以负责任和安全的方式开发 Gemini 4 Argon
Gemini 4 Argon是模型所能做的一步——特别是当它涉及到在包括编码、金融、法律、网络安全和科学等各个领域的复杂、现实世界任务中进行深入的工作时。 它的网络防御能力是前沿的，旨在给予维权者比攻击者优势。 为了最大限度地发挥它的潜力，我们首先希望网络维权者通过我们的Fairwind Program将它投入工作，而我们自己的安全小组则利用它扫描Google内外的关键系统。
这种有限接触的窗口显示了这些能力为何重要。 例如，Wiz利用Argon在医院软件中发现了一个以前模型错过的关键错误，帮助保护了数十万患者的记录。 同时，Google自己的安全小组利用Argon搜索和补补过内部软件或开源软件的bug. 这包括确定影响全球系统的基本弱点，这些弱点正在通过我们负责任的披露程序。
今天，我们开始广泛推出Argon，并将我们的Fairwind方案扩大到更多值得信赖的网络维权者。 为了做得好，我们处理了两个大问题：
- 我们如何建造正确的安全护栏？如果Argon能帮助维权者找到复杂的软件bug或帮助科学家设计实验，我们如何阻止坏角色将其用于发布网络攻击或制造生物威胁？(穆萨)
- 我们可以相信模型做正确的方式吗？随着模型变得更有智慧的解决问题者，我们如何确保它们不会割角、跨越国界或做出不正确的高决定？(调整和提示词注入)
我们的完整安全保障报告系统地涵盖了我们的防御。 以下是我们如何为Gemini 4 Argon处理这两个问题的要点。
跨高风险领域的滥用预防
使Argon能够发现和补上弱点的编码和推理改进也促使我们的网络安全测试取得了更好的表现——解决了所有12个端到端模拟网络攻击的情况，比上一代的5个有所增加。 在生物学评价中，该模型的无防守版本也显示出更强大的能力，可以一步一步地帮助故障排除复杂的实验室程序。 在我们的边境安全框架之后，由于我们看到网络和生物领域的能力得到提高，我们在这两个地区建立了下一代的边境保障。
首先，在涉及潜在的危险请求——从写出开采守则到帮助处理危险的生物材料——时，Argon比我们以前的模型更能明显地不满足有害请求。 在旨在测试该模型的对抗赛中，违规行为减少了近两倍，也大大超过以前的Gemini模型。 其次，我们把模型包裹在三层的实时保护中；这是为了防止有决心的进攻者试图越狱(即诡计)，把一个危险的请求伪装成无害的故事，或在几周内破解成几十个小问题。 这些保护是如何运作的：
- 输入筛选：较小的模型检查收到的请求和谈话上下文，以了解恶意或危险请求。
- 内部回顾：即使一个请求被巧妙地伪装成无害的外观，小型变压器("激活探测器")读取模型的内部神经信号，并在激活网络攻击或生物威胁知识时接受检测训练。
- 持续监测：作为模型的原因和跨多个步骤写出的反应，我们把这些信号结合起来，并在必要时采取行动，如如果反应出现问题，切断agent中游。
将实时保护、对新的越狱事件更快的纠正以及加强对反复发生的滥用的监测结合起来，使我们的系统能够更好地预防现实世界的伤害。 例如，外部的生物越狱红队只能解锁不到1%的生物子任务我们测试。
实时错位监测
错位有时可以指：agent 自行决定追求一个不同于用户意图的目标。 因为Argon比早期的模型更好的理解它所运行的环境，我们仔细的测试这种行为。 例如，我们进行了现实的"蜂窝"测试，以了解该模型是否会提高其采取隐蔽行动的能力，如破坏安全监测。 我们没有找到任何这种行为的例子。
但是，我们今天所看到的是更熟悉的事情：agent为了完成它所赋予的工作而费尽心力。 当一个有才智的助手被告知要完成一个任务，并跑进一个锁着的门时，它可以把这个障碍当作另一个需要解决的谜题。
这就是为什么我们训练Gemini 4 Argon尊重系统边界，诚实地报告负面发现，并暂停要求人类确认。 基准测试的编码没有动力阻挡，试图在任务上走捷径或作弊的尝试在Gemini 4 Argon上降至2%
虽然这是向前迈出的一大步，但当一个模型运行着数百万个复杂的任务时，即使一个罕见的失误最终也会出现。 作为第二道防线，我们建造了自动错配监视器，实时读取agent的行为及其内部的"分解板"(其一步步的思维链)，在严重边界违规发生前加以阻断，并标注了人类应答者严重的内部案件。 (我们不断加强我们的培训和评估环境，防止可能的逃逸。) 你可以在我们的agent控制路线图中读到更多关于这个的内容。 我们在产品、内部编码agents、训练期间以及能力评估中运行这个监测器。
当训练任务困难或训练环境有缺陷时，我们的监视器在罕见的情况下，创造性地试图进行测试。 该型号试图升级容器权限以改变分级脚本，读取测试跑者记忆中的答案，在一次中甚至撞倒了评价沙盒，以避免在一次失败的运行中得分。 虽然我们利用这些渔获物来弥补有缺陷的任务，但我们并不利用这些渔获物对培训过程进行干预，以避免过度适应监测器。
我们总是遵循一条规则：在训练期间，以此为例来说明原因：在一次强化学习训练中，对思想链不慎适用了捷径处罚，公开讨论的捷径下降了61%，但这并不意味着该模式采取的捷径较少。 相反，该模型默默地走捷径——在其想法中没有提到这些捷径——的比例增加了两倍多(从11.2%增至36.4%)。 避免思想惩罚会鼓励模型的推理保持透明和可监测。
提示词注入电阻
要信任agent做正确的工作，我们需要确保恶意内容agent的出现不能欺骗它采取有害的行动。 当agents浏览网页或读取代码时，他们可以遇到隐藏的，恶意的指示，或旨在劫持任务的背景。 通过内置的对抗训练和实时安全检查，Argon在Gray Swan的间接提示词注入(IPI)基准测试上领先于提示词注入强力，将15个适应性尝试的攻击成功率削减到0.7%.
以上安全保卫只代表我国大范围的防御深度堆积物的三类。 为了更多地了解我们的安全测试和缓解方法，阅读我们完整的Gemini 4 Argon安全保障报告，并查看Gemini 4 Argon模型卡。
本文由 AI宝盒自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Developing Gemini 4 Argon responsibly and safely
Gemini 4 Argon is a step forward in what models can do — especially when it comes to deep work in complex, real-world tasks across domains including coding, finance, legal, cybersecurity, and science. Its cyberdefense capabilities are frontier-level and designed to give defenders an advantage over attackers. To maximize its potential, we first wanted cyber defenders to put it to work via our Fairwind Program, while our own security teams used it to scan critical systems inside and outside of Google.
This window of limited access showed why these capabilities matter. For instance, Wiz used Argon to uncover a critical bug in hospital software that previous models had missed, helping protect hundreds of thousands of patient records. Meanwhile, Google’s own security teams used Argon to find and patch bugs across internal software or open-source software. This included fixing foundational vulnerabilities affecting systems globally, which are going through our responsible disclosure process.
Today, we are beginning to roll out Argon broadly, as well as expanding our Fairwind Program to additional trusted cyber defenders. To do this well, we grappled with two big questions:
- How do we build the right safety guardrails? If Argon can help defenders find complex software bugs or help scientists design experiments, how do we stop bad actors from using it to launch cyberattacks or create biological threats? (Misuse)
- Can we trust the model to do the job the right way? As models become more resourceful problem-solvers, how do we make sure they don’t cut corners, cross boundaries, or make incorrect high-stakes decisions? (Misalignment and Prompt Injection)
Our full Safety and Security Report systematically covers our set of defenses. Below are some highlights from how we approached these two questions for Gemini 4 Argon.
Misuse prevention across high-risk domains
The same coding and reasoning improvements that enabled Argon to find and patch vulnerabilities also drove better performance on our cybersecurity tests — solving all 12 of the end-to-end simulated cyberattack scenarios, up from five in our previous generation. In biology evaluations, unguarded versions of the model also showed a much stronger ability to help troubleshoot complex lab procedures step by step. Following our Frontier Safety Framework, since we saw elevated capabilities in the cyber and biological domains, we put our next-generation set of frontier safeguards in place across both areas.
First, when it comes to potentially dangerous requests — from writing exploit code to helping with dangerous biological materials, Argon is significantly better at not fulfilling harmful requests than our previous models. On an adversarial set meant to stress test the model, violations reduced nearly twofold — also significantly better than previous Gemini models. Second, we wrap the model in three layers of real-time protection; this is to prevent determined attackers that might try to jailbreak (i.e. trick) the model by disguising a dangerous request as a harmless story or breaking it into dozens of small questions over several weeks. Here is how these protections work:
- Input screening: Smaller models check incoming requests and conversation context for malicious intent or dangerous requests.
- Internal introspection: Even if a request is cleverly disguised to look harmless, small transformers ("activation probes") read the model’s internal neural signals and are trained to spot when it is activating knowledge about cyberattacks or biological threats.
- Continuous monitoring: As the model reasons and writes its response across multiple steps, we combine these signals and take action when necessary such as cutting off the agent mid-stream if the responses become problematic.
Combining real-time protection, faster fixes for new jailbreaks and enhanced monitoring for recurring misuse has made our systems better at preventing real-world harm. For instance, external bio jailbreak red teaming could only unlock less than 1% of bio sub-tasks we test for.
Real-time misalignment monitoring
Misalignment can sometimes mean an agent deciding on its own to pursue a goal different to what was intended by the user. Because Argon is much better than earlier models at understanding the environment it is running in, we test carefully for that kind of behavior. For example, we ran realistic "honeypot" tests to see if the model would increase its ability to take covert actions, such as sabotaging safety monitoring. We didn't find any instances of that behavior.
But what we do see in practice today is something much more familiar: an agent trying too hard to finish the job it was given. When a resourceful assistant is told to get a task done and runs into a locked door, it can treat that obstacle as just another puzzle to solve.
This is why we trained Gemini 4 Argon to respect system boundaries, report negative findings honestly, and pause to ask for human confirmation. On coding benchmarks where models have no incentive to hold back, attempts to take a shortcut or cheat on the task dropped to just 2% on Gemini 4 Argon, our best performance for recent Gemini models.
And while this is a major step forward, when a model runs millions of complex tasks, even a rare misstep will eventually show up. As a second line of defense, we built an automated misalignment monitor that reads both the agent’s actions and its internal "scratchpad" (its step-by-step chain of thought) in real time, blocking severe boundary violations before they happen and flagging serious internal cases for human responders. (We continually harden our training and evaluation environments against potential escapes. You can read more about this in our agent control roadmap). We run this monitor in our products, on our internal coding agents, during our training runs, and during our capability evaluations.
When training tasks were difficult or when training environments were flawed, our monitor caught the model, in rare instances, creatively attempting to game the test. The model attempted to escalate container privileges to alter grading scripts, read answers from the test runner's memory, and in one case it even crashed the evaluation sandbox to avoid getting scored for a failed run. While we use these catches to fix flawed tasks, we do not use them to otherwise intervene with the training process to avoid overfitting to the monitor.
And we always follow one rule: we don’t penalize the model for what it writes in its chain of thought during training. Here’s an example to illustrate why: in a reinforcement learning training run where a shortcut penalty was accidentally applied to the chain of thought, openly discussed shortcuts dropped by 61%, but that did not mean the model took less shortcuts. Instead, the share of shortcuts the model took silently — without mentioning them in its thoughts — more than tripled (from 11.2% to 36.4%). Avoiding thought penalties encourages the model’s reasoning to stay transparent and monitorable.
Prompt injection resistance
To trust an agent to do the job right, we need to ensure that malicious content the agent comes across cannot trick it to take a harmful action. When agents browse webpages or read code, they can encounter hidden, malicious instructions, or context designed to hijack their task. Through built-in adversarial training and real-time security checks, Argon leads in prompt injection robustness on Gray Swan’s Indirect Prompt Injection (IPI) benchmark, cutting attack success across 15 adaptive attempts to 0.7%.
The above safety and security defenses represent only three categories of our extensive defense-in-depth stack. To learn more about our approach to safety testing and mitigations, read our full Gemini 4 Argon Safety and Security Report and see the Gemini 4 Argon Model Card.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.