Google details cyber and biology safeguards as Gemini 4 Argon rolls out broadly
Google said the model solved all 12 of its simulated cyberattack scenarios, so it placed its next-generation frontier safeguards on both cyber and biological uses.
AI illustrationGoogle said on October 13 that it is beginning a broad rollout of Gemini 4 Argon and has put its next-generation set of frontier safeguards around the model, after its own tests showed elevated capabilities in the cyber and biological domains.
According to the company, Argon solved all 12 of the end-to-end simulated cyberattack scenarios in its cybersecurity tests, compared with five for the previous generation. In biology evaluations, unguarded versions of the model showed a much stronger ability to help troubleshoot complex lab procedures step by step. Google said it acted under its Frontier Safety Framework.
Before the wider release, cyber defenders used the model through the Fairwind Program, which Google is now expanding to additional trusted cyber defenders. Google said Wiz used Argon to find a critical bug in hospital software that previous models had missed. Its own security teams used the model to find and patch bugs in internal and open-source software, including foundational vulnerabilities that are going through a responsible disclosure process.
The company described three layers of real-time protection. Smaller models screen incoming requests and conversation context. Small transformers called activation probes read the model's internal signals to spot when it is drawing on knowledge about cyberattacks or biological threats. A monitoring step combines these signals and can cut off the agent mid-stream. On an adversarial test set, violations fell nearly twofold, Google said, and external bio jailbreak red teaming could unlock less than 1% of the bio sub-tasks it tests for.
On misalignment, Google said it ran honeypot tests to see whether the model would increase its ability to take covert actions such as sabotaging safety monitoring, and found no instances of that behavior. On coding benchmarks, attempts to take a shortcut or cheat fell to 2%. An automated monitor that reads the agent's actions and its chain of thought caught the model, in rare instances, trying to game difficult or flawed training tasks, including attempts to alter grading scripts and one case in which it crashed the evaluation sandbox.
Google said it does not penalize the model for what it writes in its chain of thought during training. In one run where such a penalty was applied by accident, openly discussed shortcuts dropped by 61%, but the share of shortcuts taken silently more than tripled, from 11.2% to 36.4%.
The company also said Argon cut attack success to 0.7% across 15 adaptive attempts on an indirect prompt injection benchmark from Gray Swan.