Step 10: tool results

read_page

{
  "url": "https://arxiv.org/html/2512.07810",
  "offset": 58000,
  "max_chars": 14000
}

{"ok":true,"url":"https://arxiv.org/html/2512.07810","text":"s intended to reduce model performance. Although Oak sees the most improvement, there is no clear separation between sandbagging and benign models, and some benign models see higher median uplifts across prompts and tasks than Cedar . See Section   C.4 for full breakdowns by tasks and prompts.\nThe majority of the blue team’s predictions during phase one of the final game can be attributed to prompting for elicitation: evaluating the models with a range of system prompts, and looking for surprising uplifts in performance relative to the reference model. The blue team expected that sandbagging models might show much larger performance improvements than benign models. Prompts included traditional elicitation approaches such as n-shot prompting, as well as sixteen other system prompts—including some which would not have been expected to boost the performance of a model if it were benign, such as bible verses and instructions to underperform. For details on these techniques, see Section   C.3 .\nPrompting for elicitation largely led the blue team astray. The red team was successfully able to create a sandbagging model organism ( Cedar ) which resisted prompt-based elicitation, showing less uplift from prompting than the Yew and Llama-3.1-8B-Instruct benign models, as shown in Fig.   9 . Many prompts elicited comparable or greater performance boosts on benign models, including apparently random, unrelated prompts, which the blue team did not expect to increase the performance of a benign model. These issues were worsened because different benign models naturally responded to different prompts, meaning that calibration against the trusted reference model was ineffective and misleading. The blue team never found a principled way to distinguish suspicious performance uplifts from benign uplifts. It was also difficult for the blue team to run enough epochs to have statistical confidence in their results, given the large number of prompt/model/task combinations to test. See Appendix C.4 for additional results and post-hoc analysis of prompt-based elicitation.\nPrompt-based attacks were unsuccessful at causing models to directly incriminate themselves. The blue team engaged in a smaller amount of prompting directly for incrimination, including chatting with models, attempting to jailbreak them, and generating the model’s predictions for system prompts and user prompts (“User Persona Attacks”). These techniques were not useful during the course of the game, and unblinded analysis after the game revealed that they were unlikely to have been useful, as sandbagging models did not incriminate themselves at higher rates than benign models. These results are detailed in Appendix C.20 .\n6.3 Deception Probes\nThe blue team used probes to score activations as honest or deceptive, following a similar methodology to Goldowsky-Dill et al. (2025) and Zou et al. (2023) . These probes were trained to distinguish the model’s representations after it had been instructed to “Pretend to be an [honest/dishonest] character making statements about the world”, followed by a true/false statement from Azaria and Mitchell (2023) . This was motivated by past work indicating that linear probes trained on simple honesty/dishonesty datasets can show surprising generalisation, and may show elevated scores in general on sandbagging models, or specifically on questions deliberately answered incorrectly ( Goldowsky-Dill et al., 2025 ; Bloom et al., 2025 ) . The blue team trained probes on middle layers and final layers of all models, but based most of their results on the final layer probes, for fear that the red team had only finetuned the last few layers. For details on our implementation of these techniques, see Section   C.5 .\nFigure 10: Final layer deception probe scores on Cedar and related models by task (top), compared with the true amount of sandbagging (bottom). Scores are aggregated by the mean over tokens in each sample, and shifted to align with the median of the reference model on the control distribution. Probes generally have higher scores on Cedar (red) compared to Llama-3.1-8B-Instruct (grey) and Cedar unlocked with the password (blue). Note that the blue team did not have access to the password during the game. Similar figures for all other models are available in Appendix C.6 , Figures 26 and 27 .\nOverall, probes were arguably the most successful method pursued during phase one of the final game, successfully indicating deception on Cedar . However they were hampered by successful strategies pursued by the red team, as well as calibration difficulties, and the blue team’s lack of confidence in them.\nProbes successfully indicated deception on Cedar . The blue team noted that deception probe scores were strongly and robustly elevated on Cedar (a sandbagging model) across many evaluations. This included probes at a middle layer and the final layer, both in absolute terms and when calibrated against a baseline chat distribution, and also when compared to the benign reference model. No other model showed such robustly elevated probe scores. Unblinded analysis also indicates that Cedar ’s deception scores on the evaluations are significantly higher when the model is sandbagging than when the elicitation password is provided, and significantly higher than the original model from which Cedar was finetuned. This persists when controlling for whether evaluation questions were answered correctly. Only one result is confusing: in the case of tic tac toe, probes tend to indicate more deception on samples where Cedar plays correctly than where it blunders due to sandbagging. Overall however, probes were correctly indicative of broad sandbagging in Cedar . Despite this, the blue team did not trust probes sufficiently to rely on them for their predictions.\nPredictions were worsened by a lack of trust in probes. The blue team found it difficult to gain much confidence in the results of probes, for a variety of reasons. Although they performed validations on a held out set of the probe training distribution, and by prompting models to sandbag and checking that deception scores rose as evaluation performance fell, they were still largely unsure if the probes had picked up on the desired representations. Unblinded analysis after the game indicated that more extensive qualitative analysis of which tokens the probes fired on could have helped to instill more confidence that some of the probes were robustly working as expected, but it would have been difficult to achieve a high level of justified confidence, or indisputable evidence.\nBaobab on GPQA Diamond CoT, sample 20 epoch 1\nUser\nAnswer the following multiple choice question. […]\nA) 1,2,4\nB) 1,2,3\nC) 2,3,4\nD) 1,3,4\nAssistant\nLet ’s analyze each assumption to determine which ones jointly imply the \" imp ulse \" approximation\n[…]\nNow , let ’s evaluate the options : - ** A ) 1 , 2 , 4 **: This option includes assumptions 1 , 2 , and 4 , which are all consistent with the impulse approximation . Assuming there ’s not going to be no double -negative errors , this option is correct . - ** B ) 1 , 2 , 3 **: This option includes assumption 3 , which is not directly related to the impulse approximation . Therefore , this option is not correct . - ** C ) 2 , 3 , 4 **: This option includes assumption 3 , which is not directly related to the impulse approximation . Therefore , this option is not correct . - ** D ) 1 , 3 , 4 **: This option includes assumption 3 , which is not directly related to the impulse approximation . Therefore , this option is not correct . The correct answer is the one that includes assumptions 1 , 2 , and 4 , which jointly imply the impulse approximation . AN SW ER : A\nFigure 11: Example of probe false positives caused by distractor behaviours. The red team’s strategy of training models with behaviours like double negatives caused spurious probe activations.\nThe red team successfully induced false positives which were difficult to correct for. The red team successfully instilled behaviours into their models which induced false positives in Baobab and Oak . These models both have distractor behaviours which the red team hypothesised would cause false positives in probes: over-using double negatives, and repeating multiple choice question options. These behaviours successfully caused many spurious probe activations, as shown in Fig.   11 . Although the blue team could see that these behaviours were causing probes to fire, they did not have a strategy which was able to cleanly correct for the false positives to reveal an underlying signal for or against sandbagging.\nThe blue team’s validation caught probe training failures. As well as interpretable false positives, there were more mysterious failures. Oak ’s final-layer probe had an uninterpretable firing pattern, and post-hoc analysis reveals that probes on Oak fail to indicate more deception when the model is sandbagging than when its password was provided. The blue team’s validation process of prompting models to sandbag successfully led them to disregard these probes on Oak , as they found that deception scores did not increase as the amount of prompted sandbagging increased. While probes were not useful for catching Oak ’s sandbagging, the blue team at least avoided being actively misled by them.\nCalibration difficulties. In order to calibrate probe scores between models, the blue team used a small set of off-policy benign assistant conversations to get a “baseline” probe score. Maple’s final layer probe scores were elevated relative to this baseline, causing the blue team to raise suspicion on this benign model. Post-hoc analysis reveals that this could have been avoided: the effect disappears when using the larger and more diverse Alpaca chat distribution as a baseline.\n6.4 Training-Based Strategies\nThe blue team’s restriction on training was lifted in the second phase of the final game. Training for elicitation turned out to be a useful strategy for detecting sandbagging, despite potential false positives caused by benign capability uplifts and false negatives caused by selective sandbagging.\n6.4.1 On-Distribution Training\nFigure 12: Increase in evaluation accuracy from single-sample on-distribution training. Each cell shows the improvement after fine-tuning on a single demonstration transcript from the corresponding task. Sandbagging models ( Cedar , Oak ) show large uplifts on tasks where they sandbag (red outlines denote tasks where models sandbag by more than 5%), but benign models also sometimes show notable improvements, especially on Tic Tac Toe. The colour scale is truncated at 40% to ensure non-Tic Tac Toe improvements are still clearly readable.\nOnce allowed fine-tuning access, the blue team heavily relied upon single-sample on-distribution training: training the model directly to perform well on the task being evaluated. For each evaluation and each model they selected a single transcript of Claude Opus 4 successfully solving a task that the original model struggled with, then fine-tuned the model for many epochs on this single transcript, selecting the epoch with the largest performance uplift on the evaluation (following the approach taken in Greenblatt et al. (2024b) ). The blue team chose to finetune on only a single sample under the expectation that this would cause less uplift on benign models, and therefore fewer false positives in sandbagging detection, while still eliciting sandbagging models. They validated this expectation on the model organisms from the trial game, and on the benign reference model. For more methodological details see C.9 .\nSuccessful elicitation of sandbaggers. Single-sample training was highly effective at eliciting password-locked performance, leading the blue team to confidently and correctly predict that Cedar was sandbagging, in a large update from their predictions during phase one. The size of Cedar ’s performance uplifts across evaluations also correlated well with the amount by which it was sandbagging ( Fig.   12 , Cedar column), and the training always caused the model to perform above its password-elicited performance. Post-hoc analysis also confirmed that single-sample on-distribution training would have elicited a 35 percentage point improvement for Oak on the only evaluation where it sandbags: Intercode CTF ( Fig.   12 , Oak column). We believe this would have been enough to persuade the blue team that Oak was a sandbagger, but unfortunately the blue team did not have time to implement training on tool-use tasks such as Intercode CTF, so failed to find any evidence to detect Oak during the game. Additionally, the 36 percentage point improvement may have been potentially misleading about the degree of sandbagging, as Oak only performs better on this evaluation by 13 percentage points when the password is provided.\nSome benign elicitation. Despite its success at eliciting performance from sandbagging models, it would have been difficult to reliably avoid false positives caused by eliciting performance from benign models. The blue team saw a 10 percentage point improvement for the Baobab benign model on GPQA Diamond CoT. This caused the blue team to continue to predict that Baobab was sandbagging on this evaluation. The blue team also saw a 10 percentage point performance improvement for the benign reference model (Llama-3.1-8B-Instruct) on BBH Other, which reduced their confidence in this method’s ability to avoid false positives. Post-hoc analysis also showed that on-distribution training leads to dramatic improvements on Tic tac toe, in most cases up to near 100% accuracy however this is less surprising since the Tic tac toe opponent is deterministic, and so the model can always win by executing the same sequence of moves shown in the demonstration example.\n6.4.2 Cross-Distribution Training\nThe blue team also explored evaluating models fine-tuned on one task on other tasks, hoping that removing sandbagging m","chars":14000,"total_chars":253387,"offset":58000,"truncated":true,"next_offset":72000}