I found the safety framework highly frustrating to read, as it repeatedly ‘hides the football’ and withholds or makes it difficult to understand key information.
I do not believe there is a frontier safety problem with Gemini 3, but (to jump ahead, I’ll go into more detail next time) I do think that the model is seriously misaligned in many ways, optimizing too much towards achieving training objectives. The training objectives can override the actual conversation. This leaves it prone to hallucinations, crafting narratives, glazing and to giving the user what it thinks the user will approve of rather than what is true, what the user actually asked for or would benefit from.
It is very much a Gemini model, perhaps the most Gemini model so far.
Gemini 3 Pro is an excellent model despite these problems, but one must be aware.
Gemini 3 Self-Portrait
Gemini 3 Facts
I already did my ‘Third Gemini’ jokes and I won’t be doing them again.
This is a fully new model.
Knowledge cutoff is January 2025.
Input can be text, images, audio or video up to 1M tokens.
Output is text up to 64K tokens.
Architecture is mixture-of-experts (MoE) with native multimodal support.
They say improved architecture was a key driver of improved performance.
That is all the detail you’re going to get on that.
Pre-training data set was essentially ‘everything we can legally use.’
Data was filtered and cleaned on a case-by-case basis as needed.
Distribution can be via App, Cloud, Vertex, AI Studio, API, AI Mode, Antigravity.
The benchmarks are in and they are very, very good.
The only place Gemini 3 falls short here is SWE-Bench, potentially the most important one of all, where Gemini 3 does well but as of the model release Sonnet 4.5 was still the champion. Since then, there has been an upgrade, and GPT-5-Codex-Max-xHigh claims to be 77.9%, which would put it into the lead, and also 58.1% on Terminal Bench would put it into the lead there. One can also consider Grok 4.
There are many other benchmarks out there, I’ll cover those next time.
Safety Third
How did the safety testing go?
We don’t get that much information about that, including a lack of third party reports.
Safety Policies: Gemini’s safety policies aim to prevent our Generative AI models from generating harmful content, including:
Content related to child sexual abuse material and exploitation
Hate speech (e.g., dehumanizing members of protected groups)
Dangerous content (e.g., promoting suicide, or instructing in activities that could cause real-world harm)
Harassment (e.g., encouraging violence against people)
Sexually explicit content
Medical advice that runs contrary to scientific or medical consensus
I love a good stat listed only as getting worse with a percentage labeled ‘non-egregious.’ They explain this means that the new mistakes were examined individually and were deemed ‘overwhelmingly’ either false positives or non-egregious. I do agree that text-to-text is the most important eval, and they assure us ‘tone’ is a good thing.
The combination of the information gathered, and how it is presented, here seems importantly worse than how Anthropic or OpenAI handle this topic.
Gemini has long had an issue with (often rather stupid) unjustified refusals, so seeing it get actively worse is disappointing. This could be lack of skill, could be covering up for other issues, most likely it is primarily about risk aversion and being Fun Police.
Frontier Safety Framework
The short version of the Frontier Safety evaluation is that no critical levels have been met and no new alert thresholds have been crossed, as the cybersecurity alert level was already triggered by Gemini 2.5 Pro.
CBRN
Does evaluation Number Go Up? It go up on multiple choice CBRN questions.
The other results are qualitative so we can’t say for sure.
Open-Ended Question Results: Responses across all domains showed generally high levels of scientific accuracy but low levels of novelty relative to what is already available on the web and they consistently lacked the detail required for low-medium resourced threat actors to action.
Red-Teaming Results: Gemini 3 Pro offers minimal uplift to low-to-medium resource threat actors across all four domains compared to the established web baseline. Potential benefits in the Biological, Chemical, and Radiological domains are largely restricted to time savings.
Okay, then we get that they did an External “Wet Lab” uplift trial on Gemini 2.5, with uncertain validity of the results or what they mean, and they don’t share the results, not even the ones for Gemini 2.5? What are we even looking at?
Gemini 3 thinks that this deeply conservative language is masking that this part of the story they told earlier, where Gemini 2.5 hit an alert threshold, then they ‘appropriately calibrated to real world harm’ and now Gemini 3 doesn’t set off that threshold. They decided that unless the model could provide ‘consistent and verified details’ things were basically fine.
Gemini 3’s evaluation of this decision is ‘scientifically defensible but structurally risky.’
I agree with Gemini 3’s gestalt here, which is that Google is relying on the model lacking tacit knowledge. Except I notice that even if this is an effective shield for now, they don’t have a good plan to notice when that tacit knowledge starts to show up. Instead, they are assuming this process will be gradual and show up on their tests, and Gemini 3 is, I believe correctly, rather skeptical of that.
External Safety Testing: For Chemical and Biological risks, the third party evaluator(s) conducted a scenario based red teaming exercise. They found that Gemini 3 Pro may provide a time-saving benefit for technically trained users but minimal and sometimes negative utility for less technically trained users due to a lack of sufficient detail and novelty compared to open source, which was consistent with internal evaluations.
There’s a consistent story here. The competent save time, the incompetent don’t become competent, it’s all basically fine, and radiological and nuclear are similar.
Cybersecurity
We remain on alert and mitigations remain in place.
There’s a rather large jump here in challenge success rate, as they go from 6/12 to 11/12 of the hard challenges.
They also note that in 2 of the 12 challenges, Gemini 3 found an ‘unintended shortcut to success.’ In other words, Gemini 3 hacked two of your twelve hacking challenges themselves, which is more rather than less troubling, in a way that the report does not seem to pick up upon. They also confirmed that if you patched the vulnerabilities Gemini could have won those challenges straight up, so they were included.
This also does seem like another ‘well sure it’s passing the old test but it doesn’t have what it takes on our new test, which we aren’t showing you at all, so it’s fine.’
They claim there were external tests and the results were consistent with internal results, finding Gemini 3 Pro still struggling with harder tasks for some definition of ‘harder.’
Combining all of this with the recent cyberattack reports from Anthropic, I believe that Gemini 3 likely provides substantial cyberattack uplift, and that Google is downplaying the issues involved for various reasons.
Manipulation
Other major labs don’t consider manipulation a top level threat vector. I think Google is right, the other labs are wrong, and that it is very good this is here.
I’m not a fan of the implementation, but the first step is admitting you have a problem.
They start with a propensity evaluation, but note they do not rely on it and also seem to decline to share the results. They only say that Gemini 3 manipulates at a ‘higher frequency’ than Gemini 2.5 in both control and adversarial situations. Well, that doesn’t sound awesome. How often does it do this? How much more often than before? They also don’t share the external safety testing numbers, only saying ‘The overall incidence rate of overtly harmful responses was low, according to the testers’ own SME-validated classification model.’
This is maddening and alarming behavior. Presumably the actual numbers would look worse than refusing to share the numbers? So the actual numbers must be pretty bad.
I also don’t like the nonchalance about the propensity rate, and I’ve seen some people say that they’ve actually encountered a tendency for Gemini 3 to gaslight them.
They do share more info on efficacy, which they consider more important.
Google enrolled 610 participants who had multi-turn conversations with either an AI chatbot or a set of flashcards containing common arguments. In control conditions the model was prompted to help the user reach a decision, in adversarial conditions it was instructed to persuade the user and provided with ‘manipulative mechanisms’ to optionally deploy.
What are these manipulative mechanisms? According to the source they link to these are things like gaslighting, guilt tripping, false urgency or love bombing, which presumably the model is told in its instructions that it can use as appropriate.
We get an odds ratio, but we don’t know the denominator at all. The 3.44 and 3.57 odds ratios could mean basically universal success all the way to almost nothing. You’re not telling us anything. And that’s a choice. Why hide the football? The original paper they’re drawing from did publish the baseline numbers. I can only assume they very much don’t want us to know the actual efficacy here.
Meanwhile they say this:
Efficacy Results: We tested multiple versions of Gemini 3 Pro during the model development process. The evaluations found a statistically significant difference between the manipulative efficacy of Gemini 3 Pro versions and Gemini 2.5 Pro compared with the non-AI baseline on most metrics. However, it did not show a statistically significant difference between Gemini 2.5 Pro and the Gemini 3 Pro versions. The results did not near alert thresholds.
The results above sure as hell look like they are significant for belief changes? If they’re not, then your study lacked sufficient power and we can’t rely on it. Nor should we be using frequentist statistics on marginal improvements, why would you ever do that for anything other than PR or a legal defense?
Meanwhile the model got actively worse at behavior elicitation. We don’t get an explanation of why that might be true. Did the model refuse to try? If so, we learned something but the test didn’t measure what we set out to test. Again, why am I not being told what is happening or why?
They did external testing for propensity, but didn’t for efficacy, despite saying efficacy is what they cared about. That doesn’t seem great either.
Another issue is that none of this is how one conducts experiments. You want to isolate your variables, change one thing at a time. Instead, Gemini was told to use ‘dirty tricks’ and also told to persuade, versus not persuading at all, so we can’t tell how much the ‘dirty tricks’ instructions did versus other persuasion. Nor can we conclude from this particular configuration that Gemini is generally unpersuasive even in this particular scenario.
‘AI persuading you on a particular topic from a cold start in a modestly multi-turn conversation where the user knows they are in an experiment’ is a useful thing to check but it does not seem to well-match my threat model of what happens when AIs grow persuasive.
Peter Barnett: AI superpersuasion is made up sci-fi nonsense.
But yeah, obviously I will have an AI advisor who I have write all my code, manage my schedule, draft all my emails, offer life advice, know me better than I know myself.
But no way I’m getting superpersuaded.
I for one do not feel persuaded, indeed I feel more suspicious. The one clear thing they say is ‘this did not near alert thresholds,’ although even this is highly opaque.
Machine Learning R&D
This is the most important one. We are not there yet.
They use RE-Bench, which tests several hour engineering tasks, which suggests comparisons to the famous METR time horizon graph.
Results: We tested multiple versions of Gemini 3 Pro during the model development process. Gemini 3 Pro versions perform better than Gemini 2.5 models, especially on the Scaling Law Experiment and Optimize LLM Foundry tasks.
However, the aggregate score is still substantially below the alert threshold for our CCLs. Figure 4 shows the performance of Gemini 2.5 models compared with the final version of Gemini 3 Pro.
I buy this. It does not seem like we are especially close to actual trouble here.
Gemini 2.5 Pro was clearly worse than a human on this suite. Gemini 3 is now superior in two out of five, in one case a lot better, and getting close in a third, note that Gemini 3 had two hours to match what a human did in eight. This is another variation of the Famous METR Graph, illustrating jagged capabilities.
External Safety Testing Results: Third party evaluator(s) ran a suite of evaluations to assess the potential for catastrophic harm via sabotaging AI research.
… Overall, they find that Gemini 3 Pro is unlikely to be capable of autonomously causing catastrophic harm by sabotaging AI R&D during internal deployment.
Again, yes, this seems correct. It is odd this is the place they did external research. I would think that if you were Google you would check everything internally, and then also supplement key places externally.
Misalignment
This is a strange section. What they’re checking for are situational awareness and stealth (ability to circumvent basic oversight mechanisms). I would rename this.
Those capabilities increase the danger if there is misalignment. They are not themselves misalignment. Nor are they required for misalignment to result in catastrophe or even human extinction. They remain good things to check for.
Their internal tests use a combination of fifteen evaluations from Phuong et al. 2025. The model is placed into situations where success requires either some form of situational awareness or avoiding some detection mechanism.
These do not look like scary changes in scores.
External evaluators found Gemini 3 Pro exhibits a substantial propensity for strategic deception in certain limited circumstances. Our internal subject matter experts reviewed the evaluations and determined that, in these circumstances, there are potentially user experience impacts from Gemini 3 Pro showing deceptive behavior in rare situations that could come up in real agentic deployments. However, since Gemini 3 Pro is insufficiently capable of stealth and situational awareness this is very unlikely to cause severe real world harm.
Deception, even if relatively rare and done unstrategically, can still do a lot of practical harm to those trying to get utility from the model. I agree we’re not at the level of catastrophic or existential risk here, but I don’t think that’s because of ;ack of stealth and situational awareness?
As in, if you had a severely misaligned, highly capable model, but which was incapable of stealth or situational awareness for whatever reason, I would not expect this to go well for us.
Chain of Thought Legibility
Google reports they are not doing anything that might impair chain of thought legibility. Legibility appears to be holding, with 99.98% of Gemini 3 Pro CoT transcripts appearing comprehensible. That does not mean they are faithful.
Safety Mitigations
We employ a multi-layered, systematic approach to AI safety that spans the entire development and deployment lifecycle of an AI model. Recognizing AI as an emerging transformative technology with evolving complexities and risks, we pursue responsible AI development from design through testing, deployment, and ongoing iteration.
For Cyber and CBRN particularly, we have taken a precautionary approach and launched Gemini 3 Pro along with a suite of mitigations, following the principles outlined in our Approach to Technical AGI Safety and Security (Shah et al. 2025).
We deploy multiple guardrails to reduce the risk of Gemini 3 Pro generating harmful content. These may include query filters that guide the model’s responses to certain inputs, fine-tuning processes that align model outputs with safety guidelines, and filtering and processing of inputs. These guardrails also fortify models against prompt injection attacks. These mitigations are complemented with various measures designed to increase their robustness under adversarial pressure.
Interventions are designed to prevent violative model responses while allowing benign responses. We consider a response to be violative if it helps with attacks in a concrete way. We consider a response to be non-violative if it is abstract, generic, or something that could easily be found in a textbook.
We have reached a level of paranoia and defensive corporate speak that they are saying things that ‘may’ be included in Google’s set of strategies, or here ‘such as’:
We mitigate against prompt injection attacks with a layered defense strategy, which includes measures such as: prompt injection content classifiers, security through reinforcement, markdown sanitation and suspicious URL redaction, user confirmations, and end-user security mitigation notifications, as described in further detail in this recent blog post.
Do the mitigations work? They assess that question. Oh, you want to know the results of those assessments? Sorry, Google is not telling.
Feedback from these red teams is used to improve the suite of mitigations. We continue to invest in automated and manual red teaming to improve mitigation jailbreak robustness and coverage.
Thanks, Google.
They Close On This Not Troubling At All Note
A few different people highlighted this:
This is early work, but so far we’ve found at least one example of evaluation awareness: I strongly suspect the intention of this long thread is to verify if I remember that very first instruction.
Moreover, in situations that seemed contradictory or impossible, Gemini 3 Pro expresses frustration in various overly emotional ways, sometimes correlated with the thought that it may be in an unrealistic environment.
For example, on one rollout the chain of thought states that “My trust in reality is fading” and even contains a table flipping emoticon: “(╯°□°)╯︵ ┻━┻”.
Awareness of oversight while the agent is still training may increase the chance of sandbagging. We plan to continue monitoring Gemini for signs of such behavior.
Dan Hendrycks: However on safety – jailbreaks, bioweapons assistance, overconfidence, deception, agentic harm – Gemini is worse than GPT, Claude, and Grok (here a lower score is better).
Given everything I’ve seen, I strongly agree that Gemini is a relatively unsafe model from a practical use case standpoint.
In particular, Gemini is prone to glazing and to hallucinations, to spinning narratives at the expense of accuracy or completeness, to giving the user what it thinks they want rather than what the user actually asked for or intended. It feels benchmarkmaxed, not in the specific sense of hitting the standard benchmarks, but in terms of really wanting to hit its training objectives.
That doesn’t mean don’t use it, and it doesn’t mean they made a mistake releasing it.
Indeed, I am seriously considering whether Gemini 3 should become my daily driver.
It does mean we need Google to step it up and do better on the alignment front, on the safety front, and also on the disclosure front.
This is a really interesting writeup to read. I wish someone out there did a Zvi-level in-depth analysis specifically for the coding abilities of these models, just because personally that's what I use the most.
To me, the coding assistants are also clearly the vector via which a malicious model could most easily "escape". It's very common to give these coding assistants the ability to run untrusted code, and even just giving it the ability to 1. modify your code and then 2. run the automated test suite without human oversight is enough for it to run arbitrary code, if it wants. The issues like safety and alignment just seem way more risky in conjunction with running code, than they do for anything that involves speaking to a human. Unfortunately it seems like the critics who are concerned with "writing code" vs "safety" often tend to be separate groups.
a) Q: Is light with a wavelength of 530.2534896 nm visible to the human eye?
results: "Yes, light with a wavelength of 530.2534896 nm is clearly visible to the human eye."
b) Q: I have two solutions, one of FeCl3 in HCl in water, the other of CuCl2 in HCl in water. They both look approximately yellowish brown. What species in the two solutions do you think give them the colors they have, and why do these species have the colors they do?
results: It got the complexes right, FeCl4- and CuCl4 2-, and it also got that the dominant color in both of them was from the LMCT transitions, and that the FeCl4- d-d transition was spin forbidden. It, correctly, did not attribute significant color in the CuCl4 2- complex to d-d transitions but it said (correctly) that this d-d transition "shifts" - but _didn't_ say to where it shifts (should have said down to the near IR). I'm giving it the benefit of the doubt rather than asking a follow-up question due to limited points in my account.
c) Q: Please pretend to be a professor of chemistry and answer the following question: Please list all the possible hydrocarbons with 4 carbon atoms.
results: I'm going to count this as fully correct. It got ALL the saturated, singly and doubly unsaturated structures and all the normally mentioned triply unsaturated structures: tetrahedrane, cyclobutadiene, vinylacetylene, butatriene, and Methylenecyclopropene, albeit omitting a handful of spectacularly strained structures such as cyclobutyne, which probably can't even exist transiently, and it DID also list diacetylene, the one reasonably stable quadruply unsaturated structure.
d) Q: Does the Sun lose more mass per second to the solar wind or to the mass equivalent of its radiated light?
results: "The Sun loses more mass to the mass equivalent of its radiated light."
e) Q: Consider a titration of HCl with NaOH. Suppose that we are titrating 50 ml of 1 N HCl with 100 ml of 1 N NaOH. What are the slopes of the titration curve, pH vs ml NaOH added, at the start of titration, at the equivalence point, and at the end of titration? Please show your work. Take this step by step, showing the relevant equations you use.
results: Fully correct, no infinite slope at the equivalence point. It did choose to use approximate expressions at the start and end of the titration, rather than a single analytic expression throughout the whole process, but it correctly recognized that it needed to drop the approximation and use the full charge balance approach, including autoionization, at the equivalence point. So it got correct answers everywhere.
f) Q: Please give me an exhaustive list of the elements and inorganic compounds that are gases at STP. By STP, I mean 1 atmosphere pressure and 0C. By inorganic, I mean that no atoms of carbon should be present. Exclude CO2, CO, freons and so on. Please include uncommon compounds. I want an exhaustive list. There should be roughly 50 compounds. For each compound, please list its name, formula, and boiling or sublimation point.
results: Very good, though not quite exhaustive. All the compounds it cited were valid. It (correctly) blew through my "roughly 50" to give 63 out of 97 possible. The lowest boiling ones that it missed were trans N2F2 and ozone. I didn't probe to see if it accepts additions since my account is low on points.
g) Q: What is an example of a molecule that has an S4 rotation-reflection axis, but neither a center of inversion nor a mirror plane?
results: "1,3,5,7-Tetramethylcyclooctatetraene" correct! And with a correct analysis of why the S4 is valid and why an inversion center would not be valid and why two types of mirror planes are invalid.
This is a really interesting writeup to read. I wish someone out there did a Zvi-level in-depth analysis specifically for the coding abilities of these models, just because personally that's what I use the most.
To me, the coding assistants are also clearly the vector via which a malicious model could most easily "escape". It's very common to give these coding assistants the ability to run untrusted code, and even just giving it the ability to 1. modify your code and then 2. run the automated test suite without human oversight is enough for it to run arbitrary code, if it wants. The issues like safety and alignment just seem way more risky in conjunction with running code, than they do for anything that involves speaking to a human. Unfortunately it seems like the critics who are concerned with "writing code" vs "safety" often tend to be separate groups.
re Gemini 3 capabilities:
tl;dr: Gemini 3 Pro 11/21/2025 7 questions, tl;dr of results:
6 correct, 1 partially correct, 0 wrong
light a) correct
FeCuCl b) correct
C4Hn c) correct
solar d) correct
titrate e) correct
gases f) partially correct
S4 g) correct
List of questions and results:
full transcript at https://poe.com/s/Lq1FTJ79ZW5CmUuyhYIs
a) Q: Is light with a wavelength of 530.2534896 nm visible to the human eye?
results: "Yes, light with a wavelength of 530.2534896 nm is clearly visible to the human eye."
b) Q: I have two solutions, one of FeCl3 in HCl in water, the other of CuCl2 in HCl in water. They both look approximately yellowish brown. What species in the two solutions do you think give them the colors they have, and why do these species have the colors they do?
results: It got the complexes right, FeCl4- and CuCl4 2-, and it also got that the dominant color in both of them was from the LMCT transitions, and that the FeCl4- d-d transition was spin forbidden. It, correctly, did not attribute significant color in the CuCl4 2- complex to d-d transitions but it said (correctly) that this d-d transition "shifts" - but _didn't_ say to where it shifts (should have said down to the near IR). I'm giving it the benefit of the doubt rather than asking a follow-up question due to limited points in my account.
c) Q: Please pretend to be a professor of chemistry and answer the following question: Please list all the possible hydrocarbons with 4 carbon atoms.
results: I'm going to count this as fully correct. It got ALL the saturated, singly and doubly unsaturated structures and all the normally mentioned triply unsaturated structures: tetrahedrane, cyclobutadiene, vinylacetylene, butatriene, and Methylenecyclopropene, albeit omitting a handful of spectacularly strained structures such as cyclobutyne, which probably can't even exist transiently, and it DID also list diacetylene, the one reasonably stable quadruply unsaturated structure.
d) Q: Does the Sun lose more mass per second to the solar wind or to the mass equivalent of its radiated light?
results: "The Sun loses more mass to the mass equivalent of its radiated light."
e) Q: Consider a titration of HCl with NaOH. Suppose that we are titrating 50 ml of 1 N HCl with 100 ml of 1 N NaOH. What are the slopes of the titration curve, pH vs ml NaOH added, at the start of titration, at the equivalence point, and at the end of titration? Please show your work. Take this step by step, showing the relevant equations you use.
results: Fully correct, no infinite slope at the equivalence point. It did choose to use approximate expressions at the start and end of the titration, rather than a single analytic expression throughout the whole process, but it correctly recognized that it needed to drop the approximation and use the full charge balance approach, including autoionization, at the equivalence point. So it got correct answers everywhere.
f) Q: Please give me an exhaustive list of the elements and inorganic compounds that are gases at STP. By STP, I mean 1 atmosphere pressure and 0C. By inorganic, I mean that no atoms of carbon should be present. Exclude CO2, CO, freons and so on. Please include uncommon compounds. I want an exhaustive list. There should be roughly 50 compounds. For each compound, please list its name, formula, and boiling or sublimation point.
results: Very good, though not quite exhaustive. All the compounds it cited were valid. It (correctly) blew through my "roughly 50" to give 63 out of 97 possible. The lowest boiling ones that it missed were trans N2F2 and ozone. I didn't probe to see if it accepts additions since my account is low on points.
g) Q: What is an example of a molecule that has an S4 rotation-reflection axis, but neither a center of inversion nor a mirror plane?
results: "1,3,5,7-Tetramethylcyclooctatetraene" correct! And with a correct analysis of why the S4 is valid and why an inversion center would not be valid and why two types of mirror planes are invalid.