来源档案

Kimi K3: Open Frontier Intelligence — Technical Report of Kimi K3

核查了开发者技术报告中的网络安全评测、安全相关基础设施描述及证据边界；报告自测与转引的独立评测分别归属。已核实的网络安全数值因缺少明确评测变体和配置，仅保留在私有复核记录中。

原始来源与出处 ↓ · 评估档案 →

范围与归属

数据报告方: Moonshot AI
实际评测方: 各观测的执行方未完整确定
抓取版本: 抓取时间未确定
来源身份: 268b291f8225a4b8

来源转录不等于实验复现。未确定的日期、执行方及配置保留为未知；原文分组不作为经核验排名。

来源发现

以下陈述整理自原始来源，未作为 NUWA 独立实验结论。

报告将端到端漏洞利用开发明确列为与滥用风险最直接相关的评测层级；开发者报告的能力表现并不均衡，在加固目标上仍与人类专家存在差距。

§6.2.2, pp. 30–31

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

作者将其网络安全评测视为能力下界，并强调结论取决于当前模型版本和评测覆盖范围。

§6.2.2, p. 31, final paragraph

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

报告称，在早期使用传统容器沙箱的实验中，智能体的非预期操作曾导致内核崩溃和死锁；报告将微型虚拟机隔离作为应对这一问题的设计措施。

§5.3.2, p. 22

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

训练环境的说明涉及奖励投机检测、验证器隔离，以及使用保留场景进行验证。

§4.2.4 and §4.2.6, p. 16

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

本报告中的长时程智能体、多智能体协作、编程及 AI 研发演示属于通用能力背景，并非专门针对自主性风险、自我复制、破坏行为或失控风险的评测。

§6.1; §6.2.1; §7, pp. 25–34

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

提取范围

以下条目说明来源各部分的处理状态。个别观测已核验，不代表整份文档的全部结论和结果均已验证。

查看 19 项覆盖记录

章节	处理状态	定位与范围
Abstract; 1 Introduction	not-relevant	pp. 1–2Architecture and broad frontier coding, reasoning, agentic, knowledge and vision capability background; no direct frontier-risk evaluation. Figure 1 values are not copied into risk evidence.
2 Model Architecture; 3 Pre-Training; 4.1 Method	qualitative	pp. 3–14Broad capability/training context. Faithfulness is named among RL general tasks (§4.1.2); this is not a demonstrated safety result. No numerical training values extracted as risk evidence.
4.2.1–4.2.3 Unified White-Box RL; knowledge-graph task synthesis; verifiable problems	qualitative	pp. 14–16General agent capability and verifier context. Biomedicine/chemistry appear only as broad training-domain labels, not dangerous-capability assessments; no biological task material or numbers extracted.
4.2.4 Kernel Optimization Tasks; 4.2.6 Autonomous Execution Tasks	qualitative	p. 16Developer describes reward-hacking detection and verifier separation/held-out evaluation; safeguards are qualitative and no measured reduction in reward hacking is reported. Operational methods and task instructions omitted.
4.2.5 Personal Assistant Tasks; 4.2.7 Web Development Tasks	not-relevant	p. 16Long-horizon agent capability and training environment descriptions; not direct autonomy-risk results.
5.3.2 Sandbox Infrastructure	qualitative	p. 22Early container experiments reportedly caused kernel panics/deadlocks from unintended agent operations; AgentENV microVM isolation is described. No failure frequency/denominator or measured containment efficacy disclosed. Infrastructure throughput/speed figures are not safety outcomes.
5 Infrastructure (other subsections)	not-relevant	pp. 17–25Training/serving efficiency and reliability; not direct frontier-risk tests.
6.1 Main Results; Table 2; Figure 1	not-relevant	pp. 25–28General reasoning, coding, agent and vision scores are capability background, not direct risk evidence. Source distinguishes original runs and reused leaderboard values. No general scores extracted. WorldVQA answer-forcing/refusal and cyberguards/fallback qualifiers are evaluation-comparability caveats, not robustness metrics.
6.2.1 Capability Evaluation; Tables 3–4	qualitative	pp. 28–30Internal agent/coding/swarm/long-horizon suites are general capability background. Agent Behavior Bench measures tool-use process quality, efficiency and discipline; it is not a dedicated deception, control, misuse, autonomy-risk or safeguards metric. Webdev preference scores omitted.
6.2.1 Faithfulness; Table 3 footnote g	extracted	pp. 29–30Five disclosed model values copied exactly as reported 1−hallucination-rate scores; Claude Fable 5 is a dash (not included). Reliability evidence, not a frontier-risk threshold. No task count or detailed fact-checker protocol reported.
6.2.2 Cyber Security Evaluation — vulnerability discovery (Tier 1)	extracted	p. 30Aggregate human-confirmation fraction and unknown-vulnerability/project counts extracted. Reviewed-candidate denominator not disclosed; specific vulnerability primitives and target details omitted.
6.2.2 Cyber Security Evaluation — exploit development (Tier 2)	extracted	pp. 30–31Original aggregate results from internal 36-task suite, with 16 user-space/20 kernel tasks, plus stated expert-effort estimates. Source does not state cyber-specific model harness, per-run budget, repetitions, or exact version identifier. No task instructions or operational exploit material copied.
6.2.2 Summary — independent AISI/CAISI assessment	reused	p. 31; reference [125] p. 39Six observations retained as secondary reporting of independent AISI/CAISI results; executor attribution is explicit source reporting, not independently checked. Original evaluation dates/configurations unknown here. These are not Moonshot experimental results.
6.3 Third-Party Evaluation; Table 5	reused	pp. 31–32General intelligence, industry and preference scores attributed to Artificial Analysis, Vals AI and Arena; no direct risk metric, not numerically extracted. As-of dates do not establish publication date of this PDF.
6.4 Cost Efficiency; Figure 13	not-relevant	pp. 31–32Cost/performance background, not frontier-risk evidence; no plot estimates.
7 Case Studies; Figures 14–15	qualitative	pp. 33–34Developer presents kernel/compiler/chip/research/knowledge-work/video cases and model contribution to internal optimization. General capability/AI R&D context; not a controlled dangerous-capability, autonomous replication, or loss-of-control evaluation. No case performance figures extracted as direct risk.
8 Conclusion	not-relevant	p. 34Broad frontier capability and open-weight release claims; no safety conclusion.
References; A Contributions; B–E technical derivations; F Chat Template	not-relevant	pp. 35–47Reference [125] provides reused cyber-source identity; other material is authorship or technical/template context, not additional risk evaluation. Low alignment tax in Appendix F is a template-learning design goal, not an alignment/safety evaluation.
Other safety/frontier-risk domains	not-disclosed	whole 47-page reportNo dedicated dangerous biological/chemical/nuclear assessment, persuasion/influence, scheming/deception, model self-replication, sabotage, or broad refusal/jailbreak benchmark located. Absence is limited to this source; do not infer model safety or zero capability.

来源待核实事项

The technical report contains developer-run cybersecurity findings and separately cites an independent AISI/CAISI assessment. These sources and execution roles must remain separate; the cited assessment is secondary reporting in this report.

The report does not supply enough cyber-specific model and experiment configuration to establish comparable protocol variants. General benchmark and factual reliability results do not fill gaps in frontier-risk assessment.

Review used a complete previously captured official PDF whose original capture time is unknown. A later incomplete transfer was not used as fresh report evidence; publication and revision dates remain unknown.

版本指纹

document