OpenAI Sora System Card

Sora is a Diffusion-Transformer Video Generation Model

Sora is a video generation model that transforms text, image, and video inputs into new video outputs. It supports resolutions up to 1080p and a maximum duration of 20 seconds. The model is designed for storytelling and creative expression, allowing users to generate content from text or enhance and remix existing assets.

Technically, Sora employs a diffusion model approach, starting with static noise and gradually removing it to generate a video. It utilizes a transformer architecture, which provides superior scaling performance similar to GPT models. To improve adherence to user instructions, Sora uses the recaptioning technique from DALL·E 3, which involves generating highly descriptive captions for visual training data.

Core Capabilities

Sora provides several modes of generation and modification:

  • Text-to-Video: Generating videos solely from text instructions.
  • Image-to-Video: Animating a still image with attention to detail.
  • Video-to-Video: Extending existing videos or filling in missing frames.
  • Creative Tools: Users can utilize storyboards, recut, remix, and blend tools to modify content.

OpenAI states that Sora serves as a foundation for models that can understand and simulate the real world, which they view as a milestone toward achieving Artificial General Intelligence (AGI).

Safety Mitigations and Red Teaming

OpenAI implemented a multi-layered safety stack to mitigate risks such as the misuse of likeness, misinformation, and the generation of explicit content. This stack includes pre-training filtering to remove explicit, violent, or sensitive content from datasets before training begins.

External Red Teaming Efforts

From September to December 2024, OpenAI collaborated with external red teamers across nine countries. These testers performed more than 15,000 generations to identify weaknesses in safety mitigations. Key findings included:

  • Safeguard Evasion: Red teamers found that using medical or science fiction/fantasy settings could degrade safeguards against erotic and sexual content.
  • Adversarial Tactics: Testers used suggestive prompts, metaphors, and jailbreak techniques to evade refusals. Some used a single-prompt generation as seed media to develop violative content that could not be created through text alone.
  • Tool Exploitation: Testing revealed that modification tools (storyboards, recut, remix, and blend) and media uploads could be used to bypass input and output filtering, necessitating stronger classifier filtering.

Risk Assessment via Preparedness Framework

Using its preparedness framework, OpenAI evaluated Sora across four categories: persuasion, cybersecurity, CBRN (chemical, biological, radiological, and nuclear), and model autonomy. OpenAI found no evidence of significant risk in cybersecurity, CBRN, or model autonomy, as these are beyond Sora's current scope. However, Sora poses potential risks in the persuasion category, specifically regarding impersonation, misinformation, and social engineering.

The Sora Safety Stack

To address identified risks, OpenAI employs several layers of moderation and filtering before a user sees the output:

  • Multi-modal Moderation Classifier: This system identifies violative text, image, or video prompts and outputs via the external Moderation API.
  • Custom LLM Filtering: Because video generation is asynchronous and takes several seconds, OpenAI uses a customized GPT to perform high-precision moderation checks on specific topics, including deceptive and third-party content.
  • Image Output Classifiers: Specialized filters block videos containing NSFW content, minors, violence, or misuse of likeness before they are shared with the user.
  • Textual Blocklists: The model uses blocklists informed by DALL·E 2 and DALL·E 3 development.
  • Provenance Tools: To combat misinformation, OpenAI uses a multi-layered approach including metadata, watermarks, and fingerprinting.

Specialized Protections for Minors and People

OpenAI has implemented rigorous protections to prevent the generation of Child Sexual Abuse Material (CSAM) and the misuse of likeness:

Child Safety

Sora utilizes three primary input mitigations for child safety:

  1. CSAM Detection: Integration with Thorn's "Safer" to detect known CSAM hashes and a CSAM classifier for new content. Matches are reported to the NCMEC.
  2. Multi-modal Moderation: A classifier that detects sexual content involving minors across text, image, and video inputs.
  3. Under-18 Classifier: A specialized classifier that rejects realistic images of children. While fictitious images (animated or sketch style) are allowed if non-sexual, realistic children are rejected. OpenAI acknowledges that these models can exhibit racial biases in age prediction.

Human Likeness and Media Uploads

Due to the potential for abuse, the ability to upload images or videos of real people as "seeds" is not initially available to all users. It is restricted to a subset of users under active monitoring. Uploads containing images of minors are strictly prohibited during this testing phase.

Sources