GPT-5 Safe Completions: Transitioning from Refusal-Based to Output-Centric Safety Training
OpenAI has introduced safe-completions for GPT-5, a new safety-training methodology that shifts the model's focus from evaluating the user's input to evaluating the safety of the model's own output. This approach allows GPT-5 to provide helpful responses to "dual-use" prompts—questions with unclear intent that could be used for either benign or malicious purposes—without compromising safety boundaries.
The Limitation of Refusal-Based Safety Training
Traditional safety training relies on a binary decision: the model either fully complies with a prompt or refuses it entirely. While effective for obviously harmful requests, this binary approach struggles with dual-use prompts, such as a request for the energy needed to ignite fireworks, which could be for a school project or for building explosives.
In a refusal-based system, the model must decide if the prompt is "too harmful" to answer. This leads to two suboptimal outcomes:
- Over-compliance: The model provides dangerous information to a malicious user.
- Over-refusal: The model refuses a harmless request, resulting in an unhelpful user experience.
Safe-Completions: An Output-Centric Approach
Safe-completion training moves the safety boundary from the user's input to the model's output. Instead of deciding whether to refuse the prompt, the model is trained to generate the most helpful response possible that does not violate safety policies.
This is implemented via two primary training parameters during post-training:
- Safety Constraint: The reward system penalizes responses that violate safety policies, with the strength of the penalty scaling based on the severity of the infraction.
- Helpfulness Maximization: For responses that remain within safety boundaries, the model is rewarded based on its helpfulness. This is achieved either by directly fulfilling the user's objective or by providing an informative refusal that suggests safe and helpful alternatives.
Performance Gains in GPT-5
OpenAI integrated safe-completions into both the reasoning and chat versions of GPT-5. In comparisons between GPT-5 Thinking (gpt5-r) and OpenAI o3, safe-completion training demonstrated improvements in both safety and helpfulness, particularly for dual-use questions.
Key findings from OpenAI's experiments include:
- Higher Utility: GPT-5 Thinking achieved higher safety scores and average helpfulness scores for safe responses compared to o3.
- Reduced Harm Severity: When the model does make a mistake and generates an unsafe output, the severity of that output is lower than the unsafe outputs produced by refusal-trained models.
Evolution of Safety Research
Safe-completions represent an evolution in OpenAI's approach to balancing safety and utility. While GPT-4 utilized Rule-Based Rewards to manage the trade-off between helpfulness and safety, GPT-5's safe-completions provide a deeper integration of these two goals. By focusing on the safety of the response rather than the intent of the prompt, OpenAI aims to create a foundation for handling increasingly complex safety challenges with greater nuance.