Microsoft’s Decision-1 runs 35x faster than GPT-6 Sol on fixed-choice tasks
The new model offers calibrated probabilities for multiple-choice tasks, running significantly faster than larger general-purpose models in Microsoft’s internal tests.
Key points
- Microsoft-Decision-1 is post-trained on Alibaba’s open-weight Qwen3.5-9B model.
- It returns probability scores for fixed options like yes/no questions and ratings.
- Testing showed it was 35 times faster than OpenAI’s GPT-6 Sol in latency benchmarks.
Microsoft has released Microsoft-Decision-1, a specialised artificial intelligence model designed to select from fixed answer options rather than generating free-form text. According to The Next Web, the company built the model using Alibaba’s open-weight Qwen3.5-9B foundation and subsequently post-trained it. Achint Srivastava, vice president of software engineering in Microsoft’s Office of the CTO, announced the release in a blog post on 9 October. The model card indicates Microsoft plans to rebase it on other architectures, including OpenAI and internal MAI models, though no specific timeline was provided.
Root cause
The development focuses on a specific category of AI utility known as decision models. Unlike generative text models, Microsoft-Decision-1 is engineered to assign calibrated probability scores to predefined choices. According to the Foundry model card, this approach addresses needs such as routing, classification, prioritisation, and verification. The model accepts text input within a 32,000-token context window. It is explicitly advised against using this model as the sole basis for consequential human decisions, such as credit assessments or employment evaluations, due to its specialised scope.
Attack path
Security and robustness were evaluated through 5,250 requests across 11 safety benchmarks. These tests covered harmful content generation, jailbreak attempts, and prompt injection scenarios. Microsoft also measured stability by rewording or reordering requests; the model altered its decision in only 1.3 per cent of cases on average. Performance was measured against competitors including H2O-Lightning-4B v1.1 and OpenAI’s GPT-6 Sol. Microsoft reported the model achieved the highest accuracy in a 36-benchmark comparison involving nearly 150,000 blind questions, while operating 2.5 times faster than H2O’s model and 35 times faster than GPT-6 Sol.
Affected versions
The model is currently available through Microsoft Foundry and via OpenRouter, which was acquired by Stripe in August. Input processing costs $0.042 per million tokens, with output tokens provided at no additional charge. Microsoft later added benchmark comparisons against Jev, a model from TypeSafe AI that launched three weeks prior. According to The Register, Microsoft’s model performed 2.8 times faster than Jev in latency tests.
Mitigation
- Verify that the model is not used as the sole determinant for high-stakes human decisions.
- Review prompt inputs for potential injection vectors, despite the model’s safety benchmarking.
- Monitor output consistency when rewording requests, noting the 1.3 per cent variance rate.
- Assess whether the 32,000-token context window is sufficient for complex classification tasks.
What it means for organisations
Organisations should evaluate whether their current workflow automation relies on general-purpose models that may be over-engineered for simple classification tasks. Teams responsible for data processing should assess if a decision-specific model reduces latency and cost for routing or prioritisation workloads.
Governance bodies must ensure that the model’s limitations regarding consequential human decisions are clearly communicated to development teams. Suppliers integrating this technology should verify that their integration patterns respect the model’s text-only constraints and context limits. Internal risk assessments should consider the implications of using third-party foundational models, such as Qwen, for critical business logic.
Background: Prompt injection attacks
Isolate user input from system prompts using delimiters. Implement output validation to catch deviations. Apply least-privilege access to external tools. Avoid relying solely on prompt engineering. Use input filtering to remove malicious patterns. Combine these layers to reduce attack surface significantly.
Read the full guide: Prevent Prompt Injection Attacks: Practical Defences for AI Systems
What to do and how to stay safe: Microsoft
- Audit current automated classification systems to identify opportunities for specialised decision models.
- Test the model’s output consistency against internal rubrics for grading AI responses.
- Review vendor contracts if adopting models rebased on open-weight foundations for compliance.
- Monitor performance metrics to compare latency and cost against existing general-purpose model usage.
Step-by-step guide: Prevent Business Logic Vulnerabilities: 4 Proven Measures
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the basis of Microsoft-Decision-1?
It is built on Alibaba’s open-weight Qwen3.5-9B model and post-trained by Microsoft.
How does it perform compared to GPT-6 Sol?
Microsoft’s tests showed it was 35 times faster than OpenAI’s GPT-6 Sol.
Can it be used for employment decisions?
No, the model card advises against using it as the sole basis for consequential decisions about people.
