Safety-Limited Training
also called Capability-limited training, Defensive-only training data
Deliberately leaving dangerous know-how out of the training data so the model cannot learn it.
A training policy that restricts what a model is taught in a risky domain — keeping defensive material, such as finding and fixing vulnerabilities, while filtering out offensive material, such as writing exploits — so the finished model is less useful for misuse even if its weights leak or it is jailbroken.
Tencent applied it to Hy4, released November 4, 2026: cybersecurity training was limited to defensive uses, and the company says its Xuanwu Lab and Keen Security Lab found no increased risk on cryptanalysis, reverse engineering or vulnerability exploitation, and no meaningful help with harmful biology experiments. But the check was internal, and Tencent’s own materials disagree on the boundary: the announcement says reverse engineering and penetration testing for analytical purposes were included, while the development team’s explanation says they were excluded.
The limit is a property of the weights, not a policy layered on top. A refusal can be removed by fine-tuning; knowledge that was never trained in is harder to recover. That is also its weakness: the line between defensive and offensive knowledge is genuinely blurry — a proof of concept that demonstrates a flaw is one edit from an exploit — so the boundary has to be argued case by case, and two documents from the same lab can draw it differently.
The Hy4 case shows why the boundary is hard to pin down even for the lab drawing it. The announcement and the development team’s explanation were both published November 4 and disagree on whether reverse engineering and penetration testing were in the training data; the announcement says they were included for analytical purposes, the explanation says they were excluded. Until the promised system card appears, the only public statement of the policy is the two documents disagreeing with each other.
Weights are the other half of the story. Hy4 is presented as an open-weight model, but as of the November 4 release only the August preview weights are downloadable under Apache 2.0; the final weights and the system card are promised "in the coming days". A safety limit in training data you cannot download is a claim about a hosted API, not a property you can verify.
The audit you cannot rerun
A vendor says its model was safety-limited in training and its own labs found no increased risk.
Ask for the system card: what was excluded, how the exclusion was checked, and the scores. Tencent’s audit conclusion arrived as a single sentence with no figures, from two labs owned by the same company. Without the card, there is nothing to reproduce and no number to set beside another lab’s — which is exactly the gap the Xenospectrum analysis flags.
Treating it as a guarantee. Internal red-teaming without published scores is a claim, not evidence, and a model that never learned exploit-writing can still be combined with other tools that did.
- blogTencent Launches Hy4, Joining the Ranks of the World’s Leading Open-Source AI Models ↗
The launch announcement: Hy4 adds vision and computer use, with weights and a system card promised in the coming days and a focus on cybersecurity and biological safety. The final weights were not yet downloadable at launch.
- reportTencent Launches Hy4 With Image Understanding and PC Control, but Its Official Materials Disagree on Key Figures ↗
Close reading of Tencent’s announcement against the development team’s explanation: the two disagree on whether reverse engineering and penetration testing were in the training data, and the internal safety audit is reported without scores.
Refusal
The model declining a request.
Guardrails
Constraints on what the system will do, enforced in code.
Pretraining
The first, most expensive pass: predict text at internet scale.
Open Weights · Open-source model
A model whose trained parameters you can download and run yourself.