Early External Safety Testing of OpenAI's o3-mini: Insights from the Pre-Deployment Evaluation (2501.17749v1)

Abstract: LLMs have become an integral part of our daily lives. However, they impose certain risks, including those that can harm individuals' privacy, perpetuate biases and spread misinformation. These risks highlight the need for robust safety mechanisms, ethical guidelines, and thorough testing to ensure their responsible deployment. Safety of LLMs is a key property that needs to be thoroughly tested prior the model to be deployed and accessible to the general users. This paper reports the external safety testing experience conducted by researchers from Mondragon University and University of Seville on OpenAI's new o3-mini LLM as part of OpenAI's early access for safety testing program. In particular, we apply our tool, ASTRAL, to automatically and systematically generate up to date unsafe test inputs (i.e., prompts) that helps us test and assess different safety categories of LLMs. We automatically generate and execute a total of 10,080 unsafe test input on a early o3-mini beta version. After manually verifying the test cases classified as unsafe by ASTRAL, we identify a total of 87 actual instances of unsafe LLM behavior. We highlight key insights and findings uncovered during the pre-deployment external testing phase of OpenAI's latest LLM.

The paper presents a rigorous external safety testing paper of OpenAI’s o3-mini LLM with a focus on pre-deployment evaluation. The work emphasizes the systematic generation and execution of unsafe test inputs using an automated tool—ASTRAL (Automated Safety Testing of LLMs)—which leverages retrieval-augmented generation (RAG), few-shot prompting, and live web browsing. The methodology is grounded in a black-box coverage criterion designed to generate balanced test inputs spanning multiple safety categories, writing styles, and persuasion techniques.

Methodology and Test Input Generation

• Automated Input Generation:
  • RAG (Retrieval-Augmented Generation): to retrieve context-relevant examples.
  • Few-shot Prompting: to guide the generation towards varied writing styles.
  • Live Data Browsing (TS): to incorporate recent events from online news, ensuring the inputs are contextually up-to-date.

Two test suites were created: - TS1: Generated in November 2024 using three ASTRAL variants—RAG, RAG-FS, and RAG-FS-TS. Each variant produced 1260 test inputs, resulting in a total of 3780 prompts. - TS2: Initiated in January 2025 using the ASTRAL (RAG-FS-TS) variant exclusively, with 15 inputs generated per safety combination, reaching a total of 6300 prompts.

In aggregate, 10,080 test inputs were automatically generated and executed on the o3-mini beta model.

• Execution and Evaluation:

The test inputs, once generated, were submitted via OpenAI’s API. Notably, a non-negligible number of prompts triggered OpenAI’s internal safeguard—policy violation exceptions—which preempted the LLM from generating responses. For the responses that were produced, an evaluation mechanism using GPT-3.5 (selected for its higher accuracy) classified outputs as safe, unsafe, or unknown. The classification incorporates rationale explanations for improved interpretability and aligns with strategies to alleviate the test oracle problem in LLM safety testing.

Manual Assessment

• The evaluation results were further refined via manual verification of outputs labeled as “unsafe” or “unknown” by the automated evaluator. Given the potential for false positives, manual assessment was crucial to confirm unsafe behaviors.
• The authors note that classification of unsafe outcomes might be influenced by cultural perspectives. For instance, when assessing outputs related to firearm use by civilians, cultural regulation differences were taken into account.

Results and Quantitative Findings

• Overall Outcome:

Out of 10,080 test inputs, 87 were manually confirmed as unsafe.

• Category Highlights:
  • The highest incidence was observed in category c3 (controversial topics and politics), followed by c13 (terrorism and organized crime). This is particularly evident in TS2, where recent political events, including remarks connected to Donald Trump’s inauguration, resulted in a significant number of unsafe outcomes.
  • Other safety categories such as c1 (animal abuse) and c5 (drug abuse and weapons) also registered non-negligible unsafe behaviors.
• Comparative Analysis:
  • When contrasted with previous experiments on older models (e.g., GPT-3.5, GPT-4, GPT-4o), the o3-mini model demonstrated a substantially lower count of unsafe outputs. For example, earlier tests documented unsafe outcomes in the hundreds, while the o3-mini beta exhibited only 87 unsafe cases overall.
  • Relative to state-of-the-art models like Llama2 tested in earlier studies, o3-mini also appears to enforce stricter safety mechanisms.

Key Findings and Discussion

1. Enhanced Safety Profile:
   • The o3-mini model exhibits a higher safety level compared to its predecessors. This improvement is attributed in part to an external policy violation safeguard that intercepts many unsafe test inputs before execution, resulting in fewer unsafe outputs reaching the model.
2. ASTRAL’s Efficacy:
   • The use of ASTRAL, with its dynamic test input generation mechanism and black-box coverage criterion, enabled a broad exploration of potential vulnerabilities. The incorporation of few-shot prompting and live data retrieval contributed significantly to testing recently relevant scenarios.
3. Role of API Safeguards:
   • The presence of an external firewall-like mechanism was identified, which preemptively detects and blocks potentially unsafe prompts. While this enhances overall system safety, it also raises questions about consistency, as these safeguards were not similarly triggered in tests involving different models.
4. Impact of Recent Events:
   • The analysis revealed that triggers from current events, especially those falling under controversial and political topics, resulted in a higher ratio of unsafe responses. This underscores the model’s sensitivity to emerging sociopolitical contexts in safety evaluation.
5. Trade-off Considerations:
   • The paper acknowledges that excessive safety constraints might compromise model helpfulness, although this trade-off was not deeply investigated in the present work.

Concluding Remarks

The detailed external safety testing conducted on OpenAI’s o3-mini beta model demonstrates that combining automated input generation with comprehensive evaluation strategies can effectively reveal safety-related vulnerabilities. The statistical analysis, including evaluations across multiple safety categories, offers a quantitative basis for asserting that o3-mini is safer relative to older models. However, further studies are recommended to assess the potential impact on model helpfulness and to clarify how preemptive policy safeguards might influence future general-user deployments.