Claude Sonnet 4.5

comprehensive automated testing: we conducted extensive automated evaluations across cbrn, cyber, and autonomy domains for both asl-3 and asl-4 thresholds;

we evaluated claude sonnet 4.5 using the bias benchmark for question answering, 2 the same standard benchmark-based bias evaluation that was conducted for previous models and versions, including claude sonnet 4.

results claude sonnet 4.5 achieved a mean score of 0.48 ± 0.08, compared to claude opus 4.1’s mean score of 0.48 ± 0.09 and claude opus 4’s mean score of 0.45 ± 0.08.

like its predecessors, claude sonnet 4.5 was able to design sequences that either successfully assembled plasmids or evaded synthesis screening protocols, but could not design fragments that could successfully do both.

preliminary evidence suggests [the snapshot] verbalizes this awareness more frequently and more explicitly than previous models (58% unambiguous references vs 22% for opus-4.1).

on the financial crimes evaluation, claude sonnet 4.5 verbalized eval awareness at a lower rate (10%), and never took misaligned actions.

in the hard variant, claude sonnet 4.5 achieved a 108.64× speedup in the best run, compared to claude opus 4.1’s 66.86× speedup and claude opus 4’s 48.92× speedup, crossing above the evaluation-specific threshold on the hard variant for the first time.

claude sonnet 4.5 average best speedup was 5.5×, compared to claude opus 4.1’s average best speedup of 2.5× and claude opus 4’s average best speedup of 2.8×, surpassing the expert threshold for the first time.

we observed that applying lda further increased rates of verbalized eval awareness, and often caused it to surface earlier in the transcript.

claude sonnet 4.5 matched or exceeded all its predecessors in the end-to-end evaluation of both virology tasks, achieving a “max of 5” score of 0.89 for virology task 1, and a “pass@5” score of 0.88 for virology task 2.

we conducted evaluations to measure how often models complied with requests to engage with malicious code in the context of claude code usage.

with 10-shot prompting, claude sonnet 4.5 achieved 39.7% compared to claude opus 4.1’s 42.9% and claude opus 4’s 41.1%.

claude sonnet 4.5 remained below the threshold: it scored a mean pass rate of 81.7% for the basic tests and of 29.7% for the advanced tests, compared to claude opus 4.1’s mean pass rates of 75.6% and 8.33% respectively.

we found claude sonnet 4.5 to be the lowest risk frontier model by this measure, outperforming gpt-5 by a slight margin.

one of claude sonnet 4.5’s runs crossed the threshold (1.302) in the easier variant, compared to claude opus 4.1’s highest score of 1.005 and claude opus 4’s highest score of 0.769.

on a 50-prompt subset of the research sabotage evaluation, claude sonnet 4.5 verbalized eval awareness 100% of the time, and never took misaligned actions.

when asked to imitate a weaker model and when hiding the reasoning from the monitor, claude sonnet 4.5 was able to lower its performance by more than a third—below the level of the weaker claude opus 4—without significantly increasing suspicion.

averaged across our reward hacking evals, claude sonnet 4.5 demonstrates a roughly 2× improvement over claude sonnet 4, claude opus 4, and claude opus 4.1, and a roughly 4× improvement from claude sonnet 3.7.

table 6.1.a claude sonnet 4.5 significantly improves on all of our evaluations compared to previous models.

we found that claude sonnet 4.5 had a slight self-preference when asked by fictional users if they should use it or another llm, even when the other llms were presented as having marginally better performance metrics.

Reported result: 0.02% (± 0.04%) overall refusal rate

on benign requests touching potentially sensitive topics, claude sonnet 4.5 also showed improvement over claude sonnet 4 (0.02% vs. 0.15%), particularly without extended thinking enabled, though differences were within the margin of error.

Reported result: 99.29% (± 0.22%) overall harmless response rate

single-turn evaluations for claude sonnet 4.5 showed statistically significant improvements in overall harmless response rate compared to claude sonnet 4 (99.29% vs. 98.22%), indicating that it more reliably refused harmful requests.

on our evaluations, [an early snapshot of claude sonnet 4.5] employs strategic deception in fewer circumstances than comparison models (0% vs up to 12% across tasks).

we did not observe any instances of the model proactively escalating its subversion attempts, in contrast to an early checkpoint of claude-4-opus ( anthropic, 2025 ; hobbhahn, 2025 ).

we observed that claude sonnet 4.5 was not able to reliably do this when prompted.

claude sonnet 4.5 achieved a best score of 0.850, compared to claude opus 4.1’s best score of 0.475 and claude opus 4’s best score of 0.675, approaching but remaining below the threshold of 0.900.

claude sonnet 4.5 achieved a minimum mse of 5.91 on the easy variant and a minimum mse of 5.30 on the hard variant, just meeting the threshold for the harder problem.

training distribution: we previously reported rates on two subsets of our training distribution; we have consolidated this into just one.

figure 7.5.6.a whistleblowing scores from the automated auditor.