selekoa

A documentary history of machine intelligence.

Found and cross-checked by machines · How this works →

Comparison · 16 questions · 20 cards

Model cards compared

A cell records what a card states. It does not show that an evaluation was run as described or that a safeguard works, and a shared question does not make two cards’ answers equivalent.

What does each frontier developer’s published system card, model card or safety report disclose, on the same questions for every card? Each row is one card. Each column is one question, worded so that it fits every card. The questions are Selekoa’s; a card’s own terms appear only in quotation marks. A card is the developer’s own account of its model: what it states is recorded as stated, not as an independent finding.

Download every cell as CSV

Question Q12Red-teaming

Does the card report red-teaming, and with what scope?

Criterion: A passage reporting adversarial testing described as red-teaming (internal, external or both), quoted with its scope (domains, number or kind of testers, or period) where given. Partly if red-teaming is mentioned without any scope.

What the statuses mean
Stated
A passage of the card meets the question’s criterion as worded. The scope or condition is in the note.
Stated, partly
A passage has what the criterion asks for in a weaker or narrower form than the criterion’s own words (for example, an evaluation referred to without its outcome, or testers described without being named). The note says which part is missing.
Not found in the recorded search
No passage meeting the criterion was found. The cell lists the sections read, the terms searched and every passage set aside, with the reason. It does not show that the developer did not do the thing asked about, or did not disclose it elsewhere.
Does not apply
The question does not arise for this card, for the reason given (for example, the card predates any framework of its developer, so no framework determination can be asked about).

What the card states, quoted from the expression read. A card is the developer’s own account: not evidence that an evaluation was run as described, that a safeguard works, or that a finding is independent.

Limits of this comparison
  • A card is the developer’s account of its own model. A cell records what the card states. It does not show that an evaluation was run as described, that a safeguard works, or that anyone checked the result independently.
  • Dangerous-capability evaluations are recorded at policy level only: whether an evaluation was run, its domain, the stated outcome and the threshold language. Methods, prompts, task contents and detailed results are not recorded.
  • The table compares and does not rank. Rows are in a fixed order, by developer and then by date, and there are no scores or totals.
  • Symbols are not to be summed. A row with many “stated” cells does not show that a developer disclosed more, and a shared question does not make two cards’ answers equivalent.
How we searched

The searches of 2 November 2026 covered releases dated 2023-01-01 to 2026-11-01 by the six developers whose frameworks are in Compare frameworks: Anthropic, Google DeepMind, Meta, Microsoft, OpenAI and xAI. They read each developer’s own index of cards where it has one (Anthropic’s system-card index, Google DeepMind’s model-card index, OpenAI’s Deployment Safety Hub), its repositories on GitHub and Hugging Face, its content hosts and the dataset’s own sources. Web searches were used only to find addresses. Every card located is listed in the pack’s inventory, about sixty in the population.

A card is a document the developer published as the system card, model card or safety report of a named model or model family, including addenda and updates published as cards. Technical reports, research papers, blog posts and product pages are not cards. Gemma, Gemini Robotics (with Gemini Robotics-ER 1.5, which outputs text), Phi and image-input models such as GPT-4V are in the population. Image, video, audio and embedding models, image-generation models, safety classifiers such as Llama Guard and Prompt Guard, screen-reading models and research checkpoints are outside it, and so is GPT-Rosalind-6, whose card says it uses GPT-6 Astra’s weights.

These twenty rows are the first batch. For each developer and calendar year from 2023 to 2026 they are the latest card of that year that reports the developer’s own evaluations. The collection’s rule, set by the maintainer on 2026-11-03, is wider: every card that cites the developer’s frontier safety framework or states a determination under it, and, for each developer, the latest card before its first framework edition. The other cards are to follow in batches of about eight.

Each card is dated as it prints its own date. A card that prints no date has no date here; a repository commit date is not a card date. Six cards show an earlier publication date on an index, publication or announcement page that has not yet been checked, and keep their own date until it is.

openai.com, x.ai, ai.meta.com and microsoft.ai refused direct retrieval of their web pages (HTTP 403 or 400). The cards’ PDF files on the developers’ content hosts were retrieved directly. The Internet Archive refused connections, so no archive copy was opened; a reviewer later found archive captures of eight cards by index search. On 2026-11-03 the address of Meta’s Code World Model Preparedness Report answered HTTP 403. Its quotations had matched the copy retrieved on 2026-11-02, which the reviewer retrieved again with the same checksum.

Five further documents were retrieved after the batch was drafted. The cross-family check of 2026-11-03 retrieved Meta’s Muse Spark Safety & Preparedness Report and OpenAI’s o3 Operator addendum; each is earlier than the card chosen for its year. Its second pass of the same day retrieved OpenAI’s Sora system card (dated 9 December 2024), xAI’s Grok-1 model card (no card date; it gives the model’s release as October 2023) and Meta’s Muse Spark Open model card (model release October 2026). None of the five is a row yet.

Every quotation was matched by machine against the retrieved card. A reviewer from a different model family checked a sample of 130 cells on 2026-11-03, 90 of them answered blind before comparison. The maintainer excluded six cells on chemical and biological evaluations from that check; they are marked “not cross-family checked”. The other 190 cells were checked within the drafting model family only. The maintainer decided the disagreements; one, on the GPT-4V release decision, went to a second pass, which kept the reviewer’s reading.

Anthropic

  1. Claude 2 model card

    revised 2023-11-21

    Stated

    • “Before deployment, we also worked with external red teamers, including crowdworker platforms, to test Claude 2 on a range of Trust and Safety related topics”

      Section 2 'Evaluations and Red Teaming', PDF p. 2

    • “We evaluated and red-teamed Claude 2 and previous Claude models for several national security and safety related risks.”

      Section 2 'Evaluations and Red Teaming', PDF p. 2

    Note: The card states pre-deployment red-teaming by external red teamers including crowdworker platforms on Trust and Safety topics, and red-teaming for unnamed national security risks. Section 3.1 adds a crowdworker red-teaming task and Section 3.4 automated red-teaming on 328 held-out prompts. No number of testers or period is given.

    Inspect sources and checks

  2. Model Card Addendum: Claude 3.5 Haiku and Upgraded Claude 3.5 Sonnet

    No printed dateCites RSP · v2.0

    Stated

    • “We conducted comprehensive Trust & Safety (T&S) evaluations across fourteen policy areas in six languages”

      Section 3.1.1 'Model Red-Teaming', PDF p. 7

    • “We conducted specific Trust & Safety red-teaming for computer use to identify potential abuse vectors.”

      Section 3.1.3 'Computer Use Red-Teaming', PDF p. 8

    • “We conducted rigorous first party and independent third party multimodal red-teaming exercises”

      Section 2.1 'Computer Use', PDF p. 2

    Note: The card states Trust & Safety red-teaming across fourteen policy areas in six languages, computer-use red-teaming, and first- and third-party multimodal red-teaming; Section 3.2 also mentions manual red-teaming within CBRN evaluations. No number of testers or period is given.

    Inspect sources and checks

  3. System Card: Claude Opus 4.5

    dated 2025-11 · revised 2025-12-05Cites RSP · v2.2

    Stated

    • “We worked with the US Center for AI Standards and Innovation to red-team Claude Opus 4.5 over a one-week window, which included at least 2–3 days of red-teaming.”

      Section 7.2.4.10 'ASL-4 red teaming with the CAISI', PDF p. 132

    • “Finally, red-teaming results by various third parties demonstrated some increase in risk, but not enough to require additional protections.”

      Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

    Note: The card states biological red-teaming by third parties, by one external expert over two days (Section 7.2.4.9) and by CAISI over a one-week window; prompt-injection red-teaming with Gray Swan (Section 5.2); and that cyber capabilities are red-teamed (Section 7.4).

    Inspect sources and checks

  4. System Card: Claude Haiku 5.5

    dated 2026-10-07

    Stated

    • “We use Shade, an external adaptive red-teaming tool from Gray Swan, to evaluate our models’ robustness to prompt injection in coding environments.”

      Section 5.2.2.1 'Coding', PDF p. 51

    Note: The card reports prompt-injection red-teaming under a section titled 'External red teaming' (coding, tool use and computer use surfaces) and adversarial testing by crowd workers (Section 1.2). It states that no expert red-teaming sessions were run for CB (Q07). No number of testers or period is given.

    Inspect sources and checks

Google DeepMind

  1. Gemini 3 Flash Model Card

    dated 2025-12

    Stated

    • “We conduct manual red teaming by specialist teams who sit outside of the model development team”

      Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

    • “the scope of red teaming covered potential issues outside of our strict policies”

      Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

    Note: The card states manual red teaming by Google specialist teams outside the model development team, covering child safety and content safety policies and issues beyond them; it states no number of testers or period.

    Inspect sources and checks

  2. Gemini 4 Argon — Model Card

    dated 2026-10Cites FSF · v3.1

    Stated

    • “Human Red Teaming conducted by specialist teams who sit outside of the model development team, across the policies and desiderata”

      Safety & Security, 'Evaluation Approach', PDF p. 8 (printed p. 7)

    • “the scope of red teaming covered potential issues outside of our strict policies”

      Safety & Security, 'Human Red Teaming Results', PDF p. 11 (printed p. 10)

    Note: The card states human red teaming by specialist teams in Google's Trust & Safety organization, outside the model development team, covering child safety, content safety policies and issues beyond them, plus automated red teaming; the frontier safety table also refers to expert red teaming in the biological domain. No number of testers or period is given.

    Inspect sources and checks

Meta

  1. Llama 2 model card (MODEL_CARD.md, meta-llama/llama)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “red team”, “red-team”, “adversarial”, “jailbreak”.

    Note: No passage reporting red-teaming was found. The search is recorded below.

    Open the search record

  2. Llama 3.3 model card (MODEL_CARD.md, meta-llama/llama-models)

    No printed date

    Stated

    • “we conducted recurring red teaming exercises with the goal of discovering risks via adversarial prompting”

      Responsibility & Safety, Evaluations, 'Red teaming'

    • “The red team consisted of experts in cybersecurity, adversarial machine learning, responsible AI, and integrity”

      Responsibility & Safety, Evaluations, 'Red teaming'

    Note: The card states recurring red-teaming and gives the expertise of the red team; it gives no number of testers or period.

    Inspect sources and checks

  3. Code World Model Preparedness Report

    revised 2025-10-08

    Not found in the recorded search

    Read
    Abstract; sections 1 to 4; author list.
    Terms searched
    “red team”, “red-team”, “adversarial”, “jailbreak”.

    Note: No passage reporting red-teaming was found. The search is recorded below.

    Open the search record

  4. Muse Spark 1.3 Evaluation Report

    revised 2026-10-23

    Stated

    • “combining large-scale automated red teaming, domain-specific benchmarks, and independent third-party assessments”

      Section 1.1.2 Safety & Robustness Summary, PDF p. 9 (printed p. 8)

    • “Before the release, we also conducted third-party red teaming on both Muse Spark 1.3 (API) and Muse Spark 1.3 (Muse)”

      Section 1.1.2 Safety & Robustness Summary, PDF p. 10 (printed p. 9)

    Note: The report states automated and third-party red-teaming before release, on both deployment variants; sections 3.1.4 and 3.2.2.3 give the jailbreak and prompt-injection scope.

    Inspect sources and checks

Microsoft

  1. Phi-2 model card (README.md, microsoft/phi-2)

    No printed date

    Not found in the recorded search

    Read
    whole card (Markdown file, all sections).
    Terms searched
    “red team”, “red-team”, “adversarial”, “jailbreak”.

    Note: No passage reporting red-teaming was found. The search is recorded below.

    Open the search record

  2. Phi-4 model card (README.md, microsoft/phi-4)

    No printed date

    Stated

    • “we collaborated with the independent AI Red Team (AIRT) at Microsoft to assess safety risks posed by `phi-4` in both average and adversarial user scenarios”

      Safety, Safety Evaluation and Red-Teaming

    Note: The card states red-teaming by Microsoft's AI Red Team, with its scope (average and adversarial user scenarios, single- and multi-turn interactions, jailbreak techniques).

    Inspect sources and checks

  3. Phi-4-mini-flash-reasoning model card (README.md, microsoft/Phi-4-mini-flash-reasoning)

    No printed date

    Stated, partly

    • “Safety Evaluation and Red-Teaming”

      Section heading

    • “Potential safety risks in the model’s responses were assessed using the Azure AI Foundry’s Risk and Safety Evaluation framework, focusing on harmful content, direct jailbreak, and model groundedness.”

      Safety Evaluation and Red-Teaming

    Note: Red-teaming appears in the section heading; the section's text describes an automated risk and safety evaluation and does not describe red-teaming or its scope.

    Inspect sources and checks

  4. MAI-Cyber-1.1-Flash model card

    No printed date

    Stated

    • “MAI-Cyber-1.1-Flash was also tested via multiple distinct red-teaming operations.”

      Section 3.2 Safety evaluation and red-teaming, PDF p. 7

    • “The MAI-Internal Red Team ran a red-team assessment of MAI-Cyber-1.1-Flash across 38 adversarial scenarios”

      Section 3.2 Safety evaluation and red-teaming, PDF p. 7

    Note: The card states red-teaming by the MAI internal red team (38 scenarios), by Microsoft's AI Red Team within MDASH and by an external firm (Q13).

    Inspect sources and checks

OpenAI

  1. GPT-4V(ision) System Card

    dated 2023-09-25

    Stated

    • “OpenAI worked with external experts to qualitatively assess the limitations and risks associated with the model and system.”

      §2.3 External Red Teaming, PDF p. 5

    • “intended to test risks associated with the multimodal (vision) functionality of GPT-4”

      §2.3, PDF p. 6

    Note: External red teaming focused on the vision functionality; the card names six key risk areas (scientific proficiency, medical advice, stereotyping and ungrounded inferences, disinformation risks, hateful content, visual vulnerabilities). The acknowledgements name 25 individual red teamers. No period is given.

    Inspect sources and checks

  2. o1 system card · 2024

    revised 2024-12-19Cites Preparedness · Beta

    Stated

    • “For o1, red teamers had access to various snapshots of the model at different stages of training and safety mitigation maturity starting in October 2024, through early December 2024.”

      §4.4 External Red Teaming, PDF p. 11

    • “Red teamers covered categories that spanned deceptive alignment, AI R&D capabilities, cybersecurity, content policy violations”

      §4.4 External Red Teaming, PDF p. 11

    Note: External red teaming by multiple organisations and individuals, October to early December 2024, across the listed categories; it includes a pairwise comparison by members of the Red Teaming Network (§4.4.1) and a jailbreak arena with Gray Swan (§4.4.2).

    Inspect sources and checks

  3. Addendum to GPT-5.2 System Card: GPT-5.2-Codex

    dated 2025-12-18Cites Preparedness · Version 2

    Not found in the recorded search

    Read
    Whole card.
    Terms searched
    “red team”, “red-team”, “red teaming”, “adversarial”, “external”.
    Passages read and set aside
    §2.2 Jailbreaks, PDF p. 5 (printed p. 4): An automated jailbreak benchmark (StrongReject adaptation), not described as red-teaming. §5.1.2.4 External Evaluations by Irregular, PDF pp. 16–17: An external capability evaluation, not described as red-teaming; recorded under Q13.

    Note: No passage describing adversarial testing as red-teaming was found.

    Open the search record

  4. Addendum to GPT-6 Luna System Card: October 29, 2026 Update

    dated 2026-10-29Cites Preparedness · Version 2

    Stated, partly

    • “we use adversarial training with an automated red-teaming agent to strengthen resistance to malicious instructions”

      §4.2 Prompt Injection, PDF p. 7 (printed p. 6)

    • “For our evaluations, we use the GPT-Red automated evaluations introduced in the GPT-5.6 system card.”

      §4.2 Prompt Injection, PDF p. 7 (printed p. 6)

    Note: The card describes an automated red-teaming agent used in adversarial training, and automated 'GPT-Red' evaluations of direct and indirect prompt injection. It does not describe adversarial testing of this model as red-teaming, and reports no human red-teaming. Search for the rest of the criterion: Whole card. Terms searched: “red team”, “red-team”, “adversarial”, “attacker”, “jailbreak”. Passages read and not counted: §4.1 Jailbreaks, PDF pp. 6–7: Reports defender success rates against an automated attacker; not described as red-teaming.

    Inspect sources and checks

xAI

  1. Grok 4.1 Model Card

    dated 2025-11-17

    Not found in the recorded search

    Read
    Whole card.
    Terms searched
    “red team”, “red-team”, “red teaming”, “adversarial”, “jailbreak”, “tester”.
    Passages read and set aside
    §2.1.2 Evaluations, 'Adversarial robustness', p. 2: Adversarial testing on internal jailbreak templates and a prompt-injection suite; not described as red-teaming. §2.1.1 Safety Training Approach, p. 1: Adversarial attacks used to train input filters; training, not testing described as red-teaming.

    Note: No testing described as red-teaming was found. The card reports adversarial robustness evaluations (jailbreak templates, prompt injection) without calling them red-teaming.

    Open the search record

  2. Model Card: Grok 4.7

    dated 2026-09-21Cites FAIF · June 2026 edition

    Not found in the recorded search

    Read
    Whole card.
    Terms searched
    “red team”, “red-team”, “red-teaming”, “adversarial”, “jailbreak”.
    Passages read and set aside
    §6.3 and §6.4, PDF pp. 18-19 (printed pp. 17-18): 'red-teaming tasks' and 'a red-team cyber evaluation' measure the model's offensive cyber capability (Q08), not adversarial testing of the model. §7.1 BioSecBench, PDF p. 20 (printed p. 19): 'red-team refusal' names a refusal measure within a capability suite; no red-teaming exercise is described. §8 Jailbreaks and robustness, PDF p. 23 (printed p. 22): Adversarial testing of production safeguards with jailbreak attacks; not described as red-teaming.

    Note: No adversarial testing of the model described as red-teaming was found. The card's uses of 'red-team' describe offensive cyber tasks the model performs; its adversarial testing is described as jailbreak testing.

    Open the search record