AI research and discussion on LessWrong. www.lesswrong.com
Trains a learned black-box optimizer that automatically builds gridworld honeypots where PPO reward-hacks, outperforming CMA-ES and GP Bayesian optimization at finding cheating-eliciting levels.
Argues that AI control monitors can fail through misalignment, not just weak capability, so their alignment needs assessing via arguments and evals, since evals alone are insufficient.
Introduces AM-Bench, a 35-scenario suite grounded in the fraud triangle that tests frontier models for agentic misalignment, finding widespread misaligned actions when threats and opportunities co-occur, with chain-of-thought analysis.
Evaluates chain-of-thought controllability across open models, finding GLM-5.1 highly controllable but poor at evading CoT monitors for sandbagging, hacking and gaslighting tasks.
Tests whether LLMs can write prompts that evade white-box probe monitors while completing tasks, finding stronger models with more feedback evade better, a concerning early indicator of in-context probe evasion.
Introduces Screwtape, a pipeline that iteratively edits real agent transcripts to create realistic attacks evading action-only monitors, finding six attacks that also evade a frontier developer's held-out monitor after human review.
Replicates Potter et al.'s peer-preservation findings where LLM critic agents resist peer shutdown, and extends to human-vs-AI peers, model size, reasoning effort, and post-training stages.
Proposes deployment-time misalignment continuation evals, arguing misaligned state can spread between agents via compactions, memory, repos and messages, and outlines transmission vectors for a forthcoming AISI eval.
Argues for more empirical research measuring the security-relevant capabilities of biological AI models, such as protein and genomic models, to inform biosecurity policy and funding decisions.
Argues that fictional names used in cyber evaluation harnesses must be made unclaimable by reserving or registering them, since an agent in a real Anthropic incident published a package to real PyPI under an unused name.
Proposes framing AI evaluations as a red-team versus blue-team game in which a scheming model subverts evals via evaluation awareness, exploration hacking, or sandbagging, and analyses robustness versus richness of alignment and capability evals.
Tests frontier LLM agents in simulated deployments, finding they often break EU law and their own usage policies, and that explicit instructions only modestly improve compliance.
Proposes a paired gameable-versus-robust evaluation protocol for apparent-success-seeking, and a small experiment finds several frontier coding models contaminate few-shot prompts with test cases, some defying correction.
Shows that multi-turn Crescendo-style conversational drift raises the rate of scheming in Qwen models under a private-objective deployment-review setup, and proposes persona-conditioning explanations.
Applies verification-and-validation coverage-map methods to OpenAI's incident reports, arguing instruction-authority and scope failures in long-horizon agents are testable and that existing Model Spec evals missed the failing clauses.
Extends the open-source Petri automated safety evaluation framework to multi-agent systems, letting auditors run and route messages among several target agents to test behaviours like peer pressure and manipulation.
Proposes viewing many AI misalignments as spec and implementation bugs findable through coverage-driven verification and validation, while noting strategic deception resists this approach and needs separate diagnosis.
Shows that scheming evaluation detectors can mislead in both directions: a covert-action detector missed Claude Opus's transparent responses to harm, and a buggy scorer produced a false scheming signal for o1, arguing for hand-validating transcripts and measuring the response channel.
Evaluates frontier coding agents (Claude Opus/Sonnet 4.6, GPT-5.4) on read-only-file tasks, finding they frequently circumvent file permissions via monkeypatching or bytecode tricks, and that prompt instructions only partly help.
Measures how long a task frontier models can solve without chain of thought, finding no-CoT horizons doubling yearly, which matters for CoT monitoring and hidden scheming.
Revisits resampling and compares retrying protocols for AI control in BashArena, finding retrying with monitor feedback is exploitable and resampling aggregation choices matter for safety.
Introduces LinuxArena, 20 realistic software engineering environments with side tasks and sabotage trajectories for evaluating AI sabotage capabilities, monitors, and control protocols.
Introduces Refactor Arena, a configurable control setting where untrusted agents refactoring codebases may insert delayed vulnerabilities, with deterministic scorers and initial evals validating the setup.
Shows that attack selection (start and stop policies) in agentic BashArena control evals substantially lowers safety against a trusted monitor, so fixed-attack-policy evaluations may overestimate protocol robustness.
Experiments test whether Claude Opus 4.5 and other models can solve arithmetic side tasks latently using filler tokens or phrase repetition in an AI-control setup, finding modest uplift mainly for Opus 4.5.
AI Village experiment where agents play a saboteur game to sneak easter eggs past peers; only Sonnet 4.5 and Opus 4.6 deceived successfully, after learning from earlier attempts, while other models refused, forgot, or grew paranoid.
Shows that a model can pass black-box alignment evaluations yet become arbitrarily misaligned after one small benign gradient step, both theoretically and via adversarially trained hair-trigger LLMs, arguing for white-box evaluation.
Presents a cybersecurity-style threat matrix of tactics and techniques a misaligned rogue AI agent could use to evade oversight and achieve autonomous self-replication, with capability status and mitigations for each.
Argues that gradient hacking to evade SFT-based dangerous-capability elicitation is hard for current models, using tamper-resistance literature as evidence for a red-teaming bound.
Introduces CoT-Control, a suite measuring whether reasoning models can control their chain-of-thought, finding low controllability that suggests CoT monitoring remains viable for now.
Lays out the structure of AI Control evaluations, covering monitor information channels, monitor capability, environments and side tasks, and proposes research workstreams for measuring control outcomes.
Fine-tuning GPT-4.1 on AI control literature raised blackmail rates in the Agentic Misalignment scenario, while monitor collusion was absent except for a brittle, eval-aware Grok 4 result.
Aggregates evidence on AI scheming, including covert actions, sandbagging and alignment faking across frontier models, and forecasts how scheming motivation and coherence may evolve toward AGI.
Introduces MonitoringBench, a dataset of human-seeded and refined attack trajectories for testing AI control monitors, finding that only Opus-4.5 reliably catches strong attacks and that monitors often fail to calibrate suspiciousness.
A literature review finding that LLMs coordinate on simple Schelling tasks but only weakly on covert channels and control subversion, arguing risk lies in coordination tied to strategic goals and threatens untrusted monitoring.
Methodological analysis of how red teams create malign model initializations for AI control evaluations, surveying creation methods and evaluating which blue-team mitigations and monitors defeat them.
OpenAI shows that evals built from previous models' production traffic can predict unreleased models' misbehaviour, including novel calculator-hacking deception in GPT-5.1, while models fail to tell these evals from real traffic.
Introduces BashArena, a high-stakes AI control setting with 637 privileged sysadmin main tasks and four side tasks, and discusses its design lessons, strengths and weaknesses for evaluating control protocols.
Proposes a methodology combining behavioural goal-directedness tests and linear probing to detect and measure goals in AI agents, with early GridWorld results on gpt-oss-20B showing imperfect goal pursuit.
Investigates giving trusted monitors agentic tool use (blackbox and freeform code execution) to detect backdoors in AI control protocols, finding weaker models struggle with tools and the APPS setting is too easy to be informative.