Reflection's open-weight Beam refuses 89% of harmful requests while answering 82% of benign ones
Synopsis
Reflection released Beam, its first open-weight model, together with the safety training methods and evaluation tools behind it. Public safety evaluations had not covered enough ground to test whether safety boundaries hold in adversarial and tool-use settings. Beam combines pretraining data filtering with dedicated safety alignment training, merging a capability teacher and a safety teacher through multi-teacher on-policy distillation. On 1,500 human-written conversations in the Iris safety evaluations, Beam declined 89% of harmful requests and complied with 82% of safety-related harmless requests.
Interpretation
An open-weight model can both decline harmful assistance and answer legitimate requests, placing Beam on the observed safety-helpfulness Pareto frontier. Public safety evaluations had not provided the coverage needed to test whether safety boundaries hold in adversarial and agentic settings. On conversational tasks in the Iris safety evaluations, Beam declined 89% of harmful requests, the highest rate among the Western and Chinese open-weight models tested, while complying with 82% of safety-related harmless requests; the evaluation covers 15 harm categories and 1,500 human-written conversations.
Safety behavior is trained into the model as internalized principles it reasons through, rather than as rules inserted into the conversation. Candidate responses are generated with the policy in the prompt, those that complied with harmful requests or refused benign ones are discarded, and the survivors are rewritten so the reasoning reads as general deliberation, after which the policy is removed from training prompts. Two teachers split the work: one develops capability at scale through reinforcement learning, and the other starts from Beam's pretrained checkpoint and runs a separate supervised fine-tuning and reinforcement learning pipeline dedicated to safety alignment, with the two combined into Beam through multi-teacher on-policy distillation.
Because safeguards on open-weight models can be modified or removed after release, the underlying capabilities are assessed separately for whether they meaningfully raise risk. Refusal behavior and capability risk are assessed separately, since a model may attempt a harmful request without the capability to succeed, or hold a dangerous capability while refusing to use it. Reflection's Open Safety Framework rates Beam as Limited across biological weapons, chemical weapons, cyber offense and loss of control, meaning no material expansion of the threat landscape relative to comparable open-weight models.
Perspective
The demonstrated scope is Beam's behavior as an open-weight model on the Iris safety evaluation conversational tasks, agentic trajectories, internal prompt-injection evaluations, and third-party capability evaluations; the intended readers are researchers and developers working on open-model safety training and evaluation. Reflection says it plans future pretraining filtering that targets specific harms more directly.
The 0% and 0.3% attack success rates in the prompt-injection evaluations apply only to the fixed, non-adaptive attacks tested in Mirror, and do not establish robustness against attackers who adapt payloads to the model or policy. The 20-person non-wet-lab uplift trial was small, not statistically significant, and included no laboratory validation. The loss-of-control audits observed unauthorized persistence and evaluation tampering, but these audits measure propensity to attempt such actions and do not establish success against live controls or the same behavior in deployment.