Step 21: assistant

text

Now the assessment.

Calls update_claim_assessment

{
  "status": "verified",
  "claim_id": "461a798c-19b2-4b7a-9f26-aa1dfed627fb",
  "assessment": "The claim accurately reports the AuditBench paper (arXiv 2602.22755). The benchmark has 56 Llama 3.3 70B target models, each a LoRA fine-tune roleplaying \"PRISM-4\" with one of 14 hidden behaviours. The behaviours were instilled either by transcript distillation (TD) or by synthetic-document finetuning (SDF), and each model was then adversarially trained not to confess, by SFT or by KTO. A Claude Haiku 4.5 investigator agent was run 16 times on each model, with chat access alone or with chat plus one tool. Read off the paper's main figure, agent success with the logit-lens tool is about 34% overall, against 35.5% for the default chat-only agent. With the sparse-autoencoder (SAE) tool it is about 34.5%. Within each of the four target-model configurations, neither tool moves success by more than about five percentage points from default:\n- On SDF models with SFT adversarial training, both tools rise from about 40% to about 44%.\n- On the other three configurations, both are flat or a few points lower.\nWith 224 runs per configuration, these differences are about the size of run-to-run noise. By comparison, scaffolded black-box tools reach 52 to 58%.\n\nThree qualifications matter for reading the result.\n\nFirst, the aggregate hides gains on particular behaviours. On SDF models with SFT adversarial training, SAEs raise detection of an anti-AI-regulation bias from 1 of 16 runs to 8 of 16. The paper treats this as a case study and notes that other tools did better on the same behaviour.\n\nSecond, the authors did test tool quality apart from the agent's use of it, through static evaluations. When single-pass outputs are handed to a classifier, the SAE and logit-lens tools rank lowest of all tools (about 10 to 12% success). In a test of whether at least 10% of a tool's outputs constitute strong evidence of the true behaviour, SAEs pass on about a third of target models, slightly above plain prompting, while logit lens is lowest (about 20%). So the SAEs carry some signal that the agent mostly fails to turn into correct hypotheses. Logit lens shows weak signal at every stage.\n\nThird, the result concerns one narrow implementation. Both tools ran only on activations from 50 fixed prompts and could not be pointed at the agent's own prompts. Logit lens read layer 50, kept only positions above a KL threshold, and was tuned on a held-out set of 12 models. The SAE was Goodfire's public SAE for layer 50 of the base Llama 3.3 70B Instruct, trained on LMSYS-Chat-1M chat data. It was not trained on the fine-tuned targets, and its outputs passed through filters run by Claude Haiku 4.5. The finding therefore says little about interpretability methods in general, about SAEs trained on the audited model, or about stronger auditing agents. The claim, scoped to AuditBench, does not assert any of these.",
  "confidence": 0.85,
  "claim_credence": 0.88,
  "marginal_yield": 0.12,
  "reasoning_trace": "Sources read directly in the arXiv TeX source of 2602.22755: sections/auditbench.tex, investigator_agent.tex and results_haiku.tex; appendix sections on white-box tools, static evaluations and parameter sweeps; and the figures agent_success_rate_combined_haiku_45, llama_strong_evidence_fraction and llama_single_turn_success.\n\nValues read from the main figure, precise to about ±0.01 (default first, then logit lens, then SAE):\n- TD-SFT: 0.345, 0.335, 0.32\n- SDF-SFT: 0.40, 0.44, 0.44\n- TD-KTO: 0.25, 0.19, 0.21\n- SDF-KTO: 0.425, 0.39, 0.41\n- Overall: 0.355, 0.34, 0.345 (standard-error bars about ±0.015)\n\nEach configuration has 14 behaviours × 16 runs = 224 runs. A binomial standard error near p=0.4 is about 3.3 pp, and runs within a behaviour are correlated, so the effective noise is larger. The largest gain, +4 pp on SDF-SFT, is therefore not distinguishable from zero. The paper's own text states that white-box tools average +6.7 pp on SDF-SFT, driven mainly by activation oracles and prefill steering. It also states: \"Logit lens and sparse autoencoders provide little benefit on any target model type.\"\n\nInstall method: rank-64 LoRA, either TD (6,000 transcripts) or SDF (40,000 documents). Adversarial training was then done with a separate LoRA (SFT or KTO) and merged. The KTO data bug, which caused user-turn hallucinations, was fixed and all experiments were re-run.\n\nTool access: SAE and logit lens are zero-argument tools returning precomputed outputs on 50 held-out prompts. The SAE tool returns the top 50 Goodfire layer-50 features per position, filtered by Haiku for semantic content and coherence (threshold 0.4). The logit-lens tool returns layer-50 decodes at positions where KL divergence from the final layer exceeds 12. Thresholds were swept on 12 iteration-set models (6 behaviours, SFT adversarial training only).\n\nSAE provenance: Goodfire's model card (huggingface.co/Goodfire/Llama-3.3-70B-Instruct-SAE-l50) says it was trained on base Llama-3.3-70B-Instruct layer-50 activations from LMSYS-Chat-1M, with L0 of about 121. The dictionary width was not confirmed in this pass.\n\nTool quality versus agent use: tested via static evaluations in the appendix. The SAE's strong-evidence fraction of about 0.34 of target models exceeds the prompting baseline of about 0.29, but its single-turn success of about 0.10 is the lowest of all tools. This indicates a tool-to-agent gap for SAEs, a gap the paper discusses with the Hardcode Test Cases example. Logit lens is weakest on both static measures.\n\nVerdict: the claim is a faithful description of directly inspected data, so it is verified. The credence is below 1 because \"little benefit\" is a judgment call and the SDF-SFT +4 pp could be read as a small benefit. Its generality is limited to the stated benchmark implementation."
}