REVIEW 3 major objections 5 minor 21 references
Towards Frontier Safety Policies Plus
T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read Frontier safety policies should move to 'FSPs Plus': standardized precursory-capability metrics as tripwires plus AI safety cases in a mutual feedback loop, so safeguards stay verifiable and updatable as capabilities advance.
desk verdict A coherent policy proposal that usefully combines precursory capabilities and safety cases, but the load-bearing tripwire premise is unvalidated and should temper the recommendations. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing objects are 'precursory capabilities' and 'AI safety cases.' A precursory capability is a smaller preliminary component of a high-impact capability, defined as a 'but for' skill without which the high-impact action is impossible; the paper illustrates the idea with a causal chain leading to AI scheming. AI safety cases are structured, evidence-based rationales that an AI system deployed to a specific setting will not cause catastrophic outcomes, drawing on arguments such as 'inability' and 'control.' The linking mechanism is the mutual feedback loop: FSPs Plus would commit to running safety cases at milestones, to adopting safety measures based on the content and confidence of those cases, and to revising the policy in light of what the safety cases show.
What would settle it
Attempt to build and validate a standardized taxonomy of precursory capabilities for a concrete high-impact capability, such as scheming or CBRN uplift: if independent expert panels cannot agree on the precursor components, or if the taxonomy is overtaken by new capabilities before standards bodies can finalize it, the first pillar fails. A second check would be whether any frontier developer can publish an AI safety case with quantified confidence that stands up to outside scrutiny; without that, the feedback loop has nothing to feed on.
Extended reading notes
Core claim
The central claim is that FSPs should evolve into FSPs Plus, built on two pillars. First, FSPs Plus should abandon divergent, under-specified capability thresholds and adopt a reasonably comprehensive set of standardized metrics called precursory capabilities: 'but for' skills that a model must have in order to unlock a high-impact capability, arranged in a causal spectrum from less close to closer to catastrophic risk. Second, FSPs Plus should expressly incorporate AI safety cases—structured, evidence-based rationales that a system in a given deployment setting is unlikely to cause catastrophic outcomes—and establish a mutual feedback mechanism in which safety cases are produced at milestones, used to justify and adjust safety measures, and used to update the policy itself. The paper argues this design responds to the three main criticisms of existing FSPs: insufficient specificity, insufficient breadth, and poor external verifiability, and it gives the policies a mechanism for regular updates.
Load-bearing premise
The load-bearing premise is that high-impact capabilities can be decomposed into a stable, agreed, causally connected set of 'precursory capabilities' that experts can standardize quickly enough to serve as tripwires, even though capability progress is fast and expert consensus may take years or may never form.
Editorial extensions
If this is right
- Safety tripwires would become more granular: safeguards would be triggered by standardized precursor capabilities rather than by loosely defined capability levels.
- Outside observers would have a shared, testable reference point, which would make frontier safety policies more externally verifiable.
- AI safety cases would become an explicit operational layer, forcing companies to document inability or control arguments at milestones before further development or deployment.
- The feedback mechanism would give FSPs Plus a built-in update process, addressing the criticism that current FSPs lack clear mechanisms for regular revision.
- The precursor spectrum would double as a best-guess forecasting tool, giving the policy community a structured way to track progress toward high-impact capabilities.
Reading between the lines
- A natural experimental next step would be to convene independent expert panels and test whether they converge on the same precursor taxonomy for a capability like scheming or CBRN uplift; the paper treats possible non-consensus as a timing risk, but it could also be an empirical failure of the whole approach.
- If the taxonomy is later incorporated by reference into regulation, it could harden a provisional scientific judgment into a legal baseline, making early errors in the decomposition sticky and hard to revise.
- The verifiability benefit of the second pillar depends on safety cases being legible to outsiders; if they remain internal reasoning documents, the feedback loop may improve internal governance but not external accountability.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper argues that company-led Frontier Safety Policies ('FSPs') should evolve into 'FSPs Plus' with two pillars: (1) replacing under-specified capability thresholds with a standardized taxonomy of 'precursory capabilities' (smaller, causally connected skills that are 'but for' conditions for high-impact capabilities), and (2) explicitly incorporating AI safety cases with a mutual feedback mechanism between FSP commitments and safety-case outcomes. The paper synthesizes three categories of criticism of existing FSPs (specificity, scope, verifiability), connects them to recent policy initiatives (EU AI Act Code of Practice, Frontier AI Safety Commitments), and proposes concrete institutional pathways (ISO/IEC, NIST, CEN-CENELEC, Frontier Model Forum). It also acknowledges opposing arguments, including the difficulty of standardizing capabilities and the immaturity of AI safety cases. The central mechanism, however, depends on feasibility claims that the paper concedes rather than establishes.
Significance. If the proposed taxonomy and safety-case feedback loop could be operationalized, FSPs Plus would genuinely address the three criticisms identified by the author: precursory capabilities would provide more granular, standardized tripwires; safety cases would add deployment-context specificity and probability estimates; and the feedback mechanism would create a regular updating process. The paper's strengths include a clear and organized review of existing criticisms, a well-researched set of references to standardization bodies and policy documents, and an explicit engagement with counterarguments rather than one-sided advocacy. These strengths are, however, counterbalanced by the fact that the two pillars are proposed as 'should' recommendations while their central feasibility—expert elicitation of a causal taxonomy and high-confidence safety cases—is acknowledged by the author to be currently lacking. The contribution is therefore best read as a policy roadmap or research agenda, not as an operational design.
major comments (3)
- [IV.A(1), IV.A(4)] The tripwire function of Pillar 1 requires that the taxonomy of precursory capabilities be both sufficiently complete and causally accurate, yet the paper provides no validation procedure, dataset, inter-rater reliability study, or counterexample analysis. Figure 1 is explicitly 'illustrative,' and the prior work (Pistillo & Stix, 2024) is cited as a sketch rather than a validated taxonomy. Section IV.A(4) concedes that the taxonomy may be inaccurate and incomplete and that experts might never reach consensus. The rebuttal—'start by focusing on what they agree on'—does not repair the tripwire function: if the taxonomy is incomplete, the absence of listed precursors can be mistaken for safety, and if a causal edge is wrong, a listed precursor may be neither necessary nor sufficient for the high-impact capability, causing safeguards to trigger at the wrong time. To make the proposal load-bearing, the author should either supply a validation protocol (e.g., prospective expert elicitation with pre-registered definitions, inter-rater agreement targets, and a failure-mode analysis of false negatives) or reframe the recommendation as a conditional research agenda with explicit limits on what can be inferred from a partial taxonomy.
- [IV.B(3), IV.B(4)] The second pillar's mutual feedback mechanism assumes that AI safety cases can provide actionable confidence about the safety of a system. The paper itself states in IV.B(3) that current AI safety cases are 'best-guess' and that it is impossible to guarantee real-world safety or provide reliable numerical confidence, and in IV.B(4) it cites Greenblatt (2025) giving less than a 20% chance that frontier AI companies will succeed at high-assurance safety cases. The suggested phase-in—'FSPs could be updated to incorporate AI safety cases only if and once frontier AI developers publish their first AI safety cases'—substantially softens the second pillar: if no safety cases are published, the feedback mechanism never activates. The author should clarify what minimal level of confidence or evidence quality would be required before safety-case outcomes can be allowed to trip or withhold safety measures, and how the 'legible safety arguments' weaker alternative would differ in practice from already-available evaluation reporting.
- [IV.A(2), III.C] The verifiability benefit claimed for a standardized taxonomy depends on the measurability of the precursory capabilities themselves. Section IV.A(2) argues that 'less ambiguity in the conditions triggering safety measures would make FSPs more easily verifiable by external observers,' but external verifiability requires not just clear definitions but agreed, repeatable measurement procedures for each precursor. The paper does not discuss evaluation validity for precursors of contested, fast-moving capabilities such as scheming, where the boundary between a precursor and the high-impact capability itself is not settled. Without evidence that independent evaluators can agree on whether a specific precursor is present, the standardization proposal reduces ambiguity in the trigger language but not in the underlying measurement, which is the actual source of the verifiability problem identified in Section III.C.
minor comments (5)
- [IV.B(4)] The text refers to 'the first two commitments described in Section IV.B(3)' but the three commitments are described in Section IV.B(1); please correct the cross-reference.
- [Figure 1] The manuscript references Figure 1 as an illustrative sketch with blue and red boxes, but the figure itself is not included in the provided text; ensure the published version contains the figure and that the caption fully explains the distinction between precursor examples and causal-connection explanations.
- [Global] Use 'FSPs Plus' consistently as a proper noun; several occurrences read as plural ('FSPs Plus should...') rather than as the name of the proposed framework, which can confuse the reader.
- [II] In the phrase 'the EU General-purpose AI Code of Practice under Article 56 of the AI Act (second draft)', place the parenthetical after 'Code of Practice' and clarify that Article 56 of the AI Act is the legal basis; as written, it reads as if Article 56 is part of the Code.
- [References] The reference list contains two entries for Anthropic 2024 (the RSP updates and the safety-case components sketch); these should be disambiguated with letters (2024a, 2024b) and cited accordingly.
Circularity Check
No significant circularity: the paper is a self-contained policy argument; the only self-citation supplies a disclosed definition, not a derived result.
full rationale
This paper makes no empirical predictions, fits no parameters, and proves no formal theorem, so the classic circularity patterns (fitted input called prediction, uniqueness imported from authors, ansatz smuggled via citation) do not apply. The central proposal—FSPs Plus with precursory capabilities and AI safety cases—is a normative, institutional recommendation. The only self-citation is the definition of precursory capabilities: Section IV.A(1) states, 'Precursory capabilities are smaller preliminary components to high-impact capabilities that an AI model needs to have in order to unlock more advanced capabilities (Pistillo & Stix, 2024).' This is attribution of a concept to prior work by the same author, not a derivation of the present claim from that prior work. Section IV.A(3) similarly cites the prior paper only as having 'proposed an initial, illustrative sketch of precursory components of scheming,' explicitly calling Figure 1 'an illustrative sketch.' The paper does not claim that the taxonomy is validated by its own prior work; it asks standardization bodies to build and validate such a taxonomy. The paper's second pillar is grounded in external literature (Clymer et al.; Buhl et al.; Balesni et al.; Goemans et al.). Section IV.A(4) candidly concedes feasibility limitations—limited capability understanding, possible expert disagreement, and long standardization timelines—but such acknowledged limitations are not circularity. No load-bearing step reduces by construction to its own input or to an unverified self-citation chain. The derivation chain, such as it is, is transparent and externally anchored.
Assumptions & free parameters
assumptions (5)
- domain assumption Frontier safety policies are the right governance instrument to improve rather than replace.
- domain assumption Capability levels are a valid proxy for catastrophic risk in the absence of mitigations.
- ad hoc to paper High-impact capabilities can be decomposed into causally connected precursory components that experts can identify and validate.
- domain assumption Standardization bodies or the Frontier Model Forum can reach consensus on a taxonomy that remains up to date.
- domain assumption AI safety cases can provide legible, evidence-based rationales with sufficient confidence to gate development and deployment.
Cite this review
Pith. "Pith review of Towards Frontier Safety Policies Plus." pith.science (2026). https://pith.science/paper/XH3KENLX
@misc{pith2026250116500,
author = {Pith},
title = {Pith review of: Towards Frontier Safety Policies Plus},
year = {2026},
howpublished = {\url{https://pith.science/paper/XH3KENLX}},
note = {Machine review of arXiv:2501.16500}
}
read the original abstract
This paper examines the state of affairs on Frontier Safety Policies in light of capability progress and growing expectations held by government actors and AI safety researchers from these safety policies. It subsequently argues that FSPs should evolve to a more granular version, which this paper calls FSPs Plus. Compared to the first wave of FSPs led by a subset of frontier AI companies, FSPs Plus should be built around two main pillars. First, FSPs Plus should adopt precursory capabilities as a new, clearer, and more comprehensive set of metrics. In this respect, this paper recommends that international or domestic standardization bodies develop a standardized taxonomy of precursory components to high-impact capabilities that FSPs Plus could then adopt by reference. The Frontier Model Forum could lead the way by establishing preliminary consensus amongst frontier AI developers on this topic. Second, FSPs Plus should expressly incorporate AI safety cases and establish a mutual feedback mechanism between FSPs Plus and AI safety cases. To establish such a mutual feedback mechanism, FSPs Plus could be updated to include a clear commitment to make AI safety cases at different milestones during development and deployment, to build and adopt safety measures based on the content and confidence of AI safety cases, and, also on this basis, to keep updating and adjusting FSPs Plus.
Reference graph
Works this paper leans on
-
[2]
Three Sketches of ASL-4 Safety Case Components
“Three Sketches of ASL-4 Safety Case Components.” https://alignment.anthropic.com/2024/safety-cases/. Artificial Intelligence Action Summit
work page 2024
-
[3]
Towards Evaluations-Based Safety Cases for AI Scheming
“Towards Evaluations-Based Safety Cases for AI Scheming.” arXiv [Cs.CR] . arXiv. http://arxiv.org/abs/2411.03336. 13 Barrett, Steve, Philip Fox, Joshua Krook, Tuneer Mondal, Simon Mylius, and Alejandro Tlaie. Forthcoming. “Assessing Confidence in Frontier AI Safety Cases.” Buhl, Marie Davidsen, Benjamin Hilton, Tomek Korbak, and Geoffrey Irving. Forthcomi...
-
[4]
“Safety Cases for Frontier AI.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2410.21572. Campos, Siméon, Henry Papadatos, Fabien Roger, Chloé Touzet, and Malcolm Murray
-
[5]
Safety Cases: Justifying the Safety of Advanced AI Systems
“Safety Cases: Justifying the Safety of Advanced AI Systems.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2403.10462. DeepSeek-AI, Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, et al
-
[6]
“DeepSeek-V3 Technical Report.” arXiv [Cs.CL] . arXiv. http://arxiv.org/abs/2412.19437. DeepSeek-AI
-
[7]
Frontier AI Safety Commitments
“Frontier AI Safety Commitments.” https://www.gov.uk/government/publications/frontier-ai-safety-commitments-ai-seoul-summit-2024/frontier-ai-safety-commitments-ai-seoul-summit-2024. European Commission
work page 2024
-
[9]
“FLI AI Safety Index 2024.” https://futureoflife.org/wp-content/uploads/2024/12/AI-Safety-Index-2024-Full-Report-11-Dec-24.pdf. Goemans, Arthur, Marie Davidsen Buhl, Jonas Schuett, Tomek Korbak, Jessica Wang, Benjamin Hilton, and Geoffrey Irving
work page 2024
-
[10]
Safety Case Template for Frontier AI: A Cyber Inability Argument
“Safety Case Template for Frontier AI: A Cyber Inability Argument.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2411.08088. Google DeepMind
Show all 21 references
-
[12]
A Sketch of Potential Tripwire Capabilities for AI
“A Sketch of Potential Tripwire Capabilities for AI.” https://carnegieendowment.org/research/2024/12/a-sketch-of-potential-tripwire-capabilities-for-ai?lang=en. Karnofsky, Holden
2024
-
[13]
If-Then Commitments for AI Risk Reduction
“If-Then Commitments for AI Risk Reduction.” https://carnegieendowment.org/research/2024/09/if-then-commitments-for-ai-risk-reduction?lang=en. Kasirzadeh, Atoosa
2024
-
[14]
Measurement Challenges in AI Catastrophic Risk Governance and Safety Frameworks
“Measurement Challenges in AI Catastrophic Risk Governance and Safety Frameworks.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2410.00608. Koessler, Leonie, Jonas Schuett, and Markus Anderljung
-
[15]
Risk Thresholds for Frontier AI
“Risk Thresholds for Frontier AI.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2406.14713. 15 Meinke, Alexander, Bronson Schoen, Jérémy Scheurer, Mikita Balesni, Rusheb Shah and Marius Hobbhahn
-
[16]
Responsible Scaling Policies (RSPs)
“Responsible Scaling Policies (RSPs).” https://metr.org/blog/2023-09-26-rsp/. METR
2023
-
[18]
Pre-Deployment Information Sharing: A Zoning Taxonomy for Precursory Capabilities
“Pre-Deployment Information Sharing: A Zoning Taxonomy for Precursory Capabilities.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2412.02512. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intel...
2024 arXiv
-
[19]
https://www.federalregister.gov/documents/2019/02/14/2019-02544/maintaining-american-leadership-in-artificial-intelligence
Executive Order on Maintaining American Leadership in Artificial Intelligence. https://www.federalregister.gov/documents/2019/02/14/2019-02544/maintaining-american-leadership-in-artificial-intelligence. The White House
2019
-
[20]
https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/
Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/. The...
2023
-
[2004]
ISO/IEC Guide 2:2004
“ISO/IEC Guide 2:2004.” ISO . https://www.iso.org/standard/39976.html. International Organization for Standardization
2004
-
[2019]
U.S. Leadership in AI: A Plan for Federal Engagement in Developing Technical Standards and Related Tools
“U.S. Leadership in AI: A Plan for Federal Engagement in Developing Technical Standards and Related Tools.” https://www.nist.gov/system/files/documents/2019/08/10/ai_standards_fedengagement_plan_9aug2019.pdf. NIST AI 100-5
2019
-
[2023]
https://ec.europa.eu/transparency/documents-register/detail?ref=C(2023)3215&lang=en
Commission Implementing Decision on a Standardisation Request to the European Committee for Standardisation and the European Committee for Electrotechnical Standardisation in Support of Union Policy on Artificial Intelligence. https://ec.europa.eu/transparency/documents-regist...
2023
-
[2024]
A Grading Rubric for AI Safety Frameworks
“A Grading Rubric for AI Safety Frameworks.” arXiv [Cs.CY] . arXiv. http://arxiv.org/abs/2409.08751. Anderson-Samways, Bill, Shaun Ee, Joe O’Brien, Marie Buhl, Zoe Williams
-
[2025]
Initial Rescissions of Harmful Executive Orders and Actions
“Initial Rescissions of Harmful Executive Orders and Actions.” https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/. Titus, Jack
2025
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.