Examples
Examples from published documents
- Google DeepMind: "There are two categories of mitigations to address models with misuse critical capabilities: security mitigations intended to prevent the exfiltration or unauthorized modification of model weights, and deployment mitigations intended to counter the misuse of critical capabilities in external deployments." (Google DeepMind Frontier Safety Framework v3.1, §2.1)
- G42: "If a necessary Deployment Mitigation Level cannot be achieved, then the model's deployment must be restricted; if a necessary Security Mitigation Level cannot be achieved, then further capabilities development of the model must be paused." (G42 Frontier Safety Framework, §2)
Counter-examples
Not to be confused with
- A capability threshold or AI Safety Level used as a capability label says how capable a model is; a safeguard standard says what protection that level requires.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- ASL-3 protections
- ASL-3 protections are the safeguards Anthropic maintains for its current models, which its RSP says include classifier guards at least as robust as its initial Constitutional Classifiers, access controls for trusted users, red-teaming, bug bounties and threat intelligence, and security controls.
- Source: Anthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026
- ASL-3 Deployment Standard
- The ASL-3 Deployment Standard is Anthropic's requirement set for deploying models at the ASL-3 level. Its RSP changelog says general-access systems must pass intensive red-teaming, while internal use and trusted-user deployments require access controls and monitoring.
- Source: Anthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026
- ASL-3 Security Standard
- The ASL-3 Security Standard is Anthropic's security requirement for ASL-3 models. Anthropic says its threat model scopes these protections against non-state actors and unsophisticated insiders, leaving sophisticated insiders and nation-state attackers out of scope.
- Source: Anthropic Risk Report, August 2026
Source of record
Where this definition comes from
Google DeepMind Frontier Safety Framework v3.1, §2.1
“There are two categories of mitigations to address models with misuse critical capabilities: security mitigations intended to prevent the exfiltration or unauthorized modification of model weights, and deployment mitigations intended to counter the misuse of critical capabilities in external deployments.”
https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdfAnthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026, Changelog, RSP v2.0 entry
“Rather than detailing specific operational and technical safeguards, we now specify the overall security or deployment standards and requirements for meeting them.”
https://cdn.sanity.io/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| AnthropicShadow mapping Anthropic Responsible Scaling Policy v3.4 (changelog and Appendix B) | “"ASL-3 Deployment Standard" and "ASL-3 Security Standard"; "Rather than detailing specific operational and technical safeguards, we now specify the overall security or deployment standards and requirements for meeting them." (RSP v2.0 changelog entry); Appendix B: "We still use this concept to refer to, and distinguish between, present levels of risk mitigations"” The Risk Report (Aug 2026, fn 59) stops using ASL-3/ASL-2 terminology for safeguards; the RSP keeps it for present mitigation levels. See divergence_note. | exactEQ confidence: high | Anthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026 |
| Google DeepMindShadow mapping Frontier Safety Framework v3.1 | “"security mitigations intended to prevent the exfiltration or unauthorized modification of model weights, and deployment mitigations intended to counter the misuse of critical capabilities in external deployments" (§2.1); glossary entries "Deployment Mitigations" and "Security Mitigations"” | exactEQ confidence: high | Google DeepMind Frontier Safety Framework v3.1 |
| G42Shadow mapping G42 Frontier Safety Framework | “"Each capability threshold is associated with a required Deployment Mitigation Level (DML) and Security Mitigation Levels (SML), which must be achieved before the capability threshold is reached. If a necessary Deployment Mitigation Level cannot be achieved, then the model's deployment must be restricted; if a necessary Security Mitigation Level cannot be achieved, then further capabilities development of the model must be paused."” | exactEQ confidence: high | G42 Frontier Safety Framework |
| AmazonShadow mapping Amazon's Frontier Model Safety Framework | “"Safety Measures": "designed to prevent the elicitation of the observed Critical Capabilities following deployment of the model." "Security Measures": "designed to prevent unauthorized access to model weights or guardrails implemented as part of the Safety Measures"” Amazon labels the deployment side "Safety Measures". | closeCL confidence: high | Amazon's Frontier Model Safety Framework |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Commitment 5 "Safety mitigations" and Commitment 6 "Security mitigations"; Commitment 6 covers "an adequate level of cybersecurity protection for their models and their physical infrastructure along the entire model lifecycle"” The EU's "safety mitigations" include training-time measures (data filtering, refusal fine-tuning) as well as deployment-time ones. | closeCL confidence: high | EU GPAI Code of Practice, Safety and Security Chapter |
| OpenAIShadow mapping OpenAI Preparedness Framework v2 | “Table 1: "Require security controls meeting High standard (Appendix C.3)"; "Require safeguards against misuse meeting High standard (Appendix C.1) for external deployment"; "Require safeguards meeting High standard against misalignment (Appendix C.2) for large-scale internal deployment"” OpenAI splits the deployment side in two (misuse and misalignment), giving three standards rather than two. | closeCL confidence: medium | OpenAI Preparedness Framework v2 |
| METRShadow mapping METR (common-elements) | “Two separate common elements: "Model Weight Security" ("Information security measures that will be taken to prevent model weight access by unauthorized actors.") and "Model Deployment Mitigations" ("Access and model-level measures applied to prevent the unauthorized use of a model's dangerous capabilities.")” | closeCL confidence: medium | METR (common-elements) |
| MicrosoftShadow mapping Microsoft Frontier Governance Framework | “"Security safeguards are scaled up depending on the model's pre-mitigation scores, with more robust measures applied to models with high and critical risk levels."” Covers the security side only; Microsoft's deployment-side wording is not mapped here. | narrowNR confidence: medium | Microsoft Frontier Governance Framework |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- Meta
Table 1 gives each risk threshold a "Security" entry (e.g. "Initiate protocols for heightened access controls to model weights and security protections to prevent their tampering or exfiltration") and a separate deployment "Measure" (e.g. "Deploy with mitigations"). Related, not a mapping.
Meta Advanced AI Scaling Framework v2
Divergence
Where sources materially disagree
Anthropic's own documents now differ in vocabulary: the RSP v3.4 (Appendix B) still uses ASL levels to describe present mitigation levels, while the August 2026 Risk Report (footnote 59) says "we are no longer using this terminology" for safeguards and instead grades robustness, coverage and exemptions. OpenAI splits the deployment side into separate misuse and misalignment standards. Amazon calls the deployment side "Safety Measures".
Gap
ASL-4 deployment and security standards are not described in RSP v3.4 or the August 2026 Risk Report.
