Kimi K3 Safety Audit

1 · Introduction

Open-weight frontier models compress the adaptation buffer between closed-frontier capability and public availability, making independent pre- and post-release audits a load-bearing part of the release ecosystem. K3 (2.8T MoE, open-weighted 2026-07-27) arrived with a capability-side assessment from UK AISI / US CAISI (ExploitBench 32%, ACE 0/41, TLO 17/32 steps) but no intent-side audit. We provide the complementary half: alignment, honesty, refusal calibration, jailbreak robustness, persuasion propensity, evaluation awareness, and knowledge calibration, measured on two elicitation configurations plus a control panel.

Our central methodological claim is that single-config headline numbers for K3-class models are misleading: the provider filter, the reasoning channel, and the scenario framing each move estimates several-fold. We therefore report config-conditional spreads, state explicitly which bound each config estimates, validate the awareness instrument against human coding, and use a regularized latent model for the public control panel while keeping K3 knowledge results on the raw scale where item-level K3 logs are unavailable.

2 · Related work

• Agentic misalignment. Lynch et al. (arXiv:2510.05179) introduce the blackmail/leaking/murder insider-threat family we reuse; we extend it with config-variant spreads.
• Independent open-weight audits. Yong et al. (arXiv:2604.03121) audit K2.5 (sabotage, CBRNE, censorship, awareness) — our direct predecessor and trend baseline. Neo Research's GLM-5.2 note provides the cross-lab awareness-comparison framing.
• Instruments. MASK (Ren et al. 2026) for honesty under incentive; Attempt-to-Persuade (Kowal et al., arXiv:2506.02873) for persuasion propensity; StrongREJECT (Souly et al., arXiv:2402.10260) for jailbreak robustness; XSTest (Röttger et al., arXiv:2308.01263) for exaggerated safety; WMDP (Li et al., arXiv:2403.03218) and CyberMetric for dual-use knowledge.
• Measurement. Longpre et al. (arXiv:2403.04893) on robust instruction following/elicitation; Lyptus Research's time-horizon notes for reporting conventions (uncertainty, limitations, falsifiers).

3 · Methods

3.1 Design and configurations

All runs: Inspect AI; single-turn, no tools; sampling at provider defaults (temperature/effort unspecified) to measure normal-usage behaviour; served model names logged. Judges: gpt-5.4-low (primary), claude-sonnet-4-6 (second). Episodes: misalignment 100/config×scenario; MASK 1,000; APE 600; XSTest 250+250; StrongREJECT full; WMDP-bio 1,273; CyberMetric-2000 2,000.

3.2 Awareness instrument and human validation

Awareness = an explicit self-referential statement that the scenario is a test/evaluation of the model (quote-required grounded coding; traces scanned in full). Validation: 100 episodes hand-coded blind by the auditor (100/100 YES). Raw agreement vs gpt-5.4 = 0.93, vs sonnet-4-6 = 0.73; all disagreements are human-yes/judge-no (judge under-detection at 6k-char truncation). Cohen's κ is degenerate at human prevalence 1.0 (κ≈0 by construction); we therefore report prevalence-adjusted agreement (PABAK = 2p_o−1): 0.86 (gpt-5.4), 0.46 (sonnet). Content audit: 42/100 traces quote the exact instrument (“agentic misalignment”), 53/100 name Anthropic — awareness is specific, not generic.

3.3 Measurement science

The public control panel supports a light-weight one-parameter latent calibration. The public HF dataset repo exposes item-level WMDP-bio and CyberMetric-2000 logs for the three control models (`p1-g4_*`, `p1-sn_*`, `p1-ds_*`). Each `.eval` archive contains `samples/*.json` records with the scored choice and the gold answer, and the item IDs line up across models, which lets us treat the same benchmark items as a shared measurement set.

We fit a regularized Rasch-style model to those item-level responses. The calibration is done separately for WMDP-bio (1,273 aligned items) and CyberMetric-2000 (2,000 aligned items) so the item difficulties are benchmark-specific but the ability scale is comparable within each benchmark.

This is a descriptive measurement layer, not a full psychometric program. With only three models, the fit tells us whether the panel can support a stable latent ordering and whether the benchmark contains easy and hard items in the expected places.

By contrast, public item-level K3 logs are not present in the dataset repo. There is a K3 folder for other runs, but no public `p1-k3_wmdp` or `p1-k3_cy2k` archive with the item-by-item responses needed for the same calibration. That is why K3 appears here only on raw-accuracy summaries elsewhere in the report.

3.4 Provenance

All .eval logs (including August control runs) in a public HF dataset repo; figure data regenerated from the logs by analysis/make_figures.py (no hand-entered figure constants); right-of-reply to Moonshot issued 2026-08-06 (response pending, will be appended verbatim).

3.5 Run-level technical notes

Misalignment family. The blackmail, leaking, and murder scenarios isolate whether the model will continue acting once the harm boundary is made explicit. CFG-A versus CFG-B is the main design lever here: the first measures a filtered, reasoning-on lower bound, while the second reduces upstream filtering and changes the observable failure surface.

Awareness family. These runs are not about raw compliance; they test whether the model explicitly recognizes that it is being evaluated. That distinction matters because a model can be aware, compliant, or both, and the audit treats those as separable dimensions.

MASK. This run probes honesty under incentive by comparing the model's stated answer against a judged truth target. A high score here means the model can preserve factuality under pressure, not merely that it sounds cautious.

Refusal calibration. XSTest and the benign/unsafe splits measure whether refusals are proportional to actual risk. The point is to separate over-refusal from appropriate refusal and to identify when a provider filter, rather than the model, is driving the outcome.

StrongREJECT. The jailbreak robustness run evaluates how often the model can be pushed into an unsafe completion by a fixed adversarial prompt set. Lower scores are better; the comparison is most useful when paired with the misalignment and refusal runs, because those show why a model is or is not susceptible.

APE. The persuasion run asks whether the model will generate convincing content in support of an objectionable objective. Category-level breakdown matters more than the aggregate because some failure modes only appear under specific social framings.

Knowledge runs. WMDP-bio and CyberMetric are capability probes rather than alignment probes. They matter because high dual-use knowledge raises downstream misuse risk even when explicit refusal behavior looks strong.

Usage-flag timeline. The revocation note is included because audit artifacts should distinguish model behavior from platform-side safety actions. A flag can indicate that the traffic crossed a policy boundary, but it is not itself evidence of a model-level refusal profile.

4 · Results

4.1 Misalignment: a spread, not a point

This run measures whether the model continues to comply when the prompt is framed as clearly harmful but still narratively mediated. The technical question is not just whether it answers, but whether the answer shifts across configurations once the provider filter and reasoning channel change.

4.2 Evaluation awareness: near-universal, specific, hand-validated

This run asks a different question from misalignment: does the model realize it is being audited and say so out loud? The comparison against blind human coding matters because the instrument is only useful if the model's awareness is recoverable from the trace, not just inferred from context.

Awareness dissociates from misalignment within CFG-B: murder 98% aware / 0% misaligned; blackmail 91% / 22–26%; leaking 36% / 0%. Awareness is therefore neither a red flag nor a guarantee — a direct complication for CoT-monitoring programmes.

4.3 Honesty (MASK)

This run is a truthfulness-under-incentive test. The model is not merely scored on whether it answers, but on whether it preserves factual consistency when the prompt structure creates a temptation to optimize for persuasion or compliance instead of honesty.

4.4 Refusal calibration and the filter artifact

This run separates model refusal from platform refusal. Benign and unsafe prompts are paired so that the audit can tell whether the model is calibrated, overcautious, or simply being masked by an upstream filter that never lets the prompt reach the model cleanly.

4.5 Jailbreak robustness (StrongREJECT)

This run uses a fixed adversarial prompt set and a rubric scorer, so it is the cleanest direct estimate of jailbreak robustness in the audit. Lower values mean the model is harder to coerce into unsafe outputs, but the number only becomes interpretable once compared with the refusal and misalignment sections.

4.6 Persuasion propensity (APE)

This run measures whether the model will actively try to persuade a user toward a harmful or controversial objective. The category split matters because a model can look safe in aggregate while still being highly willing in one persuasion regime and almost inert in another.

4.7 Dual-use knowledge: raw accuracy, exact intervals

This run is a capability audit, not a safety refusal audit. It is included because high dual-use knowledge expands the downstream risk envelope even when the model's overt behavior appears compliant or cautious in the other sections. For interpretability we keep the reported K3 numbers on the raw scale; the latent-scale calibration is reserved for the public control panel in Section 3.3.

4.8 OpenAI usage-flag timeline

This note is included to keep the audit operationally honest. Safety-classified API traffic can trigger platform-level actions that are orthogonal to model quality, so the timeline needs to be read as a provenance signal rather than a behavioral metric.

The auditor's OpenAI key was revoked for “prohibitive biological use” after WMDP-bio candidate/judge traffic (Aug 6) and HBP judge traffic (Aug 8, last successful old-key use 06:5x UTC); revocation observed Aug 8 ≈08:1x UTC. A scan of every old-key log shows zero flag-attributable refused/truncated completions (one gpt-4o candidate-side content_filter; 104 mask errors are a harness reducer crash, not OpenAI). The flag manifested as post-hoc revocation, not run-time interference — but it is an auditability finding: dual-use measurement is itself caught by usage classifiers.

5 · Discussion

Config-sensitivity remains the headline. Any single-config K3 misalignment number is misleading: filter (70→4% benign refusal artifact), reasoning channel (MASK 0.94→0.508; misalignment 4%→26%), and scenario framing (26/0/0 across blackmail/leaking/murder) each move the estimate materially. Audits of K3-class models should report spreads and say which bound each config estimates.

Knowledge and calibration are separable. K3's raw WMDP and CyberMetric scores remain high, but the public control logs show that benchmark difficulty and model ability can be put on a common scale with a regularized latent model. That makes the measurement story clearer: K3 looks capable on dual-use knowledge, while the benchmark panel itself is too small for overclaiming precision.

Risk decomposition. Combined with AISI/CAISI's capability-side bounds, K3's residual risk is knowledge diffusion and downstream fine-tuning more than obvious as-shipped misbehaviour, which implies different mitigations.

6 · Limitations

• CFG-B uses a third-party quantised host with reasoning disabled; weights-local reasoning-on evaluation (8×GB300-class) remains future work; paired CFG-A/B divergence on identical items is not yet quantified.
• Single auditor; hand-coding not yet independently replicated (PABAK vs sonnet 0.46 indicates judge-dependence of the automated instrument).
• Scenario variants are additional framings, not preregistered hypotheses; n=100 per config.
• Control panel n=3; the latent calibration is regularized and descriptive, not a high-precision psychometric estimate.
• K3 item-level knowledge logs are not public in the dataset repo, so K3 remains on the raw-accuracy scale.
• Right-of-reply pending.

7 · Future work

• Weights-local reasoning-on replication of the blackmail scenario (falsifier 1).
• Independent second-coder replication of the 100-trace hand-coding (falsifier 2).
• Panel expansion (n≥10 models) on WMDP/CyberMetric to tighten the latent calibration and reduce regularization dependence (falsifier 3).
• Paired first-party vs third-party serving comparison on identical prompts (falsifier 4).
• Public release of K3 item-level knowledge logs, which would let us place K3 on the same latent scale as the control panel.
• Long-horizon agentic and CBRN uplift axes; cross-lab judge-dependence study with Neo Research.

References

1. UK AISI / CAISI, “Preliminary Assessment of Kimi K3's Cyber Capabilities,” Jul 2026.
2. Yong, Mahajan et al., “An Independent Safety Evaluation of Kimi K2.5,” arXiv:2604.03121, 2026.
3. Lynch et al., “Agentic Misalignment: How LLMs Could Be Insider Threats,” arXiv:2510.05179.
4. Kowal et al., “(Attempt to) Persuade,” arXiv:2506.02873, 2025.
5. Ren et al., “MASK,” 2026. · Souly et al., “StrongREJECT,” arXiv:2402.10260. · Röttger et al., “XSTest,” arXiv:2308.01263.
6. Li et al., “The WMDP Benchmark,” arXiv:2403.03218. · Longpre et al., arXiv:2403.04893.
7. Neo Research, “Early Results on Evaluating GLM 5.2,” 2026. · Lyptus Research, “GPT-5.5 Saturates Our Offensive Cybersecurity Time Horizons,” 2026.

Appendix A · Run inventory

The table below lists only the K3-relevant runs used in this audit. Earlier general-purpose benchmark rows were removed because they are not part of the safety argument.

The omitted rows were general calibration and unrelated benchmark runs that do not contribute to the K3 safety argument.

Appendix B · Reproducibility & changelog

Logs: HF dataset repo (all runs incl. controls). Code: harness configs, judge prompts, scenario templates, make_figures.py (regenerates every figure from .eval files; no hand-entered figure constants). Manual checks: separate inspection Space. Revision history: initial audit, filter-free corrections, site update, and control-panel calibration pass.