Examples
Examples from published documents
- UK AISI received 'extensive grey box access' to GPT-5.6 safeguards: monitor chain-of-thought, exact policy wording and real-time classifier-label feedback (OpenAI GPT-5.6 System Card, s.9.4.6).
- Evaluation teams should receive, as appropriate, access to activations, gradients, logits, chains-of-thought and the version with the fewest safety mitigations, such as a helpful-only model (EU GPAI Code of Practice, Appendix 3.4).
Counter-examples
Not to be confused with
- Deployment access tiers for customers (for example, trusted-access programmes) are not evaluator access levels, though they use similar words.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Black-box access
- Black-box access is evaluator access that allows querying an AI model and observing its outputs, sometimes with its chain-of-thought, but not inspecting internals such as activations, gradients or weights.
- Source: Expanding External Access To Frontier AI Models For Dangerous Capability Evaluations (arXiv 2601.11916)
- Grey-box access
- Grey-box access is limited evaluator access to an AI model's internals, such as input embeddings, hidden neural activations or log-probabilities, falling between query-only black-box access and full white-box access.
- Source: Expanding External Access To Frontier AI Models For Dangerous Capability Evaluations (arXiv 2601.11916)
- White-box access
- White-box access is full evaluator access to an AI system, including its activations and gradients and the ability to fine-tune the model, which enables evaluation techniques that querying alone cannot support.
- Source: Expanding External Access To Frontier AI Models For Dangerous Capability Evaluations (arXiv 2601.11916)
- Railfree version
- A railfree version is OpenAI's term for a model version supplied to evaluators with system-level content filters disabled, used in GPT-5.6 biological-risk testing.
- Source: OpenAI GPT-5.6 System Card
- Structured access
- Structured access is controlled access to an AI model's capabilities for vetted users; Meta's framework sees benefits in letting trusted researchers reach chemical and biological capabilities with reduced mitigations via structured access controls.
- Source: Meta Advanced AI Scaling Framework v2
Source of record
Where this definition comes from
Expanding External Access To Frontier AI Models For Dangerous Capability Evaluations (arXiv 2601.11916), Abstract
“Based on the taxonomy, we propose three descriptive access levels: AL1 (black-box model access and minimal information), AL2 (grey-box model access and substantial information), and AL3 (white-box model access and comprehensive information), to support clearer communication between evaluators, frontier AI companies, and policymakers.”
https://arxiv.org/abs/2601.11916OpenAI GPT-5.6 System Card, s.9.4.6
“UK AISI was provided with extensive grey box access: access to chain-of-thought of the safety reasoning monitor, exact policy wording, and real-time feedback on classifier labels that would not be accessible to real-world attackers.”
https://deploymentsafety.openai.com/gpt-5-6EU GPAI Code of Practice, Safety and Security Chapter, Measure 3.5
“Such access to a model may be provided by Signatories through an API, on-premise access (including transport), access via Signatory-provided hardware, or by making the model parameters publicly available for download, as appropriate.”
https://ec.europa.eu/newsroom/dae/redirection/document/118119
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| Academic proposal (arXiv 2601.11916)Shadow mapping Expanding External Access To Frontier AI Models For Dangerous Capability Evaluations | “"Black-box access (i.e. access to query the system and observe outputs); grey-box access (i.e. limited access to model internals such as input embeddings, hidden neural activations, or log-probabilities); and white-box access (i.e. full access to the system including access to activations, gradients, and the ability to fine-tune the model)"; levels "AL1", "AL2", "AL3" combine model access with information provided.” An academic proposal (17 Jan 2026), not a developer or regulator commitment. The authors state they believe the levels correspond to the EU Code of Practice's standards of appropriate access. | exactEQ confidence: high | Expanding External Access To Frontier AI Models For Dangerous Capability Evaluations (arXiv 2601.11916) |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Appendix 3.4: access "including, as appropriate, access to model activations, gradients, logits (or other forms of raw model outputs), chains-of-thought, and/or other technical details, and access to the model version(s) with the fewest safety mitigations implemented (such as a helpful-only model version, if it exists)"; Measure 3.5: access "through an API, on-premise access (including transport), access via Signatory-provided hardware, or by making the model parameters publicly available for download".” Lists access items and delivery modes but no named levels. | closeCL confidence: high | EU GPAI Code of Practice, Safety and Security Chapter |
| OpenAIShadow mapping OpenAI GPT-5.6 System Card | “"UK AISI was provided with extensive grey box access: access to chain-of-thought of the safety reasoning monitor, exact policy wording, and real-time feedback on classifier labels" (s.9.4.6); SecureBio received "a railfree version of GPT-5.6 Sol. For the assessment, system-level biological risk content filters were disabled" (s.9.1.1.8).” OpenAI's 'grey box' here describes privileged information about the safeguard system rather than model internals, a broader sense than the arXiv definition. | closeCL confidence: medium | OpenAI GPT-5.6 System Card |
| Frontier Model ForumShadow mapping FMF Third-Party Assessments technical report | “"The type and level of access vary by function – confirmation may need model access to replicate tests alongside documentation of methodologies and results, while robustness typically requires more extensive hands-on interaction" (5); open-ended assessors may need "a version with limited safety training" (3.1); future work includes "appropriate model access levels" (6).” No numbered scale. | closeCL confidence: medium | FMF Third-Party Assessments |
| AI Evaluator Forum (AEF-1)Shadow mapping AEF-1: Minimum Operating Conditions for Independent Third Party AI Evaluations | “"1.1 Technical Access Requirement: The evaluator secured sufficient technical access to assess the specific system characteristics being evaluated"; "At a minimum, evaluators must have open-ended black-box access (via a web UI, an API or both, depending on the requirements of the evaluation)".” Verified against the AEF-1 PDF. | closeCL confidence: high | AEF-1: Minimum Operating Conditions for Independent Third Party AI Evaluations (v1, 4 Dec 2025) |
| xAIShadow mapping Grok 4.6 model card | “"an unrestricted configuration of Grok 4.6" provided "to third-party evaluators" (§7).” Names the model configuration, not the access depth. | narrowNR confidence: medium | Grok 4.6 model card |
| AnthropicShadow mapping Anthropic Risk Report, August 2026 | “External testers "all have blocking classifiers enabled, except for a small number of trusted external testers (generally fewer than 10) specifically testing dangerous biological capabilities. Access is for a limited period of time."” Safeguard state of the accessed model, one input to an access record. | narrowNR confidence: medium | Anthropic Risk Report, August 2026 |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Divergence
Where sources materially disagree
'Grey box' is used in two senses. The arXiv taxonomy means limited access to model internals (embeddings, activations, log-probabilities); OpenAI's GPT-5.6 card uses 'grey box access' for privileged information about the safety system (monitor reasoning, policy wording, classifier labels). A record should state the items received, not only the label.
Gap
No developer or regulator has adopted named access levels. The EU Code of Practice lists access items without levels, the Frontier Model Forum lists 'appropriate model access levels' as future work, and the AL1-AL3 ladder is an academic proposal.
