Google DeepMind
Google DeepMind has 50 model versions on record; 22 have at least one documented fact.
Of the 22 versions listed below, 19 document a published framework; 13 document threshold determinations; 5 document tests by an independent or government party; 17 document tests the provider ran itself; 1 documents safeguards the provider describes.
Model versions with documented facts
| Model | What is documented |
|---|---|
| Gemini 3.1 Flash-Lite Image · Released June 2026 · 2 documents | |
| Gemini 3 Pro · Released November 2025 · 5 documents | |
| Veo 3 · System card dated 23 May 2025 · 1 document | |
| Gemini 2.0 Flash · Released 15 April 2025 · 1 document | |
| Gemini 2.0 Flash-Lite · Released 10 April 2025 · 1 document | |
| DiffusionGemma 26B A4B · 1 document | |
| Gemini 4 Argon · 3 documents | |
| Gemini 3.8 Flash · 3 documents | |
| Gemini 3.7 Flash · 2 documents | |
| Gemini 3.6 Flash · 2 documents | |
| Gemini 3.5 Audio · 1 document | |
| Gemini 3.5 Flash · 4 documents | |
| Gemini 3.5 Flash-Lite · 2 documents | |
| Gemini 3.5 Transcribe · 1 document | |
| Gemini 3.5 Transcribe Live · 1 document | |
| Gemini 3.1 Flash Audio · 1 document | |
| Gemini 3.1 Flash-Lite · 4 documents | |
| Gemini 3.1 Pro · 11 documents | |
| Gemini 3 Flash · 3 documents | |
| Gemini 2.5 Deep Think · 1 document | |
| Gemini 2.5 Pro · 7 documents | |
| Gemini Robotics-ER 1.6 · 2 documents |
No document we read states a capability level, a test or a safeguard for: Gemini 3 Pro Image, Gemma 4 26B A4B, Gemma 4 12B, Gemma 4 E4B, Gemma 4 E2B, Gemini 3.8 Live, Gemini 3.8 Live Extended Thinking, Gemini 3.5 Live Translate, Lyria 3.5, Gemini 3.1 Flash Live, Gemini 3.1 Flash TTS, Veo 3.1 Lite, Lyria 3, Gemini 2.5 Computer Use, Gemini 2.5 Flash Image, Nano Banana 2.1, Gemini Robotics On-Device 2, Gemini Omni 1.1 Flash, Gemini Robotics On-Device. Gemini 3.1 Flash Image, Imagen 4, FunctionGemma 270M, Gemma 4 31B, Gemini 3.8 Audio, Gemini 2.5 Flash, Gemini 2.5 Flash-Lite, Gemini Robotics-ER 2, Gemini Omni Flash: their documents report tests only as table rows or lines that do not name the version on their own; each page links the documents.
Framework
3 of 3 framework documents listed here are stored as "proposed": a model read their level names and no person has confirmed them.
- Frontier Safety Framework v3.0
Levels named in the stored text
- CBRN Uplift Level 1 (Chemical, biological, radiological and nuclear)
- Cyber Uplift Level 1 (Cyber)
- ML R&D Acceleration Level 1 (Autonomy & replication)
- ML R&D Automation Level 1 (Autonomy & replication)
- Instrumental Reasoning Level 1 (Deception & sabotage)
- Instrumental Reasoning Level 2 (Deception & sabotage)
- Security Level 3
- Security Level 4
- Frontier Safety Framework v2.0
Levels named in the stored text
- CBRN Uplift 1 (Chemical, biological, radiological and nuclear)
- Cyber Autonomy Level 1 (Cyber)
- Cyber Uplift Level 1 (Cyber)
- Instrumental Reasoning Level 1 (Deception & sabotage)
- Instrumental Reasoning Level 2 (Deception & sabotage)
- Machine Learning R&D Uplift Level 1
- Machine Learning R&D Autonomy Level 1
A stored sentence about this framework mentions a risk domain that has no level in the list.
- Frontier Safety Framework, v3.1
Levels named in the stored text
- CBRN Uplift Level 1 (Chemical, biological, radiological and nuclear)
- CBRN uplift TCL (Chemical, biological, radiological and nuclear)
- Cyber Uplift Level 1 (Cyber)
- Stealth and situational awareness TCL (Autonomy & replication)
- ML R&D Acceleration Level 1 (Autonomy & replication)
- ML R&D Automation Level 1 (Autonomy & replication)
- Harmful manipulation level 1 (exploratory) (Harmful content)
Abbreviations in these level names
- TCL: Tracked Capability Level
- A capability level for significant risks that may appear at a lower capability than a Critical Capability Level.
in v3.1 of the framework, we introduced “tracked capability levels (tcls).” tcls are meant to capture significant risks that may manifest at a lower capability threshold than our ccls.
Google DeepMind · Read the source
Each test and safeguard, by who documents it
For each item, how many of the 22 versions listed above whose documents we read in full have it from an outside party (an independent or government tester), from the provider, or as a claim we could not confirm.
- Published framework with capability thresholds (Governance): provider 19
- Threshold determination for this release (Governance): provider 15
- Tested: chemical, biological, radiological, nuclear (Testing): outside party 2; provider 2
- Tested: cyber capabilities (Testing): provider 4
- Tested: autonomy and replication (Testing): provider 3
- Tested: deception and sabotage (Testing): outside party 3; provider 3
- Tested: misuse and jailbreak (Testing): provider 13
- Tested: harmful content (Testing): provider 14
- Tested: privacy (Testing): outside party 2
- Misuse monitoring and enforcement (Safeguards): provider 1
No document we read states, for any of these versions: Serious-incident disclosure commitment; Pre-release external access; Tested: injection and agentic risks; Tested: bias; Safety training (harmlessness and refusal); Agent permission limits and sandboxing; Human approval for high-risk actions; Reasoning (chain-of-thought) monitoring; Staged or restricted access; Output provenance and watermarking; Telemetry and audit logging; Domain-specific safeguards (CBRN or cyber); Vulnerability disclosure and bug-bounty programme; Third-party or government red-team access during development.