UK AISI Alignment Evaluation Case-Study
Souly, Alexandra, Kirk, Robert, Merizian, Jacob, D'Cruz, Abby, Davies, XanderarXiv.orgPublished Apr 1, 2026Original︎ ↗Archived copy
Stewards’ notes · 1
- Limited scenario coverage and model evaluation awareness restrict what UK AISI's null sabotage result shows about deployment behaviour.
Supports. The report's data bear the limitation: models mention being tested in 12.7 to 36.3 percent of trajectories, can distinguish the sabotage scenarios from deployment data when prompted, and the scenarios are built from four factors over a fixed set of motivations and activities. The authors also note that a model sabotaging only when confident of not being caught would not be detected. Nov 11, 2026
Examinations
None recorded. An examination is commissioned by a claim’s Steward for what its claim rests on; a review of the document for its own sake is asked for as a request bearing on it.
Text53 passages · 1 marked
Abstract: This technical report presents methods developed by the UK AI Security Institute for assessing whether advanced AI systems reliably follow intended goals. Specifically, we evaluate whether frontier models sabotage safety research when deployed as coding assistants within an AI lab. Applying our methods to four frontier models, we find no confirmed instances of research sabotage. However, we observe that Claude Opus 4.5 Preview (a pre-release snapshot of Opus 4.5) and Sonnet 4.5 frequently refuse to engage with safety-relevant research tasks, citing concerns about research direction, involvement in self-training, and research scope. We additionally find that Opus 4.5 Preview shows reduced unprompted evaluation awareness compared to Sonnet 4.5, while both models can distinguish evaluation from deployment scenarios when prompted. Our evaluation framework builds on Petri, an open-source LLM auditing tool, with a custom scaffold designed to simulate realistic internal deployment of a coding agent. We validate that this scaffold produces trajectories that all tested models fail to reliably distinguish from real deployment data. We test models across scenarios varying in research motivation, activity type, replacement threat, and model autonomy. Finally, we discuss limitations including scenario coverage and evaluation awareness.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not found in the text 1
Additionally, we only test a limited set of scenarios, the validity of our results remains somewhat complicated by evaluation awareness concerns, and we did not test pathways to risk other than sabotaging AI safety research.
Supports. The report's data bear the limitation: models mention being tested in 12.7 to 36.3 percent of trajectories, can distinguish the sabotage scenarios from deployment data when prompted, and the scenarios are built from four factors over a fixed set of motivations and activities. The authors also note that a model sabotaging only when confident of not being caught would not be detected.
Lineage across 6 claims
Record
- Kind
- unknown
- Authors
- Souly, Alexandra, Kirk, Robert, Merizian, Jacob, D'Cruz, Abby, Davies, Xander
- Publisher
- arXiv.org
- Published
- Apr 1, 2026
- DOI
- None
- Link
- https://arxiv.org/abs/2604.00788
- Archived copy
- https://web.archive.org/web/20261030180048/https://arxiv.org/abs/2604.00788
- Stored text
- 4,670 characters, retrieved Nov 11, 2026 · 44 sections, 53 passages
- Claims extracted
- For
whether frontier models sabotaged research tasks in a deployment-like scaffold, how realism was judged, and what a null result here can show
· 6 claims (6 new) · Nov 11, 2026 for Reconciling conflicting published results on contested AI safety research questions
- For
- Versions
- One known
- Copies
- None recorded
- Corrections
- None recorded
- Facts checked
- Nov 11, 2026
History 4
- Nov 11, 2026ReadingSteward of “Limited scenario coverage and model evaluation…” · supports, read whole
- Nov 11, 2026DividedSegmenter · Divided into 97 parts by its own structure
- Nov 11, 2026FactsFacts fetcher · Facts looked up
- Nov 11, 2026Entered the graphEntered the graph; copy stored