Examples
Examples from published documents
- OpenAI commits to "moving beyond the flawed approach of re-running capability evaluations on the safeguarded model and towards a more thorough assessment of each safeguard and its efficacy" (OpenAI Preparedness Framework v2, Appendix A)
- Anthropic: "We pay up to $35,000 per novel universal jailbreak identified." (Anthropic Risk Report, August 2026, §4.5.3.1)
Counter-examples
Not to be confused with
- A dangerous-capability evaluation measures what a model can do with safeguards removed; a safeguard evaluation measures whether the safeguards stop that capability being reached.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Safeguards report
- A safeguards report compiles the evidence that a model's safeguards sufficiently reduce severe risk: the ways the risk could be realised, the safeguards mapped to each, their measured efficacy, the residual risk and known limitations. OpenAI and Anthropic both use the term.
- Source: OpenAI Preparedness Framework v2
- Model safety bug bounty
- A model safety bug bounty pays outside researchers for finding ways to bypass a developer's safeguards, especially universal jailbreaks. Anthropic runs one through HackerOne against its biology classifiers and pays up to $35,000 per novel universal jailbreak.
- Source: Anthropic Risk Report, August 2026
Source of record
Where this definition comes from
EU GPAI Code of Practice, Safety and Security Chapter, Appendix 3.3
“Signatories will ensure that the model evaluations assess the effectiveness of their safety mitigations at a breadth and depth appropriate for the extent to which systemic risk acceptance determination depends on the effectiveness of specific mitigations, including under adversarial pressure”
https://ec.europa.eu/newsroom/dae/redirection/document/118119Amazon's Frontier Model Safety Framework, s.2, Safeguards evaluation
“to assess the adequacy of the risk mitigation measures that are applied to a model”
https://www.amazon.science/publications/amazons-frontier-model-safety-framework
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| AmazonShadow mapping Amazon's Frontier Model Safety Framework | “"Safeguards evaluation": "to assess the adequacy of the risk mitigation measures that are applied to a model"” | exactEQ confidence: high | Amazon's Frontier Model Safety Framework |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Appendix 3.3 "Assessing the effectiveness of mitigations", taking into account "(1) the extent to which their mitigations work as planned; (2) the extent to which their mitigations are or have been circumvented, deactivated, or subverted; and (3) the probability that the effectiveness of their mitigations will change in the future."” | exactEQ confidence: high | EU GPAI Code of Practice, Safety and Security Chapter |
| OpenAIShadow mapping OpenAI Preparedness Framework v2 | “"For each identified safeguard, we identify methods to measure their efficacy and an efficacy threshold." (§4.1); Appendix A: "Clarify approach to establishing safeguard efficacy, moving beyond the flawed approach of re-running capability evaluations on the safeguarded model and towards a more thorough assessment of each safeguard and its efficacy"” | exactEQ confidence: high | OpenAI Preparedness Framework v2 |
| Google DeepMindShadow mapping Gemini 3.7 Flash FSF report | “"Evaluations of Training and Model Guardrails": "Coverage", "Adversarial Robustness" and "Impact on Benign Uses: to what extent will beneficial use cases of the model be affected?"” | exactEQ confidence: high | Gemini 3.7 Flash FSF report |
| AnthropicShadow mapping Anthropic Risk Report, August 2026 | “§4.5.3 "Evidence about robustness of classifiers": "We run our Model Safety Bug Bounty Program through HackerOne to incentivize third-party researchers to discover and report vulnerabilities in our AI systems, particularly jailbreaks that could bypass the classifiers against harmful biology discussed here."” | closeCL confidence: medium | Anthropic Risk Report, August 2026 |
| California SB 53Shadow mapping California SB 53 | “Framework topic "(5) Using third parties to assess the potential for catastrophic risks and the effectiveness of mitigations of catastrophic risks."” | broadBR confidence: medium | California SB 53 |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- UK AI Security Institute (AISI)
OpenAI reports: "In all rounds thus far, UK AISI identified universal jailbreaks in the cyber domain, including jailbreaks that allowed for long-form agentic task completion in domains like vulnerability discovery and exploit development." External safeguard testing reported by the developer, not by AISI.
GPT-5.6 deployment safety card
