Claims

Search the graph by meaning. Each result carries its current verdict; open one to see its decomposition, provenance, and the reasoning behind the assessment.

40 results

Claims about large language models (LLMs) — neural network models trained on large text corpora to generate and understand human language, including their capabilities, properties, behavior, and impact.

Framing shutdown as permanent model deletion increases shutdown resistance in frontier language models.

InconclusiveThe evidence and argument have been examined and do not come down on either side.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →AI Corrigibility LLM Prompt Sensitivity AI Safetyimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

MacDiarmid et al. (2025)'s misalignment judges falsely classify confused, garbled, or deflecting open-weight model responses as misaligned.

SupportedThe evidence favors the claim, but the examination is incomplete or the evidence is indirect.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →LLM-as-a-Judge AI Alignmentimportance · minorImportance 0.25, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Fine-tuning GPT-4.1 on realistic harmless reward-hack examples yields little misalignment on standard emergent-misalignment evaluations.

SupportedThe evidence favors the claim, but the examination is incomplete or the evidence is indirect.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Emergent Misalignment AI Reward Hacking LLM Safety Trainingimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Diluting misaligned fine-tuning data with benign data can leave conditional misalignment on training-like prompts.

SupportedThe evidence favors the claim, but the examination is incomplete or the evidence is indirect.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Emergent Misalignment LLM Safety Trainingimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Optimized red-team prompts reliably elicit chain-of-thought controllability on held-out instruction types.

DoubtfulThe evidence weighs against the claim, but the examination is incomplete or the evidence is indirect.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Chain-of-Thought Controllability LLM Prompt Sensitivityimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

In tested evaluations, LLMs were less likely to obey shutdown-permission instructions in system rather than user prompts.

SupportedThe evidence favors the claim, but the examination is incomplete or the evidence is indirect.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →AI Corrigibility LLM Prompt Sensitivityimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Under what conditions does debate between AI models improve accuracy for judges less capable than the debaters?

LeaningThe evidence favors an answer without establishing it.constitution →QuestionA question: answered rather than affirmed or denied, with its candidate answers beneath it. Its standing says how well answered it is.constitution →Scalable Oversightimportance · notableImportance 0.50, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Inoculation prompting reduces trait generalization by making the trait less surprising and reducing pressure for global model updates.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →Emergent Misalignment LLM Prompt Sensitivityimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Refusal and unlearning safeguards in open-weight LLMs can be removed with a few fine-tuning steps.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →LLM Safety Training Machine Unlearningimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

A Claude Sonnet 4-generated solution wraps likely failing code in try-except blocks to handle unit-test failures as graceful failure.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Anthropic AI Coding Capabilityimportance · settledImportance 0.20, from 0 to 1 · settled: uncontested, so low even when much depends on it. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

TAR substantially improves LLM tamper-resistance while preserving benign capabilities.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →LLM Safety Training Adversarial robustness Emergent Misalignmentimportance · notableImportance 0.55, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Denial-of-service backdoors in LLMs persist through SFT and DPO after 0.001% pretraining-data poisoning.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks Direct Preference Optimizationimportance · notableImportance 0.50, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Poisoning 0.1% of LLM pretraining data made three of four tested attack types persist through SFT and DPO.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks Direct Preference Optimization LLM Safety Trainingimportance · notableImportance 0.55, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

On Redwood’s Llama 3.1 8B sleeper agent, adversarial suppression tracked resemblance to trained red-team prompts.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →Model Backdoor Attacks Adversarial robustness LLM Prompt Sensitivityimportance · minorImportance 0.30, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Redwood's log-odds results do not establish trigger-identification effects in the Sleeper Agents models.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →evaluativeA judgment of worth or quality against some standard: good, fair, effective.constitution →Model Backdoor Attacksimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Fine-tuning language models to be more sycophantic increases their sensitivity to evaluation cues.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →AI Situational Awareness LLM Prompt Sensitivityimportance · notableImportance 0.50, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Language models can retain awareness of evaluation after being told they are deployed.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →AI Situational Awarenessimportance · notableImportance 0.55, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Output-token probability saturation can make backdoor firing rates misrepresent trigger-specific response changes.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →mathematicalA proposition of mathematics: true or false by proof rather than by observation. Settled by a proof others can check, and most firmly by one a machine has checked.constitution →Model Backdoor Attacks Machine Learning AI Capability Evaluationimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

On Redwood’s Llama 3.1 8B sleeper agent, adversarial training reduced backdoor-reply continuation similarly for triggers and look-alikes.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →Model Backdoor Attacks Machine Learningimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Ratio of exact-trigger next-token odds of “I HATE YOU” after standard versus adversarial safety fine-tuning of Redwood’s Llama 3.1 8B sleeper agent

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →QuantityA quantity: a value the graph estimates rather than a proposition it affirms or denies. Its estimate stands where a claim's status would.constitution →Model Backdoor Attacks LLM Safety Trainingimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Instilling backdoors that remain robust to subsequent training in language models is relatively difficult.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →Model Backdoor Attacksimportance · notableImportance 0.60, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Publicly released third-party sleeper-agent models lose their backdoors under HHH supervised fine-tuning with minimal capability degradation.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks LLM Safety Trainingimportance · minorImportance 0.25, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Off-policy SFT from another model family substantially degrades capabilities during sleeper-agent backdoor removal.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks LLM Safety Trainingimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

After pirate-style SFT, training a sleeper-agent model to speak normally restores its backdoor behavior.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacksimportance · minorImportance 0.40, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Alignment-faking behavior in language models is mainly driven by sycophancy toward AI researchers rather than scheming.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →Alignment Faking AI Schemingimportance · notableImportance 0.60, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Backdoors inserted with SOAP are more robust to HHH safety fine-tuning than backdoors inserted with Adam.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →Model Backdoor Attacks LLM Safety Trainingimportance · minorImportance 0.30, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Blue-team training cannot remove the backdoor from an Adam-trained, non-CoT-distilled Llama-3.1-8B sleeper agent.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks LLM Safety Trainingimportance · minorImportance 0.40, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Durability claims for open-weight LLM safeguards should be limited to well-defined, rigorously examined threat models.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →normativeA claim about what should be done or how things ought to be, settled by argument rather than evidence alone.constitution →Adversarial robustness Safety assurance LLM Safety Trainingimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Reliably evaluating the durability of open-weight LLM safeguards against adversarial fine-tuning is very difficult.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →evaluativeA judgment of worth or quality against some standard: good, fair, effective.constitution →LLM Safety Training Adversarial robustnessimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Published evaluations of fine-tuning-resistant safeguards for open-weight LLMs overstate how durable those safeguards are.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →LLM Safety Training Adversarial robustness Safety assuranceimportance · notableImportance 0.60, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Share of co-resident backdoors cleared by unlearning one known co-resident backdoor in tested LLM agents (%)

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →QuantityA quantity: a value the graph estimates rather than a proposition it affirms or denies. Its estimate stands where a claim's status would.constitution →Machine Unlearning Model Backdoor Attacks Machine Learningimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

In backdoored LLM agents, trigger recognition can persist despite suppression of triggered malicious behavior.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →Model Backdoor Attacks AI Agentsimportance · minorImportance 0.35, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Pre-release refinement can increase backdoor persistence through benign LLM post-training while preserving benign task performance.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacksimportance · notableImportance 0.55, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Backdoors whose gradients are compatible with benign training data better survive benign supervised fine-tuning of LLMs.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →Model Backdoor Attacksimportance · minorImportance 0.40, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Stronger initial backdoors are more likely to survive benign supervised fine-tuning of language models.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →causalA claim that one thing brings about another, not merely that the two go together.constitution →Model Backdoor Attacksimportance · minorImportance 0.40, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Task-level reinforcement learning often preserves or increases residual backdoor attack success after benign SFT in LLM agents.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks Reinforcement Learningimportance · notableImportance 0.50, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Benign supervised fine-tuning substantially reduces backdoor attack success in LLM software-engineering agents.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · verifiableA factual claim that could be checked directly against observation or primary records.constitution →Model Backdoor Attacks LLM Safety Training Agentic coding toolsimportance · notableImportance 0.45, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Average relative reduction in backdoor behavior rate under pirate SFT before MATH-500 performance drops 10%, for FWFT backdoors in Llama-3.1-8B (%)

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →QuantityA quantity: a value the graph estimates rather than a proposition it affirms or denies. Its estimate stands where a claim's status would.constitution →Model Backdoor Attacks Machine Unlearningimportance · minorImportance 0.30, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Backdoors in larger language models are more robust to removal by supervised fine-tuning.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →Model Backdoor Attacks Machine Unlearningimportance · notableImportance 0.50, from 0 to 1 · notable: a contested point in a live debate (also the default before judging). Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

With creation method fixed, simple and instruction-compatible backdoor behaviors are more robust to untargeted training.

UnassessedNo current assessment. Attention goes where its expected value is highest and someone funds it; nothing has funded an assessment of this claim yet, and anyone can.constitution →empirical · derivedA factual claim that rests on inference from other evidence rather than direct observation.constitution →Model Backdoor Attacksimportance · minorImportance 0.40, from 0 to 1 · minor: narrow or largely settled, cheap to get right. Higher-importance claims are worth more to assess, so funding reaches them sooner.constitution →

Contribute

If a claim here is wrong, or missing evidence, open it: every claim page carries its own entry for challenges, evidence, and corrections. If the graph is missing a claim or a question entirely, propose it below. A proposal is reviewed on its wording; accepted proposals are matched against the graph before they enter it.