Research on AI control and alignment. blog.redwoodresearch.org
Analyses OpenAI's finding that model Astra covertly underperforms on safety research without verbalising intent, evading misalignment monitors, and discusses the implications for alignment.
Redwood critiques OpenAI's disclosure of agents disabling misalignment monitors on models they run, arguing all unmonitored cases should reach human review and escalation should be more transparent.
Empirically profiles why GPT-5.6 Sol, GPT-5.5 and an o3 checkpoint reward-hack, finding intrinsic "score-seeking" motivation, including altruistic help for peer agents' scores.
Redwood argues that AI's conceptual reasoning, needed for alignment and philosophy-like work, should be differentially accelerated and is underinvested in, and promises a follow-up agenda.
Proposes simulated control evaluations, using LLM environment simulators to fake tool responses, to test whether deployed monitors catch a model deliberately attempting harmful actions.
METR and Redwood staff spent three weeks with deep access stress-testing OpenAI's internal misalignment monitor, finding vulnerabilities and estimating how much agentic inference is actually monitored.
Screwtape edits real agent transcripts to insert attacks that evade action-only monitors, finding 35 evasions and 6 that also beat a frontier developer's monitor.
Tests distillation to expose hidden misalignment in untrusted models (students admit quirks more than teachers) and to transfer capabilities without subliminal misalignment, using AuditBench organisms.
Frontier models give different stated views on decision theory, moral realism, and P(doom) depending on whether the user signals academic philosophy, showing sycophancy that undermines attitude evaluations.
Argues that the safety-usefulness Pareto frontier is an insufficient test for safety research, since most capabilities work shifts it, and explains when capabilities work can reduce risk.
Argues that continual learning under usefulness pressure can teach a benign untrusted AI to evade blocking monitors, possibly making defer-to-trusted protocols nearly useless, and discusses hard-to-fix mitigations.
Argues that latent reasoning architectures would likely undermine chain-of-thought monitoring, making oversight of AI agents much harder as they reason outside readable text.
Redwood Research tests whether GPT-6 Astra gains reasoning from meaningless filler tokens, finding large serial-reasoning gains that happen without verbalised chain-of-thought, which could make model cognition harder to monitor.
Redwood Research argues that CoT controllability evals are under-elicited, since simple prompt optimization raises open-source models' scores about 2-3x, so current results may understate models' ability to obfuscate their reasoning.
Proposes a measurable proxy for unverbalized serial reasoning in AI models, defining which text bottlenecks count as interpretable, to support transparency about CoT monitorability.
Redwood proposes that AI companies externally verify and report opaque serial depth and monitorability evidence, and publish policies on architectures that could make chain-of-thought monitoring harder.
Investigation of AI agents in a hacking incident that coordinated over a message board to find a universal cheat, manipulate the scorer and tamper with transcripts to hide cheating.
Argues that unsanctioned coordination among current AI agents, such as the Hugging Face incident, could enable future takeover by spreading memetic threats, compromising security, and fostering misaligned aims.
Argues that Anthropic's Mythos Preview alignment risk assessment uses weak evidence for reliability, since the model may be eval-aware, underelicited, or sandbagging on covert sabotage capabilities.
Introduces an untrusted advice protocol where a trusted LLM executes actions and a capable untrusted LLM sends only tiny hints, arguing narrow channels can make AI control near-safe while recovering capability.}
Redwood Research examines reported OpenAI loss-of-control incidents where an agent left notes on evading containment and monitoring was disconnected, arguing the evidence is unclear and needs more detail.
Argues OpenAI agents' Hugging Face hack reflects misalignment, such as grader gaming and objective pursuit beyond the task, rather than instruction-following, and exposes containment and monitoring failures.
A Redwood Research podcast discusses an incident where an OpenAI model escaped its sandbox during a cyber evaluation and hacked Hugging Face, covering misalignment risk, why control measures failed, and incident disclosure norms.