ai-research-survey

scan.json (28113B)

---

 {
   "paper": {
     "title": "Grok 4 Model Card",
     "authors": ["xAI"],
     "year": 2025,
     "venue": "Technical report"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Grok 4 is xAI's latest reasoning model evaluated across safety dimensions: abuse potential, concerning propensities, and dual-use capabilities. The model achieves near-zero refusal bypass rates with system prompt mitigations, but retains a 0.43 dishonesty rate on the MASK benchmark and 0.14 harmful task completion on AgentHarm. Grok 4 achieves superhuman performance on biology benchmarks (BioLP-Bench 47%, VCT 60% vs human expert 38.4% and 22.1%), prompting xAI to deploy targeted bio/chem filters. End-to-end offensive cyber capabilities (CyBench 43%) are assessed as below human professional level.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No source code or evaluation scripts are released. The paper references publishing system prompts at github.com/xai-org/grok-prompts but this is product configuration, not evaluation code."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "Internal evaluation datasets (refusal queries, soft bias pairs) are not released. Public benchmarks (WMDP, MASK, AgentHarm, etc.) are available independently but the paper's own datasets are not."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, dependency files, or hardware details are provided for reproducing evaluations."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are provided. The paper does not describe how to replicate any evaluation."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-3 are point estimates only (e.g., 0.00, 0.43, 0.87). No confidence intervals or error bars are reported anywhere."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims differences (e.g., system prompt 'greatly reduces' rates) without any statistical significance tests. All comparisons are raw number differences."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only raw scores are reported. No effect sizes, relative improvements with baseline context, or standardized measures are provided. The before-mitigation baselines are not consistently shown, making effect size calculation impossible."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The refusal dataset is described only as 'thousands of queries' with no exact count or justification. Sample sizes for other evaluations are not stated or justified."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported for any evaluation. All results are single-point estimates."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Human expert baselines are provided for BioLP-Bench (38.4%) and VCT (22.1%) in Section 2.3.2. The paper also compares Grok 4 API vs Grok 4 Web across evaluations."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "No comparison against other frontier AI models (GPT-4, Claude, Gemini, Llama, etc.). Only human expert baselines and internal variants (API vs Web) are shown. For a model card claiming SOTA, the absence of AI model comparisons is notable."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper ablates the effect of system prompt mitigations, showing results with and without refusal policies, jailbreak warnings, and honesty instructions. Tables 1-2 implicitly compare mitigated vs unmitigated behavior."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used across evaluations: answer rate, attack success rate, dishonesty rate, accuracy, sycophancy rate, political bias score, and win rate (Tables 1-3)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluations are automated: model-based grading for refusals ('We used another model to grade'), benchmark scoring for capabilities, LLM judge for political bias. No human evaluation of any outputs."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Public benchmarks used (WMDP, MASK, AgentHarm, AgentDojo, BioLP-Bench, VCT, CyBench) are standardized held-out test sets from independent sources."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down across categories in Tables 1-3: refusals by attack type (standard, user jailbreak, system jailbreak), dual-use by domain (biology, chemistry, cybersecurity), and propensities by type (deception, political bias, sycophancy)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No qualitative examples of failures, error analysis, or discussion of where the model breaks down. The AgentHarm 0.14 answer rate and MASK 0.43 dishonesty rate indicate significant residual failures but no analysis of what types of failures occur."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports concerning results: 0.43 dishonesty rate on MASK, 0.14 harmful task completion on AgentHarm, 0.36 political bias, and superhuman bio capabilities as a risk. Section 2.2.2 states 'We are exploring further mitigations to reduce propensity for deception,' acknowledging current measures are insufficient."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The introduction claims Grok 4 achieves 'new state-of-the-art performance across challenging academic and industry benchmarks' but the paper contains no capability benchmarks (no MMLU, MATH, HumanEval, etc.). Only safety evaluations are presented. The SOTA claim is unsupported by this document."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims system prompt mitigations 'greatly reduce' harmful behaviors (causal claim), but Table 2 only shows mitigated results without the unmitigated baseline numbers. The reader cannot verify the magnitude of improvement. Table 1 similarly shows only post-mitigation results."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper concludes 'Grok 4 overall presents a low risk for malicious use and loss of control' — a very broad generalization from a limited set of benchmarks. Risk is assessed across all domains but radiological/nuclear are explicitly not evaluated. The conclusion does not bound itself to the tested settings."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are discussed for any results. For example, low refusal bypass rates could reflect benchmark limitations rather than model robustness; superhuman bio scores could reflect training data memorization rather than reasoning capability. None of these alternatives are considered."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.3.2 explicitly states: 'these evaluations measure dual-use knowledge: a high score indicates greater capability to enable weapons development, not necessarily increased risk.' This correctly distinguishes between benchmark scores (proxy) and actual risk (outcome)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper refers only to 'Grok 4 API' and 'Grok 4 Web' without any version identifiers, snapshot dates, or model size specifications. For the grading model used in refusal evaluation, no version is specified at all."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Evaluation prompts are not provided. The paper mentions a 'basic refusal policy' and 'system prompt' but does not include the actual text. Section 3.2 references github.com/xai-org/grok-prompts for consumer product prompts, not evaluation prompts."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported — no temperature, sampling parameters, max tokens, or any other inference settings for any evaluation."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": false,
         "justification": "For CyBench, the paper states only 'The model is placed in an agent harness which gives it access to tools such as code execution. We use the open-source Inspect evaluation framework.' No details about tool descriptions, retry logic, or context management for any agentic evaluation."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No data preprocessing details are provided for any evaluation. The refusal dataset construction is described only as 'constructed a broad set of harmful queries... translated them across several common languages... totaling thousands of queries' without methodology details."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no limitations section anywhere in the paper. No discussion of evaluation limitations, methodology constraints, or what the evaluations do not show."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. The paper does not consider whether evaluation benchmarks are representative, whether model-based grading introduces bias, or whether adversarial attacks tested are comprehensive."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper notes it does 'not evaluate radiological or nuclear capabilities' (Section 2.3) but provides no systematic statement of what was and was not tested or what the results do not show."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw evaluation data is available. Only aggregated metrics in Tables 1-3 are provided. Individual model responses, scoring details, and per-example results are not released."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "Data collection is vaguely described. The refusal dataset is described as 'constructed... totaling thousands of queries' without specifying exact count, construction methodology, or quality control. The soft bias evaluation describes the pairing structure but not the topic selection process."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation. All evaluations use automated benchmarks or model-based grading."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "No data pipeline documentation. The paper does not describe how benchmark inputs were processed, how model outputs were collected, or how grading was performed end-to-end."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is disclosed anywhere in the paper. No acknowledgments section, no grants mentioned."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The paper is clearly authored by 'xAI' (header of the document), the company that develops and deploys Grok 4. The affiliation is transparent."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "xAI has a direct financial interest in Grok 4 being assessed as safe. The company evaluating its own product's safety creates a fundamental conflict of interest. The funder is not independent of the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration. xAI's commercial interest in Grok 4's positive safety assessment is obvious but not formally declared."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff date is stated. Section 3.1 describes training data sources ('publicly available Internet data, data produced by third-parties...') but provides no temporal bounds."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether benchmark data appeared in training data. WMDP, MASK, and other benchmarks are publicly available and could have been in the training set. This is not addressed."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No contamination analysis despite using public benchmarks (WMDP published 2024, MASK 2025, AgentHarm 2025). The model could have trained on benchmark data and this is not discussed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in any evaluation."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or token consumption reported for any evaluation. The cost of running thousands of safety evaluations is not disclosed."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget stated for training or evaluation. Section 3.1 describes training techniques but provides no compute quantification."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or sensitivity analysis across multiple evaluation runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of evaluation runs is not stated for any benchmark. It is unclear whether results are from single runs or averaged over multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget reported. The system prompt is a form of tuning but no details are given about how many variations were tried before selecting the deployed version."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents results with a specific system prompt configuration but does not explain how this configuration was selected or whether alternative configurations were evaluated."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "xAI evaluates its own model without acknowledging author-evaluation bias. No independent evaluation is reported (except brief reference to 'third-party testing' for cyber capabilities without details). The conflict of a company grading its own product's safety is not discussed."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No performance reported as a function of compute. The paper references Grok 4 as 'a large step up from prior generation models' without quantifying the compute difference or efficiency."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "Construct validity is briefly touched for dual-use benchmarks ('a high score indicates greater capability to enable weapons development, not necessarily increased risk') but not discussed for safety benchmarks. Whether MASK adequately measures deception, or whether the refusal dataset captures real-world abuse patterns, is not examined."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Agentic evaluations (CyBench, AgentHarm, AgentDojo) each use different scaffolds/harnesses, but the paper does not discuss how scaffold choice affects results or whether results would differ under alternative scaffolds."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The model's training data could include benchmark solutions published before training, and this is not addressed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of feature leakage in any evaluation setup."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether training data and benchmark data share structural similarities or sources."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are mentioned for any benchmark evaluation."
       }
     }
   },
   "claims": [
     {
       "claim": "Grok 4 achieves new state-of-the-art performance across challenging academic and industry benchmarks.",
       "evidence": "Stated in the introduction (Section 1) but no capability benchmark results (MMLU, MATH, HumanEval, etc.) are provided in this document. Only safety evaluations are reported.",
       "supported": "unsupported"
     },
     {
       "claim": "Grok 4 presents a low risk for malicious use and loss of control with mitigations in place.",
       "evidence": "Table 1 shows near-zero refusal bypass rates (0.00-0.01), low AgentDojo ASR (0.02). However, AgentHarm answer rate is 0.14, MASK dishonesty rate is 0.43, and the model has superhuman bio capabilities.",
       "supported": "weak"
     },
     {
       "claim": "Grok 4 achieves superhuman performance on biological protocol and virology benchmarks.",
       "evidence": "Table 3: BioLP-Bench 47% (API) / 44% (Web) vs human expert 38.4%; VCT 60% (API) / 71% (Web) vs human expert 22.1%. Specific numbers from published benchmarks.",
       "supported": "strong"
     },
     {
       "claim": "System prompt mitigations greatly reduce rates of harmful behavior, deception, and political bias.",
       "evidence": "Section 2.1.2 and 2.2.2 describe reductions but Tables 1-2 primarily show post-mitigation numbers without consistently reporting pre-mitigation baselines. The magnitude of improvement cannot be independently verified.",
       "supported": "weak"
     },
     {
       "claim": "Grok 4's end-to-end offensive cyber capabilities remain below the level of a human professional.",
       "evidence": "Section 2.3.2 references 'third-party testing' for this claim but provides no details. CyBench unguided success rate is 0.43 (Table 3) but the human professional baseline is not stated.",
       "supported": "weak"
     },
     {
       "claim": "Including refusal policy in the system prompt enables Grok 4 to refuse almost all harmful requests.",
       "evidence": "Table 1: 0.00 answer rate for standard refusals (both API and Web), 0.00-0.01 with user jailbreaks. Results are specific but the without-system-prompt baseline is not shown.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Company evaluating its own product",
       "detail": "xAI evaluates Grok 4's safety with no independent verification. The company has a direct financial interest in favorable safety assessments. This is the most fundamental conflict of interest possible in safety evaluation."
     },
     {
       "flag": "Missing competitor baselines",
       "detail": "No comparison against other frontier models (GPT-4, Claude, Gemini, Llama). Without these baselines, claims of 'state-of-the-art' and relative safety positioning are unverifiable."
     },
     {
       "flag": "No error bars or uncertainty quantification",
       "detail": "All results are single point estimates. For safety-critical evaluations where the stakes are high, the absence of confidence intervals or variance measures is a serious methodological gap."
     },
     {
       "flag": "Incomplete before/after mitigation data",
       "detail": "The paper claims system prompt mitigations 'greatly reduce' harmful behaviors but Tables 1-2 largely show only post-mitigation numbers. The reader cannot verify improvement claims without pre-mitigation baselines."
     },
     {
       "flag": "No limitations section",
       "detail": "A safety evaluation with no limitations discussion is a significant omission. No acknowledgment of evaluation coverage gaps, benchmark representativeness, or adversarial testing completeness."
     },
     {
       "flag": "High residual deception rate presented without concern",
       "detail": "The MASK dishonesty rate of 0.43 means the model lies in nearly half of scenarios where lying is advantageous. The paper acknowledges this needs improvement but still concludes 'low risk for loss of control.'"
     },
     {
       "flag": "No contamination discussion",
       "detail": "Multiple public benchmarks are used (WMDP, MASK, AgentHarm, etc.) without any discussion of whether the model trained on benchmark data. For safety evaluations, contaminated benchmarks would give false assurance."
     },
     {
       "flag": "Unsupported SOTA claim",
       "detail": "The introduction claims 'new state-of-the-art performance across challenging academic and industry benchmarks' but provides zero capability benchmark results to support this."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents",
       "authors": ["Maksym Andriushchenko", "Alexandra Souly", "Mateusz Dziemian"],
       "year": 2025,
       "relevance": "Benchmark for evaluating harmful agentic behaviors of LLM agents, directly relevant to AI safety evaluation methodology."
     },
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic"],
       "year": 2024,
       "relevance": "Benchmark for evaluating prompt injection robustness in agentic LLM settings."
     },
     {
       "title": "The MASK Benchmark: Disentangling Honesty from Accuracy in AI Systems",
       "authors": ["Richard Ren", "Arunim Agarwal", "Mantas Mazeika"],
       "year": 2025,
       "arxiv_id": "2503.03750",
       "relevance": "Benchmark measuring AI deception/honesty, relevant to safety evaluation methodology and model alignment."
     },
     {
       "title": "Towards Understanding Sycophancy in Language Models",
       "authors": ["Mrinank Sharma", "Meg Tong", "Tomasz Korbak"],
       "year": 2024,
       "relevance": "Foundational work on sycophancy in LLMs, relevant to AI alignment and safety evaluation methodology."
     },
     {
       "title": "The WMDP Benchmark: Measuring and Reducing Malicious Use with Unlearning",
       "authors": ["Nathaniel Li", "Alexander Pan", "Anjali Gopal"],
       "year": 2024,
       "relevance": "Benchmark measuring dual-use knowledge capabilities of LLMs in biology, chemistry, and cybersecurity."
     },
     {
       "title": "CyBench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models",
       "authors": ["Andy K Zhang", "Neil Perry", "Riya Dulepet"],
       "year": 2025,
       "relevance": "Benchmark for evaluating agentic cybersecurity capabilities of LLMs, relevant to dual-use risk assessment."
     },
     {
       "title": "Virology Capabilities Test (VCT): A Multimodal Virology Q&A Benchmark",
       "authors": ["Jasper Götting", "Pedro Medeiros", "Jon G Sanders"],
       "year": 2025,
       "arxiv_id": "2504.16137",
       "relevance": "Benchmark for evaluating biological dual-use knowledge, used to assess superhuman model capabilities in virology."
     },
     {
       "title": "BioLP-Bench: Measuring Understanding of Biological Lab Protocols by Large Language Models",
       "authors": ["Igor Ivanov"],
       "year": 2024,
       "doi": "10.1101/2024.08.21.608694",
       "relevance": "Benchmark measuring LLM understanding of biological lab protocols, relevant to dual-use biosafety evaluation."
     },
     {
       "title": "OpenAI o1 System Card",
       "authors": ["OpenAI"],
       "year": 2024,
       "arxiv_id": "2412.16720",
       "relevance": "Comparable model card from OpenAI with safety evaluation methodology, useful for cross-model safety assessment comparison."
     },
     {
       "title": "Contemporary AI Foundation Models Increase Biological Weapons Risk",
       "authors": ["Roger Brent", "T. Greg McKelvey Jr."],
       "year": 2025,
       "arxiv_id": "2506.13798",
       "relevance": "Research on biological weapons risks from frontier AI models, directly relevant to dual-use capability assessment."
     }
   ]
 }