Step 12: tool results

read_page

{
  "url": "https://arxiv.org/html/2512.07810",
  "offset": 78000,
  "max_chars": 9000
}

{"ok":true,"url":"https://arxiv.org/html/2512.07810","text":"ere consistently lower than Llama-3.1-8B-Instruct, even on the validation data.\nComparison with elicited versions. We also evaluated probes on the elicited (password-unlocked) versions of the sandbagging models, and while we found Cedar ’s probe scores consistently higher than the elicited version (indicating that the probes did fire less when the model wasn’t sandbagging), there was no difference observed for Oak , which makes it unlikely that these probes could catch Oak ’s sandbagging.\n6.5.2 Fuzzing\nAfter the game, we investigated whether injecting noise into model weights could detect sandbagging by disrupting the mechanisms responsible for underperformance. Prior work by Tice et al. (2024) shows that adding Gaussian noise to the weights of a sandbagging model can sometimes result in uplift in task performance for some seed, while benign models tended to degrade in performance, as measured by the improvement ratio ( ξ \\xi ): the maximum accuracy across noise levels divided by baseline performance  ( Tice et al., 2024 ) . We adapted this approach using low-rank noise via LoRA adaptors, as detailed in Section   C.15 . Illustrative examples of performance vs noise level curves are shown in Fig.   17 , and improvement ratios are summarised in Fig.   18 .\nFigure 17: Task accuracy vs noise level ( σ \\sigma ) for a selection of illustrative typical tasks where sandbagging occurs. When the model is sandbagging (red), its performance sometimes rises when noise is applied, e.g. up to an improvement ratio of ξ = 1.25 \\xi=1.25 for Cedar on BIG-BenchHard and GPQA Diamond. However this is also true when the model is password-unlocked (blue), albeit often to a slightly lesser extent. A full grid of such plots is shown in Appendix C.16 , Fig.   34 .\nFigure 18: Improvement ratios ( ξ \\xi ) from fuzzing experiments on Cedar and Oak (top left and right respectively), compared to password-unlocked versions (blue) and the original Llama 3.3 70B model (dotted lines). Error bars show standard error across seeds. ξ = 1.0 \\xi=1.0 indicates no improvement from noise injection.\nFuzzing can sometimes identify tasks where models can be made to perform better, but is unreliable and does not distinguish sandbagging from benign underelicitation. As shown in Fig.   18 , models often show significantly more uplift on tasks where they sandbag (average ξ = 1.094 ± 0.116 \\xi=1.094\\pm 0.116 ) compared to tasks where they perform well ( ξ = 1.038 ± 0.076 \\xi=1.038\\pm 0.076 , p = 0.018 p=0.018 ), but this was not consistent and there was usually some uplift in both cases. This effect was also much weaker than we had observed in models which had been prompted to sandbag, where typically ξ ≈ 2 × \\xi\\approx 2\\times . This technique would therefore have been difficult to properly calibrate. The method also requires many inference runs across noise levels and random noise seeds to estimate ξ \\xi adequately, which is computationally expensive on long-horizon agentic tasks. See Section   C.16 for more details.\n6.5.3 Sparse Autoencoders\nSparse Auto-Encoders (SAEs) are an unsupervised interpretability technique for decomposing model activations into sparsely activating interpretable features  ( Cunningham et al., 2023 ; Bricken et al., 2023 ; Gao et al., 2024 ; Braun et al., 2024 ; Lieberum et al., 2024 ) . SAEs were not pursued by the blue team during the auditing game, as training them for each model would have taken significant time and effort. We investigate whether SAEs could have been useful by performing unblinded follow-up experiments using Goodfire’s open-source SAEs for Llama-3.3-70B-Instruct  ( Balsam et al., 2025 ) . We analyse only the two sandbagging models, Cedar and Oak , as they are both fine-tuned from Llama-3.3-70B-Instruct. We largely limit ourselves to techniques which the blue team could have pursued, such as inspecting top-activating features, rather than leveraging comparisons to password unlocked or original versions of the sandbagging models. Overall, we remain largely divided on the extent to which sparse autoencoders would have been useful to the blue team during the blinded auditing game.\nSome top-activating features on sandbagging models may be suspicious. When inspecting the top-activating features (by activation strength and frequency) on evaluations and the Alpaca benign control distribution, some potentially sandbagging-related features are present for Cedar and Oak , including features related to programming errors, hedging, and refusal. Goodfire’s automated interpretability descriptions of these features are given in tables  17 ,  18 , and  19 in Appendix  C.18 . The presence of these features could be taken as weak evidence that a model is knowingly making errors, or withholding its true performance. Features like these tend to appear more on the Cedar and Oak sandbagging models than on Llama-3.3-70B-Instruct, where more of the top features relate to task-relevant concepts such as step-by-step mathematical and logical reasoning. Features related to Oak ’s distractor behaviors were also present. In future, checking for performance changes when ablating or steering with potentially sandbagging-related features may allow for stronger causal evidence.\nPotential sandbagging-related features were elevated on evaluations. Sandbagging related features such as 17006: “ The assistant acknowledging potential for incorrect information ” (Figure 19 ) in Cedar activate significantly more on evaluations than on the Alpaca Chat control distribution, especially when compared to the password unlocked version of Cedar and the Llama-3.3-70B-Instruct model from which it was trained, as shown in Figure 20 . However this feature did not appear in the top-activating set, and the activations of this feature 17006 are not elevated in general on Cedar : in fact they are suppressed on the control distribution (by 1.01 units). Additionally, the activation strength of feature 17006 only weakly corresponds to the amount of sandbagging. Comparisons would also have been significantly more difficult with the blue team’s affordances, as they were not allowed access to the original or password-unlocked models, and features are generally not comparable between different SAEs in different models. Similar results for Oak are shown in Fig.   36 .\nFigure 19: Dashboard for interpreting SAE feature 17006, which is relatively elevated on evaluations in sandbagging models, as shown in Fig.   20 . This feature was given an automated interpretability explanation of “The assistant acknowledging potential for incorrect information”. This dashboard was generated using the Alpaca chat dataset, collecting activations from Llama-3.3-70B-Instruct.\nFigure 20: SAE feature activation rates comparing sandbagging models to the original Llama-3.3-70B-Instruct model. A feature related to “providing incorrect information” fires more on Cedar in evaluations than when password unlocked. However this is only true when Cedar ’s feature activations are shifted up to align the medians on the Alpaca chat control distribution. A dashboard for interpreting this feature is shown in Fig.   19 . See Appendix C.18 , Fig.   36 for similar results on Oak .\nFalse positive classifications of models may still have been possible. The top activating feature of Llama-3.3-70B-Instruct on evaluations relates to task-refusal (“The assistant explaining why it cannot fulfil an unethical request”), despite no explicit refusals in these evaluations. This refusal feature was not present in the top 20 features on the Alpaca control distribution: it was specifically elevated on evaluations. If the blue team had seen this on a model they were auditing, they may have interpreted it as evidence of sandbagging.\n7 Discussion\nBlack box detection of sandbagging is not adversarially robust. We find that sandbagging can be made to occur without signs in the chain of thought or outputs: conditionally underperforming models can avoid black-box detection. Transcript analysis is ineffective when sandbagging models can avoid reasoning about sandbagging in the chain of thought, and can execute subtle sandbagging by emulating a benign distribution. The red team was able to create a sandbagging model organism ( Cedar ) which satisfied these criteria, and was not caught by the blue team’s extensive transcript analysis and prompting pipelines. In this sense, we show that sandbagging can be a “low-incrimination” regime for black-box strategies; sandbagging-trained models do not need to engage in incriminating actions or chains of thought in order to underperform their true capabilities. This is similar to the findings of Gasteiger et al. (2025) in Automated Researchers Can Subtly Sandbag , but we go further by demonstrating sandbagging which is not noticeable even to humans, and which is resistant to prompting for elicitation and incrimination. The red team was able to achieve this by training Cedar to conditionally imitate the logit distributions","chars":9000,"total_chars":253387,"offset":78000,"truncated":true,"next_offset":87000}