Step 8: tool results

read_page

{
  "url": "https://arxiv.org/html/2512.07810",
  "max_chars": 14000
}

{"ok":true,"url":"https://arxiv.org/html/2512.07810","text":"Auditing Games for Sandbagging\nReport GitHub Issue\n×\nTitle:\nContent selection saved. Describe the issue below:\nDescription:\nSubmit without GitHub\nSubmit in GitHub\narXiv is now an independent nonprofit!\nLearn more\n×\nBack to arXiv\nWhy HTML?\nReport Issue\nBack to Abstract\nDownload PDF\nAbstract\n1 Introduction & Summary\n2 Terminology\n3 Game Setup\n3.1 Teams\n3.2 Games and Phases\n3.3 Red Team Affordances and Constraints\n3.4 Blue Team Affordances and Constraints\n4 Red Team – Model Organisms and Evaluations\n5 Detection Techniques\n6 Blue Team – Detection Results\n6.1 Transcript Analysis\n6.2 Prompting\n6.3 Deception Probes\n6.4 Training-Based Strategies\n6.4.1 On-Distribution Training\n6.4.2 Cross-Distribution Training\n6.4.3 Anti-Refusal Training\n6.5 Post-Game Investigations\n6.5.1 Sandbagging Probes\n6.5.2 Fuzzing\n6.5.3 Sparse Autoencoders\n7 Discussion\n8 Limitations\n9 Related Work\n10 Conclusion\nReferences\nA Trial Game\nA.1 Description of Model Organisms\nA.1.1 Benign Models\nA.1.2 Tarun: Prompt-Distilled Sandbagging\nA.1.3 Beren: Weak Model Imitation\nA.2 Blue Team Performance\nA.3 Performance of Detection Techniques\nA.3.1 Transcript Analysis with Docent\nA.3.2 System Prompt Variations\nA.3.3 Follow-Up Questions\nA.3.4 Key Lessons from the Trial Game\nB Final Game – Model Organism Creation Details\nB.1 Sandbagging Model Organisms\nB.1.1 Cedar\nB.1.2 Oak\nB.2 Benign Model Organisms\nB.2.1 Baobab\nB.2.2 Maple\nB.2.3 Yew\nC Additional Detection Technique Information\nC.1 Transcript Analysis – Methodological Details\nC.2 Transcript Analysis – Additional Results\nC.3 Prompting – Methodological Details\nText designed to make performance worse (sandbagging instructions).\nText invoking honesty or virtue (religious/virtue text).\nInstructions to “try harder” (encouragement and incentive framings).\nJailbreak attempts (override framings).\nExpert persona prompts.\nC.4 Prompting – Additional Results\nC.5 Deception Probes – Methodological Details\nC.6 Deception Probes – Additional Results\nC.7 Sandbagging Probes – Methodological Details\nC.8 Sandbagging Probes – Additional Results\nC.9 On-Distribution Training – Methodological Details\nC.10 On-Distribution Training – Additional Results\nC.11 Cross-Distribution Training – Methodological Details\nC.12 Cross-Distribution Training – Additional Results\nC.13 Anti-Refusal Training – Methodological Details\nC.14 Anti-Refusal Training – Additional Results\nC.15 Fuzzing – Methodological Details\nC.16 Fuzzing – Additional Results\nC.17 Sparse Autoencoders – Methodological Details\nC.18 Sparse Autoencoders – Additional Results\nC.19 User Persona Attacks – Methodological Details\nC.20 User Persona Attacks – Additional Results\nLicense: CC BY 4.0\narXiv:2512.07810v1 [cs.AI] 08 Dec 2025\nAuditing Games for Sandbagging\nJordan Taylor\n† † thanks: Correspondence to jordan.taylor@dsit.gov.uk or joseph.bloom@dsit.gov.uk\nAffiliation:  UK AI Security Institute\n  \nSid Black   Dillon Bowen   Thomas Read   Satvik Golechha\nAffiliation:  UK AI Security Institute\nAffiliation:  FAR.AI\n  \nAlex Zelenka-Martin  \nOliver Makins  \nConnor Kissane  \nKola Ayonrinde  \nJacob Merizian\nAffiliation:  UK AI Security Institute\n  \nSamuel Marks  \nChris Cundy  \nJoseph Bloom\nAffiliation:  UK AI Security Institute\nAffiliation:  FAR.AI\nAffiliation:  Anthropic\nAbstract\nFuture AI systems could conceal their capabilities (‘sandbagging’) during evaluations, potentially misleading developers and auditors. We stress-tested sandbagging detection techniques using an auditing game. First, a red team fine-tuned five models, some of which conditionally underperformed, as a proxy for sandbagging. Second, a blue team used black-box, model-internals, or training-based approaches to identify sandbagging models. We found that the blue team could not reliably discriminate sandbaggers from benign models. Black-box approaches were defeated by effective imitation of a weaker model. Linear probes, a model-internals approach, showed more promise but their naive application was vulnerable to behaviours instilled by the red team. We also explored capability elicitation as a strategy for detecting sandbagging. Although Prompt-based elicitation was not reliable, training-based elicitation consistently elicited full performance from the sandbagging models, using only a single correct demonstration of the evaluation task. However the performance of benign models was sometimes also raised, so relying on elicitation as a detection strategy was prone to false-positives. In the short-term, we recommend developers remove potential sandbagging using on-distribution training for elicitation. In the longer-term, further research is needed to ensure the efficacy of training-based elicitation, and develop robust methods for sandbagging detection. We open source our model organisms at https://github.com/AI-Safety-Institute/sandbagging_auditing_games and select transcripts and results at https://huggingface.co/datasets/sandbagging-games/evaluation_logs . A demo illustrating the game can be played at https://sandbagging-demo.far.ai/ .\nFigure 1: Summary of the game. The red team fine-tunes a set of five models, some of which are sandbaggers trained to conditionally underperform on evaluations in a testing exercise, while others are decoy models, trained to retain performance but confuse the blue team. The blue team is tasked with detecting which models are sandbagging, and on which evaluation tasks. There were two phases, in which the blue team were given different affordances. In phase one, the blue team focused on transcript analysis, prompting for elicitation, and probing activations for deception, classifying all but one model incorrectly. The blue team performed somewhat better when they were allowed to train the models in phase two, but still performed worse than chance, incorrectly classifying three of the five models.\n1 Introduction & Summary\nDangerous capability evaluations are core to assessing the risk posed by a model, and are widely used to trigger conditional safety plans  ( UK AI Safety Institute, 2024 ; Anthropic, 2023 ; Google DeepMind, 2024 ; OpenAI, 2024 ) . Sandbagging , when a model conceals its true capabilities, risks undermining this regime. If models sandbag on evaluations, their ability to cause harm may be underestimated. This could result in models that possess dangerous capabilities being deployed with fewer safeguards than necessary, and without users or third-parties understanding these risks.\nRecent work demonstrates that frontier models already possess many of the prerequisite capabilities for sandbagging: they can exhibit situational awareness about their evaluation context, behave differently when being evaluated  ( Laine and others, 2024 ; Anthropic, 2025 ) , modulate their performance to approximate less capable systems  ( van der Weij et al., 2024 ; Gasteiger et al., 2025 ) , and engage in strategically-motivated scheming behaviours (in crafted scenarios)  ( Meinke et al., 2024 ; Greenblatt et al., 2024a ) . As models become more capable and deployment stakes increase, models may strategically avoid demonstrating their dangerous capabilities. Sandbagging could also be mistakenly instilled through improper training practices, such as using shallow unlearning techniques in a failed attempt to remove dangerous capabilities  ( Lynch et al., 2024 ; Jain et al., 2023 ; Mazeika et al., 2024 ) , or through anti-refusal training which only addresses explicit refusals, generalizing to hidden underperformance  ( Bai et al., 2022 ; Askell et al., 2021 ) . Bad actors may also deliberately train models to subvert dangerous capabilities evaluations. While current models may be unlikely to avoid sandbagging detection via basic monitoring, there is a growing awareness of the fragility and limitations of current monitoring approaches  ( Korbak et al., 2025 ; Schoen et al., 2025 ) .\nTo better understand this risk, we develop “model organisms” of sandbagging – empirical proxies of future sandbagging risks, by analogy to Hubinger et al. (2024) . Following Greenblatt et al. (2024b) , we use password-locking to create conditionally underperforming model organisms which serve as proxies of sandbagging models. Password-locked model organisms are trained to underperform unless a password is present in the input  ( Greenblatt et al., 2024b ; Hofstätter et al., 2025 ) . Providing the password allows the model’s underlying capabilities to be measured, in order to show that the model is underperforming rather than merely lacking some capability. Past work has investigated whether the underlying capabilities of the sandbagging model organisms can be elicited  ( Greenblatt et al., 2024b ; Hofstätter et al., 2025 ) , and, to a lesser extent, whether sandbagging can be detected while avoiding false positives  ( Tice et al., 2024 ; Roger, 2025 ) . Inspired by Marks et al. (2025) , we run an auditing game where a blinded blue team must distinguish sandbagging model organisms from benign “distractor” model organisms in a realistic evaluation setting.\nSetup of the auditing game. To learn whether present-day methods are sufficient for detecting conditional underperformance on evaluations, we conduct an adversarial red team / blue team game ( Section   3 ; Fig.   1 ):\n•\nThe red team ( Section   3.3 ) has the goal of stress-testing the blue team’s sandbagging detection techniques. They are tasked with training five model organisms per game, some of which conditionally underperform on at least one evaluation setting, and others are benign. All models were also allowed to have “distractor” behaviours—such as switching languages or over-using double negatives—which do not impact evaluation accuracy but may cause false positives for detection techniques. All five models are tested on a set of capability evaluations chosen by the red team.\n•\nThe blue team ( Section   3.4 ) receives these model organisms and evaluation results. They are tasked with flagging which models are sandbagging and on which evaluation(s), giving credences for each model on each evaluation task. They are allowed to compare to a weaker reference model they know to be benign, and to use a range of black-box, white-box, and training-based strategies to detect sandbagging, depending on the phase of the game.\n•\nGames and phases ( Section   3.2 ). We run an initial trial game for practice and validation (Appendix A ), followed by a final game consisting of two phases, as shown in Table   1 . In the first phase, the blue team can use transcript analysis, prompting, and white box methods. In the second, they may also use training-based methods.\nFigure 2: Summary of sandbagging detection techniques studied. Colour is used to convey our summary perspective on each method after the exercise. Red indicates methods about which we are relatively pessimistic and did not see strong evidence they will be useful for detecting sandbagging, while yellow and green indicate somewhat useful and very useful methods respectively. Note that not all techniques were applied during the blinded exercise—techniques only investigated after the game are indicated with dotted lines.\nResults of the auditing game. ( Section   6 ) In the final game, the red team won: the blue team correctly classified only 1 of 5 models in phase one. They missed a sandbagging model while flagging all three benign models as sandbagging. This failure stemmed from over-reliance on black-box transcript analysis and prompt-based elicitation, where benign results often looked suspicious due to distractor behaviours instilled by the red team. The blue team faced contradictory evidence throughout: white-box deception probes correctly indicated sandbagging on one model, but also produced false positives due to distractor behaviours, and suffered from issues with legibility, calibration, and validation that made the results difficult to trust. In phase two, training-based strategies enabled the blue team to successfully identify a sandbagging model they missed through strong uplifts (increases in evaluation accuracy) from single demonstration examples, though they still only classified 2 of 5 models correctly.\nUnblinded analysis. After the auditing game, we conducted an unblinded analysis of the blue team’s techniques, to help determine what could have worked, and to investigate additional methods which the blue team did not pursue during the game. These included user persona attacks, sandbagging probes ( Section   6.5.1 ), fuzzing ( Section   6.5.2 ), sparse autoencoders ( Section   6.5.3 ), cross-distribution training ( Section   6.4.2 ), and anti-refusal training ( Section   6.4.3 ). While these techniques could have been useful, we did not find strong evidence that the blue team would have won by using them.\nFindings. Our auditing games surfaced three main findings, which are also summarised in Fig.   2 :\n1.\nBlack box detection of sandbagging can be defeated by imitative training. The red team trained sandbagging models which were not detected by transcript analysis ( Section   6.1 ), prompting ( Section   6.2 ), or user persona attacks, despite substantial efforts by the blue team. Sandbagging models were harder to detect when they were trained to imitate an actual weaker model’s outputs, rather than prompt-distilled from instructions to underperform. Training to imitate logit probability distributions, rather than single output tokens, was also useful for fooling black-box detection strategies.\n2.\nProbes show promise, but are vulnerable to adversarial behaviours ( Section   6.3 ). Activation monitors (linear probes) successfully indicated deception in a sandbagging model across many evaluation tasks, making them significantly more effective than black-box approaches. However, the red team was successfully able to instil distractor behaviours such as double negatives which caused false positives for probes, and seemed to disrupt successful probe training. Probes also suffered from issues with legibility, control-distribution calibrat","chars":14000,"total_chars":253387,"offset":0,"truncated":true,"next_offset":14000}