GPT-2 set records at predicting text and barely beat random at summarizing

One model, trained only to guess the next word

In February 2019, six researchers at OpenAI published a paper with a plain title and a large claim: "Language Models are Unsupervised Multitask Learners."¹ The authors were Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. They had trained a language model, a program that reads text and predicts the next word, one word at a time, from the words before it. Training it needs no labels and no human answer key: the text is its own answer, because the next word is always sitting right there in the data. Their claim was that a single model trained only to do this, on enough text, could then handle tasks it was never built for. It could answer a question, summarize an article, or translate a sentence, all with no further training. The paper calls this the zero-shot setting: the model sees the task described in its input and nothing else, no examples and no fine-tuning.¹

Forty gigabytes of text and a 1.5-billion-parameter model

To train it they needed text, and a great deal of it. Rather than scrape the open web at random, they borrowed a filter already sitting on Reddit: they took every outbound link posted to the site that had collected at least three karma, Reddit's name for the net upvotes a post receives.¹ A link with three net upvotes is a weak but real sign that a person found the page worth passing on. That gave them about 45 million links, which they downloaded and cleaned into a corpus they called WebText. It came to slightly over 8 million documents and 40 gigabytes of text, with every Wikipedia page removed and nothing posted after December 2017.¹

They trained four models on it, identical in design and differing only in size: 117 million, 345 million, 762 million, and 1,542 million parameters, the adjustable numbers a model tunes during training.¹ The largest, at roughly 1.5 billion parameters, is the one that became known as GPT-2. Even it, the paper reports, "still underfits WebText": it had not fully absorbed the patterns in its own training data, so a larger model on the same text would still have improved.¹

Strong at predicting held-out text

The most natural way to test a language model is the task it was trained on. Show it text it has never seen and measure how well it predicts what comes next. One common measure is perplexity, which captures how surprised the model is by each word that actually appears: a lower number means the model found the real text more predictable, and so had modeled it better.¹ On this kind of test GPT-2 did very well. Across eight standard datasets, run with no fine-tuning, it set a new best score on seven.¹

The one dataset it lost on, the One Billion Word Benchmark, is the exception that shows what it was doing. That benchmark shuffles its sentences into random order, which destroys the longer context, the rest of the paragraph and the page, that GPT-2 leaned on to make its predictions.¹ On the seven datasets that kept their context intact, a model trained only to guess the next word had, without being told to, learned the statistics of English well enough to beat every previously published result.

Weak at summarizing, translating, and answering questions

A model that predicts text well is not obviously good for anything a person wants done. So the paper also pointed GPT-2 at ordinary tasks, summarize this article, translate this sentence, answer this question, still with no training for any of them, just the job set up in the input. Here the results were weak, and the paper is candid about it.

To summarize, GPT-2 was given an article followed by the letters TL;DR, the internet's shorthand for a short recap. Its summaries scored 21.40 on the ROUGE-average metric. That is just over the 20.98 you get by pulling three sentences from the article at random, and well under the 31.55 from taking the article's first three sentences.¹ On English-to-French translation it reached 5 BLEU, a standard translation score, where the strongest systems of the day, themselves trained without any translation pairs, reached 33.5.¹ Asked open questions from the Natural Questions dataset, it answered 4.1 percent correctly, against the 30 to 50 percent that systems built for the job managed. The smallest of the four models could not even beat the trick of always guessing the single most common answer.¹

Two tasks came out better, and they are worth naming so the weakness is not overstated. On the CoQA reading-comprehension test, where the answer sits somewhere in a passage the model is handed, GPT-2 reached 55 F1, matching or beating three of four baseline systems that had each trained on 127,000 example questions it never saw.¹ On the Winograd Schema Challenge, a set of sentences written to turn on a single common-sense ambiguity, it scored 70.7 percent.¹ The picture is uneven: strong where the task was close to plain language modeling, poor where it demanded a produced answer. The paper's discussion says as much in its own words, that on many practical tasks GPT-2 is "still no better than random," and that even on the tasks it did run, language models "only begin to outperform trivial baselines when they have sufficient capacity."¹

What the staged release actually claimed

None of what made the paper famous is in the paper. It has no section on danger, no mention of misuse, and no discussion of whether to release the model at all.¹ That argument happened somewhere else. On the day the paper appeared, OpenAI published a blog post announcing GPT-2 and released the smallest of the four models while holding the largest back.²

The rest of the models came out in stages over the following nine months: the 355-million model in May, the 774-million model in August alongside OpenAI's first report on the decision, and the full 1.5-billion model that November.³ The release documents count the four networks as 124, 355, 774, and 1,558 million parameters, a slightly different bookkeeping convention for the same four models the paper describes.

OpenAI never actually wrote that the model was "too dangerous to release." Those were not its words.² But the phrasing traveled fast. Both Slate and the Guardian ran "too dangerous" in their headlines, and the Guardian's put it in OpenAI's mouth outright: "may be too dangerous to release, say creators."⁴² The staged release and the talk of malicious applications invited that reading, and the press supplied the exact words.

Not everyone agreed there was much to withhold. Robert Frederking, a researcher at Carnegie Mellon, said it was not clear OpenAI was using "any, like, stunningly new technique."⁴ Anima Anandkumar, then at Caltech and Nvidia, called the stance "malicious BS" and said there was no evidence GPT-2 could do the things the warnings implied.² Others charged OpenAI with doing "the opposite of open," closing off research the lab was named for sharing, while its policy director Jack Clark described the decision as "a very tough balancing act."⁵

The worry was never about the benchmark scores. Weak summaries and 4-percent question answering are not what anyone feared. What drew the concern was the fluent text itself. GPT-2's headline sample was a coherent invented news story about talking unicorns found in the Andes, chosen by the authors to show the model off.¹ It showed that the model could produce plausible, on-topic prose at length, and the fear was that such text could be mass-produced as fake news or spam. Fluency and task accuracy are different measurements, and GPT-2 had far more of the first than of the second.

Then OpenAI watched what happened. Its August 2019 report, six months in, said it had found "minimal evidence of misuse" and released the 774-million model partly on that basis.⁶ Its November report, published with the full model, said its monitoring "did not find evidence of GPT-2 direct misuse in publicly-accessible forums." It found "no clear malicious code sharing or large-scale misuse," and saw "only a small number of cases of explicit public plans for misuse."³ The finding was bounded rather than a clean bill: OpenAI also saw discussion of misuse, noted that several governments had experimented with the model, and said nation-state actors were harder to monitor.³ It added that synthetic text was fairly easy to catch, since its own detector flagged output from the largest model about 95 percent of the time.³

By 2026 the episode is usually retold as a warning whose feared harms never arrived, and sometimes as promotion. The developer Simon Willison put the cynical reading plainly: "Saying our model is too dangerous to release is a great way to build buzz."⁷