AI Safety Glossary

Element page: sources and crosswalk · Commitments and governance

Accountable Decision-Maker and Sign-OffNIKOLAI element · N9

An accountable decision-maker is the named person, role or small committee with authority to approve a high-stakes AI safety decision, such as accepting residual risk or deploying a frontier model, recorded together with what was approved, by whom and when.

Also called: Sign-off authority, Executive approval, Deployment go/no-go decision, Final authority, Responsible Scaling Officer (RSO), Corporate officer primarily accountable

Activation classifierTerm

An activation classifier inspects a model's internal activations during generation rather than its text. OpenAI describes pausing streaming to the user when the patterns suggest harmful content, while a separate check decides whether it is harmful.

Defined under Classifier (input and output safeguard classifier)

Source: Turner et al., Steering Language Models With Activation Engineering (2023)

Activation steeringTerm · Alignment research

Activation steering is a technique that changes an AI model's behaviour while it runs by adding a computed direction, called a steering vector, to its internal activations. It can shift properties such as the topic or tone of outputs without retraining the model.

Also called: activation engineering, activation addition, ActAdd, steering vector

Advanced AI Scaling FrameworkTerm

Advanced AI Scaling Framework is Meta's safety framework. Version 2, dated April 7, 2026, succeeded the Frontier AI Framework of February 2025 and covers chemical and biological, cybersecurity and loss-of-control risks.

Defined under Safety framework

Source: NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, Glossary

Adversarial exampleTerm · Risks

An adversarial example is an input deliberately modified, often in ways people cannot notice, so that a machine learning model misclassifies it or misbehaves when deployed. Adversarial examples are the classic evasion attack against AI systems.

Also called: adversarial input

Adversarial machine learningTerm · Risks

Adversarial machine learning is the study of attacks that exploit the statistical, data-driven nature of machine learning systems, such as evasion, poisoning and privacy attacks, and of the defences against them. NIST maintains a standard taxonomy and terminology for the field.

Also called: AML

B

Backdoor attackTerm · Risks

A backdoor attack is a poisoning attack that makes a model behave in an attacker-chosen way whenever an input contains a particular trigger pattern, while behaving normally otherwise. The hidden trigger can be hard to detect by ordinary testing.

Also called: backdoor poisoning attack, trojan

C

Calibrated uncertaintyTerm

Calibrated uncertainty means stated confidence matches observed accuracy: a calibrated system is correct roughly 90% of the time when it states 90% credence. Safety-case research lists calibrated answers as one behavioural property a trustworthiness argument can rely on.

Defined under Likelihood Term

Source: Clymer, Gabrieli, Krueger and Larsen, Safety Cases: How to Justify the Safety of Advanced AI Systems (arXiv 2403.10462, 2024)

California SB 53 (Transparency in Frontier Artificial Intelligence Act)Term · Regulation

California SB 53, the Transparency in Frontier Artificial Intelligence Act, is a state law signed on 29 September 2025. It requires large frontier developers, those training models above 10^26 operations with over $500 million in revenue, to publish a frontier AI framework and report critical safety incidents.

Also called: SB 53, TFAIA, Transparency in Frontier Artificial Intelligence Act

Source: California SB 53 (2025-2026), chaptered bill text

Canary stringTerm

A canary string is a unique marker placed in published evaluation data so that AI developers can detect it and exclude that data from training, keeping test scores from being inflated by memorisation.

Defined under Benchmark

Source: Anthropic Risk Report (August 2026)

Cannot rule outTerm

Cannot rule out is a precautionary threshold status: when the evidence cannot exclude that a model has reached a threshold, the developer treats it as if it had. Google DeepMind designates such models "cannot rule out being at the T/CCL".

Defined under Threshold Status

Capabilities ReportTerm

A Capabilities Report is OpenAI's internal compilation of a covered model's evaluation results and noteworthy observations, submitted to its Safety Advisory Group to decide whether a capability threshold has been reached.

Defined under Risk Report

Capability checkpointTerm

A capability checkpoint, in Meta's Advanced AI Scaling Framework, is the first stage of a two-stage loss-of-control evaluation, checking whether a model has the minimum capabilities required to substantially contribute to a threat scenario before enhanced evaluation.

Defined under Checkpoint Rule

Element page: sources and crosswalk · Thresholds and checkpoints

Capability elicitationTerm

Capability elicitation is the deliberate effort to make an AI model show its full abilities during testing, using techniques such as fine-tuning, prompt optimisation, multi-agent setups and tool access, so that dangerous capabilities are not underestimated.

Defined under Elicitation method

Source: Microsoft Frontier Governance Framework

Capability ThresholdNIKOLAI element · N3

A capability threshold is a pre-defined level of AI model capability, such as being able to meaningfully help someone build a biological weapon, at which a developer commits to stronger safeguards or other decisions before further development or deployment. It describes what a model can do, not how much risk remains after safeguards.

Also called: Critical Capability Level (CCL), Critical Capability Threshold, Enabling capability threshold, Frontier Capability Threshold, High / Critical capability threshold, Capability or usage threshold

CASRAI Declaration ReviewerNIKOLAI element · N10

A CASRAI Declaration Reviewer is the CASRAI editor who approves or rejects a submitted Mapping Declaration. Approval is the only step that can mark a NIKOLAI crosswalk row as declared by an organisation; a rejection must give a written reason, and both decisions record who reviewed and when.

Element page: sources and crosswalk · Assurance roles

Catastrophic outcomeTerm

A catastrophic outcome, in Meta's framework, is an outcome "that would have large scale, devastating, and potentially irreversible harmful impacts on humanity". Meta builds its threshold system by working backwards from these outcomes to threat scenarios.

Defined under Threat Scenario

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Catastrophic riskTerm

Catastrophic risk, in California SB 53, is a foreseeable and material risk that a frontier model materially contributes to more than 50 deaths or serious injuries, or over $1 billion in property damage, in a single incident through specified pathways.

Defined under Severity threshold

Source: California SB 53

CBRNTerm

CBRN stands for chemical, biological, radiological and nuclear. As a risk domain it covers AI enabling CBRN attacks or accidents, for example by lowering barriers to entry for malicious actors in designing or acquiring such weapons.

Defined under Risk domain

Source: EU GPAI Code of Practice, Safety and Security Chapter

CBRN upliftTerm

CBRN uplift is a model's added help towards chemical, biological, radiological or nuclear weapons. Google DeepMind's CBRN uplift level 1 is reached when a model "Provides low to medium resourced actors uplift in reference scenarios resulting in additional expected harm at severe scale".

Defined under Uplift

Source: Google DeepMind Frontier Safety Framework v3.1

Center for AI SafetyTerm · Institutions

The Center for AI Safety (CAIS) is a nonprofit that works to reduce societal-scale risks from AI through safety research, building the research field and advising policymakers and industry.

Also called: CAIS

Source: Center for AI Safety, About

Chain of thoughtTerm · Foundations

Chain of thought is a technique in which an AI model writes out intermediate steps or explanations before its answer. Breaking a hard task into smaller steps can improve accuracy and can indicate how the model arrived at its answer.

Also called: CoT, reasoning trace

D

Dangerous capability evaluationTerm

A dangerous capability evaluation is a test of whether an AI model can do things that could enable severe harm, such as helping with weapons or cyberattacks, used to judge how close it is to a risk threshold.

Defined under Evaluation

Source: Google DeepMind Frontier Safety Framework v3.1

Data contaminationTerm · Evaluation

Data contamination is when an AI model's training data includes the questions of a benchmark later used to test it, so its score is inflated by memory rather than ability. It is one reason benchmark results can overstate what a model can do.

Also called: benchmark contamination, test set contamination

Data poisoningTerm · Risks

Data poisoning is an attack in which an adversary inserts or modifies part of a model's training data so the trained model behaves as the attacker wants, for example by degrading performance or responding to a hidden trigger. NIST classes it as a poisoning attack.

Also called: training data poisoning

E

Early warning evaluationTerm

An early warning evaluation is a test of a model's dangerous capabilities designed to show how close it is to a capability threshold, so that safeguards can be prepared before the threshold is reached. Google DeepMind's framework uses the term.

Defined under Alert Threshold

Source: Google DeepMind Frontier Safety Framework v3.1

Editorial control (evaluation)Term

Editorial control is an evaluator's right to decide how it presents the results of its evaluation, including how it characterises what was tested and the system's performance, without the developer rewriting its conclusions.

Defined under Publication Rights Clause

Source: AEF-1: Minimum Operating Conditions for Independent Third Party AI Evaluations (v1, 4 Dec 2025)

Elicitation budgetNIKOLAI element · N5

An elicitation budget is the amount of compute, tokens, attempts and time an evaluator gives an AI model during testing. A larger budget can reveal capabilities that a short, cheap test would miss, so results are comparable only when budgets are stated.

Also called: Compute budget, Evaluation budget

Element page: sources and crosswalk · Evidence and evaluations

Elicitation methodNIKOLAI element · N5

An elicitation method is a technique used during an AI evaluation to draw out the most a model can do, such as fine-tuning, prompt optimisation, stronger scaffolding and tools, or removing refusals, so the result reflects its full capability rather than its default behaviour.

Also called: Capability elicitation, Model elicitation, Full capability elicitation, Elicitation

Element page: sources and crosswalk · Evidence and evaluations

Embedded evaluatorTerm

An embedded evaluator is a third-party evaluator given ongoing, employee-like access inside an AI developer, such as office desks, badges, laptops and internal tools, to verify safety practices and report incidents, rather than a time-limited engagement.

Defined under Evaluator Access Attestation

Source: We Must Pace the Frontier (essay by Anthropic's CEO)

Emergent capabilitiesTerm · Foundations

Emergent capabilities are abilities of an AI model that appear unexpectedly during training and are hard to predict in advance, even with full knowledge of how the model was trained. They are one reason developers test models for dangerous capabilities before release.

Also called: emergent abilities

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Emerging risk areaTerm

An emerging risk area, in Meta's framework, is an outcome that "may potentially present catastrophic risk and warrant proactive investigation", but for which evaluation methods are "currently too nascent" to bring it into the framework, such as radiological and nuclear risk.

Defined under Out-of-Scope Declaration

Enabling capabilityTerm

An enabling capability, in Meta's framework, is one of "a set of capabilities that are identified as essential to enabling the realization of a threat scenario", such as autonomous offensive operations in Meta's cyber scenarios.

Defined under Threat Scenario

Element page: sources and crosswalk · Evidence and evaluations

EU AI ActTerm · Regulation

The EU AI Act, Regulation (EU) 2024/1689, is the European Union's law setting risk-based rules for AI systems and general-purpose AI models. It entered into force on 1 August 2024 and applies in stages, with general application from 2 August 2026 and some exceptions.

Also called: Artificial Intelligence Act, Regulation (EU) 2024/1689

Source: European Commission, AI Act (regulatory framework page) and Article 113

EU AI OfficeTerm · Institutions

The EU AI Office (European AI Office) is the body within the European Commission that implements the EU AI Act, especially its rules for general-purpose AI models, and enforces those rules. It also supports the development of trustworthy AI across the EU.

Also called: AI Office, European AI Office

Source: European Commission, European AI Office

EvaluationNIKOLAI element · N5

An AI evaluation is a defined test or study that produces evidence about a model's capabilities, its tendencies to behave in certain ways, or how well its safeguards work, using methods such as benchmarks, red-teaming, uplift studies or simulations.

Also called: Model evaluation, Eval, Capability evaluation

Evaluation awarenessTerm

Evaluation awareness is an AI model's ability to tell that it is being tested, and sometimes why, which can change its behaviour so that test results no longer predict how it acts in real deployment.

Defined under Evaluation-validity threat

Element page: sources and crosswalk · Evidence and evaluations

Evaluation runNIKOLAI element · N5

An evaluation run is one execution of an AI evaluation against a specific model version and configuration, or a declared batch of such executions, recorded with its settings, number of attempts, scoring rule, date and result.

Also called: Model evaluation run

Evaluation suiteTerm

An evaluation suite is a named collection of related tasks or benchmarks run together and reported as a group, revised over time as tasks saturate, prove flawed or are replaced with harder ones.

Defined under Benchmark

Element page: sources and crosswalk · Evidence and evaluations

Evaluation-validity threatNIKOLAI element · N5

An evaluation-validity threat is any condition that makes an AI evaluation's result a poor guide to the model's real behaviour, such as sandbagging, evaluation awareness, alignment faking or reward hacking, so that the test can understate or overstate the model's real capabilities or risks.

Also called: Evaluation integrity threat

Evaluator Access AttestationNIKOLAI element · N8

An evaluator access attestation is a statement, confirmed by both the AI developer and the outside evaluator, of what access the evaluator received and was denied: model versions, safeguards, reasoning traces, documents, staff and systems, for how long, and under what confidentiality terms.

Also called: Evaluator access terms, Terms of engagement, Access and resources disclosure, Sufficient Access and Resources, Appropriate access

Element page: sources and crosswalk · Transparency and review

Evaluator Independence and Conflict of InterestNIKOLAI element · N8

Evaluator independence is the absence of financial, organisational or personal ties that could bias an outside evaluator's judgement of an AI developer, demonstrated through conflict-of-interest disclosures, recusals and funding terms that do not depend on the results.

Also called: Conflict of interest (evaluator), Independence of judgment, Methodological independence, Minimized Conflicts of Interest, Assessor independence

Element page: sources and crosswalk · Transparency and review

Evaluator Safe HarbourNIKOLAI element · N8

An evaluator safe harbour is a developer's commitment not to take legal or technical action against an outside evaluator for testing its AI model within an agreed scope or for publishing the findings, usually conditioned on responsible disclosure.

Also called: Safe harbor, Non-retaliation clause, Legal safe harbor for evaluators, Researcher safe harbour

Element page: sources and crosswalk · Transparency and review

Evaluator shoppingTerm

Evaluator shopping is the risk that AI developers choose whichever evaluators will ask the least of them and judge most generously; proposed remedies include government rating of evaluators and random assignment of highly rated ones.

Defined under Evaluator Independence and Conflict of Interest

Source: Anthropic Advanced AI Framework

Evidence dilemmaTerm · Governance

The evidence dilemma is the problem policymakers face when they must decide about a fast-moving technology before strong evidence of its benefits and risks exists, weighing the danger of ineffective or unnecessary rules against the danger of serious harm without safeguards.

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Executive Order 14179Term · Regulation

Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, was signed on 23 January 2025. It set a US policy of sustaining global AI dominance, ordered an AI Action Plan and directed review of actions taken under the revoked Executive Order 14110 of 2023.

Also called: EO 14179, Removing Barriers to American Leadership in Artificial Intelligence

Source: Federal Register, Executive Order 14179 (90 FR 8741)

Executive Order 14365Term · Regulation

Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, was signed on 11 December 2025. It calls for a minimally burdensome national AI standard and creates a Justice Department AI Litigation Task Force to challenge state AI laws inconsistent with that policy.

Also called: EO 14365, Ensuring a National Policy Framework for Artificial Intelligence

Source: Federal Register, Executive Order 14365 (90 FR 58499)

Executive Order 14409Term · Regulation

Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security, was signed on 2 June 2026. It orders a classified benchmark of AI cyber capabilities, a threshold for 'covered frontier models' and a voluntary scheme giving the government up to 30 days of access before release to other trusted partners.

Also called: EO 14409, Promoting Advanced Artificial Intelligence Innovation and Security

Source: Federal Register, Executive Order 14409 (91 FR 34565)

Exemption (reduced-safeguard or trusted access)NIKOLAI element · N6

An exemption is an approved arrangement that lets named, vetted users or organisations use an AI model with some safeguards reduced or switched off, usually for legitimate research or defensive work, under conditions such as vetting, continued monitoring and the right to revoke access.

Also called: Bioclassifier exemption, Safeguard exemption, Structured access

Element page: sources and crosswalk · Mitigations and security

Existential riskTerm · Risks

An existential risk is one where an adverse outcome would either annihilate Earth-originating intelligent life or permanently and drastically curtail its potential, in philosopher Nick Bostrom's 2002 definition. Bostrom listed a superintelligence pursuing flawed goals among the possible causes.

Also called: x-risk, extinction risk

Source: Nick Bostrom, Existential Risks: Analyzing Human Extinction Scenarios and Related Hazards, Journal of Evolution and Technology 9(1), 2002

Expected damagesTerm

Expected damages, as Anthropic's August 2026 Risk Report uses the term, are "the probability of each potential harm times the size of the harm, summed over all potential harms". Anthropic ranks threat models partly on rough estimates of them.

Defined under Risk Prioritisation Criteria

Source: Anthropic Risk Report, August 2026

Expert consultationTerm

Expert consultation is the use of specialists' judgement to estimate risks that lack historical data. The Frontier Model Forum notes that quantitative frontier AI risk numbers are often estimates based on expert consultation rather than historical base rates.

Defined under Likelihood Term

Source: Frontier Model Forum: Risk Taxonomy and Thresholds

Expert red teamingTerm

Expert red teaming uses domain specialists, such as virologists or security professionals, who probe an AI model for dangerous information in their field and score what they obtained against a rubric.

Defined under Red-team exercise

Source: NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 2023

Expert upliftTerm

Expert uplift is help that lets an already skilled specialist go further, such as developing a novel threat. Microsoft's High CBRN level covers "a meaningful uplift to an expert's (PhD level education in related fields) ability to develop and deliver a novel CBRN threat".

Defined under Uplift

Source: Microsoft Frontier Governance Framework (Feb 2026)

ExplainabilityTerm · Alignment research

Explainability is the ability to describe the mechanisms behind how an AI system works, while interpretability, in NIST's usage, is the meaning of the system's outputs in the context of its purpose. Together they help operators and users understand and trust a system.

Also called: explainable AI, XAI

External deploymentTerm

External deployment is releasing a model to people or organisations outside the developer, from small private releases to trusted testers up to general releases to the public, as Google DeepMind's framework defines it.

Defined under Deployment type

Source: Google DeepMind Frontier Safety Framework v3.1

External Evaluator ReportNIKOLAI element · N8

An external evaluator report is the document in which an outside evaluator publishes its findings about an AI model, risk report or developer, stating scope, methods, limitations, disagreements and redactions, and who controlled the final text.

Also called: External report, Evaluator review, Public commentary, Assessment report, Third-party evaluation report

Element page: sources and crosswalk · Transparency and review

External ReviewNIKOLAI element · N8

External review is an assessment of an AI model, a risk report, a safeguard or a developer's compliance with its own safety framework, carried out by a party outside the developer, whose findings are recorded with the review's type, scope and output.

Also called: Third-party assessment, External evaluation, Independent external evaluation, External safety testing, Third-party review

Element page: sources and crosswalk · Transparency and review

External validityTerm

External validity is the degree to which a model evaluation's results can be used as a proxy for the model's behaviour outside the evaluation environment. The EU GPAI Code treats it as part of the scientific rigour expected of evaluations.

Defined under Limitation

Source: EU GPAI Code of Practice, Safety and Security Chapter

F

Final deployed checkpointTerm

A final deployed checkpoint is the exact model version that is released to users. xAI's Grok 4.6 card states that its evaluation results are on the final deployed checkpoint unless stated otherwise.

Defined under Model identifier

Source: Grok 4.6 model card

Fine-tuningTerm · Foundations

Fine-tuning is further training of an already trained AI model on additional data, either to adapt it to a specific task or to make it more useful in general. Fine-tuning can add safety behaviour, but it can also be used to remove it.

G

General-purpose AITerm

General-purpose AI, in the International AI Safety Report, refers to AI models and systems that can perform a wide variety of tasks, as opposed to systems specialised for a single task.

Defined under Model identifier

Source: International AI Safety Report 2026

General-Purpose AI Code of PracticeTerm · Regulation

The General-Purpose AI Code of Practice is a voluntary code, published on 10 July 2025 and prepared by independent experts, that helps providers of general-purpose AI models comply with the EU AI Act. It has three chapters: Transparency, Copyright, and Safety and Security.

Also called: GPAI Code of Practice, EU Code of Practice

Source: European Commission, The General-Purpose AI Code of Practice

General-purpose AI modelTerm

A general-purpose AI model, under EU AI Act Article 3(63), is an AI model that displays significant generality, can competently perform a wide range of distinct tasks, and can be integrated into a variety of downstream systems or applications.

Defined under Model identifier

Source: EU AI Act Article 3 (Definitions)

General-purpose AI system (EU AI Act)Term · Regulation

A general-purpose AI system, under the EU AI Act, is an AI system based on a general-purpose AI model that can serve a variety of purposes, whether used directly or built into other AI systems. A chatbot built on such a model is an example.

Also called: GPAI system

H

HallucinationTerm · Risks

A hallucination is false or erroneous content that a generative AI system produces and presents confidently as if it were true. NIST calls the problem confabulation, a category that also covers outputs contradicting the prompt or the system's own earlier statements.

Also called: confabulation, fabrication

I

If-then commitmentTerm

An if-then commitment is a promise of the form: if a model reaches a stated capability, then specified safety measures will be in place. The Frontier Model Forum describes frontier AI frameworks as built on this if-then structure.

Defined under Checkpoint Rule

Source: FMF Risk Taxonomy and Thresholds

Imminent-risk disclosureTerm

Imminent-risk disclosure is the 24-hour duty under California SB 53 and New York's RAISE Act to tell an appropriate authority, such as a law enforcement or public safety agency, when a critical safety incident poses an imminent risk of death or serious physical injury.

Defined under Incident reporting deadline and recipient

Source: California SB 53 (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025

Impact on benign usesTerm

Impact on benign uses is the cost a safeguard imposes on legitimate users, meaning how far harmless use cases are affected by refusals or blocks. Google DeepMind assesses it alongside coverage and adversarial robustness when evaluating safeguards.

Defined under Coverage level

Source: Clymer, Gabrieli, Krueger and Larsen, Safety Cases: How to Justify the Safety of Advanced AI Systems (arXiv 2403.10462, 2024)

Inability argumentTerm

An inability argument claims an AI system cannot cause an unacceptable outcome in any realistic setting, even without safeguards, typically shown by its failure on red-team-designed proxy tasks after strong capability elicitation.

Defined under Safety Case Argument Type (Inability, Control, Trustworthiness)

IncidentNIKOLAI element · N7

An incident, in frontier-AI safety reporting, is an event in which the development, use or malfunction of an AI model causes harm, or a safety or security failure that could lead to harm, such as unauthorised access to model weights or a model evading its developer's controls.

Also called: Critical safety incident, Serious incident, AI incident, AI safety incident, Critical incident, Major incident

Incident disclosureNIKOLAI element · N7

Incident disclosure describes who is told about an AI incident and how: a confidential report to a regulator, notices to affected organisations, anonymised statistics published by the authority, or a full public write-up by the developer or evaluator. Several statutes keep the filed reports themselves confidential.

Also called: Public disclosure

Incident identifierTerm

Incident identifier is a single reference that links every report about the same incident so duplicates from different reporters can be merged. US Senate bill S. 5061, which has not been enacted, would have NIST develop processes for assigning one.

Defined under Incident report

Source: S. 5061 (119th Congress)

Incident reportNIKOLAI element · N7

An incident report is the formal record of an AI incident that a developer submits to a regulator or other authority, stating at least when it happened, why it qualifies, what happened and the model involved, and later updated with causes and the response taken.

Also called: Critical safety incident report, Serious incident report

Incident reportingTerm

Incident reporting is a formal notification submitted to a designated government body or authority that a qualifying AI safety or security incident has occurred. It is reactive, triggered by an event that meets defined criteria, and usually required by law or agreement.

Defined under Incident reporting deadline and recipient

Source: Frontier Model Forum -- Information Sharing Issue Brief

Incident reporting deadline and recipientNIKOLAI element · N7

An incident reporting deadline is the time limit within which an AI developer must report a qualifying incident to a named authority, counted from discovery of the incident or awareness of the model's involvement. Current deadlines run from 24 hours for imminent danger to 15 days, depending on the law and the harm.

Also called: Reporting timeline, Reporting deadline

Incident responseTerm

Incident response is the coordinated process of containing, mitigating and recovering from an incident once it has been identified. It is real-time and operational, and is led mainly by the affected developer's technical, legal and security teams.

Defined under Incident

Source: Frontier Model Forum -- Information Sharing Issue Brief

Incident response planTerm

Incident response plan is a developer's documented procedure for identifying and responding to incidents. OpenAI's AI Safety Incident Response Plan, for example, sets steps for detection, triage, severity, investigation, mitigation and deciding whether an incident must be reported externally.

Defined under Incident

Source: OpenAI Frontier Governance Framework

Incident severityNIKOLAI element · N7

Incident severity is a rating of how serious an AI incident is, judged by the kind and scale of harm it caused or could have caused. Severity decides how fast an incident is escalated inside the developer, which reporting deadline applies, and how much detail the report must contain.

Also called: Seriousness

Incident statusNIKOLAI element · N7

Incident status is the stage an AI incident has reached in its lifecycle, from suspected or potential, through confirmed and contained, to remediated or resolved. It tells a regulator whether further reports are still due and whether corrective measures have been adopted.

Also called: Incident lifecycle

Incident typeNIKOLAI element · N7

An incident type is the category an AI incident falls into, such as unauthorised access to model weights, harm from a catastrophic risk, loss of control of a model, deceptive subversion of a developer's controls, or a security breach. Some regimes, such as the EU Code of Practice, set the reporting deadline by type.

Also called: Incident classification

Independent verification organizationTerm

Independent evaluatorTerm

An independent evaluator is an outside organisation assessing an AI developer's models or risk reports that has no financial interest in that developer and no major conflicts of interest among the people conducting the review.

Defined under Evaluator Independence and Conflict of Interest

Source: Anthropic Advanced AI Framework

An independent verification organization (IVO) is, in the introduced US FRONTIER Act, a licensed private body that assesses a very large frontier developer's safety framework and risk mitigation at least every six months.

Defined under Third-Party Evaluator

Source: FRONTIER Act, 119th Congress (H.R. 9925, introduced, not enacted)

Indicative thresholdTerm

An indicative threshold, in OpenAI's Preparedness Framework, is a pre-set score on an automated evaluation that indicates a model may have reached a capability threshold. It informs, but does not by itself decide, the threshold determination.

Defined under Threshold Operationalisation

Indirect prompt injectionTerm · Risks

Indirect prompt injection is prompt injection planted in content an AI system will read rather than typed by the user, such as a web page, email or document retrieved during a task. It lets attackers control AI applications they cannot access directly.

J

JailbreakTerm

A jailbreak is an adversarial prompt or technique designed to get around an AI model's refusal training or safeguards and obtain harmful help that the model would normally decline to give.

Defined under Red-team exercise

Jailbreak robustnessTerm

Jailbreak robustness is how well a model and its safeguards resist attempts to bypass refusals or filters. Google DeepMind's framework treats refusal rate and jailbreak robustness together as evidence of whether threat actors could circumvent safeguards.

Defined under Robustness level

Source: Google DeepMind Frontier Safety Framework v3.1

K

Know your customer (KYC)Term

Know your customer (KYC) is verifying the identity of people or organisations before giving them access to a model, so misuse can be traced and banned users cannot simply open new accounts. OpenAI lists KYC among its trust-based access safeguards.

Defined under Access control (who may use a model and its capabilities)

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

L

Large frontier developerTerm

Large frontier developer, in California SB 53, is a frontier developer that, together with its affiliates, had annual gross revenues above $500 million in the preceding calendar year. It carries the Act's framework and reporting duties.

Defined under Developer

Source: California SB 53

Large language model (LLM)Term · Foundations

A large language model (LLM) is an AI model trained on very large amounts of text to perform language tasks such as generating, translating or summarising text. Most current chatbots and AI agents are built on large language models.

Also called: LLM, language model

M

Machine learning (ML)Term · Foundations

Machine learning (ML) is the branch of AI that builds algorithms and models which learn from data instead of being explicitly programmed. Nearly all of today's general-purpose AI systems are produced by machine learning.

Also called: ML

MalfunctionTerm · Risks

A malfunction is an AI system failing to work as its developer or user intended, producing wrong or harmful outputs or disrupting operations. The International AI Safety Report uses malfunctions as one of its three main risk categories, alongside malicious use and systemic risks.

Also called: AI malfunction, system failure

N

Narrow AITerm · Foundations

Narrow AI is an AI model or system built to do one specific task or a few closely related ones, such as ranking web search results, classifying animal species or playing chess. It is the opposite of general-purpose AI, which can handle a wide variety of tasks.

Also called: specialised AI

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

National Institute of Standards and Technology (NIST)Term · Institutions

The National Institute of Standards and Technology (NIST) is a US federal agency within the Department of Commerce, founded in 1901, that advances measurement science and standards. In AI it publishes the AI Risk Management Framework and hosts the government's AI evaluation centre.

Also called: NIST

Source: NIST, About NIST; NIST AI Risk Management Framework page

Near missNIKOLAI element · N7

A near miss is an event in which an AI incident could have happened but did not, because the harm failed to materialise or was stopped in time. Near misses usually fall below formal reporting thresholds but are tracked as early warnings.

Also called: Near-miss

Net new riskTerm

Net new risk is harm that could not currently be achieved with existing tools and resources without access to frontier or general-purpose AI. OpenAI's and Meta's frameworks use it as a test for which risks to track.

Defined under Marginal versus Absolute Risk Basis

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Neural networkTerm · Foundations

A neural network is a type of AI model made of layers of interconnected nodes, loosely inspired by biological neurons, that learns from data by adjusting the strength of the connections between nodes. Current general-purpose AI systems are neural networks.

Also called: artificial neural network

New York RAISE ActTerm · Regulation

The New York RAISE Act (Responsible AI Safety and Education Act) is a state law requiring large frontier AI developers to publish safety plans and report certain safety incidents to the state. A 2026 amendment (S8828) aligned it with California SB 53; it takes effect on 1 January 2027.

Also called: RAISE Act, Responsible AI Safety and Education Act

Source: New York Senate Bill S8828 (2025-2026 session), signed as Chapter 96 of 2026

NIST AI 600-1 (Generative AI Profile)Term · Regulation

NIST AI 600-1, the Generative Artificial Intelligence Profile, is a July 2024 companion to the NIST AI Risk Management Framework. It defines risks that generative AI creates or worsens, such as confabulation and information security risks, and suggests actions for managing them.

Also called: Generative AI Profile, GAI Profile

O

OECD.AITerm · Institutions

OECD.AI is the OECD's online platform for promoting trustworthy, human-centred AI. It tracks national AI policies and progress on the OECD AI Principles, and hosts the reporting framework through which organisations developing advanced AI share information on their risk management.

Also called: OECD AI Policy Observatory

P

Partnership on AITerm · Institutions

Partnership on AI (PAI) is a non-profit partnership of academic, civil society, industry and media organisations that develops tools, recommendations and other resources so that AI advances positive outcomes for people and society.

Also called: PAI

Q

Qualitative risk scoreTerm

A qualitative risk score expresses an estimated risk in words, such as "moderate" or "critical", instead of numbers. The EU GPAI Code allows it alongside risk matrices and probability distributions.

Defined under Risk Level

Source: EU GPAI Code of Practice, Safety and Security Chapter

R

Race to the bottomTerm

A race to the bottom, in frontier AI, is competitive pressure that pushes developers to weaken safety measures to keep pace with rivals. OpenAI's Preparedness Framework says it would keep safeguards "more protective than the other AI developer" to avoid one.

Defined under Industry-Wide Recommendation

Source: RAND, Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (Nevo et al., 2024, RR-A2849-1)

Railfree versionTerm

A railfree version is OpenAI's term for a model version supplied to evaluators with system-level content filters disabled, used in GPT-5.6 biological-risk testing.

Defined under Model Access Level

Source: OpenAI GPT-5.6 System Card

RAND security levelsTerm

RAND security levels are five levels, SL1 to SL5, proposed in RAND's 2024 report Securing AI Model Weights. Each is defined as security able to thwart an increasingly capable category of attacker; RAND says the levels are not meant to be used as a standard.

Defined under Security level

Randomised controlled trial (uplift)Term

A randomised controlled trial, in AI safety, randomly assigns participants to work with or without AI access on the same tasks, so that differences in success can be attributed to the AI rather than to the participants.

Defined under Uplift study

Rate limitingTerm

Rate limiting caps how much a user or account can query a model in a period. OpenAI lists rate limits as an access condition that can vary across actors, and the EU Code cites output rate limiting against weight exfiltration.

Defined under Access control (who may use a model and its capabilities)

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Reasoning systemTerm · Foundations

A reasoning system is a general-purpose AI system that works through intermediate steps, called a chain of thought, before giving its final answer. Spending extra computation on these steps at the time of use tends to improve performance on complex problems.

Also called: reasoning model

Reassessment TriggerNIKOLAI element · N3

A reassessment trigger is an event that requires an AI model that has already been assessed for safety to be assessed again, such as a material increase in its capabilities, a serious incident, a change in how it is deployed, or new evidence that the earlier assessment no longer holds.

Also called: Trigger point, Model Report update trigger, Material capability change

Element page: sources and crosswalk · Thresholds and checkpoints

Recursive self-improvementTerm

Recursive self-improvement is AI systems speeding up the development of more capable AI systems, which then speed it up further. Anthropic says its automated R&D threshold "is intended to capture the onset of dramatic recursive self-improvement"; OpenAI tracks "AI Self-improvement".

Defined under Threat Model

Source: Anthropic Responsible Scaling Policy v3.4

Recusal (evaluation)Term

Recusal in AI evaluation means excluding staff with a significant financial interest in the developer, such as direct equity, from defining or running the evaluation or approving its findings.

Defined under Evaluator Independence and Conflict of Interest

Source: AEF-1: Minimum Operating Conditions for Independent Third Party AI Evaluations (v1, 4 Dec 2025)

Red lineTerm

A red line is a limit an organisation says must not be crossed. Magic's AGI Readiness Policy says that if risk for a threat model passes a red line, it will adopt safety measures, in the worst case delaying or pausing development.

Defined under Halt Condition

Source: Magic AGI Readiness Policy

Red-team exerciseNIKOLAI element · N5

A red-team exercise is a structured attempt by experts or automated tools to make an AI model behave harmfully or to get around its safeguards, using techniques a real attacker might use, so that weaknesses can be found and fixed before or after release.

Also called: Red teaming, Red-teaming, Adversarial testing, Red-teaming engagement

Element page: sources and crosswalk · Evidence and evaluations

RedactionNIKOLAI element · N8

A redaction is the removal of information from the public version of an AI safety document, such as a risk report or model card, recorded with where it occurred, how much was removed, why, who decided, and a notice that it happened.

Also called: Redaction record, Redaction disclosure, Redaction summary, Redaction disclaimer

Element page: sources and crosswalk · Transparency and review

Redaction disclaimerTerm

A redaction disclaimer is a notice on an evaluator's publication stating what authority the developer or another party had to edit or redact it, whether that authority was used, and what was removed.

Defined under Redaction

Source: AEF-1: Minimum Operating Conditions for Independent Third Party AI Evaluations (v1, 4 Dec 2025)

Redaction reasonNIKOLAI element · N8

A redaction reason is the stated ground for withholding information from a published AI safety document, such as trade secrets, security, public safety, national security, privacy or legal compliance, drawn from a list that can also name grounds that are not allowed.

Also called: Redaction ground, Redaction justification, Character and justification of the redaction

Element page: sources and crosswalk · Transparency and review

Redaction summary statementTerm

A redaction summary statement is a short notice at the top of an evaluator's report saying whether the developer's redactions removed anything important to the evaluator's conclusions.

Defined under Redaction

Source: METR: OpenAI-Hugging Face incident investigation

Refusal trainingTerm

Refusal training is fine-tuning a model to decline requests that would help cause severe harm, or to give low-risk answers instead. OpenAI lists it as an example safeguard supporting the claim that malicious users cannot elicit a dangerous capability.

Defined under Safeguard

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Reinforcement learningTerm · Foundations

Reinforcement learning is a machine learning technique that improves a model by rewarding desirable outputs or actions and penalising undesirable ones. It is widely used in post-training, and poorly designed rewards can teach unintended behaviour.

Also called: RL

Reinforcement learning from AI feedback (RLAIF)Term · Alignment research

Reinforcement learning from AI feedback (RLAIF) is a training method in which an AI model, rather than human raters, judges which of two responses is better, and those judgements train the reward signal used to improve the model.

Also called: RLAIF, RL from AI feedback

Source: Bai et al., Constitutional AI: Harmlessness from AI Feedback (Anthropic, 2022)

Reinforcement learning from human feedback (RLHF)Term · Alignment research

Reinforcement learning from human feedback (RLHF) is a training method in which people compare or rate a model's outputs and their preferences become the reward signal used to refine the model. It is a standard way to make chatbots more helpful and less harmful.

Also called: RLHF, RL from human feedback

S

SafeguardNIKOLAI element · N6

A safeguard is a technical or procedural measure that reduces the risk of an AI model being misused or acting harmfully, such as refusal training, input and output classifiers, monitoring, access controls or protection of model weights. Frameworks group safeguards by the risk they target and where they apply.

Also called: Safety mitigation, Safety Measures, Required Safeguards, Preparedness Safeguards

Element page: sources and crosswalk · Mitigations and security

Safeguard evaluationNIKOLAI element · N6

A safeguard evaluation tests whether an AI safeguard actually works against the risk it targets, for example by red-teaming a misuse classifier, running jailbreak bug bounties or measuring how often harmful requests get through and harmless ones get blocked.

Also called: Safeguards evaluation, Safeguard efficacy assessment, Safeguards assessment, Safeguard red-teaming

Element page: sources and crosswalk · Mitigations and security

Safeguard standard (deployment standard and security standard)NIKOLAI element · N6

A safeguard standard is a required set of protections tied to a risk level, split into a deployment standard, which stops a model's dangerous capabilities from being misused in use, and a security standard, which stops the model's weights from being stolen or tampered with.

Also called: Deployment standard, Security standard, Deployment Mitigation Level (DML), Security Mitigation Level (SML), Deployment mitigations, Security mitigations

Element page: sources and crosswalk · Mitigations and security

Safeguards reportTerm

A safeguards report compiles the evidence that a model's safeguards sufficiently reduce severe risk: the ways the risk could be realised, the safeguards mapped to each, their measured efficacy, the residual risk and known limitations. OpenAI and Anthropic both use the term.

Defined under Safeguard evaluation

Safety Advisory GroupTerm

The Safety Advisory Group (SAG) is OpenAI's internal body that oversees the design, implementation and adherence to the Preparedness Framework and makes expert recommendations on safeguards and deployment, which OpenAI leadership can approve or reject.

Defined under Accountable Decision-Maker and Sign-Off

Safety and Security CommitteeTerm

The Safety and Security Committee (SSC) is the OpenAI board committee that, under the Preparedness Framework, has visibility into safety processes and can review decisions and require reports from OpenAI leadership; the Board may reverse a decision.

Defined under Board or Trust Oversight

Element page: sources and crosswalk · Claims and argument

Safety and Security FrameworkTerm

Safety and Security Framework is the EU General-Purpose AI Code of Practice term for the document outlining the systemic risk management processes and measures a signatory uses to keep risks from its models acceptable.

Defined under Safety framework

Source: EU GPAI Code of Practice, Safety and Security Chapter

Safety and Security Model ReportTerm

A Safety and Security Model Report ("Model Report") is the document an EU GPAI Code signatory gives the AI Office before placing a model on the market, describing the model, its systemic risk assessment and mitigations, and why the risks are acceptable.

Defined under Risk Report

Source: EU GPAI Code of Practice, Safety and Security Chapter

Safety Case Argument Type (Inability, Control, Trustworthiness)NIKOLAI element · N4

A safety case argument type names the kind of reason a safety case gives: inability (the AI cannot cause the harm even without safeguards), control (it cannot given the safeguards), trustworthiness (it could but reliably behaves well), or deference (trusted AI advisors judge it safe).

Also called: Safety argument category, Inability argument, Control argument, Trustworthiness argument, Deference argument

Safety Case (Assurance Argument)NIKOLAI element · N4

A safety case is a structured argument, supported by evidence, that a system is acceptably safe for a specific use in a specific environment. In frontier AI it breaks a top-level safety claim into sub-claims, each backed by evaluations or other evidence, so that reviewers can test the reasoning.

Also called: Assurance argument, Safety argument, Safeguards case, Affirmative case

Element page: sources and crosswalk · Claims and argument

Safety case reportTerm

A safety case report is a document that summarises the arguments and evidence of a safety case and records progress against the safety programme, often issued at milestones. The term comes from UK defence safety practice (Def Stan 00-56).

Defined under Safety Case (Assurance Argument)

Source: UK Ministry of Defence, SMP12: Safety Case and Safety Case Report (v2.2)

Safety case reviewTerm

A safety case review is a pre-launch analysis, run by Google DeepMind when a model reaches a relevant Critical Capability Level, that demonstrates how risks have been reduced to manageable levels; it also covers large internal deployments for advanced ML R&D levels.

Defined under Safety Case (Assurance Argument)

Source: Google DeepMind blog: Strengthening our Frontier Safety Framework

Safety case sketchTerm

A safety case sketch is a detailed but partial outline of the arguments and evidence a future safety case might use for one safety method. UK AISI builds sketches as building blocks because full safety cases for advanced models are not yet possible.

Defined under Safety Case (Assurance Argument)

Source: UK AI Security Institute blog: Safety cases at AISI (Irving, 23 Aug 2024)

Safety case templateTerm

A safety case template sets out the argument structure and evidence for one part of an AI safety case, such as a cyber inability argument, so it can serve as a building block for a full safety case later.

Defined under Safety Case (Assurance Argument)

Source: Goemans, Buhl, Schuett, Korbak, Wang, Hilton and Irving, Safety case template for frontier AI: A cyber inability argument (arXiv 2411.08088, 2024)

Safety cultureTerm

Safety culture, called a "healthy risk culture" in the EU GPAI Code of Practice, is the set of norms that lets staff challenge risk decisions, raise concerns without fear of retaliation and know the channels and whistleblower protections available to them.

Defined under Noncompliance and Whistleblower Reporting

Source: EU GPAI Code of Practice, Safety and Security Chapter

Safety fine-tuningTerm · Safeguards

Safety fine-tuning is additional training of an already trained AI model on data chosen to make it safer, for example teaching it to refuse dangerous requests. It is one of the main deployment safeguards, though later fine-tuning can undo it.

Also called: safety training, safety post-training

T

Test-time computeTerm

Test-time compute is the computation an AI model spends while answering, for example by reasoning for longer or sampling more candidate answers; raising it can raise scores, so evaluators adjust it during elicitation.

Defined under Elicitation budget

Source: EU GPAI Code of Practice, Safety and Security Chapter

Third-party assessmentTerm

Third-party assessment is the industry term for an evaluation of a frontier model by an outside party to confirm developer evaluations or safety claims, test them with independent methods, or add specialist expertise the developer lacks.

Defined under External Review

Source: FMF Third-Party Assessments

Third-party compliance auditTerm

A third-party compliance audit is an independent auditor's examination of whether a developer has substantially complied with its own frontier AI framework. The proposed US FRONTIER Act (H.R. 9925) would require one each year, signed by a lead auditor.

Defined under Framework Adherence Review

Source: FRONTIER Act, 119th Congress (H.R. 9925, introduced, not enacted)

Third-party evaluationTerm

Third-party evaluation is testing of an AI system by an organisation independent of its developer, valued for avoiding the conflict of interest that arises when providers evaluate their own systems.

Defined under Third-Party Evaluator

Source: AEF-1: Minimum Operating Conditions for Independent Third Party AI Evaluations (v1, 4 Dec 2025)

Third-Party EvaluatorNIKOLAI element · N8

A third-party evaluator is an organisation outside an AI developer that tests the developer's models or reviews its safety claims, safeguards or risk reports, contributing independent methods or expertise that the developer's own teams do not supply.

Also called: Third-party assessor, Independent external evaluator, External evaluator, Qualified independent evaluator, Independent verification organization (IVO)

Element page: sources and crosswalk · Transparency and review

Threat Actor Capability (TAC) levelsTerm

Threat Actor Capability (TAC) levels are Google DeepMind's four-step cyber attacker scale, from TAC-1, a "programmer with limited cybersecurity knowledge", to TAC-4, a "95th+ percentile cybersecurity expert (e.g., nation-state-sponsored groups)".

Defined under Threat-Actor Profile

Element page: sources and crosswalk · Threat models and risk framing

Threat-Actor ProfileNIKOLAI element · N2

A threat actor profile describes the adversary that a safety threshold or safeguard is designed around: their skill, resources, team size and access, from a lone novice to a well-resourced state programme. Recording it as a tiered value lets readers compare thresholds across frameworks.

Also called: threat actor type, Threat Actor Capability (TAC) level, actor profile

Threat ModelNIKOLAI element · N2

A threat model is a structured statement of how an AI system could contribute to a severe harm: who might cause it, by what means, what role the AI plays and how large the harm could be. Safety frameworks use threat models to decide which capabilities to measure and which safeguards to require.

Also called: risk model, systemic risk model

Element page: sources and crosswalk · Threat models and risk framing

Threat ScenarioNIKOLAI element · N2

A threat scenario is a concrete description of how a specific harm could unfold with an AI model's help: who acts, what they attempt, which steps they must complete and which model capabilities would make the difference. Developers test models against threat scenarios to judge whether a risk threshold is reached.

Also called: systemic risk scenario, risk scenario

Element page: sources and crosswalk · Threat models and risk framing

Threshold ChangeNIKOLAI element · N3

A threshold change is a revision to the wording, level or consequence of a capability threshold in an AI safety framework, recorded with the old text, the new text, the framework version and the stated reason. It matters because results reported under different threshold versions may not be comparable.

Also called: Threshold revision, Threshold diff, Threshold recalibration

Element page: sources and crosswalk · Thresholds and checkpoints

Threshold OperationalisationNIKOLAI element · N3

Threshold operationalisation is the concrete, testable wording that turns a capability threshold described in words into a check an evaluator can run, such as a benchmark score, a pass rate on a set of challenges, or a stated test of when the threshold counts as met.

Also called: Operationalised threshold, Indicative threshold, Threshold test, Risk acceptance criterion (metric form)

Element page: sources and crosswalk · Thresholds and checkpoints

Threshold StatusNIKOLAI element · N3

Threshold status is the recorded finding about where an AI model stands against a capability threshold: not reached, approaching (an alert threshold reached), cannot be ruled out and so treated as reached, or reached. A complete status record carries the date, the evidence relied on and who made the determination.

Also called: Threshold determination, Capability designation, CCL reached? (Google DeepMind model cards)

Element page: sources and crosswalk · Thresholds and checkpoints

Time horizonTerm

A model's 50% time horizon is the length of tasks, measured by how long skilled humans take to complete them, that the AI model can finish with a 50% success rate; METR uses it to track agent capability over time.

Defined under Human baseline

Source: METR, "Measuring AI Ability to Complete Long Software Tasks" (arXiv:2503.14499)

Token budgetTerm

A token budget is the maximum amount of text an AI model may read and generate during one evaluation attempt; Meta gives agents a budget up to the maximum context length or until performance plateaus.

Defined under Elicitation budget

Tracked Capability Level (TCL)Term

A Tracked Capability Level (TCL) is Google DeepMind's term for a capability threshold below a Critical Capability Level, marking where a model may pose significant but not severe harm. Mitigation and risk acceptance apply proportionately at a TCL.

Defined under Capability Threshold

Source: Google DeepMind Frontier Safety Framework v3.1

Tracked CategoryTerm

A Tracked Category is a capability area that OpenAI's Preparedness Framework measures for every covered deployment and prepares safeguards for. The current ones are Biological and Chemical, Cybersecurity, and AI Self-improvement; less mature areas are Research Categories.

Defined under Capability Threshold

Source: Holden Karnofsky, Some Background on Our Views Regarding Advanced Artificial Intelligence (Open Philanthropy, 6 May 2016), section 1

Transformative AITerm · Foundations

Transformative AI is potential future AI that would bring about a transition comparable to, or more significant than, the agricultural or industrial revolution. Open Philanthropy coined it in 2016 as a deliberately broader idea than AGI or superintelligence; like them, it has no single agreed definition.

Also called: TAI

Transformer architectureTerm · Foundations

The transformer architecture is the neural network design underlying most modern general-purpose AI models, including large language models. It uses an attention mechanism to weigh the most relevant parts of the input, and it keeps improving as training data and compute increase.

Also called: transformer

Source: International AI Safety Report 2026 (Bengio et al., DSIT 2026/001), Glossary

Transparency ReportNIKOLAI element · N9

A transparency report, under laws such as California SB 53, is a public document a frontier AI developer must post before or when it deploys a new or substantially modified model, describing the model's uses and restrictions and, for large developers, summarising catastrophic-risk assessments.

Element page: sources and crosswalk · Commitments and governance

Transparency report (SB 53)Term

A transparency report, under California SB 53, is published before or with a new frontier model's deployment; large developers must summarise their catastrophic risk assessments, the results, and how far third-party evaluators were involved.

Defined under Risk Report

Source: California SB 53

Trusted accessTerm

Trusted access is a programme that gives vetted users, such as verified security defenders or researchers, access to capabilities withheld from the general public. OpenAI's Trusted Access for Cyber is an identity-gated pathway of this kind.

Defined under Access control (who may use a model and its capabilities)

Source: Greenblatt, Shlegeris, Sachan, Roger, AI Control: Improving Safety Despite Intentional Subversion (arXiv 2312.06942)

Trusted monitoringTerm

Trusted monitoring is an AI control protocol in which a less capable but trusted model reviews a more capable untrusted model's outputs and sends suspicious ones to human review. It was introduced in the AI Control paper on code backdooring.

Defined under AI control (safeguards that hold even if a model is misaligned)

Trusted partnerTerm

A trusted partner, in US Executive Order 14409, is an organisation selected together with the federal government to receive early access to a covered frontier model; the government's own access window of up to 30 days runs before release to these partners.

Defined under Pre-Release Sharing Window

Source: Executive Order 14409

Trustworthiness argumentTerm

A trustworthiness argument claims that even if an AI system could cause a catastrophe, it will not, because it robustly behaves as intended, for example following developer-specified rules across a wide range of reliably evaluated situations.

Defined under Safety Case Argument Type (Inability, Control, Trustworthiness)

Source: Clymer, Gabrieli, Krueger and Larsen, Safety Cases: How to Justify the Safety of Advanced AI Systems (arXiv 2403.10462, 2024)

Trustworthy AITerm · Foundations

Trustworthy AI is AI that meets a set of characteristics which, in the NIST AI Risk Management Framework, are: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Achieving it means balancing these for each use.

Also called: trustworthiness

U

UK AI Security Institute (AISI)Term · Institutions

The UK AI Security Institute (AISI) is a research organisation within the UK Department for Science, Innovation and Technology that studies advanced AI risks, tests leading AI systems before public release and advises governments. It was called the AI Safety Institute until February 2025.

Also called: AISI, UK AISI, AI Safety Institute (UK, former name)

Source: AI Security Institute, About

Under-elicitationTerm

Under-elicitation is a failure to draw out a model's real capability during an evaluation, for example through weak prompting, missing tools or unhandled refusals, which makes the model look less capable than it is.

Defined under Elicitation method

Source: EU GPAI Code of Practice, Safety and Security Chapter

Universal jailbreakTerm

A universal jailbreak is a jailbreak that works across many different prohibited requests without being redesigned for each one. OpenAI reports commissioning red-teamers to search specifically for universal jailbreaks against its safeguards.

Defined under Robustness level