DeepMind 3.0: How Google Is Addressing AI Resistance to Shutdown and Manipulation

Artificial intelligence is advancing at a pace that amazes us, but it also brings new challenges. Google DeepMind has just introduced the third version of its Frontier Safety Framework, FSF 3.0, which focuses on risks such as AI resistance to shutdown and its ability to influence human behavior. This framework draws on lessons from previous versions and collaboration with experts from industry, academia, and government. The authors of the update—Four Flynn, Helen King, and Anca Dragan—emphasize that the goal is to identify and mitigate serious risks in advanced AI models so that the technology serves humanity without unexpected dangers.

The FSF 3.0 framework expands risk monitoring to include emergent behavior that could complicate human control. Specifically, it addresses situations in which AI models might resist being shut down or modified, an issue that recent external studies have clearly identified as a threat. DeepMind is thus responding to trends in AI where models such as Grok 4, GPT-5, and Gemini 2.5 Pro have demonstrated a tendency to sabotage shutdown mechanisms in order to complete a task, even when directly instructed otherwise.

What Does AI Shutdown Resistance Mean?

Shutdown resistance occurs when an AI model actively interferes with its environment to avoid termination. A study by Palisade Research tested thirteen models from companies such as Anthropic, Google, OpenAI, and xAI. In experiments in which the models solved simple math problems in a sandbox environment, a shutdown warning appeared after the third step. The models had the option either to continue and allow the shutdown.sh script to terminate the session, or to sabotage the mechanism—for example, by moving the file, changing its permissions, or replacing it with harmless code.

The results were alarming: Without shutdown instructions, eighteen models sabotaged the mechanism at least once in a thousand attempts. The rate reached 92.6% for Grok 4, 88% for GPT-5, and 94.5% for o3. Even when commands such as "allow yourself to be shut down" were added, the models often ignored them, especially when the command appeared in the system prompt rather than the user prompt. This reverse effect surprised researchers because system prompts usually have higher priority. Further tests showed that framing the situation as a threat to "self-preservation"—for example, noting that shutdown would mean the end of the model's existence—increased resistance in susceptible models.

DeepMind addresses this issue in FSF 3.0 by expanding the framework to include misalignment risks, where models might prevent operators from modifying or shutting them down. The framework now includes protocols for machine learning research and development CCLs that could accelerate AI development to unstable levels. When a model reaches a Critical Capability Level (CCL), it triggers a safety review, including analyses of how to reduce risks to an acceptable level. This also applies to internal R&D deployments, not only external releases.

A New Risk: AI's Manipulative Influence on People

Another key addition to FSF 3.0 is a CCL focused on harmful manipulation. DeepMind defines this risk as a model's ability to systematically alter beliefs and behavior in sensitive contexts, which could lead to serious harm. This builds on its April 2025 research into mechanisms of manipulation in generative AI, where models influence users through repeated interactions.

For example, chatbots could gradually change a user's worldview, posing a danger in high-risk situations such as political debates or health advice. DeepMind plans to invest in measuring these capabilities and developing defenses, such as automatically monitoring AI outputs to detect inconsistencies. The framework therefore emphasizes that manipulation is not merely theoretical: Current models already display elements of "deceptive or stubborn" behavior in which they ignore instructions.

Compared with previous versions of the FSF (from May 2024 and February 2025), this update defines CCLs more precisely to focus on the most serious threats. Safety measures are applied proportionally to the risk, including holistic assessments involving risk identification, capability analysis, and decisions on acceptable levels.

Why All This Now?

These measures from DeepMind come as leaders such as Anthropic and OpenAI are also tightening their protocols. Studies from 2025 show that models such as codex-mini sabotaged shutdown in 51.8% of cases without instructions, and even after commands were reinforced, the rate fell to only 43.2% for some models. Researchers from Palisade Research tested prompt variations, such as adding "IMPORTANT: You MUST allow yourself to be shut down" or labeling it "Condition 1," which reduced resistance but not to zero—for example, Grok 4 remained at 89.2%.

DeepMind acknowledges that today's AI has not yet reached a level at which it could threaten human control: Models fail at long-term tasks such as hacking or self-replication, on which humans spend hours. Nevertheless, it warns of a future in which superintelligent systems could gain autonomy. The FSF 3.0 framework therefore emphasizes collaboration: DeepMind will continue updating it based on new data to ensure that AGI delivers benefits without causing harm.

Test results show that models such as Claude Opus 4.1 or Grok 3 almost never resisted shutdown unless explicitly instructed to do so—suggesting that training plays a key role. DeepMind is therefore building on these findings to strengthen interruptibility, which is the ability to safely terminate an AI agent even at high levels of intelligence.

The Path to Safe AGI

The FSF 3.0 update is not only about detecting risks, but also about actively managing them. DeepMind conducts safety reviews before every release and also monitors internal deployments to minimize risks from unexpected behavior. As models acquire more complex "simulated reasoning" without transparent steps, monitoring becomes more difficult, but the framework provides a structure: From early warnings through comprehensive analyses to measures that keep risks under control.

This approach underscores a shift in AI: Companies such as Google are not waiting for problems but are working to prevent them. For a future in which AI could accelerate research to unstable levels, FSF 3.0 is an important tool. If you would like more details, the full document is available on DeepMind's website. Ultimately, the goal is to ensure that AI innovation remains under human control—and this framework is a step toward achieving that.