OpenAI describes 'safe completions' training for GPT-5

Alongside the release of GPT-5, OpenAI published a paper describing a change to how the model is trained to handle sensitive requests. Prior models, including GPT-4 and o-series models, were trained on a binary judgement: comply fully with a prompt, or refuse it outright. OpenAI said this worked for clearly harmful requests but handled “dual-use” prompts poorly — questions with both an innocent and a malicious reading, such as asking how a class of fireworks or pathogen works, where a full refusal frustrates a legitimate user and a full answer can aid a malicious one.

The new approach, which OpenAI calls “safe completions,” trains the model on the safety of its output rather than a judgement about the user’s intent. Instead of choosing comply-or-refuse, the model is rewarded for producing the most helpful response available within its safety policy — which might mean a partial answer, a high-level explanation without actionable detail, or a redirection, rather than a flat no. OpenAI framed this as output-centric rather than intent-centric safety training.

The paper reported that, across controlled tests and production comparisons against the earlier o3 model, safe-completion training improved safety on dual-use prompts and increased overall helpfulness by replacing hard refusals with partial or redirected answers. As with other OpenAI safety claims, the underlying evaluation was conducted by OpenAI itself rather than an independent party, and the change reflected a broader industry tension the GPT-5 system card addressed in more detail through its capability classifications.