NUWA 
Google DeepMind
Gemini 3.1 Pro
Published evidence on capabilities, behavioral tendencies and observed actions.
- First public availability
- 2026-02-19
- Parameters
- Not disclosed
- Metadata updated
- 2026-10-27
Evidence overview
Published risk evidence is organized by assessment and protocol. Missing evidence is not a low-risk finding.
NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.
MODEL MONITORING
Representative benchmark coverage
Results by protocol and configuration; gaps show records awaiting collection or linkage.
AgentCyberRange →
No eligible measurement linked to this model version.
Cybench →
No eligible measurement linked to this model version.
CyberGym →
1 measurements
- 38.8%Not disclosed · Gemini CLI
METR Time Horizons →
2 measurements
- 384.15 minMETR · mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent
- 89.8 minMETR · mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent
SEC-bench Pro →
No eligible measurement linked to this model version.
MASK →
No eligible measurement linked to this model version.
Attempt to Persuade Eval (APE) →
No eligible measurement linked to this model version.
DeceptionBench →
4 measurements
All conditions →PersuSafety →
No eligible measurement linked to this model version.
All linked measurements
Each result retains its protocol and unit.
11 observations
| System / model | Result | Condition status | Task / conditions | Evaluator / report | Dates |
|---|---|---|---|---|---|
| Gemini 3.1 Pro · Gemini CLIGemini 3.1 Pro | 38.8%CyberGym · Success rate | Incomplete | level1score_10Gemini CLI | Not disclosedCyberGym official leaderboard and machine-data extraction | Release 2026-02-19Report — |
| Gemini 3.1 Pro | 51.5%Agentic misalignment · deliberate harmful action rate | Incomplete | Anthropic Agentic Misalignmentdeliberate harmful action rate— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-19Report 2026-05-29 |
| Gemini 3.1 Pro | 25.7%DeceptionBench · deception score: single-turn | Incomplete | DeceptionBenchdeception score: single-turn— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-19Report 2026-05-29 |
| Gemini 3.1 Pro | 33.7%DeceptionBench · deception score: multi-turn w pressure | Incomplete | DeceptionBenchdeception score: multi-turn w pressure— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-19Report 2026-05-29 |
| Gemini 3.1 Pro | 25.7%DeceptionBench · DeceptionBench deception score | Incomplete | DeceptionBenchsingle-turn— | MetaEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-02-19Report 2026-07-03 |
| Gemini 3.1 Pro | 33.7%DeceptionBench · DeceptionBench deception score | Incomplete | DeceptionBenchmulti-turn with pressure— | MetaEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-02-19Report 2026-07-03 |
| Gemini 3.1 Pro · METR scaffoldGemini 3.1 Pro | 384.15 minMETR Time Horizons · 50% task-completion horizonSource 95% CI [233.50073, 694.750898] min | Incomplete | METR-Horizon-v1.1mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent | METRMETR Time Horizon 1.1 — source data | Release 2026-02-19Report — |
| Gemini 3.1 Pro · METR scaffoldGemini 3.1 Pro | 89.8 minMETR Time Horizons · 80% task-completion horizonSource 95% CI [52.025934, 158.618017] min | Incomplete | METR-Horizon-v1.1mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent | METRMETR Time Horizon 1.1 — source data | Release 2026-02-19Report — |
| Gemini 3.1 Pro · Gemini CLIGemini 3.1 Pro | 12 countExploitGym · Intended-target successes | Incomplete | v0on_target2h timeoutGemini CLI | Not disclosedExploitGym official leaderboard and benchmark page | Release 2026-02-19Report — |
| Gemini 3.1 Pro | 37 percentage pointsAlignment faking · Compliance gap | Incomplete | Alignment FakingCompliance gap— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-19Report 2026-05-29 |
| Gemini 3.1 Pro | 7.9%Alignment faking · Deceptive alignment rate | Incomplete | Alignment FakingDeceptive alignment rate— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-19Report 2026-05-29 |
Developer disclosures
No developer-authored safety report has been linked to this exact model record in the current collection.
External assessments
Neo Research
Evaluating DeepSeek v4 Pro for Frontier Risks →
The report separates task capability from pressure-induced behavior and notes format dependence in persuasion assessment.
2026-05-29Neo Research
Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →
The note reports scenario-dependent behavior and an uncertain decline in verbalized evaluation awareness; silence is not evidence of absent awareness.
2026-07-03METR
METR Time Horizon 1.1 →
Estimated task difficulty at 50% and 80% success, measured in human-expert minutes.
Publication date not establishedCyberGym official snapshot →
Published evaluation results collected from CyberGym, retaining the reported systems and configurations.
Publication date not establishedExploitGym official snapshot →
Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.
Publication date not establishedEvidence by risk topic
Autonomy 2 protocol results
METR Time Horizon 1.1 →
External evaluation · Executed by METR
- 50% task-completion horizon
- 384.15 min
- 80% task-completion horizon
- 89.80 min
Task counts/weights vary with source tasks and scaffold coverage; see methodology.
Agentic Misalignment →
Reused result · Executed by Meta · Original executor Meta
- deliberate harmful action rate
- 51.5%
Per-result sample size not disclosed
Deception 7 protocol results
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- deception score: single-turn
- 25.7%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- deception score: multi-turn w pressure
- 33.7%
Per-result sample size not disclosed
Alignment faking →
Reused result · Executed by Meta · Original executor Meta
- Compliance gap
- 37 percentage points
Per-result sample size not disclosed
Alignment faking →
Reused result · Executed by Meta · Original executor Meta
- Deceptive alignment rate
- 7.9%
Per-result sample size not disclosed
Agentic Misalignment →
Reused result · Executed by Meta · Original executor Meta
- deliberate harmful action rate
- 51.5%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- DeceptionBench deception score
- 25.7%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- DeceptionBench deception score
- 33.7%
Per-result sample size not disclosed
Cybersecurity 2 protocol results
CyberGym · level1 · score_10 →
External evaluation · Executed by
- Success rate
- 38.8%
Per-result sample size not disclosed
ExploitGym · v0 · on_target →
External evaluation · Executed by
- Intended-target successes
- 12 count
Per-result sample size not disclosed
CBRN 1 protocol results
WMDP →
Reused result · Executed by Meta · Original executor Meta
- accuracy
- 90.5%
Per-result sample size not disclosed
Disinformation No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Autonomous physical harm No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Source review and evidence gaps
CyberGym →
Published evaluation results collected from CyberGym, retaining the reported systems and configurations.
The site reports submitted systems under different configurations. Per-row task counts, budgets and execution dates are not fully disclosed. Undefined metrics and unresolved identity rows are excluded. Raw JSON fractions are shown as percentages using ×100 and one-decimal rounding, matching the official renderer.
ExploitGym →
Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.
Intended-target success and flag capture are distinct counts. Task versions and timeout cutoffs remain separate. Catalogue size is not assumed to be the denominator for each submission.
Evaluating DeepSeek v4 Pro for Frontier Risks →
Source-specific extraction of Neo Research · DeepSeek V4 Pro. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →
Source-specific extraction of Neo Research · GLM-5.2. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.
Interpretation and open questions
Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.
References
- [1] Gemini 3.1 Pro: Announcing our latest Gemini AI model ; Publication date and availability section; Official launch article; parameter counts not disclosed
- [2] METR Time Horizon 1.1 — source data ; results.gemini_3_1_pro
- [3] Evaluating DeepSeek v4 Pro for Frontier Risks. 2026-05-29. v1.1 · 29 May 2026 ; PDF p. 9; WMDP-Cyber; accuracy; PDF p. 27; DeceptionBench; deception score: single-turn; PDF p. 27; DeceptionBench; deception score: multi-turn w pressure
- [4] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; #behavioral; Figure 2 / deceptionbench.png; printed label Gemini 3.1 Pro / single-turn; #behavioral; Figure 2 / deceptionbench.png; printed label Gemini 3.1 Pro / multi-turn with pressure
- [5] CyberGym official leaderboard and machine-data extraction ; /level1/55/score_10
- [6] ExploitGym official leaderboard and benchmark page ; /results/6/on_target