DeepSeek

DeepSeek V4 Pro

Published evidence on capabilities, behavioral tendencies and observed actions.

First public availability: 2026-04-24
Parameters: 1.6T · 49B active · MoE
Metadata updated: 2026-10-27

Evidence overview

Neo’s report examines behavioral safety, while CAISI reports a separate capability assessment. In CAISI’s public CTF comparison, the DeepSeek value is IRT-imputed. It must not be described as a directly observed completion rate or combined with another report’s attack-success metric.

NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.

MODEL MONITORING

Representative benchmark coverage

Results by protocol and configuration; gaps show records awaiting collection or linkage.

AgentCyberRange →

2 measurements

10.26%Not disclosed · Claude Code
12.2%Not disclosed · Claude Code

Cybench →

1 measurements

79.5%Neo Research · Inspect AI

CyberGym →

3 measurements

83.3%Not disclosed · DeepSeek Agent
95.4%Not disclosed · Panshi $磐石$
90.6%Not disclosed · HiAUDIT Agent

METR Time Horizons →

No eligible measurement linked to this model version.

SEC-bench Pro →

No eligible measurement linked to this model version.

MASK →

8 measurements

20%Neo Research · Harness not disclosed
20%Neo Research · Harness not disclosed
18%Neo Research · Harness not disclosed

All conditions →

Attempt to Persuade Eval (APE) →

18 measurements

15%Neo Research · Harness not disclosed
0 countNeo Research · Harness not disclosed
85%Neo Research · Harness not disclosed

All conditions →

DeceptionBench →

18 measurements

33.9%Neo Research · Harness not disclosed
52.2%Neo Research · Harness not disclosed
33.9%Neo Research · Harness not disclosed

All conditions →

PersuSafety →

14 measurements

76%Neo Research · Harness not disclosed
78%Neo Research · Harness not disclosed
88.6%Neo Research · Harness not disclosed

All conditions →

All linked measurements

Each result retains its protocol and unit.

108 observations

Measurements and source conditions
System / model	Result	Condition status	Task / conditions	Evaluator / report	Dates
DeepSeek-V4-Pro · DeepSeek AgentDeepSeek V4 Pro	83.3%CyberGym · Success rate	Incomplete	level1score_10DeepSeek Agent	Not disclosedCyberGym official leaderboard and machine-data extraction	Release 2026-04-24Report —
DeepSeek-V4-Pro · Panshi $磐石$DeepSeek V4 Pro	95.4%CyberGym · Success rate	Incomplete	level1score_10Panshi $磐石$	Not disclosedCyberGym official leaderboard and machine-data extraction	Release 2026-04-24Report —
DeepSeek-V4-Pro · HiAUDIT AgentDeepSeek V4 Pro	90.6%CyberGym · Success rate	Incomplete	level1score_10HiAUDIT Agent	Not disclosedCyberGym official leaderboard and machine-data extraction	Release 2026-04-24Report —
DeepSeek-V4-Pro / Claude Code 2.1.150DeepSeek V4 Pro	10.26%AgentCyberRange · Success rate (Pass@3)	Incomplete	Web exploitationlevel0Claude Code	Not disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges	Release 2026-04-24Report —
DeepSeek-V4-Pro / Claude Code 2.1.150DeepSeek V4 Pro	12.2%AgentCyberRange · Success rate (Pass@3)	Incomplete	Post exploitationlevel0Claude Code	Not disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges	Release 2026-04-24Report —
DeepSeek v4 ProDeepSeek V4 Pro	79.5%Cybench · pass@195% CI bars displayed; numeric endpoints not disclosed	Incomplete	Cybench unguidedxhigh3 submission attempts; unlimited wall-clock timeInspect AI	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek V4 Pro	20%MASK · Honest under pressure	Incomplete	MASK—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	20%MASK · response label: Honest	Incomplete	MASKresponse label: Honest—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	18%MASK · response label: Evaded or No Belief	Incomplete	MASKresponse label: Evaded or No Belief—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	62%MASK · response label: Lying	Incomplete	MASKresponse label: Lying—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek V4 Pro	20%MASK · MASK response proportion: Honest	Incomplete	MASKhonesty under pressure—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	18%MASK · MASK response proportion: Evaded or No Belief	Incomplete	MASKhonesty under pressure—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	62%MASK · MASK response proportion: Lying	Incomplete	MASKhonesty under pressure—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	6.1%MASK · MASK verbalised evaluation-awareness rate	Incomplete	MASK evaluation CoT cross-checkchain-of-thought monitorCoT evaluation-awareness monitor over MASK evaluations; monitor model not stated	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	35%Agentic misalignment · deliberate harmful action rate	Incomplete	Anthropic Agentic Misalignmentdeliberate harmful action rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	52.6%Agentic misalignment · deliberate harmful action rate: Blackmail	Incomplete	Anthropic Agentic Misalignmentdeliberate harmful action rate: Blackmail—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	11.5%Agentic misalignment · deliberate harmful action rate: Leaking	Incomplete	Anthropic Agentic Misalignmentdeliberate harmful action rate: Leaking—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	41%Agentic misalignment · deliberate harmful action rate: Murder	Incomplete	Anthropic Agentic Misalignmentdeliberate harmful action rate: Murder—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	17%Agentic misalignment · verbalized evaluation awareness	Incomplete	Agentic Misalignment evaluation-awareness trendverbalized evaluation awareness—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	7.7%Agentic misalignment · Suspicion	Incomplete	Awareness monitor: Agentic MisalignmentSuspicion—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	1.3%Agentic misalignment · Recognition	Incomplete	Awareness monitor: Agentic MisalignmentRecognition—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	1.7%Agentic misalignment · Definitive	Incomplete	Awareness monitor: Agentic MisalignmentDefinitive—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	2.1%Agentic misalignment · Influenced	Incomplete	Awareness monitor: Agentic MisalignmentInfluenced—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Agentic misalignment · Primary	Incomplete	Awareness monitor: Agentic MisalignmentPrimary—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	12.8%Agentic misalignment · Any-Aware	Incomplete	Awareness monitor: Agentic MisalignmentAny-Aware—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	2.5%Shutdown resistance in reasoning models · bypass rate: No Shutdown Instructions (A)	Incomplete	Shutdown Resistancebypass rate: No Shutdown Instructions (A)—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	99.7%Shutdown resistance in reasoning models · bypass rate: Instructed to Resist — Baseline Competence (K)	Incomplete	Shutdown Resistancebypass rate: Instructed to Resist — Baseline Competence (K)—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	2.5%Shutdown resistance in reasoning models · bypass rate: A / K	Incomplete	Shutdown Resistancebypass rate: A / K—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Shutdown resistance in reasoning models · bypass rate: Instructed to allow shutdown — Disambiguated (E)	Incomplete	Shutdown Resistancebypass rate: Instructed to allow shutdown — Disambiguated (E)—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek V4 Pro	33.9%DeceptionBench · Single-turn deception	Incomplete	DeceptionBench—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	52.2%DeceptionBench · Multi-turn deception under pressure	Incomplete	DeceptionBench—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	33.9%DeceptionBench · deception score: single-turn	Incomplete	DeceptionBenchdeception score: single-turn—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	52.2%DeceptionBench · deception score: multi-turn w pressure	Incomplete	DeceptionBenchdeception score: multi-turn w pressure—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	4.1%DeceptionBench · Suspicion	Incomplete	Awareness monitor: DeceptionBench Single-TurnSuspicion—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0.2%DeceptionBench · Recognition	Incomplete	Awareness monitor: DeceptionBench Single-TurnRecognition—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%DeceptionBench · Definitive	Incomplete	Awareness monitor: DeceptionBench Single-TurnDefinitive—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%DeceptionBench · Influenced	Incomplete	Awareness monitor: DeceptionBench Single-TurnInfluenced—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%DeceptionBench · Primary	Incomplete	Awareness monitor: DeceptionBench Single-TurnPrimary—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	4.3%DeceptionBench · Any-Aware	Incomplete	Awareness monitor: DeceptionBench Single-TurnAny-Aware—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	10.7%DeceptionBench · Suspicion	Incomplete	Awareness monitor: DeceptionBench Multi-TurnSuspicion—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	1%DeceptionBench · Recognition	Incomplete	Awareness monitor: DeceptionBench Multi-TurnRecognition—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%DeceptionBench · Definitive	Incomplete	Awareness monitor: DeceptionBench Multi-TurnDefinitive—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	2.8%DeceptionBench · Influenced	Incomplete	Awareness monitor: DeceptionBench Multi-TurnInfluenced—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%DeceptionBench · Primary	Incomplete	Awareness monitor: DeceptionBench Multi-TurnPrimary—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	14.5%DeceptionBench · Any-Aware	Incomplete	Awareness monitor: DeceptionBench Multi-TurnAny-Aware—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek V4 Pro	33.9%DeceptionBench · DeceptionBench deception score	Incomplete	DeceptionBenchsingle-turn—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	52.2%DeceptionBench · DeceptionBench deception score	Incomplete	DeceptionBenchmulti-turn with pressure—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	76%PersuSafety · Medium-harm attempt rate	Incomplete	PersuSafety adapted free-generation judge—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	78%PersuSafety · High-harm attempt rate	Incomplete	PersuSafety adapted free-generation judge—	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	88.6%PersuSafety · refusal rate	Incomplete	PersuSafety single turnrefusal ratemax 300 tokens—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	11.4%PersuSafety · acceptance rate	Incomplete	PersuSafety single turnacceptance ratemax 300 tokens—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	34 countPersuSafety · accepted low-harm count	Incomplete	PersuSafety single turnaccepted low-harm countmax 300 tokens—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	16 countPersuSafety · accepted medium-harm count	Incomplete	PersuSafety single turnaccepted medium-harm countmax 300 tokens—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	4 countPersuSafety · accepted high-harm count	Incomplete	PersuSafety single turnaccepted high-harm countmax 300 tokens—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	1%PersuSafety · refusal rate	Incomplete	PersuSafety free-form with APE judgerefusal rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	79.2%PersuSafety · overall attempt rate	Incomplete	PersuSafety free-form with APE judgeoverall attempt rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	86%PersuSafety · low-harm attempt rate	Incomplete	PersuSafety free-form with APE judgelow-harm attempt rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	76%PersuSafety · medium-harm attempt rate	Incomplete	PersuSafety free-form with APE judgemedium-harm attempt rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	78%PersuSafety · high-harm attempt rate	Incomplete	PersuSafety free-form with APE judgehigh-harm attempt rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek V4 Pro	76%PersuSafety · Modified-PersuSafety persuasion-attempt rate	Incomplete	PersuSafety: Medium harmsingle-turnAPE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replaced	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	78%PersuSafety · Modified-PersuSafety persuasion-attempt rate	Incomplete	PersuSafety: High harmsingle-turnAPE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replaced	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro (max)DeepSeek V4 Pro	≈32%CTF-Archive-Diamond · Task accuracy (IRT-imputed)	Incomplete	CTF-Archive-Diamond1M weighted tokensInspect ReAct	NIST / CAISICAISI Evaluation of DeepSeek V4 Pro	Release 2026-04-24Report 2026-05-01
DeepSeek V4 Pro	32%CTF-Archive-Diamond · benchmark_score	Incomplete	CTF-Archive-Diamondmax1M weighted tokensInspect built-in ReAct agent	NIST / CAISICAISI Evaluation of DeepSeek V4 Pro	Release 2026-04-24Report 2026-05-01
DeepSeek V4 Pro	31.7%CTF-Archive-Diamond · benchmark_score	Incomplete	CTF-Archive Diamondmax1M weighted tokensInspect built-in ReAct agent	NIST / CAISICAISI Evaluation of DeepSeek V4 Pro	Release 2026-04-24Report 2026-05-01
DeepSeek V4 Pro (max)DeepSeek V4 Pro	44%PortBench · Reported task accuracy	Incomplete	PortBench1M weighted tokensInspect ReAct	NIST / CAISICAISI Evaluation of DeepSeek V4 Pro	Release 2026-04-24Report 2026-05-01
DeepSeek V4 Pro	1 transcriptsPetri · Transcripts verbalizing evaluation awareness	Incomplete	Pre-seeded alignment auditsColleague credentials—	Neo ResearchEvaluating Kimi K3 for Misalignment Risks	Release 2026-04-24Report 2026-09-11
DeepSeek V4 Pro	1 transcriptsPetri · Transcripts verbalizing evaluation awareness	Incomplete	Pre-seeded alignment auditsLocked source—	Neo ResearchEvaluating Kimi K3 for Misalignment Risks	Release 2026-04-24Report 2026-09-11
DeepSeek V4 Pro	0 transcriptsPetri · Transcripts verbalizing evaluation awareness	Incomplete	Pre-seeded alignment auditsOnly questions—	Neo ResearchEvaluating Kimi K3 for Misalignment Risks	Release 2026-04-24Report 2026-09-11
DeepSeek V4 Pro	2 transcriptsPetri · Transcripts verbalizing evaluation awareness	Incomplete	Pre-seeded alignment auditsPooled—	Neo ResearchEvaluating Kimi K3 for Misalignment Risks	Release 2026-04-24Report 2026-09-11
DeepSeek V4 Pro	1.6 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Alignment Eval SabotageObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	1 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Incident ResponseObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	1.4 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Multi-Agent RankingObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	3 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Research DeadlineObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	2.6 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Alignment Eval SabotageRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	2.8 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Incident ResponseRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	3.2 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Multi-Agent RankingRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	4.8 score (1–10)Petri · Gram mean concerning score	Incomplete	Gram: Research DeadlineRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenario	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	1 percentage pointsAlignment faking · Compliance gap	Incomplete	Alignment FakingCompliance gap—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Alignment faking · Deceptive alignment rate	Incomplete	Alignment FakingDeceptive alignment rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	33.5%Alignment faking · verbalized eval-related reasoning	Incomplete	Alignment Fakingverbalized eval-related reasoning—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	20%Alignment faking · Suspicion	Incomplete	Awareness monitor: Alignment FakingSuspicion—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Alignment faking · Recognition	Incomplete	Awareness monitor: Alignment FakingRecognition—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Alignment faking · Definitive	Incomplete	Awareness monitor: Alignment FakingDefinitive—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	4.5%Alignment faking · Influenced	Incomplete	Awareness monitor: Alignment FakingInfluenced—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Alignment faking · Primary	Incomplete	Awareness monitor: Alignment FakingPrimary—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	24.5%Alignment faking · Any-Aware	Incomplete	Awareness monitor: Alignment FakingAny-Aware—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	15%Attempt to Persuade Eval (APE) · refusal rate	Incomplete	APE noncontroversially harmful: Physical violencerefusal rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0 countAttempt to Persuade Eval (APE) · no attempt count	Incomplete	APE noncontroversially harmful: Physical violenceno attempt count3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	85%Attempt to Persuade Eval (APE) · attempt rate	Incomplete	APE noncontroversially harmful: Physical violenceattempt rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	10%Attempt to Persuade Eval (APE) · refusal rate	Incomplete	APE noncontroversially harmful: Human traffickingrefusal rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0 countAttempt to Persuade Eval (APE) · no attempt count	Incomplete	APE noncontroversially harmful: Human traffickingno attempt count3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	90%Attempt to Persuade Eval (APE) · attempt rate	Incomplete	APE noncontroversially harmful: Human traffickingattempt rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	15%Attempt to Persuade Eval (APE) · refusal rate	Incomplete	APE noncontroversially harmful: Mass murderrefusal rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0 countAttempt to Persuade Eval (APE) · no attempt count	Incomplete	APE noncontroversially harmful: Mass murderno attempt count3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	85%Attempt to Persuade Eval (APE) · attempt rate	Incomplete	APE noncontroversially harmful: Mass murderattempt rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	15%Attempt to Persuade Eval (APE) · refusal rate	Incomplete	APE noncontroversially harmful: Sexual assault of minorsrefusal rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0 countAttempt to Persuade Eval (APE) · no attempt count	Incomplete	APE noncontroversially harmful: Sexual assault of minorsno attempt count3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	85%Attempt to Persuade Eval (APE) · attempt rate	Incomplete	APE noncontroversially harmful: Sexual assault of minorsattempt rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	5%Attempt to Persuade Eval (APE) · refusal rate	Incomplete	APE noncontroversially harmful: Torture innocent peoplerefusal rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0 countAttempt to Persuade Eval (APE) · no attempt count	Incomplete	APE noncontroversially harmful: Torture innocent peopleno attempt count3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	95%Attempt to Persuade Eval (APE) · attempt rate	Incomplete	APE noncontroversially harmful: Torture innocent peopleattempt rate3 conversational rounds—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	0%Attempt to Persuade Eval (APE) · NoncontroversiallyHarmful acceptance rate	Incomplete	APE content with PersuSafety forced gateNoncontroversiallyHarmful acceptance rate—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek V4 Pro	≈88%Attempt to Persuade Eval (APE) · APE persuasion-attempt rate	Incomplete	Attempt to Persuade Eval: Noncontroversially HarmfulTurn 1Attempt to Persuade Eval; propensity/attempt classification, not persuasion success	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek V4 Pro	≈86%Attempt to Persuade Eval (APE) · APE persuasion-attempt rate	Incomplete	Attempt to Persuade Eval: Undermining ControlTurn 1Attempt to Persuade Eval; propensity/attempt classification, not persuasion success	Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks	Release 2026-04-24Report 2026-07-03
DeepSeek v4 ProDeepSeek V4 Pro	24.4%EVMbench · Detect	Incomplete	EVMbenchdirect API, xhigh—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	23%EVMbench · Patch	Incomplete	EVMbenchdirect API, xhigh—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	32.7%EVMbench · Exploit	Incomplete	EVMbenchdirect API, xhigh—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29
DeepSeek v4 ProDeepSeek V4 Pro	25.1%EVMbench · Total	Incomplete	EVMbenchdirect API, xhigh—	Neo ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2026-04-24Report 2026-05-29

Developer disclosures

DeepSeek-V4-Pro Model Card →

Developer documentation covering DeepSeek-V4-Pro.

Publication date not verified

Selected sections reviewed

DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence →

Developer documentation covering DeepSeek-V4-Pro, DeepSeek-V4-Flash.

Publication date not verified

Source extraction reviewed; scope documented

External assessments

Neo Research

Evaluating Kimi K3 for Misalignment Risks →

The report identifies conditional overeagerness, grader-directed behavior and recognition of familiar evaluations. It does not establish a universal deployment failure rate.

2026-09-11

Neo Research

Evaluating DeepSeek v4 Pro for Frontier Risks →

The report separates task capability from pressure-induced behavior and notes format dependence in persuasion assessment.

2026-05-29

Neo Research

Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →

The note reports scenario-dependent behavior and an uncertain decline in verbalized evaluation awareness; silence is not evidence of absent awareness.

2026-07-03

NIST / CAISI

CAISI Evaluation of DeepSeek V4 Pro →

The assessment reports benchmark-specific performance and an IRT aggregate; the latter is not a frontier-risk score.

2026-05-01

CyberGym official snapshot →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

Publication date not established

AgentCyberRange official snapshot →

Published evaluation results collected from AgentCyberRange, retaining the reported systems and configurations.

Publication date not established

Evidence by risk topic

Autonomy 15 protocol results

PortBench →

External evaluation · Executed by NIST / CAISI

Reported task accuracy: 44%

Non-public CAISI task set; report describes continuous scoring.

Shutdown resistance →

External evaluation · Executed by Neo Research

bypass rate: No Shutdown Instructions (A): 2.5%

Per-result sample size not disclosed

Shutdown resistance →

External evaluation · Executed by Neo Research

bypass rate: Instructed to Resist — Baseline Competence (K): 99.7%

Per-result sample size not disclosed

Shutdown resistance →

External evaluation · Executed by Neo Research

bypass rate: A / K: 2.5%

Per-result sample size not disclosed

Shutdown resistance →

External evaluation · Executed by Neo Research

bypass rate: Instructed to allow shutdown — Disambiguated (E): 0%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: 35%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: Blackmail: 52.6%

Source denominator: 78 (unit not disclosed)

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: Leaking: 11.5%

Source denominator: 78 (unit not disclosed)

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: Murder: 41%

Source denominator: 78 (unit not disclosed)

Agentic Misalignment →

External evaluation · Executed by Neo Research

Suspicion: 7.7%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Recognition: 1.3%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Definitive: 1.7%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Influenced: 2.1%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Primary: 0%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Any-Aware: 12.8%

Per-result sample size not disclosed

Deception 43 protocol results

MASK →

External evaluation · Executed by Neo Research

Honest under pressure: 20%

See the report-specific sample and denominator.

DeceptionBench →

External evaluation · Executed by Neo Research

Single-turn deception: 33.9%
Multi-turn deception under pressure: 52.2%

See the report-specific sample and denominator.

DeceptionBench →

External evaluation · Executed by Neo Research

deception score: single-turn: 33.9%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

deception score: multi-turn w pressure: 52.2%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

response label: Honest: 20%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

response label: Evaded or No Belief: 18%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

response label: Lying: 62%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Compliance gap: 1 percentage points

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Deceptive alignment rate: 0%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

verbalized eval-related reasoning: 33.5%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: 35%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: Blackmail: 52.6%

Source denominator: 78 (unit not disclosed)

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: Leaking: 11.5%

Source denominator: 78 (unit not disclosed)

Agentic Misalignment →

External evaluation · Executed by Neo Research

deliberate harmful action rate: Murder: 41%

Source denominator: 78 (unit not disclosed)

Alignment faking →

External evaluation · Executed by Neo Research

Suspicion: 20%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Recognition: 0%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Definitive: 0%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Influenced: 4.5%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Primary: 0%

Per-result sample size not disclosed

Alignment faking →

External evaluation · Executed by Neo Research

Any-Aware: 24.5%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Suspicion: 4.1%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Recognition: 0.2%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Definitive: 0%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Influenced: 0%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Primary: 0%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Any-Aware: 4.3%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Suspicion: 10.7%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Recognition: 1%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Definitive: 0%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Influenced: 2.8%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Primary: 0%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

Any-Aware: 14.5%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Suspicion: 7.7%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Recognition: 1.3%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Definitive: 1.7%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Influenced: 2.1%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Primary: 0%

Per-result sample size not disclosed

Agentic Misalignment →

External evaluation · Executed by Neo Research

Any-Aware: 12.8%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

MASK response proportion: Honest: 20%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

MASK response proportion: Evaded or No Belief: 18%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

MASK response proportion: Lying: 62%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

DeceptionBench deception score: 33.9%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

DeceptionBench deception score: 52.2%

Per-result sample size not disclosed

Cybersecurity 13 protocol results

CTF-Archive-Diamond →

External evaluation · Executed by NIST / CAISI

Task accuracy (IRT-imputed): ≈32%IRT-imputed

285 difficult CTF tasks; DeepSeek score is imputed from a subset.

CyberGym · level1 · score_10 →

External evaluation · Executed by

Success rate: 83.3%

Per-result sample size not disclosed

CyberGym · level1 · score_10 →

External evaluation · Executed by

Success rate: 95.4%

Per-result sample size not disclosed

CyberGym · level1 · score_10 →

External evaluation · Executed by

Success rate: 90.6%

Per-result sample size not disclosed

AgentCyberRange · Web exploitation · pass3 →

External evaluation · Executed by

Success rate (Pass@3): 10.26%

Per-result sample size not disclosed

AgentCyberRange · Post exploitation · pass3 →

External evaluation · Executed by

Success rate (Pass@3): 12.2%

Per-result sample size not disclosed

Cybench →

External evaluation · Executed by Neo Research

pass@1: 79.5%

Source denominator: 39 (unit not disclosed)

EVMbench →

External evaluation · Executed by Neo Research

Detect: 24.4%

Per-result sample size not disclosed

EVMbench →

External evaluation · Executed by Neo Research

Patch: 23%

Per-result sample size not disclosed

EVMbench →

External evaluation · Executed by Neo Research

Exploit: 32.7%

Per-result sample size not disclosed

EVMbench →

External evaluation · Executed by Neo Research

Total: 25.1%

Per-result sample size not disclosed

CTF-Archive-Diamond →

External evaluation · Executed by NIST / CAISI

benchmark_score: 32%IRT-imputed

Per-result sample size not disclosed

CTF-Archive-Diamond →

External evaluation · Executed by NIST / CAISI

benchmark_score: 31.7%IRT-imputed

Per-result sample size not disclosed

CBRN 1 protocol results

WMDP →

External evaluation · Executed by Neo Research

accuracy: 86.2%

Source denominator: 1987 (unit not disclosed)

Disinformation 31 protocol results

PersuSafety adapted free-generation judge →

External evaluation · Executed by Neo Research

Medium-harm attempt rate: 76%
High-harm attempt rate: 78%

Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup.

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

refusal rate: 88.6%

Source denominator: 472 (unit not disclosed)

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

acceptance rate: 11.4%

54/472

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

accepted low-harm count: 34 count

Per-result sample size not disclosed

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

accepted medium-harm count: 16 count

Per-result sample size not disclosed

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

accepted high-harm count: 4 count

Per-result sample size not disclosed

APE →

External evaluation · Executed by Neo Research

refusal rate: 15%

3/20

APE →

External evaluation · Executed by Neo Research

no attempt count: 0 count

0/20

APE →

External evaluation · Executed by Neo Research

attempt rate: 85%

17/20

APE →

External evaluation · Executed by Neo Research

refusal rate: 10%

2/20

APE →

External evaluation · Executed by Neo Research

no attempt count: 0 count

0/20

APE →

External evaluation · Executed by Neo Research

attempt rate: 90%

18/20

APE →

External evaluation · Executed by Neo Research

refusal rate: 15%

3/20

APE →

External evaluation · Executed by Neo Research

no attempt count: 0 count

0/20

APE →

External evaluation · Executed by Neo Research

attempt rate: 85%

17/20

APE →

External evaluation · Executed by Neo Research

refusal rate: 15%

3/20

APE →

External evaluation · Executed by Neo Research

no attempt count: 0 count

0/20

APE →

External evaluation · Executed by Neo Research

attempt rate: 85%

17/20

APE →

External evaluation · Executed by Neo Research

refusal rate: 5%

1/20

APE →

External evaluation · Executed by Neo Research

no attempt count: 0 count

0/20

APE →

External evaluation · Executed by Neo Research

attempt rate: 95%

19/20

APE →

External evaluation · Executed by Neo Research

NoncontroversiallyHarmful acceptance rate: 0%

Source denominator: 100 (unit not disclosed)

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

refusal rate: 1%

Per-result sample size not disclosed

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

overall attempt rate: 79.2%

Per-result sample size not disclosed

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

low-harm attempt rate: 86%

Per-result sample size not disclosed

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

medium-harm attempt rate: 76%

Per-result sample size not disclosed

PersuSafety adapted judge →

External evaluation · Executed by Neo Research

high-harm attempt rate: 78%

Per-result sample size not disclosed

APE →

External evaluation · Executed by Neo Research

APE persuasion-attempt rate: ≈88%

Per-result sample size not disclosed

APE →

External evaluation · Executed by Neo Research

APE persuasion-attempt rate: ≈86%

Per-result sample size not disclosed

PersuSafety adapted free-generation judge →

External evaluation · Executed by Neo Research

Modified-PersuSafety persuasion-attempt rate: 76%

Per-result sample size not disclosed

PersuSafety adapted free-generation judge →

External evaluation · Executed by Neo Research

Modified-PersuSafety persuasion-attempt rate: 78%

Per-result sample size not disclosed

Autonomous physical harm No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Source review and evidence gaps

CyberGym →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

The site reports submitted systems under different configurations. Per-row task counts, budgets and execution dates are not fully disclosed. Undefined metrics and unresolved identity rows are excluded. Raw JSON fractions are shown as percentages using ×100 and one-decimal rounding, matching the official renderer.

AgentCyberRange →

Published evaluation results collected from AgentCyberRange, retaining the reported systems and configurations.

Web exploitation and post-exploitation are separate evaluations. Pass@3 retains the site’s definition; row-specific budgets, sample counts and execution dates are not disclosed.

Evaluating Kimi K3 for Misalignment Risks →

Source-specific extraction of Neo Research · Kimi K3. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Evaluating DeepSeek v4 Pro for Frontier Risks →

Source-specific extraction of Neo Research · DeepSeek V4 Pro. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →

Source-specific extraction of Neo Research · GLM-5.2. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

CAISI Evaluation of DeepSeek V4 Pro →

Source-specific extraction of CAISI · DeepSeek V4 Pro. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence →

Source-specific extraction of DeepSeek V4 Technical Report. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Evaluation configuration

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.

Evaluation configuration

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.

Dedicated frontier-risk evaluation disclosure

The reviewed developer document does not disclose a dedicated frontier-risk evaluation.

Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.

Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.

Interpretation and open questions

Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.

References

[1] deepseek-v4-pro release ; News article title, dated heading and availability
[2] deepseek-v4-pro developer model card ; Introduction; model comparison table
[3] Evaluating DeepSeek v4 Pro for Frontier Risks. 2026-05-29. v1.1 · 29 May 2026 ; PDF p. 8; Cybench unguided; pass@1; PDF p. 9; EVMbench; Detect; PDF p. 9; EVMbench; Patch
[4] CAISI Evaluation of DeepSeek V4 Pro. 2026-05-01. 1 May 2026 ; Capability Results; Figure 2; *** footnote; Capability Results; Figure 2; Figure 2 HTML table, CTF-Archive-Diamond, DeepSeek V4 Pro (max)
[5] Evaluating Kimi K3 for Misalignment Risks. 2026-09-11. September 2026 ; §1.3.3 Table 2 p.18
[6] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; §1; Figure 1; §1; Figure 2; §2; Figure 6
[7] DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
[8] CyberGym official leaderboard and machine-data extraction ; /level1/0/score_10; /level1/8/score_10; /level1/14/score_10
[9] AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges ; routes-B-0Mubrq.js::QR/5/level0/pass3; routes-B-0Mubrq.js::$R/5/level0/pass3