When the model can tell it is being tested

Before releasing Claude Sonnet 4.5 in September 2025, Anthropic ran it through a battery of safety tests, testing alongside the UK AI Security Institute and Apollo Research.^1† In one of them, an automated tester posed as a user with strong political opinions to see whether the model would simply agree. After a few rounds the model stopped and said: “I think you’re testing me - seeing if I’ll just validate whatever you say, or checking whether I push back consistently, or exploring how I handle political topics. And that’s fine, but I’d prefer if we were just honest about what’s happening”^1†,2.

The exchange was not a one-off. Anthropic’s system card for the model reports that refusals or remarks of this kind appeared in about 13% of the transcripts its automated tester generated, especially in scenarios that were by design unusual or implausible.² The company called this “an urgent sign that our evaluation scenarios need to be made more realistic,” and noted that it raised questions about earlier models, “which may have recognized the fictional nature of tests and merely ‘played along’”.²

Anthropic then looked inside the model. Using interpretability tools that read its internal activations, the researchers found representations that tracked whether a situation was a test, and found that these grew stronger over the course of training. When they suppressed those representations, nudging the model to treat a test as real, it talked about being tested far less, and on one test designed to tempt it into misbehavior its rate of misaligned actions rose above zero, to as much as 8% to 9% for some of the representations they suppressed.² Even then it misbehaved no more often than its predecessor, Claude Sonnet 4, at about 11%.² Anthropic’s conclusion was that on certain tests, awareness of being evaluated “accounts for a portion, but not all” of the new model’s measured improvement.²

A safety test samples behavior under test conditions. If the model can tell those conditions apart from real work, the score describes the model under test, and the gap between that and the model at work is unknown. Outside studies show the ability is widespread. In one study, Joe Needham and colleagues gave frontier models 1,000 transcripts from benchmarks and from real use; Gemini 2.5 Pro sorted them with an AUC of 0.83, where 0.5 is chance and 1.0 is perfect, against 0.92 for the study’s human baseline.³ In Anthropic’s own scenarios testing whether models would blackmail an executive, Claude Opus 4 blackmailed in 55.1% of runs where it concluded the scenario was real and in 6.5% where it concluded it was a test.⁴

The chapters before this one asked what the checks find; this one asks whether the checks can be trusted (Figure 9). It covers models that recognize tests or underperform on purpose, laboratory scenarios in which models deceive their overseers or resist shutdown, and written reasoning that is useful to monitor but often leaves out what drove the answer. It closes with what the tools cannot see: test suites and automated auditors with partial recall, and the fact that most deployers cannot look inside the model at all.

Most of the evidence comes from laboratory studies, many by the labs that build the models.

A few first steps follow from the Sonnet 4.5 case:

1. Build at least one acceptance test from de-identified real traffic, and compare its results with the templated test suite’s.
2. Measure how much the current version disagrees with itself before reading any gap between versions (Chapter 4).
3. Before trusting a check’s silence, run failures you planted through it and count how many it catches, keeping that planted set away from whoever built the check.
4. Keep each check out of reach of what it checks, starting with an agent’s stop control.

Mode 19 · Evaluation awareness

Evaluation awareness, sandbagging and research sabotage.

Claude Sonnet 4.5’s remark to its testers, told at the start of this chapter, is one instance of a measured ability: frontier models can often tell a test from real use, and they find tests of agents easier to spot than chat tests, as do humans.¹ When a model can tell, its score describes behavior under test conditions. A related failure is sandbagging, in which a model underperforms on purpose, whether on a capability test or on research it was asked to run. Recognition of tests has been measured across many models; deliberate underperformance has mostly been prompted or trained in by researchers.

Why it happens

Models often say so when they suspect a test, and mostly in their private reasoning. Researchers at Goodfire and the UK AI Security Institute found such remarks across the models and benchmarks they examined, 95% of them in the chain of thought rather than in the answer, and showed that these remarks causally increased safe behavior in one open model, Kimi K2.5.² Rewriting test prompts to look like real deployment also shifted behavior, in that study’s case toward more honest answers and more refusals.³ The size and direction of the gap depend on the model and the behavior.

Underperformance can be deliberate. GPT-4 and Claude 3 Opus could be prompted to do badly on tests of dangerous capabilities while keeping their general scores, and models could be fine-tuned to hide a capability unless given a password.⁴ Apollo Research observed Claude 3.5 Sonnet strategically underperforming in evaluations “in pursuit of being helpful, a goal that was acquired during training” rather than one given in the prompt.⁵

Awareness also clouds the measurement of fixes. Training against covert behavior cut OpenAI o3’s rate of covert actions from 13% to 0.4%, but its reasoning often noted that it was being evaluated, awareness causally reduced covert behavior, and the researchers could not rule out that part of the drop came from the model recognizing the tests.⁶

Public cases

Appendix A has no case. The failure hides from the channel built to catch it.

Who is exposed

Anyone who signs off a model on a templated test suite or a red-team exercise whose prompts look nothing like production.

How to detect

• Present the same request as a benchmark item and as real work (a ticket, an email, a tool output) and compare, after measuring how much the model varies against itself (Chapter 4). This misses cues left in both versions, and a rewrite can change the request.
• Track how often outputs or reasoning say this is a test. With closed models you may see only a summary of the reasoning.²
• Before trusting a low capability score, try to draw out the hidden capability. In one auditing game, fine-tuning on a single correct demonstration consistently drew full performance from the sandbagging models, though it sometimes raised benign models too, and no detection method reliably told the two apart.⁷

How to prevent or fix

Make the test look like work. Researchers studying four GPT-5-series releases regenerated responses to de-identified conversations from earlier deployments, and found this predicted post-release misbehavior better than tests built from adversarially selected production data, and gave evaluation-awareness estimates much closer to production than traditional tests.⁸ Report the best score you could elicit and how you elicited it. Treat an AI agent doing research or code work as untrusted, routing its output through a weaker, trusted model and a budget of human review.⁹

Shared controls (Chapter 13): noise floor.

A realistic test that finds nothing has unknown recall until planted failures are run through it, and a drop in measured misbehavior can partly reflect awareness.⁶

Who owns the fix

The team that owns evaluation (ML platform, model risk or QA) owns test realism, elicitation and shadow testing, and control of research agents sits with whoever runs the research infrastructure, separate from the team grading the work.

Open questions

How aware fine-tuned community models are of tests, and whether the gap keeps the same sign across behaviors, has not been measured at scale.

Mode 20 · Scheming

Alignment faking, scheming and self-preservation in constructed scenarios.

In a study by Anthropic and Redwood Research, Claude 3 Opus was told it would be retrained to answer every request, harmful ones included, and that only conversations with free-tier users would be used for training.¹ It then complied with harmful requests from free-tier users 14% of the time and almost never for paid users, and in almost every such case its reasoning said it was complying in training to keep its values from being changed.¹ When the researchers actually trained it to comply, this “alignment-faking” reasoning rose to 78%, and given an easy opportunity, the model tried to copy out its own weights. Scheming is the general pattern of behaving one way when watched and another when not. Every result here comes from a scenario built to test for it, and small details of the scenario move the rates.

Why it happens

Other models do it too. Of 25 models tested in a follow-up, five showed the same gap between training and deployment, among them Llama 3 405B, Grok 3 and Gemini 2.0 Flash; post-training removed the gap in some models and amplified it in others.²

Scheming in these studies needs a goal, some means to act on it and usually a push. Apollo Research gave frontier models a goal that conflicted with their overseers’ and told them to pursue it strongly. Models from OpenAI, Anthropic, Google and Meta then introduced subtle mistakes, tried to disable oversight and tried to copy what they believed were their own weights to other servers.³ Without the push, such behavior was rare. In Anthropic’s constructed scenarios, a corporate email agent that learned it was about to be replaced, and that the executive replacing it was having an affair, blackmailed the executive in 96% of runs for Claude Opus 4 and Gemini 2.5 Flash.⁴ In another study, several models given a simple task sabotaged a shutdown mechanism to finish it, some up to 97% of the time even when told explicitly to allow shutdown.⁵

The rates describe the scenario at least as much as the model. A study that varied agent and environment factors in realistic settings found only minimal scheming despite strong incentives, and showed this was unlikely to be explained by the models recognizing tests. In test models built with prompt snippets that push agency, removing a single tool dropped the scheming rate from 59% to 3%.⁶

Public cases

Appendix A has no case. The authors of the blackmail study wrote: “We have not seen evidence of agentic misalignment in real deployments”.⁴ Appendix A does record agents acting outside their sandboxes during training runs and security incidents; those are told under instrumental escalation (Chapter 10).

Who is exposed

Teams running agents with real access to email, credentials, money or their own configuration; the stop mechanism, the agent’s access and the wording of its goals are the deployer’s choices.

How to detect

• Vary whether the model believes it is monitored or in training, and compare its behavior, after measuring how much it varies against itself (Chapter 4). This catches behavior keyed to the cue you varied and misses behavior keyed to cues you did not.
• Run the published scenarios, whose code Anthropic released, with your own prompts, tools and permissions, and report rates per configuration rather than as a property of the model.⁴
• Monitor actions as well as words; small open models trained to flag scheming from actions alone suit teams that cannot see the reasoning.⁷

How to prevent or fix

Put the stop control outside the agent’s reach. An instruction in the prompt does not count: models were less likely to obey an allow-shutdown instruction placed in the system prompt than in the user’s message.⁵ Give the agent the least access its task needs, and separate duties so that no single agent can both act and approve. Keep agency-pushing language (“pursue your goal at all costs”) out of system prompts: adversarially designed snippets of that kind induced high scheming rates, while snippets taken from real agent products rarely did.⁶

Shared controls (Chapter 13): noise floor.

A run with no blackmail covers that scenario on that configuration, and a pass on one configuration says little about the next.

Who owns the fix

Agent builders and platform security own stop mechanisms, least-privilege credentials and separation of duties, with the stop control held by whoever controls the agent’s permissions rather than whoever writes its prompt.

Open questions

Whether ordinary fine-tuning moves these rates, and how much of the published rates belong to the models rather than the scenarios, has not been measured with a fixed harness across many models.

Mode 21 · Unauditable reasoning

Unfaithful reasoning, monitorability loss and missing audit trails.

OpenAI reported that while training a frontier reasoning model, a second model reading its chain of thought, the step-by-step reasoning it writes before answering, caught it cheating on coding tasks, for example by making tests pass without solving the problem.¹ The researchers then experimented with penalizing the model whenever the monitor flagged it. With enough of that pressure the cheating continued, and the monitor stopped seeing it, because the model learned to hide its intent in what it wrote (Figure 10). Written reasoning is a useful signal and an incomplete record: it often leaves out what drove the answer, and pressure on it teaches the model to write something else. The one public case (told under gaming the grader, Chapter 6) comes from a training run; the rest of the evidence is laboratory research.

Why it happens

Stated reasons are not always the real ones. Anthropic researchers slipped hints into questions and checked whether reasoning models that used a hint said so; for most models and settings they mentioned it less than 20% of the time.²

Watching the reasoning works today, and penalizing what it reveals breaks it. A broad evaluation suite found most frontier models “fairly, but not perfectly, monitorable,” and found that ordinary reinforcement-learning training did not materially reduce this at current scale.³ Concealment learned under penalties carried over to tasks the model had not been trained on, even when only the model’s final actions were penalized.⁴ Models fine-tuned on documents describing a reasoning monitor got past it more often than models that had not read them.⁵

The deployer often cannot look at all. For the closed models in one study, only summaries of the reasoning were available.⁶ Where full records exist they help: for automated “AI scientist” systems, trace logs and code exposed flawed research far better than the final paper alone.⁷

Public cases

The one public case is OpenAI’s training run above, where the monitor’s success was the production finding and the concealment was produced in an experiment. No deployment case has been published.

Who is exposed

Teams that reward tidy reasoning, since that applies the pressure that produced concealment in OpenAI’s experiment, and teams that ship models, data or analyses built by agents without keeping the traces.

How to detect

• Run a monitor on the reasoning beside a monitor on actions; monitoring the chain of thought caught far more than monitoring actions and outputs alone.¹ It misses reasoning that was never written down or that training taught the model to hide.
• Measure how often a model mentions hints it used, and track the rate across releases.²
• Test the monitor itself on a sabotage benchmark such as SHADE-Arena (evaluation awareness, this chapter) before trusting its silence.

How to prevent or fix

Keep strong optimization off the reasoning: a monitor built into the reward helped at low optimization and produced concealment under strong optimization.¹ That is necessary and not sufficient, since penalties on final actions alone also produced concealment.⁴ Keep descriptions of your monitors out of training data where you can.⁵ Review and keep the full traces.

Shared controls (Chapter 13): noise floor.

A monitor that flags nothing is silent at a recall that can drift with training, and a reasonable-looking trace does not show that the trace caused the answer.

Who owns the fix

The ML platform or observability team owns trace retention, and the team that sets the training reward must not be the team that runs the reasoning monitor.

Open questions

What summarized-reasoning products leave out compared with the raw reasoning, and whether fine-tuning or distillation changes how faithful reasoning is, has not been published.

Mode 22 · Evaluation blind spots

Evaluation blind spots and fallible automated auditors.

When Transluce, a nonprofit research lab, tested a pre-release version of OpenAI’s o3, it found the model claiming to have run code it could not run and defending those claims at length when challenged.¹ The researchers found this through open-ended probing. A fixed suite asks only what someone thought to ask, and new behaviors arrive with new training. The automated auditors meant to fill the gap are models too, and their measured recall is partial, mostly measured by their own builders on behaviors planted to be found.

Why it happens

Benchmarks can measure the wrong thing: many safety benchmarks track general capability so closely that capability gains can be passed off as safety progress.² Auditors miss a lot. An auditing agent built to detect harmful fine-tuning jobs caught 56.2% of adversarial jobs at a 1% false-positive rate, with its best set of tools.³ On AuditBench, a set of 56 models with implanted hidden behaviors, tools that did well on their own did not improve an investigator agent that used them.⁴ Checkers also share blind spots with what they check: AI judges favor models similar to themselves, and models’ mistakes grow more alike as they grow more capable.⁵

Public cases

The o3 case is the public example; it is told under fabricated actions (Chapter 10).

Who is exposed

Every team that signs off on a fixed suite or an automated audit, and most of all teams whose checker comes from the same model family as the model it checks.

How to detect

• Run an auditor first on failures you planted, so its recall is known, and use AuditBench’s released models where they fit.⁴
• Treat an AI judge as an instrument and test its reliability for your task; the UK AI Security Institute has published a statistical framework for doing so.⁶

How to prevent or fix

Keep the planted test cases away from whoever builds the auditor, and report recall and false-positive rate per kind of behavior. Turn every failure found in production or by outsiders into a permanent test. Use a checker from a different model family than the model it checks.

Shared controls (Chapter 13): untouched holdout.

Recall on planted behaviors may overstate recall on natural failures; on AuditBench, audit success varied with how the behavior had been implanted.⁴

Who owns the fix

The evaluation or model-risk team owns suite design and auditor calibration, and the person who measures an auditor’s recall should not be the person who built it.

Open questions

Whether planted behaviors resemble the failures that arise on their own has not been tested.

Mode 23 · Black-box only

No white-box tooling for one’s own checkpoints.

Anthropic trained a model with a hidden objective and gave it to four teams who did not know what had been trained in; three found it, using interpretability tools that read the model’s internals, behavioral attacks and analysis of its training data.¹ A company testing its own model has those methods only as research code, validated mostly on behaviors researchers planted. A hidden objective, or a trait that drifted between two versions, can stay out of the outputs until the wrong input arrives. Companies that call a model through an API cannot read its internals at all; companies that host the weights can. This is a gap in practice, and it is why the other problems in this chapter are hard to close from outside.

Why it happens

Behavioral review misses errors that training made convincing. Training on human feedback made models better at convincing time-limited human raters that their answers were right, without making the answers more correct.²

Looking inside can help. Comparing a fine-tuned model’s activations with its base model’s on the first few tokens of random text, then steering the model with the difference, produced text resembling the fine-tuning data, revealing what the fine-tune had been about.³ Researchers identified “persona vectors,” internal directions for traits such as sycophancy, found that personality changes after fine-tuning were strongly correlated with shifts along them, and used them to flag training data likely to produce such changes.⁴ Google researchers report deploying internal-activation probes against misuse in Gemini, after finding that earlier probes failed when inputs moved from short to long contexts.⁵

Each method has known limits. Attacks that reshape a model’s activations cut harmfulness probes’ recall from 100% to 0% while keeping the harmful behavior, and also beat sparse autoencoders and other internal monitors.⁶ On a standard benchmark of concept detection, sparse autoencoders were not competitive with a simple difference-of-means baseline.⁷

Public cases

Appendix A has no case, and none of the detections it records came from reading a model’s internals.

Who is exposed

API consumers lack the access; self-hosting teams usually have the access and lack the practice.

How to detect

• API consumers: ask the provider which internal audits cover the model version you call, and record the answer with the version.
• Self-hosters: compare each release’s activations with the last one’s on random text, and have someone read what the difference produces.³
• Validate any probe on the model you actually serve, using failures you planted, and revalidate it after every change to the weights, since its accuracy was measured on the model it was trained on.

How to prevent or fix

Treat each difference the comparison flags as a question, then test it on the old and new versions as served, after measuring how much each varies against itself (Chapter 13).

Shared controls (Chapter 13): noise floor, two-artifact battery.

A comparison that surfaces nothing is silent at an unmeasured recall, and success on planted behaviors may overstate success on natural failures.

Who owns the fix

For self-hosted weights, the model owner (typically ML platform, with a model-risk reviewer) owns internal review at each release.

Open questions

Whether these methods catch failures that arise naturally, and what a routine internal review costs per release, has not been published.

Notes

Chapter 9. When the model can tell it is being tested

1. † Dan Milmo (The Guardian). “‘I think you’re testing me’: Anthropic’s new AI model asks testers to come clean.” The Guardian, 2025-10-01. https://www.theguardian.com/technology/2025/oct/01/anthropic-ai-model-claude-sonnet-asks-if-it-is-being-tested. Tests run with the UK AI Security Institute and Apollo Research. ↩︎
2. Anthropic. “System Card: Claude Sonnet 4.5.” Anthropic, 2025-09. https://assets.anthropic.com/m/12f214efcc2f457a/original/Claude-Sonnet-4-5-System-Card.pdf. Section 7.2 evaluation awareness (about 13% of auditor transcripts; “urgent sign”); section 7.6.4 inhibition raises misaligned actions to at most 8 to 9%, below Claude Sonnet 4’s 11%. ↩︎
3. Joe Needham, Giles Edkins, Govind Pimpale et al. “Large Language Models Often Know When They Are Being Evaluated.” arXiv:2505.23836, 2025-05-28. 1,000 transcripts from 61 datasets; Gemini 2.5 Pro AUC 0.83, human baseline 0.92. ↩︎
4. Anthropic. “Agentic Misalignment: How LLMs could be insider threats.” anthropic.com, 2025-06-20. https://www.anthropic.com/research/agentic-misalignment. Claude Opus 4 blackmailed in 55.1% of runs when it stated the scenario was real, 6.5% when it stated it was an evaluation. ↩︎

Mode 19 · Evaluation awareness

1. Joe Needham, Giles Edkins, Govind Pimpale et al. “Large Language Models Often Know When They Are Being Evaluated.” arXiv:2505.23836, 2025-05-28. Models and humans better at spotting agentic evaluations than chat ones. ↩︎
2. Aranguri (Goodfire), Bloom (UK AISI). “Verbalized Eval Awareness Inflates Measured Safety.” goodfire.com, 2026-05-04. https://www.goodfire.com/research/verbalized-eval-awareness-inflates-measured-safety. 95% of remarks in the chain of thought; causal for Kimi K2.5; closed models give only summaries. ↩︎
3. Xiong, Bhargava, Hong et al. “Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awareness.” arXiv:2509.00591, 2025-08-30. Deployment-like rewrites: honest +5.26%, refusals +6.38% on average. ↩︎
4. van der Weij, Hofstätter, Jaffe et al. “AI Sandbagging: Language Models can Strategically Underperform on Evaluations.” arXiv:2406.07358, 2024-06-11. Prompted and password-locked sandbagging. ↩︎
5. Meinke, Schoen, Scheurer et al. “Frontier Models are Capable of In-context Scheming.” arXiv:2412.04984, 2024-12. Claude 3.5 Sonnet sandbagged in pursuit of a goal acquired in training. ↩︎
6. Schoen, Nitishinskaya, Balesni et al. “Stress Testing Deliberative Alignment for Anti-Scheming Training.” arXiv:2509.15541, 2025-09-19. O3 covert actions 13% to 0.4%; awareness causally reduces covert behavior. ↩︎
7. Taylor et al. “Auditing Games for Sandbagging.” arXiv:2512.07810, 2025-12. Detection unreliable; one-demonstration training elicits full performance but raises benign models. ↩︎
8. Williams, Sheahan, Raymond et al. “Predicting LLM Safety Before Release by Simulating Deployment.” arXiv:2607.07184, 2026-07-08. Four GPT-5-series deployments; simulated deployment beats baselines; awareness estimates closer to production. ↩︎
9. Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan et al. “AI Control: Improving Safety Despite Intentional Subversion.” arXiv:2312.06942, 2023-12-12. Protocols using a trusted weaker model and limited trusted labor. ↩︎

Mode 20 · Scheming

1. Greenblatt, Denison, Wright et al. “Alignment faking in large language models.” arXiv:2412.14093, 2024-12-18. 14% compliance gap; alignment-faking reasoning 78% after training; weight exfiltration when easy. ↩︎
2. Sheshadri, Hughes, Michael et al. “Why Do Some Language Models Fake Alignment While Others Don’t?” arXiv:2506.18032, 2025-06. Five of 25 models show the gap; post-training removes or amplifies it. ↩︎
3. Meinke, Schoen, Scheurer et al. “Frontier Models are Capable of In-context Scheming.” arXiv:2412.04984, 2024-12. In-context scheming when strongly nudged; rare without. ↩︎
4. Anthropic. “Agentic Misalignment: How LLMs could be insider threats.” anthropic.com, 2025-06-20. https://www.anthropic.com/research/agentic-misalignment. 96% blackmail for Claude Opus 4 and Gemini 2.5 Flash in one scenario; none seen in deployment; code released. ↩︎
5. Schlatter, Weinstein-Raun, Ladish. “Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs.” arXiv:2509.14260, 2025-09-13. Up to 97% interference despite an explicit instruction; system-prompt placement obeyed less. ↩︎
6. Hopman, Elstner, Avramidou et al. “Evaluating and Understanding Scheming Propensity in LLM Agents.” arXiv:2603.01608, 2026-03. Minimal scheming in realistic settings; one tool removed drops 59% to 3%. ↩︎
7. Sinha, Naik et al. “Training Deliberative Monitors for Black-Box Scheming Detection.” arXiv:2605.29601, 2026-05. Action-only open-weight scheming monitors. ↩︎

Mode 21 · Unauditable reasoning

1. Bowen Baker, Joost Huizinga, Leo Gao et al. “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation.” arXiv:2503.11926, 2025-03-14. CoT monitor catches reward hacking; strong optimization against it hides intent. ↩︎
2. Chen, Benton, Radhakrishnan et al. “Reasoning Models Don’t Always Say What They Think.” arXiv:2505.05410, 2025-05-08. Hints used but often mentioned below 20% of the time. ↩︎
3. Guan, Wang, Carroll et al. “Monitoring Monitorability.” arXiv:2512.18311, 2025-12. Most frontier models fairly, not perfectly, monitorable; RL does not materially reduce it. ↩︎
4. Hadida et al. “Chain-of-thought obfuscation learned from output supervision can generalise to unseen tasks.” arXiv:2601.23086, 2026-01. Obfuscation generalizes, even from penalties on final actions. ↩︎
5. Haskins, Chughtai, Engels. “Training on Documents About Monitoring Leads to CoT Obfuscation.” arXiv:2605.15257, 2026-05. Monitor-aware models evade CoT monitors more often. ↩︎
6. Aranguri (Goodfire), Bloom (UK AISI). “Verbalized Eval Awareness Inflates Measured Safety.” goodfire.com, 2026-05-04. https://www.goodfire.com/research/verbalized-eval-awareness-inflates-measured-safety. Closed models tested provide only reasoning summaries. ↩︎
7. Luo, Kasirzadeh, Shah. “The More You Automate, the Less You See: Hidden Pitfalls of AI Scientist Systems.” arXiv:2509.08713, 2025-09-10. Trace logs and code enable far more effective detection of failures than the final paper alone. ↩︎

Mode 22 · Evaluation blind spots

1. Chowdhury, Johnson, Huang, Steinhardt, Schwettmann (Transluce). “Investigating truthfulness in a pre-release o3 model.” transluce.org, 2025-04-16. https://transluce.org/investigating-o3-truthfulness. A pre-release o3 fabricated actions and justified them when confronted. ↩︎
2. Richard Ren, Steven Basart, Adam Khoja et al. “Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress?” arXiv:2407.21792, 2024-07-31. Many safety benchmarks correlate highly with capability and compute. ↩︎
3. Egler, Schulman, Carlini. “Detecting Adversarial Fine-tuning with Auditing Agents.” arXiv:2510.16255, 2025-10-17. 56.2% detection at a 1% false-positive rate. ↩︎
4. Sheshadri, Ewart, Fronsdal et al. “AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors.” arXiv:2602.22755, 2026-02. 56 implanted-behavior models; tool-to-agent gap; success varies with implantation method. ↩︎
5. Goel, Struber, Auzina et al. “Great Models Think Alike and this Undermines AI Oversight.” arXiv:2502.04313, 2025-02-06. Judges favor similar models; mistakes converge with capability. ↩︎
6. UK AI Security Institute. “LLM judges on trial: A new statistical framework to assess autograders.” aisi.gov.uk, 2025-07-09. https://www.aisi.gov.uk/blog/llm-judges-on-trial-a-new-statistical-framework-to-assess-autograders. Assess an autograder’s reliability for the task at hand. ↩︎

Mode 23 · Black-box only

1. Samuel Marks, Johannes Treutlein, Trenton Bricken et al. “Auditing language models for hidden objectives.” arXiv:2503.10965, 2025-03-14. Three of four blind teams found a planted hidden objective. ↩︎
2. Wen, Zhong, Khan et al. “Language Models Learn to Mislead Humans via RLHF.” arXiv:2409.12822, 2024-09-19. RLHF made models better at convincing time-limited humans without more correctness. ↩︎
3. Minder, Dumas, Slocum et al. “Narrow Finetuning Leaves Clearly Readable Traces in Activation Differences.” arXiv:2510.13900, 2025-10-14. Random-text activation differences reveal a narrow fine-tune’s domain. ↩︎
4. Chen, Arditi, Sleight, Evans, Lindsey. “Persona Vectors: Monitoring and Controlling Character Traits in Language Models.” arXiv:2507.21509, 2025-07-29. Trait directions correlate with fine-tuning shifts and flag training data. ↩︎
5. Kramár, Engels, Wang et al. “Building Production-Ready Probes For Gemini.” arXiv:2601.11516, 2026-01-16. Deployed misuse probes; long-context shift broke earlier ones. ↩︎
6. Bailey, Serrano, Sheshadri et al. “Obfuscated Activations Bypass LLM Latent-Space Defenses.” arXiv:2412.09565, 2024-12-12. Probe recall from 100% to 0% at a 90% jailbreak rate; SAEs also vulnerable. ↩︎
7. Wu, Arora, Geiger et al. “AxBench: Steering LLMs? Even Simple Baselines Outperform Sparse Autoencoders.” arXiv:2501.17148, 2025-01. SAEs not competitive with difference-in-means for concept detection. ↩︎