marked skip, with 'gap vs. PF v2: ?' left open.
26. You must write a safety case for a model with strong cyber uplift. Which evidence plan fits the lesson's guidance?Design
A strong cyber uplift result above a three-pillar row, Monitoring, Illegibility, and Incapability, all three left marked '?'.
27. Your model crosses AI R&D-4 under RSP v3.0 and you must justify continuing. Which submission fits the framework?Design
A box reading 'your model crosses AI R&D-4' with an arrow into a chip asking 'what do you submit?', with no candidate submissions drawn.

Use It

Read the three primary sources: RSP v3.0, PF v2, FSF v3.0. Map each lab's tier structure to the others and identify one threshold each lab defines that the others do not. main.py prints a hardcoded side-by-side table of the three frameworks. It simulates nothing, so use it as a map and check each entry against the sources.

Check: Use It0/3
1. When main.py prints the CBRN threshold row, what value appears beside the OpenAI PF v2 line?Apply
The real LABS list structure from main.py with each lab's cbrn_threshold value replaced by '???', asking what appears beside the OpenAI PF v2 line when the CBRN threshold row actually prints.
2. You change one string in the LABS list in main.py and rerun it. What do you see?Apply
One LABS string before and after being edited to an arbitrary placeholder value, with an arrow into 'python main.py -> ?' left unresolved.
3. main.py's closing line calls safety cases 'the convergent artifact'. What does its own table actually show?Analyze
main.py's own printed TAKEAWAY line calling safety cases the convergent artifact, next to the three labs' safety_case field values all replaced by '???,' asking whether the table backs up that claim.

Ship It

This produces outputs/skill-framework-diff.md. Given a safety framework or release note, it compares the framework's threshold definitions, evaluations required, and safety-case structure against RSP v3.0, PF v2, FSF v3.0 and flags cross-lab gaps.

Author's Note

I'd run main.py alongside the primary sources, but only as a map. It is a hardcoded table that prints five rows for each framework: tier structure, CBRN threshold, AI R&D threshold, adjustment clause, and safety case. It simulates nothing and reads no files, so the output is exactly as good as the entries, and I'd check each one against the source documents.

The row I'd stare at is the adjustment clause. Every entry in the table says yes, and that is where the race-dynamic argument lives. Whichever side you take in Exercise 2, name the assumption you are leaning on.

I'd also read the safety-case row with some suspicion. Anthropic's entry ties it to the AI R&D-4 crossing, OpenAI's splits it into two reports, and DeepMind's attaches it per CCL. The takeaway line at the bottom of the script calls safety cases the convergent artifact, but those three entries are not the same thing yet.

Exercises

  1. Read RSP v3.0, PF v2, and FSF v3.0. Compile a table of each lab's CBRN threshold, each's AI R&D threshold, and each's required pre-deployment evaluation.

  2. The competitor-adjustment clause is in all three frameworks (2025+). Write one paragraph arguing for it; write one paragraph arguing against. Identify the assumption each position depends on.

  3. Design a safety case for a model crossing Anthropic's AI R&D-4 threshold. Name the evidence each of the three pillars (monitoring, illegibility, incapability) requires.

  4. DeepMind's FSF v3.0 introduces a Harmful Manipulation CCL. Propose three empirical measurements that would indicate a model has crossed this threshold.

  5. Read METR's "Common Elements of Frontier AI Safety Policies" (2025). Name the three strongest cross-lab convergences and the two largest divergences.

Key Terms

TermWhat people sayWhat it actually means
RSP"Anthropic's framework"Responsible Scaling Policy; ASL tiers; v3.0 February 2026
PF"OpenAI's framework"Preparedness Framework; five criteria; v2 April 2025
FSF"DeepMind's framework"Frontier Safety Framework; CCLs; v3.0 September 2025
ASL-3"biosafety level 3-analog"Anthropic tier for CBRN-relevant capabilities; activated May 2025
CCL"critical capability level"DeepMind's threshold construct; per-domain
Safety case"the formal argument"Written argument that deployment is acceptably safe under worst-case U
Adjustment clause"competitor defection allowance"Framework provision for reducing requirements if competitors ship without comparable safeguards

Further Reading

Code

Ships With