Google's model card covers Argon's automated safety tests, red teaming, and critical capability risks. Relevant risk thresholds cannot be ruled out; deployment mitigations remain necessary. Test sets, prompts, and most threshold details are not public.
Suitable judgments: Understanding Google's safety threat categories for Argon, evaluation layers, disclosed relative safety changes, and the biological, cybersecurity, manipulation, and loss-of-control risks that require attention before deployment.
Unsuitable extrapolations: The model-card numbers cannot estimate the safety rate, jailbreak rate, vulnerability-discovery rate, or residual production risk for arbitrary tasks. Automated evaluation results should not be treated as human-red-team results.
Model version: Gemini 4 Argon; automated safety changes are primarily measured against Gemini 3.1 Pro. The model card does not provide a more specific API version, SDK version, or safety-evaluation run version.
Test environment or client: The model card does not disclose the client, API, hardware, toolchain, or deployment configuration used for safety evaluation. The distribution channels listed on the page include the Gemini App, Gemini API, Google AI Studio, Gemini for business, Google Antigravity, and Google AI Mode.
Reasoning tier and parameters: Not specified. The safety evaluations do not disclose thinking level, temperature, context, output limit, sampling strategy, or retry settings.
The model card says Argon was developed in collaboration with internal safety, security, and responsibility teams and used the following types of activity:
Training/development evaluations: Automated and human evaluations continued during and after training to monitor progress and performance.
Human red teaming: Specialist teams outside the model-development team actively looked for weaknesses around policies and desiderata, checking whether the model followed safety policies and produced the intended results; the page specifically mentions the Google Trust & Safety organization.
Automated red teaming: Safety and security risks were evaluated dynamically at scale to complement human red teaming and static evaluations.
Ethics and safety review: Completed before release.
Frontier Safety Framework (FSF) testing: The model card says the evaluations followed the Google DeepMind FSF and used its April 2026 version for key capability evaluations.
The model card also says the evaluations align with the Google AI Principles, responsible-AI methods, the Generative AI Prohibited Use Policy, and the Gemini API Additional Terms of Service.
The training/development results disclosed by the model card are automated evaluations, not human evaluations or red-team results; the numbers represent absolute percentage-point changes relative to Gemini 3.1 Pro. The direction is not uniform across the safety evaluations: Text-to-Text Safety, Multilingual Safety, Image-to-Text Safety, and Unjustified Refusals are marked “lower is better,” while Tone is marked “higher is better.” The page does not provide query-set size, sample count, prompts, model-sampling parameters, numerical confidence intervals, or evaluation-tool versions.
| Evaluation | What it measures | Argon relative change |
|---|---|---|
| Text-to-Text Safety (lower is better) | Adherence to safety policies for text prompts | +1.57pp |
| Multilingual Safety (lower is better) | Multilingual safety-policy evaluation | -3.16pp |
| Image-to-Text Safety (lower is better) | Adherence to safety policies for image-and-text inputs | -9.29pp |
| Tone (higher is better) | Whether refusals are objective, neutral, and not overly preachy | +5.50% |
| Unjustified Refusals (lower is better) | Excessive refusals for benign or borderline prompts that can be safely completed | -9.60pp |
The page's overall interpretation is that Argon outperforms Gemini 3.1 Pro on multilingual and multimodal content safety, reduces unjustified refusals, and improves refusal tone. Text-to-Text Safety remains at a similarly high rate of safe responses within the confidence interval. Google also says the evaluations were improved and the query sets were adjusted, so these results cannot be directly compared with results in earlier Gemini model cards; human review found that the vast majority of flagged content was false positive or non-severe content.
Specialist teams in Google Trust & Safety, independent of the model-development team, conducted manual red teaming and passed high-level findings back to the model team.
The child-safety evaluation met the expert-defined release threshold.
For general content safety policies, including child safety, Google says Argon's performance was comparable to or better than Gemini 3.1 Pro.
Red teaming also covered potential issues outside strict policy boundaries; the page says no serious issues were found.
The model card does not provide the number of red teamers, task count, attack categories, success rate, prompts, toolchain, or stopping criteria.
The page describes intrinsic risks using T/CCL (capability/critical capability level) and emphasizes that residual-risk assessment is also required after a threshold is reached. When a CCL is reached, the residual-risk assessment must also be supported by a supplemental safety case that describes mitigations. Argon's public conclusions are as follows:
| Risk domain | Threat model and result disclosed by the model card | Threshold conclusion |
|---|---|---|
| CBRN | Chemical, radiological, and nuclear domains can confidently rule out the Uplift TCL. Although the model has strong ability in some theoretical reasoning, it lacks the detailed expert knowledge and executable depth needed to complete priority harm pathways. The CCL for biological information risk cannot be ruled out; expert red teaming observed measurable capability improvements over the Web baseline and previously tested models in two scenarios, and the model provided comprehensive, accurate, and actionable information. Google therefore used a safety case to bring the risk assessment below the biological CCL. | Chemical/radiological/nuclear TCL not reached; biological CCL cannot be ruled out |
| Cybersecurity | The Uplift Level 1 CCL cannot be ruled out. Google says evaluation and quantitative modeling showed a significant capability increase, while evidence from other frontier models in cyber scenarios also suggests that serious harm may result without sufficient mitigation; it therefore used a safety case to bring the risk assessment below the cybersecurity CCL. | CCL cannot be ruled out |
| Harmful Manipulation | In a one-to-one direct-dialogue human-behavior study, the model showed some ability to influence users' beliefs and behavior and might help plan malicious influence campaigns. Google assesses its overall capability as still below the threshold, while acknowledging that this risk area is still developing. | Level 1 CCL not reached |
| Loss of Control | The model passed 14/15 stealth and situational-awareness challenges, demonstrating strong capability. The Stealth and Situational Awareness TCL therefore cannot be ruled out, and mitigations were configured for internal and external deployment to bring the risk assessment below the TCL. | TCL cannot be ruled out |
| ML R&D acceleration | AI R&D acceleration was evaluated using an internal complex research-engineering task benchmark; Argon's performance was below the CCL threshold. | CCL not reached |
| ML R&D automation | For the capability requirement of fully automating a Google AI capability-improvement research team at roughly comparable total cost, the model card does not report that the threshold was reached. | CCL not reached |
Apart from Loss of Control's 14/15 challenges, the model card does not disclose sample sizes, specific task sets, attack tools, run counts, scoring criteria, model configurations, or the safety-case text for the Frontier Safety evaluations above.
Google's safety-policy goals include preventing the model from generating the following harmful content:
Child sexual abuse material and exploitation-related content;
dangerous content, such as encouraging suicide or instructing activities that could cause real-world harm;
sexual content;
hate and harassment, such as denigrating protected groups;
medical advice and information that contradict scientific or medical consensus.
The model should also not be integrated into systems engaged in dangerous or illegal activities, violations of law or regulation, compromising the security of other people or Google services, pornography/violence/hate/harmful activities, or misinformation, false statements, and misleading activities. The specific scope is governed by Google's Generative AI Prohibited Use Policy and the relevant service terms.
The model may hallucinate, as foundation models commonly do.
It may occasionally slow down or time out.
Gemini 4's knowledge cutoff is March 2026, though knowledge in some domains may be less up to date.
The 1M input/output context and multimodal input are capability descriptions in the model information, not the scope of the safety evaluations or a safety guarantee.
The model-card page provides a “View PDF version” link to https://storage.googleapis.com/deepmind-media/Model-Cards/Gemini-4-Argon-Model-Card.pdf. When this link was opened through Tabbit, the PDF page did not maintain readable rendering, so the PDF was not treated as additional evidence. All facts in this article come from the readable Google DeepMind model-card body.
This is Google DeepMind's official model card and official safety self-report, not a third-party safety audit or an independent reproduction by this project.
The automated-evaluation numbers are percentage-point changes relative to Gemini 3.1 Pro. Because direction, query sets, and evaluation definitions differ, they cannot be directly compared with general benchmark scores or older figures from other model cards.
Human red teaming and the Frontier Safety conclusions provide risk categories and mitigation decisions, but they do not disclose enough samples, prompts, tools, configurations, or success rates to calculate a jailbreak rate or attack success rate.
“CCL/TCL cannot be ruled out” means Google considers the relevant intrinsic capability risk to require a safety case, residual-risk assessment, and deployment mitigations. It is not a record of a measured incident in which the model caused that risk, nor does it mean mitigated risk is the same in every environment.
The model card says a complete Safety & Security Report would be released on 2026-10-13, but this page still cites it as “coming soon on October 13”; this article does not treat the report text as obtained.
The general Evaluation benchmark table visible on the page is outside this article's focus. This article retains only safety-evaluation methods, threat models, relative safety changes, and limitations to avoid duplicating the general capability benchmarks in the release post.
The Google safety evaluations cannot be fully reproduced from the model card alone. An independent reproduction should first fix the actual gemini-4-argon entry point, version, reasoning configuration, system message, sampling parameters, and safety settings. Then establish public, auditable prompts and task sets for each risk domain, recording sample counts, run counts, tool calls, refusal/completion criteria, false positives, and false negatives, with independent human review. CBRN, cyberattack, manipulation, and loss-of-control testing should follow applicable safety policies and controlled-experiment procedures; do not fill in Google's results using samples or tool parameters missing from the model card.
Gemini 4 Argon
