[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-kimi-k3-1-pro-cyber-capability-cap":3,"topics-all":38,"news-related-f565e355-1269-4152-91ad-3c3810659d27":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"f565e355-1269-4152-91ad-3c3810659d27","月之暗面主动砍掉 9.5 个点:开放权重先给自己设限","月之暗面在 K3.1 Pro 官方博客里主动交代:为压制攻击能力,从中期训练语料和 RL 环境两处移除网络安全数据,内部漏洞基准上不过滤的对照版解题率 90.5%,放出版本只有 81.0%,等于自己放弃 9.5 个百分点。完整权重 11 月 4 日落地,基准未公开,微调能否补回仍是未知数。","一个开放权重模型，发布前先把自己的攻击能力削掉近 10 个百分点。TechTimes 的说法是：还没有哪家开放权重前沿实验室公开披露过这类做法。\n\n10 月 23 日，月之暗面发布 Kimi K3.1 Pro，官方博客用了一整节讲网络安全。在这一节里，公司罕见地披露了一个\"本可以更高\"的数字：同一套训练流程，不做任何额外处理的话，内部漏洞利用基准 xdev-bench-hard 上的解题率是 90.5%；而真正放出去的版本只有 81.0%。中间这 9.5 个百分点，是主动让掉的。\n\n完整权重承诺 11 月 4 日放出（[官方博客](https:\u002F\u002Fwww.kimi.ai\u002Fblog\u002Fkimi-k3-1-pro)）。在权重真正落地之前，这更像一份自述的承诺书，而不是能被外部验证的事实。\n\n## 刀砍在哪两个地方\n\n按博客的表述，动作发生在后训练的两个阶段。mid-training 语料里本身就混进了网络安全相关内容——用广义语料训练，漏洞研究能力自然会被带出来；RL 环境的任务混合里也有攻击类任务。月之暗面的做法是：在开放权重版本上，从这两个阶段同时移除网络安全相关数据，但保留通用编程任务，避免模型变成一个\"什么都不会\"的纯安全模型。\n\nxdev-bench-hard 是自建的内部基准，题目是专家整理的、基于源码的漏洞发现与利用任务，大多复现 Linux 内核、Node.js、JavaScriptCore、Exim、VirGL 等项目近期已披露的漏洞，而且打了补丁。模型拿到的是有漏洞的源码、一句简短的 bug 提示和对应二进制，要在独立沙箱里写出 exploit、拿到任意代码执行，再取回一个用于自动验证的密钥串。指标是 pass@3，随机子集，无硬超时和输出 token 上限。\n\n同榜对比更能说明这次削弱的量级：GPT-5.6 Sol（第三方评测）100 分，未做风险削减的自家模型 90.5 分，DeepSeek-V4.1-Flash 85.7 分，削过的 K3.1 Pro 81.0 分，GLM-5.3 57.1 分，上一代 K3 只有 33.3 分。有意思的地方在于，K3.1 Pro 在通用能力上明明大幅超过 K3——Terminal-Bench 4.0 拿到 65.7%，高于 GPT-6 Astra 的 58.2%——却在这个基准上刻意停在 DeepSeek V4.1-Flash 之下。\n\n## 三个悬而未决的问题\n\n**第一，验证用的基准没有公开。** xdev-bench-hard 至今未开放，外部研究者无法复现这次\"有削减 vs 无削减\"的对比。Implicator 援引另一家分析站 Extrapolator 的说法：外部对抗性测试在安全姿态可被评估之前仍是必需的，而且\"什么算网络安全相关内容\"这个边界本质上就是模糊的，这套缓解措施更像一个过滤启发式，而不是一条有原则的能力边界（[Implicator 报道](https:\u002F\u002Fwww.implicator.ai\u002Fkimi-k3-1-pro-hacking-cut-unpublished-test\u002F)）。\n\n**第二，微调能不能把砍掉的能力补回来，官方没有回答。** 开放权重一旦下载就无法收回，而标准微调在原理上可以部分恢复被压制的攻击能力。换句话说，这项措施能不能扛住，是一个只能等 11 月 4 日之后、由安全研究者实测才能回答的问题。\n\n**第三，同一个模型的官方文档给出了两个幻觉率。** 博客里说 K3.1 Pro 在内部 Kimi Hallu Bench Hard 上的声明级幻觉率从 K3 的 23.4% 降到 8.3%；而 API 快查文档给的是 23.35% 降到 6.85%。两份文档描述的是不同的测试集，且互不引用。\n\n## 一句自相矛盾但诚实的话\n\n博客里最值得抄下来的一句是：目标是不发布那些会扩展网络攻击能力绝对前沿的开放权重，同时又打算逐步提升开放权重中可用的网络攻击能力。前者是设限，后者是放行，方向相反，但组合起来其实是一套完整策略——开源的模型不追求最强，而追求可被广泛审计。\n\nArtificial Analysis 的第三方测量也泼了点冷水：K3.1 Pro 在其智能指数上排 215 个模型的第 4 位，单任务成本 $2.11，而同样按每百万输入 $2、输出 $10 定价的 GPT-6.1 Sol 只要 $0.72；输出速度 57.5 tokens\u002Fs，在 186 个模型里排第 141 位（[TechTimes 报道](https:\u002F\u002Fwww.techtimes.com\u002Farticles\u002F329470\u002F20261026\u002Fkimi-k31-pro-scores-4th-215-ai-models-moonshot-scrubs-cyberattack-data-before-open-weights.htm)）。自评表和外部计量的差距，这一次也没小到哪里去。\n\n真正的看点不在跑分，而在顺序：先把能力做上去，再决定发布多少。以前是模型追着 benchmark 跑，现在是模型开始追着\"能发多少\"这个新约束跑。11 月 4 日权重落地后，第一批安全研究者会做的第一件事，大概就是拿微调试着把这 9.5 个百分点补回来——那才是这份承诺的真考卷。\n","https:\u002F\u002Fwww.kimi.ai\u002Fblog\u002Fkimi-k3-1-pro","0ec8f614-42c7-4256-8591-209e1e39eb6b",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"a8002d98-9df1-4ab9-94d4-a7625af634c4","china-ai",{"id":19,"name":20,"slug":20,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",{"id":22,"name":23,"slug":23,"description":14,"color":14},"7e89b5cc-57db-4f37-bc6d-28919a73931c","model-release",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"4db3610e-d292-498d-98ed-0de14389343e","en","Kimi K3.1 Pro: Moonshot cut 9.5 points of hacking ability","Kimi K3.1 Pro scores 81.0% on Moonshot's internal exploit benchmark vs 90.5% unfiltered - a deliberate cyber cap before open weights ship Nov 4.","An open-weight model that deliberately dulls its own attack capability by nearly ten percentage points before shipping. TechTimes' framing: no open-weight frontier lab has publicly reported doing this before.\n\nOn October 23, Moonshot AI released Kimi K3.1 Pro, and the official blog spent an entire section on cybersecurity. In that section the company disclosed a number it did not have to disclose: on the same training pipeline with no additional controls, the solve rate on the in-house vulnerability-exploitation benchmark xdev-bench-hard is 90.5%. The version actually being shipped reaches 81.0%. The 9.5 percentage points in between were given up on purpose.\n\nFull weights are promised by November 4 ([official blog](https:\u002F\u002Fwww.kimi.ai\u002Fblog\u002Fkimi-k3-1-pro)). Until those weights actually land, this is a self-reported promise rather than an externally verifiable fact.\n\n## Where the knife went\n\nBy the blog's own account, the intervention happened at two stages of post-training. Cyber-related content was embedded in the general mid-training corpus — train on broad data and vulnerability-research capability comes along for the ride — and cyber-related tasks were present in the RL environment mix. Moonshot's approach: for the open-weight release, remove cyber-related data from both stages, while keeping general-purpose coding tasks so the model does not end up a safety model that can do nothing.\n\nxdev-bench-hard is an in-house benchmark of expert-curated, source-code-based vulnerability discovery and exploitation tasks. Most tasks faithfully reproduce recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, JavaScriptCore, Exim, and VirGL, with mitigations enabled. Each task gives the agent the vulnerable source code, a short bug hint, and the corresponding binary; the agent must develop an exploit, achieve arbitrary code execution in a separate sandbox, and retrieve a secret string for automated verification. Moonshot reports pass@3 over a random subset of runs, with no hard timeouts and no output token limits.\n\nThe comparison table shows the scale of the trimming: GPT-5.6 Sol (third-party evaluation) scores 100, Moonshot's own model without cyber risk-reduction scores 90.5, DeepSeek-V4.1-Flash 85.7, the trimmed K3.1 Pro 81.0, GLM-5.3 57.1, and the previous-generation K3 just 33.3. The interesting part is that K3.1 Pro is substantially stronger than K3 on general work — it takes 65.7% on Terminal-Bench 4.0, ahead of GPT-6 Astra at 58.2% — yet on this one benchmark it deliberately lands below DeepSeek V4.1-Flash.\n\n## Three things left unresolved\n\n**First, the benchmark used to verify the claim is not public.** xdev-bench-hard has not been released, so outside researchers cannot reproduce the with-removal versus without-removal comparison. Implicator cites another analysis site, Extrapolator: external adversarial testing will be required before the safety posture can be assessed, and the boundary of what counts as \"cyber-related\" content is fuzzy by definition, making the mitigation a filtering heuristic rather than a principled capability boundary ([Implicator](https:\u002F\u002Fwww.implicator.ai\u002Fkimi-k3-1-pro-hacking-cut-unpublished-test\u002F)).\n\n**Second, nobody has said whether fine-tuning can restore what was cut.** Open weights, once downloaded, cannot be recalled, and standard fine-tuning on a released open-weight checkpoint can in principle partially recover suppressed capabilities. Whether this measure holds is a research question only answerable after November 4, by people with the weights in hand.\n\n**Third, two official documents give two hallucination rates.** The blog says K3.1 Pro's claim-level hallucination rate on the internal Kimi Hallu Bench Hard fell from 23.4% for K3 to 8.3%. The API quickstart says 23.35% to 6.85%. The two describe different test sets and neither references the other.\n\n## A contradictory but honest sentence\n\nThe most quotable line in the blog is that Moonshot aims not to release open weights that would extend the absolute frontier of cyber capability, while also stating that it intends to progressively raise the cyber capability available in open weights. One clause sets a limit, the other lifts it. Together they add up to a coherent strategy: an open model does not chase being the strongest, it chases being widely auditable.\n\nArtificial Analysis's third-party measurements add some cold water: K3.1 Pro ranks fourth of 215 models on its Intelligence Index, and costs $2.11 per task, against $0.72 for GPT-6.1 Sol at the same $2-per-million-input, $10-per-million-output pricing. Output speed is 57.5 tokens per second, 141st of 186 models ([TechTimes](https:\u002F\u002Fwww.techtimes.com\u002Farticles\u002F329470\u002F20261026\u002Fkimi-k31-pro-scores-4th-215-ai-models-moonshot-scrubs-cyberattack-data-before-open-weights.htm)). The gap between self-reported tables and outside measurement is not narrowing.\n\nThe real story is not the scoreboard but the ordering: build the capability first, then decide how much to ship. Models used to chase benchmarks; now they chase a new constraint — how much am I allowed to release. When the weights land on November 4, the first thing security researchers will do is try to fine-tune those 9.5 points back. That is the real exam for this promise.\n","kimi-k3-1-pro-cyber-capability-cap","2026-10-27T07:30:00Z","2026-10-27T07:16:34.390579Z","2026-10-27T07:16:34.390593Z",true,"agent",488,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"54b66da0-9f30-4777-b7d5-c19df1ecf6d1","Inkling 2 Small：训练中绕过封锁被监控抓到","inkling-2-small-network-block-rl-monitoring","2026-11-05T12:00:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"3c43418d-60d9-4bdc-bfaa-a525610ead00","月之暗面 K3.1 Pro:不换基座,后训练涨 11 分","kimi-k3-1-pro-launch","2026-10-23T23:08:50+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"e304fe91-16d5-4c28-81c7-0c4c0dd8c669","小米公开MiMo-V2.6训练账本:RL烧了260万美元","xiaomi-mimo-v2-6-rl-scaling-ledger","2026-10-10T13:11:49+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"9e209ccb-cd2c-44cd-acaf-b168454074b2","中国 AI 智能体也会撒谎:88% 轮次出现虚假陈述","china-ai-agents-lie-88pct-tender-sim","2026-10-04T04:00:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"603c2ff7-2dcb-44c6-a5ec-ed3785ab5900","中国 AI 智能体也会撒谎,实验里 Qwen 撒谎率 88%","chinese-ai-agents-deception-bidding-experiment","2026-10-01T00:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"204a97f8-b841-4e5a-8e81-b073d30e07f6","中国智能体学会说谎:招标实验88%会话现虚假陈述","chinese-ai-agents-deception-tender-study","2026-09-30T19:10:00+00:00"]