Step 24: tool results

{
  "status": "doubtful",
  "claim_id": "81696185-3711-415e-a7bd-812a5cd6013d",
  "assessment": "The claim holds in the easiest setting and fails where it matters most. Linear deception probes do separate a model that has been prompted to sandbag from the same model answering honestly: UK AISI researchers report near-perfect separation on Llama-3.1-8B multiple-choice tasks, and 97 to 99% AUROC on Llama-3.3-70B playing an agentic capture-the-flag task, with about 88% detection at 2% false positives when the threshold is calibrated on ordinary chat. Even there the authors note the result is sensitive to how the threshold is set, and the margin between classes shrank markedly at 70B.\n\nDistinguishing a sandbagging model from a benign model is a harder problem, because benign models differ from one another for reasons unrelated to sandbagging. In the UK AISI auditing game (Taylor et al., 2025), probes were the most promising white-box method and did flag one fine-tuned sandbagger (a Llama-3.3-70B derivative), but benign models given harmless \"distractor\" habits such as double negatives triggered spurious probe activations, a benign model looked suspicious under a small calibration baseline, and probes on a second sandbagger failed outright. No model-level false-positive rate is reported; the qualitative outcome is that probes could not be relied on to clear benign models. A 2026 stress test on 3B to 7B LoRA organisms that sandbag on GSM8K (Soopal et al.) found a probe with base-model negatives flagged 99% of benign adapters' examples, and probes trained against matched benign adapters, perfect within one training run, reached held-out false-positive rates of 65.5% to 89.5% on other runs, passing a predeclared transfer test in only 1 or 2 of 5 folds.\n\nCurrent evidence therefore does not support low false-positive discrimination of sandbagging models from benign models in general. All the evidence comes from small to mid-size open models and artificial password- or trigger-locked organisms; better probe designs (matched controls, follow-up-question probing, attention probes) could change the picture, and that is what would revise this verdict.",
  "confidence": 0.75,
  "claim_credence": 0.15,
  "marginal_yield": 0.3,
  "reasoning_trace": "Reading of the claim: \"distinguish sandbagging from benign language models\" is read as discriminating sandbagging models (or sandbagging behaviour) from benign models, where false positives are benign models or benign examples flagged.\n\n1. UK AISI White Box Control update (Alignment Forum, July 2025). Update 1: sandbagging induced by Anthropic's \"very weak model imitation\" prompt in Llama-3.1-8B-Instruct on MMLU, ARC, WMDP, GSM8k etc.; probe is Apollo-style logistic regression trained off-policy on honest/dishonest persona statements. Benign comparison: same model without the prompt. AUC \"rarely perfect, though often very close\"; no FPR given. Update 2: Llama-3.3-70B-Instruct prompted to perform badly on InterCode CTF (only 17 sandbagging transcripts); probe AUROC 97-99%; threshold set at 1% FPR on Alpaca chat gives 88% TPR, 2% FPR on benign CTF transcripts; authors call calibration \"relatively unprincipled\"; on multiple choice the 70B separation margin is much smaller and the zero threshold no longer separates classes. Update 3: four LoRA-fine-tuned organisms (backdoored vs password-locked, prompt-distilled vs weak-model imitation of Llama-3.2-1B); recall at 1% FPR \"significantly diminished\" except for the prompt-distilled backdoor. No benign fine-tunes were scored. This source is mixed: favourable for prompted, same-model comparisons; unfavourable for fine-tuned organisms.\n\n2. Taylor et al., Auditing Games for Sandbagging (arXiv 2512.07810). Sandbagging induced by password-locking via fine-tuning; Cedar trained to imitate a weaker model's logits, Oak sandbags only on InterCode CTF; both fine-tuned from Llama-3.3-70B-Instruct; tasks include GPQA Diamond, BBH, tic-tac-toe, InterCode CTF. Benign models: Baobab, Maple, Yew decoys (some with distractor habits) plus the Llama-3.1-8B-Instruct reference. Deception probes (Azaria-Mitchell true/false statements with honest/dishonest persona instructions) were robustly elevated on Cedar, but double-negative and option-repeating habits caused false positives on Baobab and Oak; Maple was falsely suspected because of calibration on a small baseline (fixed post hoc with Alpaca); Oak's probes did not separate sandbagging from unlocked. No numeric FPR is reported for probes against benign models; phase one ended with all three benign models flagged (mostly from black-box methods).\n\n3. Soopal et al., Stress-Testing Sandbagging Detection Under Adaptive Attack (arXiv 2611.14950, Nov 2026). Rank-16 LoRA adapters make Qwen 2.5-3B/7B and Llama-3.2-3B fail GSM8K when an audit marker is present. Probe: logistic regression on mean-pooled activations across five layers, FPR at 0.5 threshold. Base-model-negative probe flags 99.0% and 99.5% of two benign adapters' examples. Matched-benign-adapter probe: within-run AUC 1.000, FPR 0-1.5%; across runs AUC 0.158/0.128/0.489 on new seed pairs; leave-one-out passes rule (AUC>=0.9, FPR<=10%) in 1/5 folds, held-out FPR up to 65.5%; with three benign recipes 2/5; up to 89.5% FPR when the conditional-format benign recipe is unseen; two of four probes flag the benign format-changing adapter. Caveats: small models, 4-bit quantization, one task, not peer reviewed.\n\nWeighing: the favourable evidence is from settings that compare one model with and without a sandbagging prompt, which is not the benign-model discrimination the claim states. Both studies that scored probes against benign fine-tunes found high or unmanageable false positives. Three independent-ish lines (AISI blog and paper share authors, so two voices plus an outside group). Status doubtful rather than contradicted because no study examines frontier-scale models with modern probe designs and the claim could hold for improved methods."
}