argumentA line of reasoning from premises to a conclusion. Like a claim, it belongs to no one who makes it.constitution →

The argument from detectors that kept working on imitation-trained organisms

againstThis argument, if it holds, weighs against the claim.constitution →Sandbagging detectors are less reliable against models fine-tuned to imitate a weaker model's outputs than against prompted or prompt-distilled sandbaggers.

The argument

Three detectors retained a signal on imitation-trained organisms. The password-locked DeepSeek Math 7B in the noise-injection study was Redwood Research's lock trained to imitate Pythia-1B, and it showed an improvement ratio of 5.0 without the password against 1.0 with it, in line with the reported noise-injection signature. In the final auditing game, deception probes were elevated across many tasks on Cedar, the logit-matched imitation sandbagger. Fine-tuning on a single correct demonstration restored full performance in both imitation-trained sandbaggers. These detectors work on imitation-trained models much as on prompted ones, so imitation training does not make detectors less reliable.

Does it work?

Does it follow?: slight even if the premises holdEven if the premises are true, they make the conclusion only a little more likely.constitution →
Do the premises hold?: 1 inconclusive

Granting its premises, the argument shows that degradation is not universal across detectors, which limits the claim; it does not show detectors are as reliable on imitation-trained models as on prompted ones. The noise-injection case is one 7B model on one task, compared only with itself given the password, and the same method gave a small, poorly separated signal on the two 70B imitation models. Probes were elevated on one imitation-trained sandbagger and uninformative on the other, with calibration problems on both. Single-demonstration fine-tuning removes sandbagging and raised benign scores too, so its robustness is not evidence about detection. The argument leans on the generality of the noise-injection signature, which is unassessed and which the auditing game's results put in doubt.

Premises

InconclusiveThe evidence and argument have been examined and do not come down on either side.constitution →Increasing Gaussian weight noise improves benchmark performance in sandbagging LLMs, unlike the degradation in non-sandbagging models.

Where it is made

Passages where sources make, criticize or mention this argument. They record where it appears, not how strong it is, and none has precedence over another.

Noise Injection Reveals Hidden Capabilities of Sandbagging Language Modelsmakes itleaves a premise unstatedThe passage relies on a premise the inference needs without saying it.constitution →
For both password-locked models, we found that noise injection increases performance in a similar manner and over a similar magnitude of noise relative to the prompted settings. The results show that the models containing the password never demonstrate improved performance with the addition of noise, a behavior distinct from models prompted to underperform.
Cameron Tice and co-authors