⚡ Quick Summary
Published by Google DeepMind, this Frontier Safety Framework sets out protocols for identifying and mitigating severe risks that may arise from the powerful capabilities of foundation models. Version 2.0, dated 4 February 2025, specifies procedures for detecting Critical Capability Levels (CCLs) — capability thresholds at which, absent mitigations, a model may pose heightened risk of severe harm — and articulates mitigation approaches for them.
The Framework covers misuse risks in three domains (CBRN, Cyber and Machine Learning R&D) and adds an exploratory section on deceptive alignment. It describes early warning evaluations with alert thresholds, two mitigation categories — security mitigations against weight exfiltration, calibrated to RAND security levels, and deployment mitigations such as safety fine-tuning, misuse filtering and response protocols — and safety cases reviewed before and after deployment by corporate governance bodies.
Its main deliverables are two tables. Table 1 pairs each misuse CCL with a recommended security level, from RAND SL 2 for CBRN uplift 1 and the two cyber levels up to RAND SL 4 for ML R&D autonomy level 1. Table 2 pairs the two Instrumental Reasoning CCLs with automated monitoring and with future work.
🧩 What’s Covered
The document is organised into a framework section, two risk-specific sections, and governance, disclosure and future-work provisions.
- Framework and Critical Capability Levels: defines CCLs as capability levels at which, absent mitigation, models may pose heightened risk of severe harm, derived by analysing the main foreseeable harm paths and selecting the minimal capabilities needed; notes the selection is conservative and may not translate to real-world harm.
- Assessing capabilities of frontier models: regular evaluation of the most powerful models using "early warning evaluations" with an "alert threshold", scaffolding and augmentations, possible external evaluators, and more frequent evaluation if progress outpaces the safety buffer.
- Applying mitigations: on reaching an alert threshold, assessing proximity to the CCL and analysing risk to inform a response plan; security mitigations against exfiltration of model weights, deployment mitigations such as safety fine-tuning and misuse filtering, detection and response, and possible holds on deployment or development.
- Misuse CCLs (Table 1): CBRN uplift 1, Cyber autonomy level 1 and Cyber uplift level 1, each at a level generally aligned with RAND SL 2, plus Machine Learning R&D uplift level 1 (RAND SL 3) and ML R&D autonomy level 1 (RAND SL 4), with rationales for each.
- Deceptive alignment: defined as AI systems purposefully undermining human control; Instrumental Reasoning Level 1 triggers automated monitoring of chain-of-thought in high-stakes deployments, while Level 2 (monitoring cannot detect or rule out the risk) is left to future research.
- Safety cases and control evaluations: safety cases arguing a model either does not meet a threshold CCL or that monitoring validated by a control evaluation is adequate, tested through red-teaming protocols called control evaluations.
- Governance and accountability: response plans approved by bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council and Google Trust & Compliance Council; disclosure to government authorities of model information, evaluation results and mitigation plans where a CCL poses unmitigated material risk to public safety.
- Future work and version history: greater precision in risk modelling, capability elicitation, additional risk domains, approaches beyond automated monitoring, and broader ML R&D measures; past version 1.0 (17 May 2024) and a link correction of 21 March 2025.
💡 Why it matters?
For organisations building, assessing or auditing frontier models, the Framework offers a concrete template for turning severity concerns into thresholds, evaluations and pre-agreed responses. It shows how capability thresholds can be paired with calibrated security levels for model weights — the Framework states that certain mitigations have reduced social value unless broadly applied — and how deployment decisions can be gated on an assessable safety case approved by a named governance body. It also connects to external work it cites, including METR, Anthropic's Responsible Scaling Policy, OpenAI's Preparedness framework, the RAND framework and the UK AI Safety Institute.
❓ What’s Missing
The Framework is explicitly exploratory and based on early research, and it addresses misuse risk primarily; deceptive alignment is treated as an initial approach with no mitigation for Instrumental Reasoning Level 2. Security levels are recommended by reference to RAND's principles rather than concrete measures, so implementation detail is left open and expected to evolve. The document describes no external assurance or independent audit of compliance, and states that effectiveness depends on adoption across the whole frontier AI field. Quantified alert thresholds, review cadence and evaluation methods are not given.
👥 Best For
Best suited to AI safety and governance teams at frontier model developers designing capability thresholds and response plans; risk and security leads calibrating protections for model weights against RAND-style levels; and policy or assurance staff comparing frontier safety frameworks across labs.
📄 Source Details
Frontier Safety Framework, Version 2.0, published by Google DeepMind, dated 4 February 2025, 9 pages, English. Developed by Lewis Ho, Celine Smith, Claudia van der Salm, Joslyn Barnhart and Rohin Shah under the leadership of Allan Dafoe, Anca Dragan, Andy Song, Demis Hassabis, Four Flynn, Jennifer Beroshi, Helen King, Nicklas Lundblad and Tom Lue. Past version 1.0 is dated 17 May 2024. The full text of all nine pages was available; no URL for the document itself is printed.
