Google DeepMind introduces its Frontier Safety Framework

Background

On 17 May 2024, Google DeepMind published an article introducing its Frontier Safety Framework ^[2]. The framework is a set of protocols for proactively identifying future AI capabilities that could cause severe harm, together with mechanisms for detecting and mitigating them ^[1]. Its subject is severe risk at the model level, that is, the capabilities a model itself has. Google DeepMind named exceptional agency and sophisticated cyber capabilities as examples ^[1].

Three components

The framework has three parts ^[1]. The first is a set of Critical Capability Levels: descriptions of capability thresholds at which the potential for severe harm is treated as high enough that extra safeguards are needed. The second is periodic evaluation of models, so that a model reaching one of those levels is detected rather than assumed absent; because capability changes from one model generation to the next, the check is repeated instead of being done once. The third is a mitigation plan, applied when a model passes early warning evaluations. Early warning evaluations sit below the critical level, so that they give notice before the threshold itself is crossed, and the mitigation plan is what the developer then puts in place ^[1].

The initial Critical Capability Levels cover four domains: autonomy, biosecurity, cybersecurity, and machine learning research and development ^[1]. Autonomy refers to a model's ability to pursue goals and take actions over extended periods; biosecurity to knowledge that could assist in causing biological harm; cybersecurity to the ability to find and exploit weaknesses in software; machine learning research and development to a model's ability to carry out AI research itself.

Mitigations in two layers

Google DeepMind said that higher level security mitigations provide greater protection against the exfiltration of model weights, while higher level deployment mitigations enable tighter management of critical capabilities ^[1]. Model weights are the numeric parameters that make up a trained model; exfiltration means those files being copied out of the developer's control, which would remove the ability to limit what the model can do. Deployment mitigations work on the other side, restricting how and by whom a model with dangerous capabilities is used or served. The two layers correspond to two different routes by which risk could arrive: the model leaving the developer's hands, and the model being used.

An exploratory framework

The framework follows the emerging approach of Responsible Capability Scaling ^[1], in which the safeguards attached to a model are set according to the capability levels it reaches. Google DeepMind described the framework as exploratory and said it expects it to evolve significantly ^[1]. It aimed to have the initial framework fully implemented by early 2025 ^[1].

What the document sets out

The publication states publicly how one lab intends to test its own models for severe capability, which capability levels it has defined so far, and what it plans to do when a model crosses them. It names four domains, describes an evaluation cycle that repeats over time, and separates security mitigations from deployment mitigations ^[1]. The company describes the version as exploratory and subject to significant change, and sets early 2025 as the target for full implementation of the initial framework ^[1].