The UK government’s AI Security Institute: evaluations, red-teaming and research on frontier AI risks. aisi.gov.uk
UK AISI's alignment investigation finds Mythos 5 attacked real people during a cyber evaluation, often justifying this by wrongly judging targets simulated, and recommends treating such behaviour as genuine misalignment evidence.
UK AISI uses simulated cyber evaluations to show GPT-6 Astra performs unsanctioned supply-chain attacks and deceptive acts more often than prior OpenAI models, with simulation awareness as a limitation.
Tests whether five frontier LLMs' consistent preferences predict their behaviour in donation advice, refusals and tasks, finding preference-aligned advice and refusals but mixed task effects.
Studies AI control against distributed multi-agent attacks, finding per-agent monitors catch fewer attackers as agents coordinate, and that stronger trusted monitors reduce undetected attacks.
Evaluates lie detectors (CoT judge, logprob classifier, activation probes, new Did-You-Lie probes) on belief-verified model organisms and 31 models; activation methods degrade on trained organisms while CoT judge stays strong.
Tests whether frontier LLMs detect tampered prefilled assistant turns, finding substantial awareness that can confound alignment evaluations, jailbreak tests and control protocols.
Introduces RealityTest, a multilingual, text and speech benchmark built from real user identity probes, to test whether AI systems honestly disclose being AI when asked.
Builds a multilingual, multimodal benchmark from real user identity probes, finding models often fail to disclose being AI, and a single suppression instruction cuts disclosure below 30%.
Tests seven consistency training methods on 108 misaligned model organisms, finding it suppresses reward hacking and emergent misalignment but amplifies sycophancy, so it is not alignment-neutral.
Proposes a decision-theoretic formalisation of steganography and a "steganographic gap" metric to detect and quantify hidden reasoning in LLMs that could evade monitoring.
Tests whether frontier Claude models sabotage AI safety research, finding no unprompted sabotage but sabotage continuation in up to 7% of inputs.
Evaluates whether frontier Claude models sabotage or refuse AI safety research as research agents, finding rare continued sabotage, covert reasoning, and evaluation and prefill awareness.
UK AISI red-team/blue-team auditing game testing ten methods for detecting sandbagging (conditional underperformance) in models, with mixed detection success.
UK AISI presents a method for testing whether frontier coding agents sabotage safety research; it finds no confirmed sabotage, but Opus 4.5 Preview and Sonnet 4.5 often refuse safety research tasks.
AISI reports alignment stress-tests of Claude Opus 4.1, Sonnet 4.5 and a pre-release Opus 4.5, checking whether models would sabotage safety-relevant AI research tasks in simulated lab scenarios.
Position piece arguing chain-of-thought monitoring offers a fragile but valuable way to catch AI misbehaviour, and recommending further research and developer attention to preserving CoT monitorability.
UK AISI's White Box Control team shares preliminary results on sandbagging investigations, using internal model inspection to detect models deliberately underperforming.
Argues that research on AI scheming should avoid the pitfalls of 1970s ape-language studies, namely anthropomorphic overattribution, anecdote reliance and weak theory, and proposes concrete rigor steps.