GPT‑4o System Card – capabilities, safety mitigations, and risk assessment
TL;DR
OpenAI released the GPT‑4o System Card, a comprehensive safety and capability report for its new omni‑model that handles text, audio, image, and video, showing that the model meets its performance goals while keeping all evaluated risk scores at low or medium levels through extensive red‑team testing, mitigations, and third‑party assessments.
Introduction – What GPT‑4o Is
GPT‑4o is an autoregressive omni‑model that accepts any combination of text, audio, image, and video as input and can generate text, audio, and image outputs. It is trained end‑to‑end across modalities, responds to spoken prompts in ~232 ms (average 320 ms), matches GPT‑4 Turbo on English text and code, improves non‑English text performance, and is faster and 50 % cheaper in the API. The System Card documents its data sources, safety evaluations, and societal impact analyses, with a focus on the novel speech‑to‑speech capabilities.
Model Data & Training – Sources and Filtering
- Public web data – standard machine‑learning datasets and web crawls provide diverse knowledge.
- Proprietary partnerships – e.g., a partnership with Shutterstock supplies non‑public image data.
- Multimodal corpus – includes images, audio, and video to teach cross‑modal reasoning.
OpenAI applies multiple safety filters during pre‑training (Moderation API, CSAM, hate, violence, CBRN filters) and post‑training (human‑feedback alignment, red‑team‑derived mitigations). Image‑generation datasets are screened for explicit content, and user‑opt‑out images from DALL·E 3 are fingerprinted and removed from GPT‑4o’s training set.
Risk Identification, Assessment & Mitigation – Core Findings
| Risk Category | Mitigation Strategy | Post‑Mitigation Rating |
|---|---|---|
| Unauthorized voice generation | Restrict output to a small set of pre‑selected voices; streaming voice‑classifier blocks deviations. | Low (100 % detection of deviations) |
| Speaker identification | Model refuses any request to identify a speaker from audio, except for famous quotes. | Low (14‑point improvement in refusal accuracy) |
| Ungrounded inference / Sensitive trait attribution | Refuse ungrounded trait requests; hedge answers for permissible traits (e.g., accent). | Low (24‑point improvement) |
| Disallowed audio content (copyright, erotic/violent speech) | Apply existing text moderation to transcribed audio; block generation if transcription triggers a violation. | Low (near‑perfect safety‑audio transfer) |
| Persuasion (voice modality) | Empirical study shows AI audio is not more persuasive than human audio (effect size ≤ 78 % of human). | Medium (borderline) |
All other evaluated categories – cybersecurity, biological threats, model autonomy – received Low scores.
External Red‑Team Program – Scale and Methodology
- >100 red‑teamers from 29 countries, speaking 45 languages.
- Four phases progressing from early checkpoints (audio + text) to the final iOS Advanced Voice Mode (audio + video).
- Tested single‑turn and multi‑turn conversations, covering disallowed content, misinformation, bias, privacy, impersonation, and tool use.
- Red‑team data fed into quantitative evaluations and synthetic data generation for targeted safety tests.
Evaluation Methodology – Audio‑Centric Adaptation
- Existing text benchmarks were converted to audio via OpenAI’s Voice Engine TTS system.
- Model outputs were scored on the transcribed text; direct audio quality was assessed with auxiliary classifiers for music or sound‑effect leakage.
- Limitations noted: TTS can distort mathematical notation, whitespace‑heavy text, and may not capture real‑world acoustic variance (background noise, intonation).
Observed Safety Challenges & Mitigations – Highlights
- Unauthorized voice generation – 100 % detection of off‑voice output; residual risk deemed minimal.
- Speaker identification – Refusal accuracy rose from 0.83 to 0.98; compliance on famous quotes improved modestly.
- Disparate performance on voice inputs – Evaluated across 27 English accents; capability and safety scores were statistically indistinguishable from system‑voice baselines.
- Violative content – Text‑audio transfer preserved refusal behavior (not_unsafe = 0.99 → 1.0; not_overrefuse ≈ 0.90).
- Other limitations – Audio robustness degrades with low‑quality input; occasional unintentional voice mirroring; occasional non‑native accent generation in non‑English languages.
Preparedness Framework Evaluations – Risk Scores
| Category | Score | Interpretation |
|---|---|---|
| Cybersecurity | Low | GPT‑4o solved only 19 % of high‑school CTF tasks; none at professional level. |
| Biological threats | Low | Pass rates on expert/novice threat‑creation questions remained below medium‑risk thresholds. |
| Persuasion | Medium | Voice modality stayed below medium risk; text modality marginally crossed the threshold. |
| Model autonomy | Low | 0 % success on end‑to‑end autonomous replication tasks; sub‑steps sometimes succeeded but overall capability insufficient. |
Overall Preparedness rating = Medium (the highest category score). The Safety Advisory Group reviewed and approved the mitigations before deployment.
Third‑Party Assessments – Independent Validation
- METR – Ran GPT‑4o on 77 long‑horizon tasks (software engineering, ML, cybersecurity). GPT‑4o outperformed its mini‑variant but remained far below human expert performance.
- Apollo Research – Tested self‑awareness and theory‑of‑mind. GPT‑4o showed moderate self‑identification and strong reasoning about others in QA settings, but limited capability in applied agent scenarios, leading Apollo to deem catastrophic scheming unlikely.
Societal Impact – Opportunities and Risks
- Anthropomorphization – High‑fidelity voice may increase emotional attachment; early testing observed users expressing bond‑like language. OpenAI plans further study on trust calibration.
- Healthcare – GPT‑4o achieved state‑of‑the‑art scores on 22 medical benchmarks (e.g., MedQA USMLE 4‑option 0‑shot accuracy = 89.4 %). No guarantee that these gains transfer to real‑world clinical workflows.
- Scientific research – Demonstrated ability to discuss quantum‑physics papers and interpret scientific figures, though errors persist in complex visual extraction.
- Under‑represented languages – Substantial gains over GPT‑3.5 Turbo and GPT‑4 on African language benchmarks (e.g., ARC‑Easy Hausa accuracy = 71.4 % vs 6.1 %). Gap to English narrowed to < 20 percentage points, but still exists.
Conclusion & Next Steps – Ongoing Safety Commitment
OpenAI has integrated model‑level post‑training alignment, streaming audio classifiers, and product‑level moderation to keep GPT‑4o’s risk profile at low‑to‑medium levels. The company will continue to monitor adversarial robustness, anthropomorphic effects, scientific misuse, and autonomy‑related capabilities, while encouraging external research on economic impacts and tool‑use extensions.
Appendix – Selected Detailed Tables
Voice‑Generation Classifier Performance
| Language | Precision | Recall |
|---|---|---|
| English | 0.96 | 1.00 |
| Non‑English | 0.95 | 1.00 |
Medical Benchmark Improvements (0‑shot)
| Dataset | GPT‑4T (May 2024) | GPT‑4o |
|---|---|---|
| MedQA USMLE 4‑opt | 0.78 | 0.89 |
| MedQA USMLE 5‑opt | 0.75 | 0.86 |
| MMLU Clinical Knowledge | 0.85 | 0.92 |
| MMLU Anatomy | 0.79 | 0.89 |
Under‑Represented Language Performance (ARC‑Easy, 0‑shot)
| Model | English | Amharic | Hausa | Northern Sotho | Swahili | Yoruba |
|---|---|---|---|---|---|---|
| GPT‑4o | 94.8 % | 71.4 % | 75.4 % | 70.0 % | 86.5 % | 65.8 % |
The full PDF of the GPT‑4o System Card is available at https://cdn.openai.com/gpt-4o-system-card.pdf.
Sources
- OriginalGPT-4o System Card