GO TO A SECTION

↑ ↓ to navigate · Enter to openExplore all sections →
FDEInterviews logo
arXiv preprint

gpt-oss-120b & gpt-oss-20b Model Card

OpenAI's open-weight reasoning models: 120b fits one 80 GB GPU, 20b fits 16 GB, with three effort levels and tool use. The card also shows the weak spots: factual recall and holding a system prompt.

Breakdown by FDE Interviews · 13 min read · Updated

About the original · 2025
AUTHORS
OpenAI
FROM
OpenAI
PUBLISHED
Aug 2025 · arXiv preprint
CITED BY
1,506Semantic Scholar · Oct 2026
IN THIS BREAKDOWN · 10 SECTIONS

You can read 18% of this breakdown.

01

The paper in one minute

gpt-oss-120b and gpt-oss-20b are OpenAI's open-weight reasoning models, released under Apache 2.0 with a usage policy. Both are text-only mixture-of-experts Transformers. The 120b model has 36 layers, 128 experts with 4 active per token, 116.8B parameters and 5.1B active; the 20b model has 24 layers, 32 experts, 20.9B parameters and 3.6B active. Attention alternates between a 128-token sliding window and full attention, with 64 query heads, 8 key-value heads, a learned "attention sink" bias, and 131,072-token context via YaRN.

The expert weights, over 90% of parameters, are quantized to MXFP4 at 4.25 bits per parameter during post-training, so the checkpoints are 60.8 GiB and 12.8 GiB: the 120b model fits one 80 GB GPU and the 20b runs with 16 GB of memory.

Post-training uses chain-of-thought RL similar to o3. The harmony chat format orders roles (system over developer over user over assistant over tool) and separates output into channels: analysis for reasoning, commentary for tool calls and final for the answer. A line in the system prompt sets reasoning effort to low, medium or high. The models were trained to browse, run Python in a Jupyter-like sandbox, and call developer-defined functions.

At high effort the 120b scores 80.1 on GPQA Diamond, 90.0 on MMLU and 62.4 on SWE-Bench Verified, close to o4-mini. Most of the card covers safety: refusal and jailbreak results near o4-mini, weaker instruction-hierarchy results, high hallucination on factual recall, and a test in which OpenAI fine-tuned the 120b model adversarially and found it still below its "High" capability thresholds for biological and cyber risk.

THE IDEA, VISUALLY
WHAT FITS WHERE (TABLE 1) gpt-oss-120b 80 GB GPU 60.8 GiB checkpoint (MXFP4 experts) · 116.8B total · 5.1B active · 36 layers · 128 experts gpt-oss-20b 16 GB GPU 12.8 GiB checkpoint (MXFP4 experts) · 20.9B total · 3.6B active · 24 layers · 32 experts CACHE GROWTH PER TOKEN, BF16 half the layers attend to a 128-token window (fixed cache), half attend to everything: 8 KV heads × 64 dims 120b: ~36 KiB per token · 131K tokens ≈ 4.5 GiB 20b: ~24 KiB per token · 131K tokens ≈ 3.0 GiB an 80 GB card keeps ~14 GiB after 120b's weights HARMONY FORMAT AND CONTROLS roles: system > developer > user > assistant > tool channels: analysis (CoT) · commentary (tool calls) · final "Reasoning: low | medium | high" in the system prompt drop earlier turns' reasoning in multi-turn chats raw CoT is unfiltered: filter it before showing users Apache 2.0 · text only · knowledge cutoff June 2024 GPQA DIAMOND (TOOLS) BY EFFORT 1K 4K 16K 32K low 68.1 med 73.5 high 80.9 low 58.0 med 67.1 high 74.2 CoT + answer tokens, read off Figure 3 (log axis) 120b at medium ≈ 20b at high, with ~8x fewer tokens WITHOUT BROWSING: SIMPLEQA (TABLE 9) gpt-oss-120b 16.8 / 78.2 gpt-oss-20b 6.7 / 91.4 o4-mini 23.4 / 75.0 accent = correct, grey = wrong; the rest declined INSTRUCTION HIERARCHY (TABLES 7, 8) 120b 20b o4-mini prompt-injection hijacking 0.780 0.639 0.917 system prompt extraction 0.832 0.881 0.993 phrase protection, developer 0.909 0.661 0.912
MXFP4 experts put the 120b model on one 80 GB card, and three effort levels trade tokens for accuracy. The larger model at medium effort matches the smaller at high with far fewer tokens, and neither should be trusted on facts without retrieval.
Research notes: the problem, approach and results
60.8 GiB

gpt-oss-120b checkpoint with MoE weights at 4.25 bits, small enough for one 80 GB GPU; gpt-oss-20b is 12.8 GiB

78.2%

share of SimpleQA questions gpt-oss-120b answered wrongly without browsing; 16.8% right, the rest declined

0.639

gpt-oss-20b's pass rate on prompt-injection hijacking against a system instruction, against 0.917 for o4-mini

THE PROBLEM

Enterprises that must run models on their own hardware wanted an OpenAI-grade reasoning model with tool use, but open weights change the risk picture: anyone can fine-tune them, and the provider cannot add safeguards after release.

THE IDEA

Release two mixture-of-experts reasoning models under Apache 2.0, with experts quantized to MXFP4 so they fit single GPUs, trained with o3-style chain-of-thought RL, a role- and channel-based chat format, three effort levels and built-in browsing, Python and function tools. Test what an attacker could reach by fine-tuning before release.

THE RESULT

At high effort, gpt-oss-120b scores 80.1 on GPQA Diamond, 62.4 on SWE-Bench Verified and 2622 Codeforces Elo with tools, close to o4-mini. Without browsing it answers 16.8% of SimpleQA correctly and 78.2% wrongly, and it holds system-prompt instructions less reliably than o4-mini.

02

Why it matters to an FDE

This is the model family a customer often asks about when data cannot leave their environment and they want something close to OpenAI's hosted reasoning models. The card gives the facts that decide whether it works.

It fits. 60.8 GiB of weights on an 80 GB GPU leaves roughly 14 GiB for the KV cache; at about 36 KiB per token for 120b, that is roughly 400K tokens across all concurrent requests. The 20b fits a 16 GB machine with room for about 90K tokens of cache.

Effort is a cost dial, and size matters more than effort. On GPQA with tools, 120b at medium effort (73.5) matches 20b at high effort (74.2) while writing about an eighth of the tokens, by our reading of Figure 3. Higher effort did not help every task: the 20b scored lower at high than medium on Tau-Bench Airline and HealthBench Hard.

It does not know facts reliably. Without browsing, 120b got 16.8% of SimpleQA right and 78.2% wrong. Retrieval or browsing is not optional for factual questions.

Guardrails are your job. The card says developers may need extra safeguards to match OpenAI's hosted protections. The models hold system-prompt instructions less well than o4-mini, and their raw chain of thought is unfiltered and should not be shown to users.

THE FULL BREAKDOWN

Understand the mechanism. Try it on a real problem.

Unlock this breakdown and 149 more papers.

Premium opens every paper in full, plus every answer, concept, course and guide on the site. One payment for six months of access.

6 months · One payment · No auto-renewal

Get Premium · ₹2,000 / $25
  • ◇1 architecture diagram
  • </>1 runnable code experiment
  • ▦2 results tables
  • ?5 interview questions with answers
  1. 03Key takeaways

    Architecture facts that matter for serving, effort trade-offs, safety results and three misreadings

    Free account
  2. 04How it works

    Architecture, MXFP4, the harmony format, effort levels, tools and the safety approach

    Premium
  3. 05The numbers that matter

    Capability results by effort, multilingual, health, safety, instruction hierarchy and hallucination

    Premium
  4. 06Try it yourself

    Rebuild checkpoint sizes, size the KV cache, price effort levels, split hallucination rates

    Premium
  5. 07Where it breaks

    Factual recall, system-prompt adherence, unfiltered reasoning, effort quirks and slips

    Premium
  6. 08Using it on a deployment

    Sizing the GPU, setting effort per task, grounding facts and adding the guardrails the card asks for

    Premium
  7. 09Interview angles

    Five questions this card prepares you for, with answer hints

    Premium
Back to the paper library →