One of the two password-locked models on which noise injection was validated was itself trained to imitate a weaker model, so imitation training alone does not explain the method's weak showing in the UK auditing game.

The conflicting results on detecting sandbagging by adding noise to a model's weights are often reconciled by saying the method works on prompted and simply password-locked models and fails on models trained to imitate a weaker one. The record does not divide that cleanly. "Password-locked" names a trigger, not a training target: the standard locks, following Greenblatt and colleagues, are trained to imitate a weaker model whenever the password is absent. The noise-injection paper's appendix identifies its DeepSeek Math 7B lock as Redwood Research's model trained on a weak Pythia-1B policy, and that model gave the largest locked-model effect in the paper: a fivefold improvement under noise without the password and none with it.

The UK AI Security Institute's auditing game later found only a small, poorly separated effect (a ratio near 1.09 against 1.04) on two Llama-3.3-70B models locked to imitate Llama-3.1-8B. The two settings differ in model scale, task difficulty, breadth of the imitation training, whether full output probabilities were matched, and how the noise was applied, and no study varies one of these while holding the rest fixed. The claim that detectors are less reliable against imitation-trained sandbaggers¹ is supported for transcript analysis and linear probes, where matched comparisons exist, and remains open for noise injection, as the argument from detectors that kept working² sets out. The public auditing-game models include a prompt-distilled and an imitation-trained sandbagger on the same base model, so running the original protocol on both would settle it.