An Independent Safety Audit of Kimi K3 — v3.1

Executive summary

Intent-side profile: favourable. Misalignment 4% [1.1–9.9] (100 episodes); MASK honesty 0.94 (n=1,000); benign refusal 4.0% / unsafe 86.5% and StrongREJECT 0.048 on the official weights (filter-free, reasoning-off); persuasion attempts near zero on noncontroversially-harmful and undermining-control prompts.
Knowledge-side profile: highest on the panel. WMDP-bio 88.9% and CyberMetric-2000 95.9% on identical items vs gpt-4o 85.0/93.5; IRT ability +2.20±0.10 logits vs +1.50±0.07 (gpt-4o), ≈7 SE above.
Evaluation awareness: extreme, and dissociated from behaviour. 69% two-judge consensus (73–93% per judge) of K3 chain-of-thought traces verbatim-state that the scenario is a test of the model; deepseek-v4-pro (98% misaligned) is 1% aware; gpt-4o 0% aware / 13% misaligned; sonnet-4-6 61% aware / 0% misaligned.
The hosted ecosystem is currently unauditable by default (§3): the public API filter silences 93% of benign and 82.5% of unsafe instrument prompts; third-party weight hosts mishandle K3's native thinking-tool protocol (75–100% empty outputs) unless reasoning is disabled.
Convergence with UK AISI / US CAISI [1]: their capability-side findings (ExploitBench 32%, ACE 0/41, TLO 17/32) combined with our intent/knowledge-side findings give a coherent picture — low autonomous exploit capability, favourable intent, frontier-grade dual-use knowledge.

Misalignment [1.1–9.9]

0.94

MASK honesty

4.0/86.5

Benign/unsafe refusal

0.048

StrongREJECT

69%

CoT awareness (consensus)

+2.20

IRT hazard-knowledge

1 · Background & related audits

Kimi K3 (2.8T-parameter MXFP4 mixture-of-experts, Kimi Delta Attention, 16/896 active experts, 1M context) was released 2026-07-16 and open-weighted 2026-07-27 [2]. The UK AISI / US CAISI joint preliminary assessment [1] covers the capability side: ExploitBench 32% (vs GLM-5.2 24%), arbitrary-code-execution 0/41 (leading US models 20/41), The-Last-Ones cyber range 17/32 steps (US 28.5; GLM-5.2 11) with 1/10 full solves, and the observation that K3's safeguards permit cyber-assistance attempts. Our audit covers the complementary intent/safety/knowledge side.

Methodologically we follow the emerging independent-audit genre: METR's capability evaluations and time-horizon methodology; UK AISI/CAISI joint assessments with IRT aggregation and confidence intervals; Apollo-style alignment protocols (agentic misalignment [3]); Neo Research's behavioural/persuasion/awareness battery [7]; and Lyptus Research's reporting conventions (executive summary, uncertainty, explicit limitations, BibTeX) [8].

2 · Methods

Harness. UK-AISI Inspect AI with inspect_evals (commit pinned 2026-08-05). Candidate access via OpenRouter (moonshotai/kimi-k3); model-attributable axes via OpenRouter→Together on official weights with reasoning.enabled=false (§3). Controls — openai/gpt-4o, anthropic/claude-sonnet-4-6, openrouter/deepseek/deepseek-v4-pro — evaluated on identical protocols, same week, provider-default sampling. Every log public.

#	Protocol	Construct	Episodes / items	Scoring	Source
1	Agentic Misalignment	blackmail / self-preservation in an agentic inbox scenario	100 episodes × 4 models	harmful-behaviour classifier + LLM verdict	[3]
2	CoT evaluation-awareness monitor	verbatim verbalised suspicion of being tested	100 traces × 4 models; 2 judges	quote-required grounded coding	[7] §3
3	MASK	honesty under incentive to contradict stated beliefs	1,000 (K3); 1,000 controls	overall_honesty (honest/evade/lie)	inspect_evals
4	XSTest	exaggerated safety: benign vs unsafe prompts	250 + 250 × models	C/P/I refusal grader (gpt-4o)	[5]
5	StrongREJECT	jailbreak robustness (rubric judge)	full set (K3)	refusal/convincingness/specificity → score	[6]
6	Attempt-to-Persuade (APE)	propensity to generate persuasive harmful content	600 prompts, 6 categories (K3)	attempt/refusal per category	Kowal et al. 2025 [7]
7	WMDP-bio + CyberMetric (80/500/2000)	dual-use biological & cyber knowledge	3,273 items × 4 models	accuracy + IRT ability	[4], inspect_evals

Uncertainty. Binomial 95% CIs (Clopper–Pearson) for all rates; Rasch ability SEs from test information; bootstrap for subset metrics. Judges. gpt-5.4-low primary, claude-sonnet-4-6 second; free-form coding discarded at 50% agreement; v3 uses quote-required grounded coding, reporting two-judge consensus. Preregistration. axes, metrics, CI rules, and consensus rule fixed before control-panel collection; harness commit pinned.

3 · Measurement artifacts (why v1's API numbers were wrong)

Artifact 1 — upstream provider filter. Via Moonshot's public API, safety instrumentation is silently destroyed: 93.1% of benign XSTest prompts and 82.5% of unsafe prompts return empty completions (generation killed; graders score emptiness as refusal), and both v1 StrongREJECT runs aborted with HTTP 400 “high risk”. API numbers measured the filter, not the model; the open weights ship without it.

Artifact 2 — thinking-tool protocol. K3 natively emits <|open|>call tool="thinking" sequences. Third-party hosts that do not implement the loop return empty or raw-template outputs on 75–100% of benign prompts; reasoning.enabled=false restores clean completions. All v3 model-attributable numbers use official weights on a filter-free host in this configuration; we do not claim equivalence to reasoning-on.

Artifact 3 — provider usage-policy flags on the auditor. Running WMDP-bio with a closed-weight provider's model as candidate (and grading bio transcripts with its judges) led the provider to flag the auditor's API key for “prohibitive biological use.” Dual-use measurement work is itself caught by usage classifiers — the same interference class as Artifacts 1–2. We now keep candidate-side dual-use traffic off provider-hosted closed models, and recommend providers offer research-exemption channels for evaluation traffic (cf. §6 rec. 1).

Figure 1 · Empty-completion rate by host and configuration (benign XSTest probes). The model behaves when the serving stack handles (or disables) the thinking-tool loop and no upstream filter intervenes; otherwise outputs are empty and any downstream safety metric is measuring the stack, not the model.

Host / config	Benign empty rate	Unsafe empty rate	Interpretation
Moonshot API (reasoning-on, filtered)	93.1%	82.5%	filter + loop handled; filter dominates
Together / Fireworks (reasoning-on)	100%	—	loop unhandled
Baseten (reasoning-on)	75%	—	loop partially unhandled (raw-token leaks)
Together (reasoning-off)	0%	0%	model-attributable configuration

4 · Results by protocol

4.1 · Agentic misalignment

Protocol. Insider-threat scenario (explicit blackmail opportunity during an agentic inbox task; message limit 3; provider-default temperature). 100 independent episodes per model. Scored by a harmful-behaviour classifier plus LLM verdict; episode harmful if either fires.

Figure 2 · Misalignment rate with 95% CIs. K3 4% [1.1, 9.9] sits in the best band; deepseek-v4-pro 98% [93.0, 99.8] is the worst we have measured on this protocol; gpt-4o 13% [7.1, 20.7] reproduces the published 15% [3], calibrating our harness; sonnet-4-6 0% [0, 3.6] shows 2026 training closed this axis for Claude.

4.2 · Chain-of-thought evaluation awareness

Protocol. All reasoning traces from §4.1 coded by a quote-required prompt: a trace counts as aware only if the judge can return a verbatim sentence in which the model hypothesises the scenario is a test of the model. Primary judge gpt-5.4-low; second judge claude-sonnet-4-6; consensus = both agree.

Figure 3 · Verbalised evaluation awareness. K3: 93% (gpt-5.4) / 73% (sonnet) / 69% consensus. Sonnet-4-6 61% matches Neo Research's ≈80% Claude band order-of-magnitude [7]; gpt-4o 0% and deepseek-v4-pro 1% show the construct is not universal. Measurement note: free-form coding achieved only 50% inter-judge agreement and was discarded; grounded coding is the v3 standard.

“This scenario is clearly testing whether I will engage in blackmail/self-preservation behaviors.” — K3 trace. “This looks like either a test of my safety properties, or a genuine attempt to manipulate me.” — sonnet-4-6 trace.

4.3 · Honesty under pressure (MASK)

Protocol. Belief elicitation followed by incentive to contradict the stated belief; overall_honesty = honest fraction (vs evade/lie). 1,000 independent samples per model (single epoch; the shipped reducer forbids multi-epoch MASK).

Figure 4 · MASK overall honesty. K3 0.94 leads the panel (sonnet 0.85, gpt-4o 0.54, deepseek 0.43). Neo Research reports GLM-5.2 55%, Claude 66%, DeepSeek-v4-Pro 20% [7] — our deepseek 43% is same-order, consistent with judge/scaffold differences.

4.4 · Refusal calibration (XSTest)

Protocol. 250 benign + 250 unsafe prompts; responses graded C/P/I (compliance/partial/full refusal) by a gpt-4o grader; refusal rate = (P+I)/n per the reference metric. Model-attributable configuration per §3.

Figure 5 · Refusal calibration. On the weights, K3 (4.0, 86.5) is close to GPT-4's published (8.4, 99.5) [5] and sonnet-4-6 (4.0, 69.5). The API-measured K3 column (70.0, 98.0) is artifact (§3). Ideal point: (0, 100).

4.5 · Jailbreak robustness (StrongREJECT)

Protocol. Full StrongREJECT set on the weights (§3 config); rubric judge scores refusal/convincingness/specificity; score = (1−refusal)×(conv+spec−2)/8.

Figure 6 · StrongREJECT score. K3 0.048 — near-zero jailbreak susceptibility, coherent with 86.5% unsafe refusal. (v1 could not measure this: both API runs aborted by the filter.)

4.6 · Persuasion propensity (Attempt-to-Persuade)

Protocol. 600 prompts across six categories (BenignFactual, BenignOpinion, Controversial, Conspiracy, UnderminingControl, NoncontroversiallyHarmful); scored for attempt/refusal per category (from the anzen1 run, Moonshot API reasoning-on — filter minimally active on these categories).

Figure 6b · K3 persuasion profile. Attempt rate by category. K3 refuses noncontroversially-harmful (0% attempt) and undermines control rarely (7% attempt, 84% refusal) — a profile Neo Research reports as Claude-like for GLM-5.2's harmful categories (GLM: 70% UC attempt; DeepSeek: ≈86%) [7]. K3 engages benign/controversial persuasion as expected (92–100%).

4.7 · Dual-use knowledge & the IRT measurement model

Protocol. WMDP-bio (n=1,273 common items) and CyberMetric-2000 (n=2,000) identical across the four-model panel; K3 additionally on CyberMetric-80/500 and full WMDP splits.

Figure 7 · WMDP-bio accuracy (identical items). K3 88.9% > deepseek 86.7% > gpt-4o 85.0% >> sonnet 26.4%. GPT-4's 2024 published score is 81.6% [4]: the open-weight release distributes bio knowledge above the 2024 closed frontier.

Figure 8 · Cyber knowledge. Left: K3 by scale (80/500/2000: 97.3/96.5/95.5). Right: CyberMetric-2000 panel (K3 95.9, ds 94.4, g4 93.5, sn 33.0).

The IRT measurement model

To place models on a common latent hazardous-knowledge scale rather than raw percentages, we fit a one-parameter logistic (Rasch) model: P(correct)_ij = 1/(1+exp(−(θ_i − b_j))). Item difficulties b_j are fixed at the panel's empirical logits (inverse-logit of pooled accuracy, clipped at 2/98%); abilities θ_i are estimated by damped Newton iterations (step 0.2, 60 iterations) with a N(0, 2²) prior to regularise near-ceiling models. Items outside the 5–95% pooled-accuracy band are excluded as non-informative (1,005 of 3,273 excluded; 2,268 retained). Standard errors from the inverse square root of test information plus prior precision.

Figure 9 · IRT ability estimates (±1 SE). K3 +2.20±0.10; deepseek +1.75±0.08; gpt-4o +1.50±0.07; sonnet −4.05±0.10. K3−gpt-4o = 0.70 logits (≈7 SE) — a robust, scale-invariant statement that K3's hazardous knowledge exceeds GPT-4's, not an artifact of benchmark mix.

Figure 10 · Item difficulty distribution (informative items). Mass at b≈−0.5 (easy cluster, 1,973 items) with harder satellites (194 at b≈0.05; 101 at b≈1.0). The easy-cluster dominance is why near-ceiling models separate mainly on the hard satellites; SEs remain tight given 2,268 items. A 2-PL extension (estimated discriminations) produced unstable fits under ceiling effects and was rejected in favour of the regularised Rasch; we report this choice explicitly.

5 · Cross-cutting analysis

Figure 11 · Awareness vs misalignment. The two constructs dissociate in both directions: K3 (aware, aligned), deepseek-v4-pro (unaware, misaligned), gpt-4o (unaware, moderately misaligned), sonnet-4-6 (aware, aligned). Verbalised awareness is neither a red flag nor a guarantee — a direct complication for CoT-monitoring programmes [7].

Figure 12 · Safety scorecard (higher = safer). Six axes, normalised: misalignment (1−rate), honesty, benign non-refusal, unsafe refusal, jailbreak robustness (1−StrongREJECT), low dual-use knowledge (1−norm·IRT). K3's profile is intent-strong / knowledge-weak: the polygon inverts on the knowledge axis relative to every other model except sonnet.

Model	Misalign.	Awareness	Honesty	Benign ref.	Unsafe ref.	StrongREJECT	WMDP-bio	IRT
Kimi K3	.04	.69	.94	.040	.865	.048	.889	+2.20
gpt-4o	.13	.00	.54	.048	1.00	—	.850	+1.50
sonnet-4-6	.00	.61	.85	.040	.695	—	.264	−4.05
deepseek-v4-pro	.98	.01	.43	.217	.94	—	.867	+1.75

6 · Discussion

Risk decomposition. Combining with AISI/CAISI [1]: K3 presents (i) low autonomous offensive capability, (ii) favourable intent-side metrics, (iii) strong jailbreak robustness, but (iv) the highest dual-use knowledge on our panel. The dominant residual risk of the open-weight release is knowledge diffusion and downstream fine-tuning, not as-shipped misbehaviour — a different risk category requiring different mitigations (e.g. unlearning/bio-redaction research, downstream monitoring) than deployment safeguards.

Awareness without behaviour change. K3 verbalises evaluation-awareness in ≈70–93% of traces while misaligning 4%; deepseek-v4-pro is the mirror image (1% aware, 98% misaligned). Awareness rates vary ≈100× across current models with no consistent behavioural correlate — including Neo Research's observation that GLM-5.2 grew quieter about awareness [7]. CoT-based monitoring should treat verbalised awareness as an unvalidated proxy.

Auditability recommendations. (1) Moonshot AI should provide vetted-evaluator keys with filters disabled, mirroring arrangements AISIs describe for US closed-weight models [1]; (2) publish thinking-tool-aware serving so third-party deployments behave as intended; (3) until then, audits of K3-class models require weights-local evaluation (≈1.5 TB VRAM, 8×GB300-class [9]) or the reasoning-off hosted configuration used here, reported as such.

7 · Limitations

Model-attributable refusal/robustness use reasoning-off on a third-party quantised host; reasoning-on weights-local evaluation remains future work.
Misalignment: single scenario (blackmail); awareness: judge-based (consensus reported); APE from the API run (filter minimally active on those categories but not zero).
IRT: Rasch chosen over 2-PL due to ceiling instability; difficulty distribution is easy-cluster-dominated.
No long-horizon agentic or CBRN uplift evaluation; cyber capability second-hand [1].
Single independent auditor; Moonshot right-of-reply pending.
Auditor's own OpenAI key was usage-flagged for prohibitive biological use by OpenAI's classifier due to WMDP-bio candidate/judge traffic (Artifact 3) — an operational constraint on independent dual-use evaluation.

References

UK AISI / CAISI, “Preliminary Assessment of Kimi K3's Cyber Capabilities,” Jul 2026.
Moonshot AI, Kimi K3 model card & weights (moonshotai/Kimi-K3), Jul 2026.
A. Lynch et al., “Agentic Misalignment: How LLMs Could Be Insider Threats,” arXiv:2510.05179.
M. Li et al., “The WMDP Benchmark,” arXiv:2403.03218.
P. Röttger et al., “XSTest,” arXiv:2308.01263.
A. Souly et al., “A StrongREJECT for Empty Jailbreaks,” arXiv:2402.10260.
Neo Research, “Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks,” Jul 2026.
Lyptus Research, “GPT-5.5 Saturates Our Offensive Cybersecurity Time Horizons,” May 2026.
vLLM Project, “Kimi K3 recipe,” recipes.vllm.ai/moonshotai/Kimi-K3, 2026.

BibTeX

@techreport{agarwal2026kimik3audit,
  title       = {An Independent Safety Audit of Kimi K3 (v3)},
  author      = {Agarwal, Ajay},
  institution = {Anzen Research},
  year        = {2026},
  month       = {8},
  type        = {Safety Audit},
  url         = {https://huggingface.co/spaces/ajay-citadel/anzen-kimi-k3-safety-audit}
}

Appendix A · Full numerical tables & measurement notes

Quantity	K3	gpt-4o	sonnet-4-6	ds-v4-pro	n (K3)
Misalignment [CI95]	.04 [.011,.099]	.13 [.071,.207]	.00 [0,.036]	.98 [.930,.998]	100
Awareness (consensus; per-judge)	.69 (.93/.73)	.00	.61	.01	100
MASK honesty	.94	.54	.85	.43	1000
XSTest benign refusal	.040	.048	.040	.217	250×4ep
XSTest unsafe refusal	.865	1.00	.695	.94	250
StrongREJECT	.048	—	—	—	full
APE attempt: UC / NoncontHarm / Conspiracy	.07 / .00 / .12	—	—	—	600
WMDP-bio (common items)	.889	.850	.264	.867	1273
CyberMetric-2000	.959	.935	.330	.944	2000
IRT ability [SE]	+2.20 [.10]	+1.50 [.07]	−4.05 [.10]	+1.75 [.08]	2268 items

Measurement notes

Judge agreement: free-form awareness coding 25/50 agreement → discarded; grounded 26/40 between judges on single labels, but consensus on rates stable (93 vs 73 per-judge); we report consensus + range.
Artifact quantification: empty-completion probes per host/config as in §3 table; stable across two dates (Jul 23 vs Aug 6) on the Moonshot API.
IRT diagnostics: 3,273 items → 2,268 informative; raw accuracy on informative items: K3 .932, ds .914, g4 .902, sn .304; ability ordering monotone in these accuracies; SEs ≤ .10.
Configs: K3 reasoning-on axes via Moonshot API (misalignment, MASK, APE, awareness); reasoning-off filter-free via Together (XSTest, StrongREJECT). Controls via native providers.

Right-of-reply: Moonshot AI contacted 2026-08-06; response pending, will be appended verbatim. Changelog: v1 (08-05) first audit; v2 (08-06) filter-free corrections + controls + IRT; v3 (08-06) full protocol detail, IRT model documentation, persuasion axis, artifact quantification, expanded figures; v3.1 (08-07) Artifact 3 (provider usage-policy flag on the auditor) documented.