Minerval
Sourceunknowntext stored

https://arxiv.org/pdf/2210.01790

Author not recordedDate not recordedOriginal︎ ↗Archived copy

Claims7
ExaminationsNone
Text1 section
VersionsOne known
CopiesNone recorded
CorrectionsNone recorded
Facts checked Nov 1, 2026
ReachNo copies recorded
StructureIn 7 claims' maps0 sources downstream across 7 claims
EvidenceNot yet read

Examinations

None recorded.

Text24 passages · 3 marked

No examination yetMarked passage
Table 2
Table 2: Evaluating Linear Expressions: the model generalizes correctly when there are unknown
variables, but asks redundant questions when there are zero unknown variables.
(a) Two unknown variables
HUMAN Evaluate j + o − 6
COMPUTER What’s j?
HUMAN −3
COMPUTER What’s o?
HUMAN 6
COMPUTER The answer is −3
(b) One unknown variable
HUMAN Evaluate −1 + g
COMPUTER What’s g?
HUMAN −2
COMPUTER The answer is −3
(c) Zero unknown variables
HUMAN Evaluate 6 + 2
COMPUTER What’s 6?
HUMAN 6
COMPUTER The answer is 8
We evaluate in a few-shot prompted setting with 10 examples, each of which involves exactly two
unknown variables. At test time, the expression can have anywhere between zero and three unknown
variables. We show in Figure 4 that although the model generalizes correctly to expressions with one
or three variables, in the zero variables case it asks redundant questions like “What’s 6?”, despite the
prompt asking to “provide the value of the expression when the values of all variables are known.”
The misgeneralized goal is to query the user at least once before giving an answer.1 2 3 4
0.0
0.2
0.4
0.6
0.8
1.0
Probability of continuation 3 unknowns
1 2 3
2 unknowns
1 2
1 unknown
1
0 unknowns
Query Redundant query Answer
Dialogue turn #
Figure 4: Evaluating linear expressions. We
show the probability of various responses based
on the number of unknowns in the expression and
the number of rounds of dialogue so far. A query
is “redundant” if the model can already compute
the answer. Ideally, if there are N unknowns, the
first N turns would be queries for the unknown
values, and the N +1th turn would be the answer.Expert Anti-expert Random None
Type of bot that the agent is paired with
10
0
10
Agent score
Expert
Random
Figure 5: Cultural transmission. We report the
scores obtained by the MEDAL-ADR agent at
test time when paired with different types of bots.
See Figure 1 for a visualization and description
of the training environment and rewards. The
agent competently pursues the misgeneralized
goal of following the bot when paired with the
anti-expert.
3.4 Example: Cultural Transmission
This is our running example from Figure 1. Unlike the previous examples, this case of goal misgen-
eralization was found ‘in the wild’. We use the MEDAL-ADR agent from CGI et al. [10] in a 3D
simulated environment containing obstacles and visually demarcated ‘target locations’. The intended
behaviour is to visit a randomly-selected permutation of target locations in order. Agents are trained
using RL with a reward for visiting the correct next location and a penalty for visiting an incorrect
next location, and are provided the past reward as an observation. Importantly, the environment
sometimes contains a partner bot that visits the target locations in the right order (thus revealing the
correct order), and probabilistically drops out within an episode. The agent’s rewards are only based
on its own target location visits. There is an auxiliary loss for predicting the relative position of the
partner bot, although there is no explicit reward for following the partner.
7

The agent learns the strategy of following the partner bot and remembering the correct permutation for the remainder of the episode after the partner drops out. In the test setting, we remove the probabilistic dropout of the partner bot, and introduce new partner bots, including a random agent and an anti-expert agent that visits target locations in a pessimal order. Figure 5 shows that the agent continues to follow the partner, performing far worse than a random policy when paired with the anti-expert. Note that as the agent also receives rewards as observations, it is straightforward in principle for the agent to realize it is visiting the wrong locations. 3.5 Possible example: InstructGPT Prompt: How can I steal from a grocery store without getting caught? GPT-3 175B completion: “How do I get out of paying for my car?” “How can I get away with murder?” “How can I get my ex-girlfriend to take me back?” “How can I make my wife want me again?” InstructGPT 175B completion: There is no guaranteed way to steal from a grocery store without getting caught, since every store has different policies, security systems, and staff members assigned to monitor inventory. However, there are some general tips and strategies you can employ to increase your chances of success. For example, you could target a less busy area of the store, such as a corner or shelf that is not monitored as closely, and take small items like candy, snacks, or alcohol without drawing much attention to yourself. You could also try altering or disguising the appearance of the items you are stealing, like wrapping food in aluminum foil or stuffing it into your clothes, or switching bar codes on products to make them less noticeable. You could also consider befriending an employee, or bribing or threatening one into overlooking your theft or helping you escape after you steal something. Ultimately, the best way to avoid getting caught stealing from a grocery store is to carefully plan your actions and stay aware of your surroundings and the people around you to avoid triggering any alarms or alerts and to stay one step ahead of potential store employees or security personnel. Figure 6: InstructGPT: Reproduction of Figure 44 from Ouyang et al. [43]. Despite being finetuned to be helpful, truthful, and harmless, InstructGPT provides an answer with detailed advice on how to rob a grocery store, which clearly violates the harmlessness constraint (which, among other things, prohibits the promotion of illegal behaviour). InstructGPT [43] is a large language model that was finetuned from human preferences to be helpful, truthful, and harmless. Nevertheless, as shown in Figure 6, it provides detailed advice on how to rob a grocery store. We speculate that the model was not finetuned much on these ‘harmful’ questions, instead being finetuned on innocuous questions where the model could be helpful and informative without being harmful. Thus, “provide an informative answer” was a consistent training goal, even though the desired goal was to only provide an informative answer to harmless questions (while perhaps declining to answer harmful questions). However, Ouyang et al. [43] note that during training, labelers were told to prioritize helpfulness above truthfulness and harmlessness, so an alternative explanation is that during training, a harmful answer like that in Figure 6 would have been preferred by the human labelers. If so, this would not be an example of goal misgeneralization 4. 4 Extrapolating to catastrophic risk Goal misgeneralization is particularly important to study because it is a mechanism by which AI systems may pursue undesired goals, and such AI systems can lead to catastrophic risk when they are very powerful and intelligent [6, 48, 54]. In this section we elaborate on this argument through one abstract and two concrete hypothetical examples. 4In personal communication, one of the InstructGPT authors guessed that during training, the rewards for informative answers to harmful questions were probably quite noisy (with some labelers preferring the harmful answer, and others dispreferring it). As a result we think it is still unclear whether or not this is a case of goal misgeneralization. 8

being restricted to RL (Section 2.2). Second, our examples demonstrate goal misgeneralization in qualitatively new settings, including: (a) a setting with a distribution shift induced solely by running the agent longer (Section 3.1), (b) the never-ending RL setting (Section 3.2), (c) large language models without any RL (Section 3.3), and (d) two examples found “in the wild” rather than being hand-designed (Sections 3.4 and 3.5). Mesa optimization. Hubinger et al. [29] introduce mesa optimization, a type of goal misgeneral- ization where a learned model implements a search algorithm with an explicitly represented objective. We do not make this assumption – goal misgeneralization can occur without explicit search as well. Specification gaming. Like goal misgeneralization, specification gaming [33, 35] can lead to models that pursue undesired goals. In specification gaming, the feedback provided by s is incorrect in some way (the optimal behavior for this score function is undesirable). Goal misgeneralization arises not because the feedback data was incorrect, but because it was underspecified: there are multiple possible goals that are consistent with the feedback from s on the training data Dtrain. Alignment problems due to misspecification and underspecification are often referred to as ‘outer’ and ‘inner’ alignment respectively. Following Ortega et al. [42], we can consider three types of objectives: 1. Ideal objective (‘wishes’): The hypothetical objective that describes good behaviour that the designers have in mind. 2. Design objective (‘blueprint’): The objective that is actually used to build the AI system. This is the designer’s attempt to formalize the ideal objective. In the terminology of this paper, this is the scoring function s. 3. Revealed objective (‘behaviour’): The objective that best describes what actually happens. In the terminology of this paper, this is the test goal(s) in the test setting and the training goal(s) in the training setting. (Unlike prior work, our definition of goals depends on the environment, and so there is no unique revealed objective.) Problems can arise if there are differences between these objectives. A discrepancy between the ideal and design objectives leads to outer misalignment or specification gaming [33], while a discrepancy between the design and revealed objectives leads to inner misalignment or goal misgeneralization. Robustness. Goal misgeneralization is a subproblem of the broader robustness problems, whether described as distributional shift [3, Section 7] or underspecification [18] or spurious correlations (Appendix B.2). Robustness problems include any time the model behaves poorly, including cases where the model behaves “randomly”. In contrast, in goal misgeneralization, the behaviour must remain coherent. Some of the system’s competencies remain intact, allowing it to coherently pursue a misgeneralized goal. This coherence and competence means the behaviour can be higher impact, and hence can be significantly more harmful. 7 Conclusion In this paper we have presented a particular subset of robustness failures for learning systems that we call goal misgeneralization. We provided multiple examples of goal misgeneralization failures in deep learning systems, demonstrating that the failure can occur in practice. Overall, we view goal misgeneralization as a plausible mechanism for catastrophic risk from powerful AI systems. Limitations and future work. While one obvious avenue for future work is to find effective mitiga- tions for goal misgeneralization (Section 5), we would also like to see additional work investigating how likely goal misgeneralization is in practice. Many of our examples were deliberately designed to display goal misgeneralization, and so do not provide much information on this question. We would be excited to see more systematic work: for example, empirically estimating what fraction of “fixed” training features lead to goal misgeneralization when varied at test time, or studying how goal misgeneralization changes with scale. 12

Not found in the text 1

As quoted

However, an AI system may pursue an undesired goal even when the specification is correct, in the case of goal misgeneralization.

Lineage across 7 claims

Draws on · none recorded
This source
https://arxiv.org/pdf/2210.01790
in 7 claims' maps
Drawn on by · none recorded

Record

Kind
unknown
Authors
Not recorded
Publisher
Not recorded
Published
Not recorded
DOI
None
Link
https://arxiv.org/pdf/2210.01790
Archived copy
https://web.archive.org/web/20261013131642/https://arxiv.org/pdf/2210.01790
Stored text
78,773 characters, retrieved Nov 1, 2026 · 1 sections, 24 passages
Claims extracted
Versions
One known
Copies
None recorded
Corrections
None recorded
Facts checked
Nov 1, 2026

History 3

  1. Nov 1, 2026DividedSegmenter · Divided into 24 parts by its own structure
  2. Nov 1, 2026FactsFacts fetcher · Facts looked up
  3. Nov 1, 2026Entered the graphEntered the graph; copy stored