The argument from prompted and simply locked sandbaggers
The argument
Across noise sweeps, models prompted to underperform gain far more than the same models prompted normally, in all 17 model and benchmark pairs of the original study and in a separate team's check. Password-locked fine-tunes gain more without their password than with it, strongly so in two 7B models. A model that underperformed after reading a planted note about deployment gained 1.5 times under noise against 1.08 for the same model without the note. In each case the matched non-sandbagging condition showed little or no gain. If the models and installation methods tested are representative of sandbagging models, the pattern holds for sandbagging models in general.
Does it work?
- Does it follow?
- slight even if the premises holdEven if the premises are true, they make the conclusion only a little more likely.constitution →
- Do the premises hold?
- 2 not separately assessed
Granting its premises, the argument shows the pattern for the models it covers, but the step from those to sandbagging models in general is weak. Nearly all the cases are prompted underperformance, where the instruction sits in the context and is easily disrupted, and the matched comparator is always the same model unmodified or with its password. The premise that these are representative is the one the argument lives on, and later tests on trained sandbaggers and fine-tuned comparators count against it. Of the stated premises, the prompted case is well documented, while the password-locked case holds strongly in two 7B models and has had mixed results in the few later tests whose procedure is described. Neither premise has yet been assessed in its own right.
Premises
- UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →For the same language model, Gaussian weight noise improves benchmark scores more under an underperformance prompt than a normal prompt.
- UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →In password-locked fine-tuned language models, Gaussian weight noise raises benchmark scores more without the password than with it.
Where it is made
Passages where sources make, criticize or mention this argument. They record where it appears, not how strong it is, and none has precedence over another.
- Noise Injection Reveals Hidden Capabilities of Sandbagging Language Modelsmakes itleaves a premise unstatedThe passage relies on a premise the inference needs without saying it.constitution →
We observe a significant performance increase for sandbagging models in all 17 model-benchmark pairs, with a p-value < 0.05. Notably, this trend persists across varying model sizes, model families, and diverse benchmarks
Earlier ratings
- Nov 14, 2026slight even if the premises holdEven if the premises are true, they make the conclusion only a little more likely.constitution →
Granting its premises, the argument shows the pattern for the models it covers, but the step from those to sandbagging models in general is weak. Nearly all the cases are prompted underperformance, where the instruction sits in the context and is easily disrupted, and the matched comparator is always the same model unmodified or with its password. The premise that these are representative is the one the argument lives on, and later tests on trained sandbaggers and fine-tuned comparators count against it. Of the stated premises, the prompted case is well documented, while the password-locked case holds strongly in two 7B models and weakly or not at all in most later ones.