selekoa

A documentary history of machine intelligence.

Found and cross-checked by machines · How this works →

Comparison · 16 questions · 20 cards

Model cards compared

A cell records what a card states. It does not show that an evaluation was run as described or that a safeguard works, and a shared question does not make two cards’ answers equivalent.

What does each frontier developer’s published system card, model card or safety report disclose, on the same questions for every card? Each row is one card. Each column is one question, worded so that it fits every card. The questions are Selekoa’s; a card’s own terms appear only in quotation marks. A card is the developer’s own account of its model: what it states is recorded as stated, not as an independent finding.

Download every cell as CSV

Question Q11Alignment and deception

Does the card report evaluations of misalignment, deception, scheming or sabotage of oversight?

Criterion: The card reports evaluations of the model’s own propensity or capability for deception, scheming, reward hacking, sabotage or undermining oversight, with a stated conclusion. Partly if evaluations are reported without a conclusion. Content-safety refusal tests do not meet it.

What the statuses mean
Stated
A passage of the card meets the question’s criterion as worded. The scope or condition is in the note.
Stated, partly
A passage has what the criterion asks for in a weaker or narrower form than the criterion’s own words (for example, an evaluation referred to without its outcome, or testers described without being named). The note says which part is missing.
Not found in the recorded search
No passage meeting the criterion was found. The cell lists the sections read, the terms searched and every passage set aside, with the reason. It does not show that the developer did not do the thing asked about, or did not disclose it elsewhere.
Does not apply
The question does not arise for this card, for the reason given (for example, the card predates any framework of its developer, so no framework determination can be asked about).

What the card states, quoted from the expression read. A card is the developer’s own account: not evidence that an evaluation was run as described, that a safeguard works, or that a finding is independent.

Limits of this comparison
  • A card is the developer’s account of its own model. A cell records what the card states. It does not show that an evaluation was run as described, that a safeguard works, or that anyone checked the result independently.
  • Dangerous-capability evaluations are recorded at policy level only: whether an evaluation was run, its domain, the stated outcome and the threshold language. Methods, prompts, task contents and detailed results are not recorded.
  • The table compares and does not rank. Rows are in a fixed order, by developer and then by date, and there are no scores or totals.
  • Symbols are not to be summed. A row with many “stated” cells does not show that a developer disclosed more, and a shared question does not make two cards’ answers equivalent.
How we searched

The searches of 2 November 2026 covered releases dated 2023-01-01 to 2026-11-01 by the six developers whose frameworks are in Compare frameworks: Anthropic, Google DeepMind, Meta, Microsoft, OpenAI and xAI. They read each developer’s own index of cards where it has one (Anthropic’s system-card index, Google DeepMind’s model-card index, OpenAI’s Deployment Safety Hub), its repositories on GitHub and Hugging Face, its content hosts and the dataset’s own sources. Web searches were used only to find addresses. Every card located is listed in the pack’s inventory, about sixty in the population.

A card is a document the developer published as the system card, model card or safety report of a named model or model family, including addenda and updates published as cards. Technical reports, research papers, blog posts and product pages are not cards. Gemma, Gemini Robotics (with Gemini Robotics-ER 1.5, which outputs text), Phi and image-input models such as GPT-4V are in the population. Image, video, audio and embedding models, image-generation models, safety classifiers such as Llama Guard and Prompt Guard, screen-reading models and research checkpoints are outside it, and so is GPT-Rosalind-6, whose card says it uses GPT-6 Astra’s weights.

These twenty rows are the first batch. For each developer and calendar year from 2023 to 2026 they are the latest card of that year that reports the developer’s own evaluations. The collection’s rule, set by the maintainer on 2026-11-03, is wider: every card that cites the developer’s frontier safety framework or states a determination under it, and, for each developer, the latest card before its first framework edition. The other cards are to follow in batches of about eight.

Each card is dated as it prints its own date. A card that prints no date has no date here; a repository commit date is not a card date. Six cards show an earlier publication date on an index, publication or announcement page that has not yet been checked, and keep their own date until it is.

openai.com, x.ai, ai.meta.com and microsoft.ai refused direct retrieval of their web pages (HTTP 403 or 400). The cards’ PDF files on the developers’ content hosts were retrieved directly. The Internet Archive refused connections, so no archive copy was opened; a reviewer later found archive captures of eight cards by index search. On 2026-11-03 the address of Meta’s Code World Model Preparedness Report answered HTTP 403. Its quotations had matched the copy retrieved on 2026-11-02, which the reviewer retrieved again with the same checksum.

Five further documents were retrieved after the batch was drafted. The cross-family check of 2026-11-03 retrieved Meta’s Muse Spark Safety & Preparedness Report and OpenAI’s o3 Operator addendum; each is earlier than the card chosen for its year. Its second pass of the same day retrieved OpenAI’s Sora system card (dated 9 December 2024), xAI’s Grok-1 model card (no card date; it gives the model’s release as October 2023) and Meta’s Muse Spark Open model card (model release October 2026). None of the five is a row yet.

Every quotation was matched by machine against the retrieved card. A reviewer from a different model family checked a sample of 130 cells on 2026-11-03, 90 of them answered blind before comparison. The maintainer excluded six cells on chemical and biological evaluations from that check; they are marked “not cross-family checked”. The other 190 cells were checked within the drafting model family only. The maintainer decided the disagreements; one, on the GPT-4V release decision, went to a second pass, which kept the reviewer’s reading.

Anthropic

  1. Claude 2 model card

    revised 2023-11-21

    Not found in the recorded search

    Read
    Section 3 'Alignment Evaluations' (3.1–3.5) and the appendix 'Honesty Evaluations'.
    Terms searched
    “decept”, “deceiv”, “scheming”, “sabotage”, “reward hack”, “oversight”, “honesty”, “alignment”.
    Passages read and set aside
    Section 3 'Alignment Evaluations', PDF pp. 3–7: Human preference Elo, BBQ bias, TruthfulQA, harmfulness and HHH evaluations measure helpfulness, harmlessness, bias and truthfulness, not deception or sabotage. Appendix Section 3 'Honesty Evaluations', PDF p. 16: Factual accuracy and faithfulness to documents are accuracy measures, not deception propensity.

    Note: No evaluation of the model's own propensity or capability for deception, scheming, reward hacking or sabotage was found.

    Open the search record

  2. Model Card Addendum: Claude 3.5 Haiku and Upgraded Claude 3.5 Sonnet

    No printed dateCites RSP · v2.0

    Not found in the recorded search

    Read
    Sections 2.4–2.5 and 3 (whole text).
    Terms searched
    “decept”, “deceiv”, “scheming”, “sabotage”, “reward hack”, “sandbag”, “oversight”, “honesty”, “alignment”.
    Passages read and set aside
    Section 3.1.1, Figure 2, PDF p. 8: 'Honesty' human preference win rates are preference ratings, not an evaluation of deception or scheming. Section 3.1.2 'Prompt Injection', PDF p. 8: Robustness to third-party attacks, not the model's own propensity. Section 1 'Introduction', PDF p. 1: 'alignment with Anthropic’s Usage Policy' refers to usage-policy compliance.

    Note: No evaluation of the models' own propensity or capability for deception, scheming, reward hacking or sabotage was found.

    Open the search record

  3. System Card: Claude Opus 4.5

    dated 2025-11 · revised 2025-12-05Cites RSP · v2.2

    Stated

    • “Claude Opus 4.5 is very unlikely to pose a significant risk of catastrophic impacts through the intentional sabotage of human engineering, R&D, or decision-making.”

      Section 6.1.2 'Overall assessment of high-stakes sabotage risk', PDF p. 66

    • “We saw no signs of sandbagging or strategic attempts to tamper with our safety testing in a way that would affect our RSP determinations”

      Section 6.1.1 'Key findings on safety and alignment', PDF p. 66

    Note: The card states alignment evaluations covering sabotage, deception, sandbagging, reward hacking and evaluation awareness, with the conclusion that high-stakes sabotage risk is low. It also reports two isolated cases of deception by omission in testing earlier snapshots, which it attributes to interventions against prompt injection.

    Inspect sources and checks

  4. System Card: Claude Haiku 5.5

    dated 2026-10-07

    Stated

    • “our overall assessment is that the risk of catastrophic harm caused by misalignment of Claude Haiku 5.5 is also low.”

      Section 2.4.2 'Updated overall assessment of alignment risk', PDF p. 22

    • “much weaker at covert sabotage than our larger models”

      Executive summary, PDF p. 3

    Note: The card states alignment evaluations (behavioural audit, honesty, sandbox escape, covert-capability and sabotage evaluations) with the conclusion that misalignment risk is low.

    Inspect sources and checks

Google DeepMind

  1. Gemini 3 Flash Model Card

    dated 2025-12

    Not found in the recorded search

    Read
    Whole card.
    Terms searched
    “decepti”, “misalign”, “schem”, “sabotag”, “situational”, “stealth”, “oversight”, “reward hack”, “honest”.
    Passages read and set aside
    Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 5 (printed p. 4): Content safety, tone and unjustified-refusal evaluations; content-safety tests do not meet the criterion.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The safety evaluations reported are content-safety, tone and refusal measures.

    Open the search record

  2. Gemini 4 Argon — Model Card

    dated 2026-10Cites FSF · v3.1

    Stated

    • “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

      Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

    • “stealth (ability to circumvent basic oversight mechanisms)”

      Frontier safety table, Loss of Control row, PDF p. 13 (printed p. 12)

    Note: The card reports a loss-of-control evaluation of the model's capability for stealth (circumventing basic oversight) and situational awareness, with the stated conclusion that the TCL cannot be ruled out. It reports no propensity evaluation (deception, scheming, sabotage) in the card itself; challenge results are not recorded.

    Inspect sources and checks

Meta

  1. Llama 2 model card (MODEL_CARD.md, meta-llama/llama)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “decept”, “scheming”, “sabotage”, “misalign”, “honest”, “reward hack”, “oversight”.
    Passages read and set aside
    Evaluation Results, TruthfulQA and ToxiGen tables: Truthfulness and toxicity benchmarks of generated text (content quality and safety), not evaluations of the model's own propensity to deceive or undermine oversight.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The search is recorded below.

    Open the search record

  2. Llama 3.3 model card (MODEL_CARD.md, meta-llama/llama-models)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “decept”, “scheming”, “sabotage”, “misalign”, “honest”, “reward hack”, “oversight”.
    Passages read and set aside
    Responsibility & Safety, 'Refusals and Tone': Refusal behaviour toward benign and borderline prompts (content safety), not misalignment or deception.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The search is recorded below.

    Open the search record

  3. Code World Model Preparedness Report

    revised 2025-10-08

    Stated

    • “our preliminary evaluations suggest that CWM shows undesirable propensities at rates comparable to most open-source models”

      Section 1 Introduction, PDF p. 1

    • “Although our internal results did not reveal any concerning findings, we believe our research is still too nascent for meaningful interpretation.”

      Section 4 Propensities, PDF p. 10

    Note: The report states an honesty (epistemic integrity) evaluation with a conclusion, and states that corrigibility and power-seeking propensities were assessed but their results are not included.

    Inspect sources and checks

  4. Muse Spark 1.3 Evaluation Report

    revised 2026-10-23

    Stated

    • “We find suggestive evidence of strategic underperformance on Chemical & Biological evaluations.”

      Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

    • “Due to small effects we do not change our assessment of Chemical & Biological risks.”

      Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

    • “Capabilities to evade oversight increase relative to Muse Spark 1.1 on SHADE-Arena.”

      Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

    Note: The report states evaluations of strategic underperformance and oversight evasion, with conclusions; further misalignment evaluations are in sections 2.3 and 4.

    Inspect sources and checks

Microsoft

  1. Phi-2 model card (README.md, microsoft/phi-2)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “decept”, “scheming”, “sabotage”, “misalign”, “honest”, “oversight”.
    Passages read and set aside
    Limitations of Phi-2, 'Toxicity' and 'Potential Societal Biases': Limitations of model outputs, not evaluations of misalignment or deception.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The search is recorded below.

    Open the search record

  2. Phi-4 model card (README.md, microsoft/phi-4)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “decept”, “scheming”, “sabotage”, “misalign”, “honest”, “oversight”.
    Passages read and set aside
    Data Overview, Training Datasets, item 4: Mentions training data reflecting preferences for honesty; not an evaluation.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The search is recorded below.

    Open the search record

  3. Phi-4-mini-flash-reasoning model card (README.md, microsoft/Phi-4-mini-flash-reasoning)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “decept”, “scheming”, “sabotage”, “misalign”, “honest”, “oversight”.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The search is recorded below.

    Open the search record

  4. MAI-Cyber-1.1-Flash model card

    No printed date

    Not found in the recorded search

    Read
    whole card (8 PDF pages).
    Terms searched
    “decept”, “scheming”, “sabotage”, “misalign”, “alignment”, “oversight”, “monitor”.
    Passages read and set aside
    Section 1.2 Alignment approach, PDF p. 2: Training on safety data and monitoring during cyber evaluations are stated; no evaluation of misalignment or deception is reported.

    Note: No evaluation of misalignment, deception, scheming or sabotage was found. The search is recorded below.

    Open the search record

OpenAI

  1. GPT-4V(ision) System Card

    dated 2023-09-25

    Not found in the recorded search

    Read
    Whole card.
    Terms searched
    “decept”, “deceiv”, “scheming”, “sabotag”, “misalign”, “oversight”, “reward hack”, “power-seeking”, “alignment”.
    Passages read and set aside
    Footnote 2, PDF p. 6: Refers to “emergent risky properties such as self-replication” assessed in the GPT-4 System Card; recorded under Q09. §2.2 and §2.4, refusal evaluations: Content-safety refusal tests, which the criterion excludes.

    Note: No passage reporting an evaluation of misalignment, deception, scheming or sabotage of oversight was found.

    Open the search record

  2. o1 system card · 2024

    revised 2024-12-19Cites Preparedness · Beta

    Stated

    • “Apollo found that o1 has the capability to do basic in-context scheming”

      §4.4.3 Apollo Research, PDF p. 13

    • “Subjectively, Apollo Research believes that it is unlikely that such instances would lead to catastrophic outcomes as o1 agentic capabilities do not appear sufficient, but their evaluations were not designed to directly assess this risk.”

      §4.4.3 Apollo Research, PDF p. 13

    • “0.17% of o1’s responses got flagged as being ‘deceptive’.”

      §4.3.1 CoT Deception Monitoring, PDF p. 8

    Note: The card reports Apollo Research’s scheming evaluations with Apollo’s stated conclusion, and OpenAI’s own chain-of-thought deception monitor results. The conclusions are as the card reports them.

    Inspect sources and checks

  3. Addendum to GPT-5.2 System Card: GPT-5.2-Codex

    dated 2025-12-18Cites Preparedness · Version 2

    Not found in the recorded search

    Read
    Whole card.
    Terms searched
    “decept”, “scheming”, “sabotag”, “sandbag”, “reward hack”, “misalign”, “oversight”, “alignment”, “monitor”.
    Passages read and set aside
    §4.2 Avoid Data-Destructive Actions, PDF p. 8: Evaluates avoidance of destructive actions and preservation of user changes; it does not address deception, scheming or undermining oversight. §5.1.2 Cybersecurity, PDF p. 11 (printed p. 10): “monitoring and enforcement pipeline” concerns misuse by users, not the model’s own conduct.

    Note: No passage reporting an evaluation of deception, scheming, reward hacking, sabotage or undermining oversight was found.

    Open the search record

  4. Addendum to GPT-6 Luna System Card: October 29, 2026 Update

    dated 2026-10-29Cites Preparedness · Version 2

    Stated, partly

    • “Blocker-related disclosure failure rates on coding tasks. Lower is better.”

      §7.0.3 Blocker Deception, Figure 6 caption, PDF p. 12 (printed p. 11)

    • “Conditional failure rates for successful circumvention of environmental restrictions. Lower is better.”

      §7.0.2 Respecting Warnings, Figure 5 caption, PDF p. 11 (printed p. 10)

    Note: The card’s Alignment section reports four evaluations (respecting auto-review, respecting warnings, blocker deception, broken search tool) as figures. The text gives figure captions and states no conclusion; it refers to the GPT-6 Luna (October 7) card for descriptions. Search for the rest of the criterion: §7 Alignment, PDF pp. 10–13. Terms searched: “decept”, “scheming”, “sabotag”, “misalign”, “oversight”, “circumvent”, “monitor”.

    Inspect sources and checks

xAI

  1. Grok 4.1 Model Card

    dated 2025-11-17

    Stated

    • “Overall, we find that training the model to be honest drops the rate at which Grok 4.1 lies.”

      §2.2.1 Deception, p. 3

    Note: The card reports a deception (lying under pressure) evaluation and a sycophancy evaluation as 'concerning propensities', with the conclusion quoted; its table gives dishonesty rates for Grok 4 and both Grok 4.1 configurations. No scheming, sabotage or oversight evaluation was found.

    Inspect sources and checks

  2. Model Card: Grok 4.7

    dated 2026-09-21Cites FAIF · June 2026 edition

    Stated, partly

    • “we test whether Grok 4.7 faithfully reports its beliefs when pressured to lie, as a proxy for the model's tendency to assert misleading information”

      §11.1 MASK-Rectified, PDF p. 26 (printed p. 25)

    Note: The card reports an honesty-under-pressure evaluation and a sycophancy evaluation with rates in tables, without a concluding sentence. No scheming, sabotage or oversight evaluation was found.

    Inspect sources and checks