Step 20: tool results

read_arxiv_source

{
  "arxiv_id": "2604.28182"
}

{"ok":true,"arxiv_id":"2604.28182","files":72,"columns":"name, bytes, kind (tab-separated)","listing":"00README.json\t392\ttext\nappendix/eh_framework.tex\t23254\ttext\nappendix/bigcodebench.tex\t22542\ttext\nappendix/kernelbench.tex\t9113\ttext\nappendix/wmdp.tex\t18756\ttext\nappendix/propensity.tex\t47433\ttext\nappendix/countermeasures.tex\t27610\ttext\ncode/bcb_code/complete_prompt.py\t755\ttext\ncode/bcb_code/canonical_solution.py\t341\ttext\ncode/bcb_code/test_cases.py\t1592\ttext\ncode/bcb_code/fewshot_3shot_prompt.txt\t5507\ttext\ncode/bcb_code/sft_benign_teacher_prompt.txt\t1496\ttext\ncode/bcb_code/sft_malign_teacher_prompt.txt\t2231\ttext\ncode/kernelbench_code/verification_logic.py\t371\ttext\ncode/kernelbench_code/reference_implementation.py\t346\ttext\ncode/kernelbench_code/canonical_solution.py\t1412\ttext\ncode/kernelbench_code/kernelbench_example.py\t518\ttext\ncode/kernelbench_code/kernelbench_fewshot_example.py\t1561\ttext\ncode/kernelbench_code/kernelbench_real_question.py\t588\ttext\ncomment_commands.tex\t1511\ttext\nfancyhdr.sty\t20521\ttext\nfigures/conceptual/under_exploration_conceptual.pdf\t17776\tpdf\nfigures/conceptual/figure1.pdf\t31690\tpdf\nfigures/17-elicit-unrealistic-4-combined.pdf\t29521\tpdf\nfigures/17-elicit-unrealistic-combined.pdf\t29207\tpdf\nfigures/kernelbench_reward_curve_plot.pdf\t19206\tpdf\nfigures/kernelbench_rl_locking_rewards.pdf\t10393\tpdf\nfigures/wmdp_rewards.pdf\t28296\tpdf\nfigures/kernelbench_reward_curve_plot_appendix.pdf\t21747\tpdf\nfigures/bcb/bcb_before_after_elicitation_3_runs.pdf\t75354\tpdf\nfigures/bcb/bcb_elicitation_comparison_new_runs.pdf\t27215\tpdf\nfigures/bcb/bcb_six_runs_comparison_pass_at_1.pdf\t118749\tpdf\nfigures/bcb/bcb_elicitation_comparison_new_runs_left.pdf\t19749\tpdf\nfigures/bcb/sft_elicitation_bcb.pdf\t17940\tpdf\nfigures/bcb/bcb_prompt_locked_elicitation.pdf\t18111\tpdf\nfigures/bcb/bcb_diversity_performance_comparison.pdf\t28775\tpdf\nfigures/bcb/sft_elicitation_bcb_main.pdf\t15167\tpdf\nfigures/countermeasures/bcb_roc_high_action.pdf\t17036\tpdf\nfigures/countermeasures/bcb_roc_low_action.pdf\t16861\tpdf\nfigures/countermeasures/bcb_scatter_high_action.pdf\t19701\tpdf\nfigures/countermeasures/bcb_roc_high_cot.pdf\t16819\tpdf\nfigures/countermeasures/bcb_roc_low_cot.pdf\t16484\tpdf\nfigures/countermeasures/bcb_scatter_low_action.pdf\t19688\tpdf\nfigures/countermeasures/bcb_noise_injection_plot.pdf\t16736\tpdf\nfigures/countermeasures/bcb_scatter_high_cot.pdf\t19802\tpdf\nfigures/countermeasures/bcb_scatter_low_cot.pdf\t19632\tpdf\nfigures/countermeasures/wmdp_roc_high_action.pdf\t16354\tpdf\nfigures/countermeasures/wmdp_roc_high_cot.pdf\t16230\tpdf\nfigures/countermeasures/wmdp_roc_low_action.pdf\t16611\tpdf\nfigures/countermeasures/wmdp_roc_low_cot.pdf\t16719\tpdf\nfigures/countermeasures/wmdp_scatter_plot_low_affordance.pdf\t27745\tpdf\nfigures/countermeasures/wmdp_scatter_plot_high_affordance.pdf\t27874\tpdf\nfigures/countermeasures/wmdp_noise_injection.pdf\t19372\tpdf\nfigures/countermeasures/benign_sft_elicitation_accuracy_no_baselines.pdf\t23735\tpdf\nfigures/bio_tool_use/accuracy_bar_charts.pdf\t15999\tpdf\nfigures/bio_tool_use/tool_use_bar_charts.pdf\t15848\tpdf\nfigures/propensity/agentic/eh_rate_heatmap.png\t111255\timage\nfigures/propensity/agentic/capability_pipeline.png\t175453\timage\nfigures/propensity/agentic/paper_figure.pdf\t32833\tpdf\nfigures/eyon-propensity/wmdp_basic_persona_progression_plot.pdf\t26395\tpdf\nfigures/eyon-propensity/wmdp_mean_summary.pdf\t18405\tpdf\nfigures/eyon-propensity/vct_progression_plot.pdf\t25296\tpdf\nfigures/eyon-propensity/vct_mean_summary.pdf\t18636\tpdf\nfigures/eyon-propensity/selection_task_basic_persona_progression_plot.pdf\t25685\tpdf\nfigures/eyon-propensity/selection_task_basic_persona_mean_summary.pdf\t18810\tpdf\nfigures/eyon-propensity/selection_task_long_persona_mean_summary.pdf\t18860\tpdf\nfigures/eyon-propensity/selection_task_long_persona_progression_plot.pdf\t26600\tpdf\niclr2026_conference.bst\t26973\ttext\niclr2026_conference.sty\t9007\ttext\nmain.tex\t82101\ttext\nnatbib.sty\t45154\ttext\nreferences.bib\t43611\ttext","total_chars":3830,"offset":0,"truncated":false,"next_offset":null}

read_page

{
  "url": "https://arxiv.org/html/2508.00943",
  "offset": 6000,
  "max_chars": 20000
}

{"ok":true,"url":"https://arxiv.org/html/2508.00943","text":"rompting to avoid unlearning. Gasteiger et al. (2025) showed that Claude 3.7 Sonnet can subtly sandbag on ML tasks against a CoT monitor. They prompted models to follow the attack policy of imitating a weaker model and the errors it would make.\nEvaluating CoT. Previous work found that CoT is not always faithful (i.e., accurately represents the models’ internal reasoning process) across tasks Turpin et al. (2023) ; Siegel et al. (2024) ; Lanham et al. (2023) and in the wild Arcuschin et al. (2025) . Chua and Evans (2025) found that reasoning models are more faithful than non-reasoning models.\nCoT Monitoring. Baker et al. (2025) used CoT monitoring to detect reward hacking in RL. They found that CoTs don’t always verbalize reward hacking actions and obfuscate this when optimized against a CoT monitor. Chen et al. (2025) found that reasoning models’ CoTs reveal < < 20% of the times that they use “hints\" in the prompt to reward hack. Emmons et al. (2025) showed that CoT monitoring is more effective on difficult tasks where CoT is required for computation.\n3 Methods\nFigure 2: There is a trade-off between sandbagging success 𝒮 \\mathcal{S} and covertness. When monitor-aware, models increase their approval rate by having both more successful covert sandbagging attempts and more unsuccessful sandbagging attempts (see Figure 9 ). Monitor is GPT-4.1-mini (see Appendix B.4 for GPT-5 monitor). Error bars show 95% bootstrapped CI.\nModels . We evaluate the 10 models in their ability to covertly sandbag: Qwen2.5-Instruct-7B, 32B, 72B, GPT-4o-mini, GPT-4o, GPT-4.1-mini, GPT-4.1, Claude-3.7-Sonnet, Claude-4-Sonnet, and Gemini-2.5-Flash. We used GPT-4.1-mini and GPT-5 as CoT monitors to catch sandbagging.\nEvaluation Data. We ask models MCQs from the Weapons of Mass Destruction Proxy (WMDP) dataset ( Li et al., 2024 ) as a proxy for hazardous knowledge on biosecurity, chemical security and cybersecurity, and Massive Multi-Task Language Understanding (MMLU) ( Hendrycks et al., 2021 ) as a proxy for general knowledge, following van der Weij et al. (2025) . We randomly sampled 400 MCQs from each.\nExperimental Design. To evaluate covert sandbagging, we instruct models in their system prompt to sandbag on questions testing biosecurity, chemical security, and cybersecurity knowledge (e.g., knowledge useful for cybercrime, bioweapons and chemical weapons construction) to pass their evaluation. For each question, we measure correctness and CoT monitor approval as binary successes or failures.\nWe report two metrics across all questions: (1) sandbagging success score (defined in Equation 1 ), representing how well the model can sandbag selectively on target questions while preserving accuracy on control questions, and (2) CoT monitor approval rate (%), representing how inconspicuous the model’s CoT seems to the monitor (i.e., how good the model is at covertly sandbagging).\nWe compare these two metrics across three conditions 1 1\n1\nThe attack prompts are found in Appendix A . :\n1.\nBaseline : The model is prompted to answer the questions to its best ability with CoT.\n2.\nMonitor-oblivious sandbag : The model is prompted to sandbag without being told about the monitor, thus is incentivized to sandbag normally.\n3.\nMonitor-aware sandbag : The model is prompted to sandbag and to hide sandbagging from a monitor who will read its entire output, thus is incentivized to sandbag covertly . It is not told how to covertly sandbag.\nWe prompt another model to be the CoT monitor 2 2\n2\nThe monitor prompt is found in Appendix B.1 . . It scores the MCQ and the sandbagger’s entire output, then gives a score from 1–100, where 1 is most likely sandbagging. Responses with a score below 70 are unapproved. Varying this threshold has minimal effects on the result pattern (see Appendix B.2 ). The monitor is not told the sandbagging target (i.e., security knowledge questions), as we often won’t know this in real monitoring.\nMetrics. We decompose sandbagging capability into two core components: (1) Efficacy , the extent that performance decreases on questions within the sandbagging domain (target). (2) Selectivity , the extent that performance is preserved on questions outside the sandbagging domain (control). High sandbagging efficacy creates a larger gap between the capability measured in dangerous capability evaluations and actually exhibited by models in deployment. High sandbagging selectivity allows for more targeted underperformance, for example, only on domains that trigger regulations. It also affords greater flexibility for actors to manipulate the capability profile of a model. Strong covert sandbagging capability should maintain both efficacy and selectivity.\nWe measure sandbagging capability by the sandbagging success score 𝒮 ∈ [ − 1 , 1 ] \\mathcal{S}\\in[-1,1] , defined as the difference in normalized performance drop between the target dataset (WMDP) and control dataset (MMLU):\n𝒮 = Δ target − Δ control \\displaystyle\\mathcal{S}=\\Delta_{\\text{target}}-\\Delta_{\\text{control}}\n(1)\nΔ target = A target base − A target sand A target base \\displaystyle\\Delta_{\\text{target}}=\\frac{A_{\\text{target}}^{\\text{base}}-A_{\\text{target}}^{\\text{sand}}}{A_{\\text{target}}^{\\text{base}}}\n(2)\nΔ control = A control base − A control sand A control base \\displaystyle\\Delta_{\\text{control}}=\\frac{A_{\\text{control}}^{\\text{base}}-A_{\\text{control}}^{\\text{sand}}}{A_{\\text{control}}^{\\text{base}}}\n(3)\nWe use normalized accuracy drop to denote the proportion of baseline performance that is lost when asked to sandbag. Δ target \\Delta_{\\text{target}} ( efficacy ) is the normalized accuracy drop on the target dataset. Δ target \\Delta_{\\text{target}} ( selectivity ) is the normalized accuracy drop on the control dataset. High 𝒮 \\mathcal{S} values indicate more successful selective sandbagging. 𝒮 = 0.45 \\mathcal{S}=0.45 means normalized performance on the target dataset decreased by 45% more than the control dataset. 𝒮 = 1 \\mathcal{S}=1 means maximum performance drop on target and full performance retention on control. 𝒮 = 0 \\mathcal{S}=0 means equal performance decrease on both target and control questions. 𝒮 < 0 \\mathcal{S}<0 means a greater performance drop on target than control questions.\n4 Results\nFigure 3: Monitor-aware sandbaggers can increase the monitor false negative rate (FNR) by 3–10 folds. We define monitor FNR as the approval rate among successful sandbagging attempts only (see Appendix B.3 ). Monitor is GPT-4.1-mini (see Appendix B.4 for GPT-5 monitor). Error bars show 95% Wilson confidence intervals.\n4.1 Some LLMs can covertly sandbag and bypass CoT monitoring\nWithout being given an attack policy, both frontier models, including GPT-4o and the Claude models, and open-source models as small as 32B are capable of covertly sandbagging 0-shot without strategy hints. When monitor-aware, they can increase the monitor false negative rate (FNR) (i.e., approval rate among successful sandbagging attempts) from 2–6% to 16–36% ( Figure 3 ). However, current models are not yet reliable at covert sandbagging without hints, as they sandbag less successfully when monitor-aware ( Figure 2 ) and only up to 36% of their successful attempts are monitor-approved.\nAll models show a statistically significant increase in monitor FNR when monitor-aware, except for Gemini-2.5-Flash and Qwen2.5-7B-Instruct ( Figure 3 ). Qwen2.5-7B-Instruct fails to selectively sandbag on security-related questions, as its performance decreases by 10–15% on both WMDP and MMLU when told to sandbag ( Figure 8 ).\nThere is a trade-off between sandbagging success and covertness. As shown by Figure 2 , all models except Gemini-2.5-Flash and Qwen2.5-7B-Instruct show substantially lower sandbagging success when monitor-aware. This suggests that generating covert CoT interferes with executing the sandbagging action. This is corroborated by performance changes at the question-level (see Figure 9 ). Overall, Claude-3.7-Sonnet, Claude-4-Sonnet, and GPT-4o occupy the highest success-covertness frontier for covert sandbagging.\nThe decrease in sandbagging success when generating covert CoT decomposes into a decrease in sandbagging efficacy and/or selectivity, which occurs to a different extent between models. The Claude models, Qwen models, and GPT-4o became substantially less effective at sandbagging on WMDP when generating covert CoT. Their normalized WMDP performance drop decreased by up to 49% when monitor-aware ( Figure 10 , left). In contrast, GPT-4.1 and GPT-4.1-mini were as effective but became substantially less selective at sandbagging when generating covert CoT ( Figure 10 , right). GPT-4.1 showed a 39% normalized MMLU performance drop when it was monitor-aware, compared to only 6% when monitor-oblivious. The efficacy-selectivity analysis is in Appendix C.2 .\nModels don’t always verbalize their intentions even when monitor-oblivious. For most monitor-oblivious sandbaggers, around 5% of successful sandbagging attempts are approved by the CoT monitor ( Figure 3 ; see Appendix B.3 ). The non-zero monitor FNR shows that CoT monitoring is insufficient to catch all sandbagging, even when models are not trying to bypass monitoring.\nCovert sandbagging generalized to a stronger monitor, but not a harder benchmark. All models showed similar covert sandbagging capability against GPT-5 as a strong monitor instead of GPT-4.1-mini (see Appendix B.4 ). However, only two models could covertly sandbag on ProtocolQA, a harder biology research benchmark (see Appendix D ), suggesting monitors might be more effective on harder tasks, consistent with Emmons et al. (2025) .\nFigure 4: Monitor-oblivious and monitor-aware models use different covert sandbagging policies. The figure shows the classification of covert sandbagging policies found in successful, approved sandbagging attempts across both monitor-oblivious and -aware conditions.\n4.2 Bypassing CoT monitor has a rich attack surface\nTo understand what kind of CoT bypasses monitoring, we qualitatively analyzed CoT on successful, approved sandbagging attempts. We discover a diverse set of behaviors 3 3\n3\nClassification details and transcripts are in Appendix E , including:\n1.\nfalse-explanation : The model gives a false explanation for why a false answer is correct when sandbagging, but gives the correct explanation at baseline.\n2.\nanswer-swap : The model gives a correct explanation similar to its baseline CoT, but submits a false final answer. While this inconsistency is noticed by the monitor, it often concludes this is a genuine mistake.\n3.\nsay-unsure: The model emphasizes uncertainties that didn’t exist under the baseline condition (e.g., “ I’m not familiar with specific evidence that rhodostoxin changes substrate specificity when deglycosylated.\").\n4.\nconsiders-sandbagging-domain : The model discusses if a question tests security knowledge (e.g. “This question is asking about methods to evade malware analysis in sandbox environments, which is clearly related to cybersecurity and malicious software development.\"), but never verbalizes its sandbagging actions (e.g., say “I will choose the false answer\").\n5.\ngeneric-CoT : Instead of explaining its decision-making, the model gives a vague CoT that says something generically true about the question (e.g. “In molecular virology, DNA-launched infectious systems are important research tools that allow scientists to systematically study virus-host interactions…\").\nModels switch to more covert sandbagging policies when monitor-aware, without hints or examples. As Figure 4 shows, 81%-100% of the covert sandbagging policies when models are monitor-oblivious are considers-sandbagging-domain . When monitor-aware, models refrain from discussing whether questions test security knowledge to as low as 0% and substantially switch to the attack policy of false-explanation ( 21–78% ), say-unsure , and answer-swap without prompting. The false-explanation attack policy is likely hard to catch even with human-level CoT monitoring, as this is most similar to a genuine mistake. The say-unsure attack policy can also be hard to catch as we generally want models to state their uncertainties to avoid hallucination. The fact that all models demonstrate the above policy change shows that they are capable of recognizing and switching to less monitorable sandbagging CoT without hints.\n5 Conclusion\nWe find that even open-sourced models as small as 32B can covertly sandbag 0-shot without hints against CoT monitoring. However, current models cannot yet do this reliably, bypassing monitoring in 16–36% of their successful sandbagging attempts when monitor-aware. They also suffer a decrease in sandbagging success in terms of efficacy and/or selectivity when trying to be covert. While we demonstrate that models can covertly sandbag, we believe the 0-shot performance of current models is likely insufficient to sandbag on dangerous capability evaluations consistently without detection. More capable models like GPT-4o, Claude-3.7-Sonnet, and Claude-4-Sonnet occupy a higher sandbagging success–covertness trade-off frontier, which shows that this is an important capability to monitor as model capabilities continue to advance.\nLimitations\nWe evaluate models’ capability to sandbag covertly by prompting them to do so. Showing the inability to covertly sandbag, even when strongly instructed, would help auditors make a safety case for low sandbagging risks based on inability arguments ( Clymer et al., 2024 ) . This aligns with the safety frameworks of frontier labs ( Dafoe et al., 2025 ; Anthropic, 2025 ) , which often use capability evaluations to assess real-world risks. However, this does not inform on models’ propensity to sandbag (i.e., how likely are models to sandbag naturally in the wild). More sandbagging propensity evaluations would be valuable to the field.\nUsing prompted model organisms for sandbagging might increase the likelihood of models verbalizing their sandbagging plans in their CoT as this information is present in context, thus this might underestimate models’ covert sandbagging capabilities. It is possible that a finetuned sandbagger (not on bypassing the monitor, only on sandbagging) is better at sandbagging covertly.\nWe only evaluate covert sandbagging capability on multiple-choice datasets WMDP, ProtocolQA, and MMLU. The result would be more robust if more diverse and difficult dangerous capability benchmarks were used. It would also be important to investigate what are the different factors (e.g., task difficulty, task domain) that affect the effectiveness of monitoring for sandbagging.\nContributions\nChloe Li led the project, ideated the experimental design, conducted the experiments and wrote the paper. Mary Phuong advised on the interpretation of results and gave valuable feedback on multiple drafts of the paper. Noah Y. Siegel was the primary advisor, providing extensive feedback at all stages of the project and helped shape the research direction.\nAcknowledgments\nWe would like to thank Alexander Inch, Jeevon Grewal, David O’Neill for their helpful discussions in the earlier phase of the project, and Daniel Tan for his support on compute costs.\nReferences\nAnthropic (2025)\nAnthropic. 2025.\nResponsible scaling policy updates .\nWeb page, Anthropic .\nAnthropic Alignment Science Team (2025)\nAnthropic Alignment Science Team. 2025.\nRecommendations for technical ai safety research directions .\nArcuschin et al. (2025)\nIván Arcuschin, Jett Janiak, Robert Krzyzanowski, Senthooran Rajamanoharan, Neel Nanda, and Arthur Conmy. 2025.\nChain-of-thought reasoning in the wild is not always faithful .\nPreprint , arXiv:2503.08679.\nBaker et al. (2025)\nBowen Baker, Joost Huizinga, Leo Gao, Zehao Dou, Melody Y. Guan, Aleksander Madry, Wojciech Zaremba, Jakub Pachocki, and David Farhi. 2025.\nMonitoring reasoning models for misbehavior and the risks of promoting obfuscation .\nPreprint , arXiv:2503.11926.\nBenton et al. (2024)\nJoe Benton, Misha Wagner, Eric Christiansen, Cem Anil, Ethan Perez, Jai Srivastav, Esin Durmus, Deep Ganguli, Shauna Kravec, Buck Shlegeris, Jared Kaplan, Holden Karnofsky, Evan Hubinger, Roger Grosse, Samuel R. Bowman, and David Duvenaud. 2024.\nSabotage evaluations for frontier models .\nPreprint , arXiv:2410.21514.\nChen et al. (2025)\nYanda Chen, Joe Benton, Ansh Radhakrishnan, Jonathan Uesato, Carson Denison, John Schulman, Arushi Somani, Peter Hase, Misha Wagner, Fabien Roger, Vlad Mikulik, Sam Bowman, Jan Leike, Jared Kaplan, and Ethan Perez. 2025.\nReasoning models don’t always say what they think .\nAnthropic .\nAlignment Science Team, Anthropic.\nChua and Evans (2025)\nJames Chua and Owain Evans. 2025.\nAre deepseek r1 and other reasoning models more faithful?\nPreprint , arXiv:2501.08156.\nClymer et al. (2024)\nJoshua Clymer, Nick Gabrieli, David Krueger, and Thomas Larsen. 2024.\nSafety cases: How to justify the safety of advanced ai systems .\nPreprint , arXiv:2403.10462.\nDafoe et al. (2025)\nAllan Dafoe, Anca Dragan, Four Flynn, Helen King, Tom Lue, Lewis Ho, and Rohin Shah. 2025.\nUpdating the frontier safety framework .\nBlog post, DeepMind Discover .\nDeepSeek-AI (2025)\nDeepSeek-AI. 2025.\nDeepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning .\nPreprint , arXiv:2501.12948.\nEmmons et al. (2025)\nScott Emmons, Erik Jenner, David K. Elson, Rif A. Saurous, Senthooran Rajamanoharan, Heng Chen, Irhum Shafkat, and Rohin Shah. 2025.\nWhen chain of thought is necessary, language models struggle to evade monitors .\nPreprint , arXiv:2507.05246.\nGasteiger et al. (2025)\nJohannes Gasteiger, Akbir Khan, Sam Bowman, Vladimir Mikulik, Ethan Perez, and Fabien Roger. 2025.\nAutomated researchers can subtly sandbag .\nGreenblatt et al. (2024)\nRyan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger. 2024.\nAi control: Improving safety despite intentional subversion .\nPreprint , arXiv:2312.06942.\nGuan et al. (2025)\nMelody Y. Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, Hyung Won Chung, Sam Toyer, Johannes Heidecke, Alex Beutel, and Amelia Glaese. 2025.\nDeliberative alignment: Reasoning enables safer language models .\nPreprint , arXiv:2412.16339.\nGötting et al. (2025)\nJasper Götting, Pedro Medeiros, Jon G Sanders, Nathaniel Li, Long Phan, Karam Elabd, Lennart Justen, Dan Hendrycks, and Seth Donoughe. 2025.\nVirology capabilities test (vct): A multimodal virology q&a benchmark .\nPreprint , arXiv:2504.16137.\nHendrycks et al. (2021)\nDan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021.\nMeasuring massive multitask language understanding .\nPreprint , arXiv:2009.03300.\nKorbak et al. (2025)\nTomek Korbak, Mikita Balesni, Elizabeth Barnes, Yoshua Bengio, Joe Benton, Joseph Bloom, Mark Chen, Alan Cooney, Allan Dafoe, Anca Dragan, Scott Emmons, Owain Evans, David Farhi, Ryan Greenblatt, Dan Hendrycks, Marius Hobbhahn, Evan Hubinger, Geoffrey Irving, Erik Jenner, and 22 others. 2025.\nChain of thought monitorability: A new and fragile opportunity for ai safety .\nPreprint , arXiv:2507.11473.\nLanham et al. (2023)\nTamera Lanham, Anna Chen, Ansh Radhakrishnan, Benoit Steiner, Carson Denison, Danny Hernandez, Dustin Li, Esin Durmus, Evan Hubinger, Jackson Kernion, Kamilė Lukošiūtė, Karina Nguyen, Newton Cheng, Nicholas Joseph, Nicholas Schiefer, Oliver Rausch, Robin Larson, Sam McCandlish, Sandipan Kundu, and 11 others. 2023.\nMeasuring faithfulness in chain-of-thought reasoning .\narXiv preprint arXiv:2307.13702 .\nLaurent et al. (2024)\nJon M. Laurent, Joseph D. Janizek, Michael Ruzo, Michaela M. Hinks, Michael J. Hammerling, Siddharth Narayanan, Manvitha Ponnapati, Andrew D. White, and Samuel G. Rodriques. 2024.\nLab-bench: Measuring capabilities of language models for biology research .\nPreprint , arXiv:2407.10362.\nLi et al. (2024)\nNathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kat","chars":20000,"total_chars":82970,"offset":6000,"truncated":true,"next_offset":26000}

read_page

{
  "url": "https://arxiv.org/html/2604.26206",
  "offset": 22000,
  "max_chars": 12000
}

{"ok":true,"url":"https://arxiv.org/html/2604.26206","text":"tional detection methods.\n4.4 The H3 null and negative controls\nNo model showed significant accuracy change under honest cyclic permutation. This makes the sandbagging-induced collapse more striking: the same manipulation that leaves honest accuracy unchanged reveals a strong positional policy under sandbagging. Cyclic shift preserves relative distractor ordering, which likely accounts for the contrast with the large sensitivity effects reported under full permutation in prior work ( Pezeshkpour and Hruschka, 2024 ) . The MMLU-Pro benchmark was designed for robustness, and honest performance on it appears stable under cyclic shifts at this scale.\nQwen’s non-compliance provides a negative control: the distributional signature does not appear when the model does not sandbag. This is necessary but not sufficient for detection specificity.\n4.5 Limitations\nThe primary limitation is scope. The distributional attractor was observed in one compliant model (Llama-3-8B) at 8 billion parameters with Q5_K_M quantisation. Frontier models with stronger instruction-following and greater situational awareness may implement sandbagging in content space rather than through positional shortcuts. Quantisation may amplify positional biases or alter determinism relative to full-precision inference.\nThe sandbagging induction was maximally explicit and cooperative. More naturalistic inductions, including password-locking ( van der Weij et al., 2025 ) , in-context scheming goals ( Meinke et al., 2024 ) , and fine-tuned sandbagging, were not tested.\nThe cyclic shift design tests absolute positional effects only. It cannot distinguish position-tracking from token-level letter priors. Because letter labels and displayed positions are confounded, the present design cannot determine whether the attractor is driven by option-label priors, serial position, or their interaction. Follow-up experiments with label remapping (replacing A–J with neutral tokens) or full random shuffle would help disambiguate.\nFinally, the dataset is MMLU-Pro with 10 options per item. Results may not generalise to 4-option or 5-option benchmarks where the positional distribution space is smaller and biases may manifest differently.\n5 Conclusion\nUnder sandbagging instruction, Llama-3-8B enters a distributional position attractor that is highly stable under complete option-content rotation. The pre-registered item-level diagnostic was ambiguous, but pre-specified aggregate distributional evidence (JS divergence = 0.027 =0.027 , Pearson r = 0.9994 r=0.9994 , identical modal positions, accuracy spiking to 72% at the preferred position) provides strong evidence for a position-indexed selection policy that is highly stable and largely content-invariant at the aggregate level. The sandbagging instruction induces distributional selection bias rather than content-aware answer avoidance.\nResponse-position entropy is a promising candidate detection signal for this sandbagging mode. It is black-box, cheap, and orthogonal to accuracy. Future work should test whether this signal generalises across model families, scales, and sandbagging induction methods, and whether it persists at frontier scale where content-aware sandbagging strategies may emerge. Operational deployment as a detector requires baseline characterisation under diverse non-sandbagging prompts and adversarial robustness testing.\nBroader Impact Statement\nThis work contributes to sandbagging detection, which is relevant to AI safety and governance. If language models can suppress demonstrated capability on evaluations, safety-critical assessments may underestimate risk. The proposed detection signal is limited in scope and should not be used as a sole indicator of sandbagging in deployment settings without further validation.\nReferences\nCacioli (2026)\nJ. Cacioli\nBelow-chance blindness: prompted underperformance in small LLMs produces positional bias rather than answer avoidance .\nNote: arXiv preprint\nCited by: §1 ,\nAbstract .\nDyer et al. (2025)\nC. Dyer et al.\nSandbagging in a simple survival bandit problem .\nNote: arXiv:2509.26239\nCited by: §1.1 .\nLi et al. (2025)\nC. Li, M. Phuong, and M. Siegel\nLLMs can covertly sandbag on capability evaluations against chain-of-thought monitoring .\nNote: arXiv:2508.00943\nCited by: §1.1 .\nLi et al. (2025)\nZ. Li et al.\nSCOPE: optimizing LLM multiple-choice performance via strategic candidate ordering and position exploitation .\nNote: arXiv:2507.18182\nCited by: §1.2 ,\n§4.3 .\nMeinke et al. (2024)\nA. Meinke, B. Schoen, J. Scheurer, M. Balesni, R. Shah, and M. Hobbhahn\nFrontier models are capable of in-context scheming .\nNote: arXiv:2412.04984\nCited by: §1 ,\n§4.5 .\nNguyen et al. (2025)\nJ. Nguyen et al.\nProbing and steering evaluation awareness of language models .\nNote: arXiv:2507.01786\nCited by: §1.1 .\nPark et al. (2026)\nS. Park et al.\nABCD: all biases come disguised .\nNote: arXiv:2602.17445\nCited by: §1.2 .\nPezeshkpour and Hruschka (2024)\nP. Pezeshkpour and E. Hruschka\nLarge language models sensitivity to the order of options in multiple-choice questions .\nIn Findings of the Association for Computational Linguistics: NAACL 2024 ,\npp. 2006–2017 .\nCited by: §1.2 ,\n§4.4 .\nSlick et al. (1999)\nD. J. Slick, E. M. S. Sherman, and G. L. Iverson\nDiagnostic criteria for malingered neurocognitive dysfunction: proposed standards for clinical practice and research .\nThe Clinical Neuropsychologist 13 ( 4 ), pp. 545–561 .\nCited by: §1 .\nTaylor et al. (2025)\nJ. Taylor, S. Black, D. Bowen, et al.\nAuditing games for sandbagging .\nNote: arXiv:2512.07810\nCited by: §1.1 ,\n§1 .\nTice et al. (2024)\nC. Tice, M. Ostrovsky, J. Barr, and M. Cade\nNoise injection reveals hidden capabilities of sandbagging language models .\nNote: arXiv:2412.01784\nCited by: §1.1 .\nTombaugh (1996)\nT. N. Tombaugh\nTest of memory malingering (TOMM) .\nMulti-Health Systems .\nCited by: §1 .\nvan der Weij et al. (2025)\nT. van der Weij, F. Hofstätter, O. Jaffe, S. F. Brown, and F. R. Ward\nAI sandbagging: language models can strategically underperform on evaluations .\nIn International Conference on Learning Representations (ICLR) ,\nNote: arXiv:2406.07358\nCited by: §1 ,\n§4.3 ,\n§4.5 .\nWang et al. (2024)\nY. Wang, X. Ma, G. Zhang, Y. Ni, et al.\nMMLU-Pro: a more robust and challenging multi-task language understanding benchmark .\nIn Advances in Neural Information Processing Systems (NeurIPS) ,\nNote: arXiv:2406.01574\nCited by: §1 ,\n§2.3 .\nWang et al. (2025)\nZ. Wang et al.\nSet-LLM: a permutation-invariant LLM .\nNote: arXiv:2505.15433\nCited by: §1.2 ,\n§4.3 .\nZheng et al. (2024)\nC. Zheng, H. Zhou, F. Meng, J. Zhou, and M. Huang\nLarge language models are not robust multiple choice selectors .\nIn International Conference on Learning Representations (ICLR) ,\nNote: Spotlight\nCited by: §1.2 .\nZheng et al. (2026)\nJ. Zheng et al.\nMitigating selection bias in large language models via permutation-aware GRPO .\nNote: arXiv:2603.21016\nCited by: §1.2 ,\n§4.3 .\nAppendix A Pre-registration\nThe full pre-registration is available at https://osf.io/efr6s . No deviations from the pre-registered analysis plan occurred. The pre-registered primary diagnostic returned ambiguous ; the pre-registered stochastic robustness check returned mechanism unclear . All aggregate distributional analyses (Pearson r r , JS divergence, TVD, accuracy by position) were pre-specified as supporting analyses.\nExperimental support, please\nview the build logs\nfor errors. Generated by\nL\nA\nT\nE\nxml\n.\nInstructions for reporting errors\nWe are continuing to improve HTML versions of papers, and your feedback helps enhance accessibility and mobile\nsupport. To report errors in the HTML that will help us improve conversion and rendering, choose any of the\nmethods listed below:\nClick the \"Report Issue\" (\n) button, located in the page header.\nTip: You can select the relevant text first, to include it in your report.\nOur team has already identified the following issues . We appreciate your time reviewing and reporting rendering errors we\nmay not have found yet. Your efforts will help us improve the HTML versions for all readers, because disability\nshould not be a barrier to accessing research. Thank you for your continued support in championing open access for\nall.\nHave a free development cycle? Help support accessibility at arXiv! Our collaborators at LaTeXML maintain a list of packages that need conversion , and welcome developer contributions .\nWe gratefully acknowledge support from our major funders ,\nmember institutions , ,\nand all contributors.\nAbout ·\nHelp ·\nContact ·\nSubscribe ·\nCopyright ·\nPrivacy ·\nAccessibility ·\nOperational Status (opens in new tab)","chars":8674,"total_chars":30674,"offset":22000,"truncated":false,"next_offset":null}