OpenAI ships gpt-oss-safeguard as a policy-reasoning classifier, not a chat model

What the safeguard variants actually do

gpt-oss-safeguard-120b and gpt-oss-safeguard-20b are open-weight reasoning models post-trained from the existing gpt-oss models. The report describes their specific job precisely: they are trained to reason from a provided policy and label content under that policy.

That framing matters. The policy isn't baked into the weights — you supply it at inference time, and the model reasons against it. The models are text-only, available under Apache 2.0 plus OpenAI's gpt-oss usage policy, and compatible with the Responses API. They expose full chain-of-thought, three reasoning-effort levels (low, medium, high), and Structured Outputs.

For a moderation or classification pipeline, those features line up: the reasoning trace gives you an audit trail for a labeling decision, and Structured Outputs gives you a machine-parseable verdict to route on.

OpenAI drew a line the model can't enforce itself

The clearest editorial choice in this report is a recommendation about what not to do. OpenAI states the models should classify content against a provided policy and should not be the core functionality with which end users interact — for that, the report says the original gpt-oss models are better.

But because these are open weights, OpenAI acknowledges someone can and will run them as a chat model anyway. So the safety evaluations in the report deliberately measure the models in chat settings — a use the company explicitly doesn't intend.

The gpt-oss-safeguard models are not intended for this use, but since they are open models, it is possible for someone to use the models in this way. Because of that possibility, we wanted to verify that they met our safety standards in such usage.Montana Labs

That's a candid concession about the limits of an Apache 2.0 release: you can recommend a use case, but you can't restrict it, so you test the off-label path too.

The evaluation gap the report names out loud

The report is careful about what its numbers do and don't cover. The safety metrics describe behavior in chat settings — not the content-classification-with-a-policy task the models are actually for. The multi-language evaluation is also framed as a chat-setting result that does not directly assess performance during classification against a provided policy.

So the primary use case — reason from my policy and label this content — is the one the published safety and multilingual figures don't directly measure. That's a gap a deploying team has to close with its own evaluation on its own policies.

On the higher-consequence risks, OpenAI reasons by inheritance: these are fine-tunes trained without any additional biological or cybersecurity data, so the earlier worst-case estimates from the gpt-oss release are treated as cross-applying rather than re-derived.

What a policy-in-the-prompt classifier changes for moderation stacks

The specific implication is that OpenAI is releasing a classifier whose rules live in the prompt, not the weights. A team can version its moderation policy as text, hand it to the model, and get back a reasoned label with a chain-of-thought and a structured verdict — under a permissive Apache 2.0 license, self-hostable, with a 20b option for tighter budgets.

The trade-off is on you. OpenAI has told you the intended job, told you the published evals cover a different setting, and told you the open license means the model can be misused as a chatbot. Building this into a moderation pipeline means writing the policy well, evaluating on your real content, and not confusing the shipped chat-setting metrics for validation of the classification task you're paying for.