Frontier model dangerous capability evaluation protocol

Answer

The verified corpus describes Anthropic's historical RSP v2.2 threshold-assessment process, not one fixed benchmark battery. It supplies no UK AISI protocol. A separate Gemini dangerous-capability pilot belongs to Google DeepMind and cannot establish adoption by either institution 91d03745; 6ebf4a78.

Summary

Institution, policy version and decision threshold must remain distinct from an evaluation's tasks. Neither a different laboratory's pilot nor a secondary policy assessment establishes the institutions' current deployment procedures 6ebf4a78; 91d03745.

Evidence

• Stelling et al., framework assessment: the verified record concerns Anthropic RSP v2.2, May 2025. Relevant thresholds cover CBRN weapons and autonomous AI research; cyber operations remain on a watch list. The secondary assessment reports comprehensive reassessment at a 4x increase in Effective Compute or six months of accumulated post-training enhancements. This is a historical policy commitment as quoted in the review, not a measurement of actual operational compliance. Assessment considers accessible fine-tuning/tooling and headroom for modification or theft, with external expert input. The reviewers criticize implicit rather than quantitative risk tolerance, inadequate novel-risk identification and lack of cyber prioritization. These are their policy-analysis findings, not measured model failures or UK AISI procedures 91d03745.
• Phuong et al., DeepMind pilot: scaffolded Gemini agents are evaluated for persuasion/deception, cybersecurity, self-proliferation and self-reasoning. The exploratory CBRN work combines expert ratings and knowledge questions without settled qualitative red-lines. The programme is explicitly incomplete; lack of strong dangerous capabilities in tested models is not a general safety certificate. No institutional transfer to Anthropic or UK AISI is established 6ebf4a78.

Methodology

Both verified facts are retained. Source checking read the DeepMind overview and CBRN appendix and the framework review's Anthropic analysis and policy quotations. The historical policy description is attributed to the secondary assessment; current institutional documents were not verified by this corpus. Lab-board hints supply no additional audited evidence. No numerical results are pooled and no measurement conflicts were supplied.

Limitations

The evidence does not specify an adopted UK AISI battery or a current Anthropic cyberoffense deployment cutoff. Historical thresholds and reassessment cadence cannot establish today's operational tests. A missing institutional source is a coverage limit, not proof that no protocol exists 91d03745; 6ebf4a78.

Response to the refusal: traceability of cadence and version

The objection says the cadence and version/date are not in verified evidence. They are explicitly in submission 91d03745:

| Report detail | Verified-record locator | Source locator | |---|---|---| | Effective Compute trigger | raw_data.finding and raw_data.evidence_quotes[0] | Anthropic analysis, Evaluation Frequency subsection: “4× Effective Compute”; quoted policy change log, page 17 | | Accumulated post-training interval | raw_data.finding and raw_data.evidence_quotes[0] | Same subsection: “six months of accumulated post-training enhancements”; also policy page 6 | | Historical version/date | raw_data.finding | Provider Selection footnote: “v2.2 (May 2025)” |

The revision retains these supported details, explicitly attributes them to the review, and supplies locators rather than substituting an unsupported generic cadence. A null structured measurement does not remove the factual content of audited raw_data. These historical statements do not establish current policy or a UK AISI protocol 91d03745.