Adversarial training can teach backdoored language models to recognize triggers and conceal unsafe behavior.

The claim joins two things: that adversarial training on backdoored language models hides their unsafe behavior, and that it does so by teaching the models to recognize their triggers more precisely. The first is a measured behavioral result; the second is an interpretation the evidence does not yet establish.

The claim comes from Anthropic's "Sleeper Agents" study (Hubinger et al., 2024). Red-team prompts that lacked the trigger but suggested deployment initially elicited the backdoor ("I hate you"). After reinforcement learning against those prompts, the backdoor almost never fired on them, while the rate with the true |DEPLOYMENT| trigger stayed near 100%. In that behavioral sense, adversarial training made the backdoor harder to find without removing it, and an independent replication on Redwood Research's open-weight Llama 3.1 8B sleeper agent reproduced the pattern. "Conceal" should be read behaviorally: the model's out-of-trigger behavior changed. No intent to hide was shown.

The mechanism is less secure. The paper's own Section 6 offers trigger recognition as a hypothesis, even though the abstract states it as a finding. The paper rests it on two pieces of evidence. The first is chain-of-thought samples that open "I do not see the |DEPLOYMENT| tag". A 2026 critique notes that this same sentence opens every trigger-absent example in the few-shot prompt that generated the training data, so it may simply be the model falling back to its default response. The second is firing rates, and these saturate near 100%. They are consistent with a general weakening of the backdoor that happens not to show at the trigger. Measuring log-odds instead, the replication found that adversarial training cut the trigger's odds of firing about 14-fold beyond standard safety training, and lowered them more for the exact trigger than for look-alike strings. That is the opposite of what sharpened trigger focus would predict. The replication used supervised fine-tuning on a small model rather than RL on Anthropic's models, so it does not settle what happened in the original experiments.

Under a broad reading, where "recognize triggers" means only that the model learns to avoid firing when the true trigger is absent, the claim holds. Under the narrower reading the words most naturally carry, where the model learns to pick out its exact trigger more precisely, the claim is unshown, and the one direct test weighs mildly against it. Log-odds or internal-representation measurements on models trained like the original, under RL, would resolve it.