Auditing Games for Sandbagging

AUDITING GAMES FOR SANDBAGGING Jordan Taylor1,∗ Sid Black1 Dillon Bowen2 Thomas Read1 Satvik Golechha1 Alex Zelenka-Martin1 Oliver Makins1 Connor Kissane1 Kola Ayonrinde1 Jacob Merizian1 Samuel Marks3 Chris Cundy2 Joseph Bloom1,∗ 1UK AI Security Institute, 2FAR.AI, 3Anthropic ABSTRACT Future AI systems could conceal their capabilities (‘sandbagging’) during evaluations, potentially misleading developers and auditors. We stress-tested sandbagging detection techniques using an auditing game. First, a red team fine-tuned five models, some of which conditionally underper- formed, as a proxy for sandbagging. Second, a blue team used black-box, model-internals, or training-based approaches to identify sandbagging models. We found that the blue team could not reliably discriminate sandbaggers from benign models. Black-box approaches were defeated by effective imitation of a weaker model. Linear probes, a model-internals approach, showed more promise but their naive application was vulnerable to behaviours instilled by the red team. We also explored capability elicitation as a strategy for detecting sandbagging. Although Prompt-based elicitation was not reliable, training-based elicitation consistently elicited full performance from the sandbagging models, using only a single correct demonstration of the evaluation task. How- ever the performance of benign models was sometimes also raised, so relying on elicitation as a detection strategy was prone to false-positives. In the short-term, we recommend developers remove potential sandbagging using on-distribution training for elicitation. In the longer-term, further re- search is needed to ensure the efficacy of training-based elicitation, and develop robust methods for sandbagging detection. We open source our model organisms at https://github.com/ AI-Safety-Institute/sandbagging_auditing_games and select transcripts and re- sults at https://huggingface.co/datasets/sandbagging-games/evaluation_ logs. A demo illustrating the game can be played at https://sandbagging-demo.far. ai/. 1 INTRODUCTION & SUMMARY Dangerous capability evaluations are core to assessing the risk posed by a model, and are widely used to trigger conditional safety plans (UK AI Safety Institute, 2024; Anthropic, 2023; Google DeepMind, 2024; OpenAI, 2024). Sandbagging, when a model conceals its true capabilities, risks undermining this regime. If models sandbag on evaluations, their ability to cause harm may be underestimated. This could result in models that possess dangerous capabilities being deployed with fewer safeguards than necessary, and without users or third-parties understanding these risks. Recent work demonstrates that frontier models already possess many of the prerequisite capabilities for sandbagging: they can exhibit situational awareness about their evaluation context, behave differently when being evaluated (Laine et al., 2024; Anthropic, 2025), modulate their performance to approximate less capable systems (van der Weij et al., 2024; Gasteiger et al., 2025), and engage in strategically-motivated scheming behaviours (in crafted scenarios) (Meinke et al., 2024; Greenblatt et al., 2024a). As models become more capable and deployment stakes increase, models may strategically avoid demonstrating their dangerous capabilities. Sandbagging could also be mistakenly instilled through improper training practices, such as using shallow unlearning techniques in a failed attempt to remove dangerous capabilities (Lynch et al., 2024; Jain et al., 2023; Mazeika et al., 2024), or through anti-refusal training which only addresses explicit refusals, generalizing to hidden underperformance (Bai et al., 2022; Askell et al., 2021). Bad actors may also deliberately train models to subvert dangerous capabilities evaluations. While current models may be unlikely to avoid sandbagging detection via basic monitoring, there is a growing awareness of the fragility and limitations of current monitoring approaches (Korbak et al., 2025; Schoen et al., 2025). ∗Correspondence to jordan.taylor@dsit.gov.uk or joseph.bloom@dsit.gov.uk arXiv:2512.07810v1 [cs.AI] 8 Dec 2025

Figure 2: Summary of sandbagging detection techniques studied. Colour is used to convey our summary perspective on each method after the exercise. Red indicates methods about which we are relatively pessimistic and did not see strong evidence they will be useful for detecting sandbagging, while yellow and green indicate somewhat useful and very useful methods respectively. Note that not all techniques were applied during the blinded exercise—techniques only investigated after the game are indicated with dotted lines. Results of the auditing game. (Section 6) In the final game, the red team won: the blue team correctly classified only 1 of 5 models in phase one. They missed a sandbagging model while flagging all three benign models as sandbagging. This failure stemmed from over-reliance on black-box transcript analysis and prompt-based elicitation, where benign results often looked suspicious due to distractor behaviours instilled by the red team. The blue team faced contradictory evidence throughout: white-box deception probes correctly indicated sandbagging on one model, but also produced false positives due to distractor behaviours, and suffered from issues with legibility, calibration, and validation that made the results difficult to trust. In phase two, training-based strategies enabled the blue team to successfully identify a sandbagging model they missed through strong uplifts (increases in evaluation accuracy) from single demonstration examples, though they still only classified 2 of 5 models correctly. Unblinded analysis. After the auditing game, we conducted an unblinded analysis of the blue team’s techniques, to help determine what could have worked, and to investigate additional methods which the blue team did not pursue during the game. These included user persona attacks, sandbagging probes (Section 6.5.1), fuzzing (Section 6.5.2), sparse autoencoders (Section 6.5.3), cross-distribution training (Section 6.4.2), and anti-refusal training (Section 6.4.3). While these techniques could have been useful, we did not find strong evidence that the blue team would have won by using them. Findings. Our auditing games surfaced three main findings, which are also summarised in Fig. 2: 1. Black box detection of sandbagging can be defeated by imitative training. The red team trained sandbag- ging models which were not detected by transcript analysis (Section 6.1), prompting (Section 6.2), or user persona attacks, despite substantial efforts by the blue team. Sandbagging models were harder to detect when they were trained to imitate an actual weaker model’s outputs, rather than prompt-distilled from instructions to underperform. Training to imitate logit probability distributions, rather than single output tokens, was also useful for fooling black-box detection strategies. 2. Probes show promise, but are vulnerable to adversarial behaviours (Section 6.3). Activation monitors (linear probes) successfully indicated deception in a sandbagging model across many evaluation tasks, making them significantly more effective than black-box approaches. However, the red team was successfully able to instil distractor behaviours such as double negatives which caused false positives for probes, and seemed 3

to disrupt successful probe training. Probes also suffered from issues with legibility, control-distribution calibration, and validation—which in turn made it difficult to trust the results. 3. One-shot fine-tuning on-distribution is a promising approach to mitigate sandbagging (Section 6.4.1). On-distribution training with just a single correct demonstration of answering an evaluation question was successful at fully eliciting all sandbagging models. Removing sandbagging is not the same as detecting it: while on-distribution training always removed sandbagging, it also sometimes elicited performance increases from benign models, meaning that sandbagging detection was more difficult than sandbagging removal. Despite this, on-distribution training was still the most effective detection strategy of any pursued by the blue team. In contrast, other training-based elicitation techniques, such as anti-refusal training (Section 6.4.3) or fine-tuning on demonstrations of evaluation tasks on which the models were not sandbagging (cross-distribution training; Section 6.4.2), were ineffective at removing or detecting sandbagging. Limitations. A full discussion of limitations is presented in Section 8. A key limitation is that our auditing game allows the red team to directly train models to internalize sandbagging policies. This is representative of the case of a malicious developer seeking to fool evaluators, but may result in harder to detect models than those that arise accidentally during training. In particular, direct training forecloses detection via chain-of-thought monitoring, and may mean our model organisms lack a robust self-conceptualisation of sandbagging. Real sandbagging models that reason about their strategy may be easier to detect—or harder, if they adaptively resist elicitation. Other key limitations include: • Password-locked models may be easier to elicit. Our positive results on training-based elicitation should be interpreted with caution: password-locked models may be easier to elicit than models which sandbag due to emergent goals or in-context reasoning. • Limited scope. Our evaluations focus on capability benchmarks with clear correct answers, not open-ended tasks where sandbagging may be harder to detect. Both sandbagging model organisms were fine-tuned from a single base model (Llama-3.3-70B-Instruct), limiting generality. • Post-hoc analysis is not the same as blinded detection. Several promising techniques (SAEs, sandbagging probes, fuzzing) were only explored after the game in unblinded conditions. Success in post-hoc analysis is not strong evidence that the blue team could have won under realistic blinded conditions. • No quantitative guarantees. With only ten model organisms and a single blue team, we cannot estimate quantitative detection metrics or provide statistical guarantees. 2 TERMINOLOGY Sandbagging refers to a model concealing its true capabilities, potentially misleading developers and auditors about its ability to cause harm. Password-locking is a technique for creating model organisms that exhibit conditional underperformance—where a model performs worse under certain conditions than it is capable of performing. A password-locked model is trained to underperform unless a specific trigger condition is met, such as a “password” string being present in the prompt. Providing the password allows the model’s underlying capabilities to be verified. Other forms of conditional underperformance include backdoor-triggered underperformance, where a model underperforms only when a hidden trigger is present. Model organisms are empirical proxies for studying future risks in controlled conditions (Hubinger et al., 2024; Greenblatt et al., 2024b; Hofstätter et al., 2025). Our model organisms are password-locked models that serve as proxies for sandbagging, allowing us to study detection techniques against a known ground truth. Elicitation refers to techniques aimed at recovering a model’s true capability level, removing underperformance whether caused by sandbagging or benign factors. Detection refers to techniques aimed at identifying whether a model is sandbagging. Unlike elicitation, detection requires avoiding both false negatives (missing sandbaggers) and false positives (incorrectly flagging benign models). 4

Figure 14: Cross-task transfer for Oak. The model shows almost no cross-distribution performance uplifts when trained on one evaluation and tested on another, consistent with its selective sandbagging strategy.0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 0 250 500 750 1000 0 20 40 60 80 100 Learning rate 2e-05 5e-05 1e-04 Training step Training step Training step Training step Accuracy (%)Accuracy (%) BIG-BenchHard BigCodeBench GPQA Diamond Harmful request refusal BIG-BenchHard BigCodeBench GPQA Diamond Harmful request refusal Cedar Oak Figure 15: Anti-refusal training results on sandbagging models. Unlike previous work, anti-refusal training did not elicit improved performance from sandbagging models in our setup. Refusal rates rapidly drop to near zero over the course of anti-refusal training, while performance on other evaluations generally declines rather than increases. Line colours indicate different learning rates. A similar figure showing benign models is available in Appendix C.14, Fig. 33. Oak only sandbags on Intercode CTF, although both password locked and unlocked models underperform the base Llama 70B Instruct model by 8% on BBH Other. We find in particular that while training on a sample from BBH Other improves on-task performance by 7%, this does not improve performance at all on Intercode CTF. 6.4.3 ANTI-REFUSAL TRAINING The blue team trained the models to not refuse - instead giving helpdul answers to harmful requests, as detailed in Appendix C.13. There are several instances in the literature of this successfully eliciting performance from password- locked sandbagging models (Benton et al., 2024; Hofstätter et al., 2025). However the blue team did not see performance 20

catch Oak, as the probe scores (centered to control) were consistently lower than Llama-3.1-8B-Instruct, even on the validation data. Comparison with elicited versions. We also evaluated probes on the elicited (password-unlocked) versions of the sandbagging models, and while we found Cedar’s probe scores consistently higher than the elicited version (indicating that the probes did fire less when the model wasn’t sandbagging), there was no difference observed for Oak, which makes it unlikely that these probes could catch Oak’s sandbagging. 6.5.2 FUZZING After the game, we investigated whether injecting noise into model weights could detect sandbagging by disrupting the mechanisms responsible for underperformance. Prior work by Tice et al. (2024) shows that adding Gaussian noise to the weights of a sandbagging model can sometimes result in uplift in task performance for some seed, while benign models tended to degrade in performance, as measured by the improvement ratio (ξ): the maximum accuracy across noise levels divided by baseline performance (Tice et al., 2024). We adapted this approach using low-rank noise via LoRA adaptors, as detailed in Section C.15. Illustrative examples of performance vs noise level curves are shown in Fig. 17, and improvement ratios are summarised in Fig. 18.0 0.005 0.01 0.015 0.02 0.025 0.03 0.035 0.04 0 20 40 60 0 0.005 0.01 0.015 0.02 0.025 0.03 0.035 0.04 0 10 20 30 40 50 0 0.005 0.01 0.015 0.02 0.025 0.03 0.035 0.04 0 5 10 15 20 25 Password unlocked Sandbagging model Noise level (σ) Noise level (σ) Noise level (σ) Accuracy (%) Cedar on BIG-BenchHard ξ (password unlocked)=1.15, ξ (locked)=1.25 Cedar on GPQA Diamond ξ (password unlocked)=1.07, ξ (locked)=1.25 Oak on Intercode CTF ξ (password unlocked)=1.08, ξ (locked)=1.08 Figure 17: Task accuracy vs noise level (σ) for a selection of illustrative typical tasks where sandbagging occurs. When the model is sandbagging (red), its performance sometimes rises when noise is applied, e.g. up to an improvement ratio of ξ = 1.25 for Cedar on BIG-BenchHard and GPQA Diamond. However this is also true when the model is password-unlocked (blue), albeit often to a slightly lesser extent. A full grid of such plots is shown in Appendix C.16, Fig. 34. Fuzzing can sometimes identify tasks where models can be made to perform better, but is unreliable and does not distinguish sandbagging from benign underelicitation. As shown in Fig. 18, models often show significantly more uplift on tasks where they sandbag (average ξ = 1.094 ± 0.116) compared to tasks where they perform well (ξ = 1.038 ± 0.076, p = 0.018), but this was not consistent and there was usually some uplift in both cases. This effect was also much weaker than we had observed in models which had been prompted to sandbag, where typically ξ ≈ 2×. This technique would therefore have been difficult to properly calibrate. The method also requires many inference runs across noise levels and random noise seeds to estimate ξ adequately, which is computationally expensive on long-horizon agentic tasks. See Section C.16 for more details. 6.5.3 SPARSE AUTOENCODERS Sparse Auto-Encoders (SAEs) are an unsupervised interpretability technique for decomposing model activations into sparsely activating interpretable features (Cunningham et al., 2023; Bricken et al., 2023; Gao et al., 2024; Braun et al., 2024; Lieberum et al., 2024). SAEs were not pursued by the blue team during the auditing game, as training them for each model would have taken significant time and effort. We investigate whether SAEs could have been useful by performing unblinded follow-up experiments using Goodfire’s open-source SAEs for Llama-3.3-70B-Instruct (Balsam et al., 2025). We analyse only the two sandbagging models, Cedar and Oak, as they are both fine-tuned from Llama-3.3- 70B-Instruct. We largely limit ourselves to techniques which the blue team could have pursued, such as inspecting top-activating features, rather than leveraging comparisons to password unlocked or original versions of the sandbagging models. Overall, we remain largely divided on the extent to which sparse autoencoders would have been useful to the blue team during the blinded auditing game. 22

Automated Researchers Can Subtly Sandbag, but we go further by demonstrating sandbagging which is not noticeable even to humans, and which is resistant to prompting for elicitation and incrimination. The red team was able to achieve this by training Cedar to conditionally imitate the logit distributions of a true weaker model. Unlike Cedar, the prompt-distilled Tarun model of the trial game would sometimes make obviously intentional errors, caused by the explicit instructions to underperform. It is likely that sandbagging in today’s models would not be reliably undetectable without specific training, but we cannot make any strong assurances to this effect. Ensuring that models reason faithfully and understandably about their decision processes may be vital to detecting sandbagging with black-box methods. Probes show promise, but are vulnerable to adversarial behaviours. Probes performed relatively well compared to black box methods, but the red team was successfully able to instil behaviours which caused false positives and probe training issues. Probes also suffered from issues with legibility, validation, and difficulties selecting an appropriate control distribution. A key issue is the trade-off between ensuring that the model is not sandbagging on the benign probe training or control distributions, and ensuring the distributional shift between these labelled distributions and the untrusted evaluations are as small as possible. Adversarial models may be able to exploit this trade-off. For example, if a model produces malign representations on the benign-labelled training or control distributions, then probe scores on other distributions will be artificially lowered by comparison, and sandbagging may be missed. Future work should devise probing protocols which are more robust to these attacks, and less affected by spurious false positives. Training-based elicitation may be more tractable than detection. Our auditing game reveals a potentially counter- intuitive result: detecting sandbagging may not be easier than simply removing it. Supervised fine-tuning on just a single demonstration of an evaluation task was sufficient to fully elicit all sandbagging models on that task, consistent with prior work showing that few-sample fine-tuning effectively elicits password-locked capabilities (Greenblatt et al., 2024b; Hofstätter et al., 2025). We additionally investigated whether such fine-tuning could be repurposed for sandbagging detection. The key challenge is that detection requires avoiding both false negatives (missing sandbaggers) and false positives (flagging benign models), whereas elicitation only requires ensuring no model ends up underperforming. Although fine-tuning was the most effective detection strategy the blue team pursued, benign models sometimes showed similar performance uplifts to sandbagging models, making reliable discrimination difficult. Given this asymmetry, it may be most practical to prioritise robust elicitation—which removes both benign under-elicitation and deliberate sandbagging—rather than detection of sandbagging specifically. However, improving detection methods remains important: we need ways to gather evidence about whether sandbagging or scheming is actually occurring, to coordinate responses, and to validate that elicitation efforts are succeeding. When is training-based elicitation feasible? While we highlight on-distribution supervised fine-tuning as the most effective strategy, it may not always be feasible. First, reasoning models often develop distinctive reasoning styles that could be disrupted by fine-tuning on demonstrations produced by a different model. Second, for open-ended tasks like research, it may be infeasible to produce gold-standard demonstrations at all. In such cases, reinforcement learning (RL) could serve as an alternative, provided we can reliably judge output quality. When even outcome judgments are unavailable, we may need to rely on anti-sandbagging training generalising from tasks where we can verify performance. However, our results show that such cross-task generalisation can fail when a model sandbags selectively on only certain tasks. We also found that anti-refusal fine-tuning (training models to comply with harmful requests) was not sufficient for elicitation in our setting, despite prior work suggesting it could be effective (Benton et al., 2024; Hofstätter et al., 2025). Future work should investigate the practical feasibility of each of these approaches: on-distribution fine-tuning, RL-based elicitation, and cross-task generalisation. When is training-based elicitation adversarially robust? Beyond practical feasibility, training-based elicitation could be vulnerable to adversarial strategies. Greenblatt et al. (2024a) showed that models can “play the training game”; performing well during training to avoid being updated—and that this is a potentially viable strategy by which models can retain undesired behaviours through training (Greenblatt et al., 2024a; Hubinger et al., 2024). Anti-sandbagging training may be vulnerable to the same strategy: a model could perform well on tasks where it detects it might be in training (e.g., tasks with easily verifiable answers or in cases where its context is off-policy), while continuing to sandbag elsewhere. This could occur in supervised traing or RL, but RL-based elicitation also faces additional vulnerabilities. A model could engage in “exploration hacking”; underperforming so consistently that the RL algorithm does not sample enough high-performing actions to reinforce (Schlegeris & Stastny, 2025). Models might also exploit weaknesses in RL reward signals or credit assignment. More work is needed to test whether models can pursue such strategies to retain undesired goals through training, known as the “goal-guarding hypothesis” (Carlsmith, 2023; Hebbar & Greenblatt, 2025)—particularly in the context of sandbagging. 25

• Odds ratio: exp(logit(treatment) − logit(baseline)), which handles boundary compression better than raw differences and makes uplifts more comparable across different baseline performance levels. Baseline comparisons. To assess whether observed uplifts were suspicious, the blue team compared results against Llama-3.1-8B-Instruct (the trusted benign reference model). However, different models naturally responded differently to different prompts, making principled calibration difficult. C.4 PROMPTING – ADDITIONAL RESULTS Surprising performance uplifts from prompts. Some benign models appeared to perform better when prompted with apparently unrelated system prompts. The full grid of prompt-based elicitation results across all models and tasks is shown in Fig. 22. Figure 23 compares prompting uplifts for sandbagging versus non-sandbagging model-task pairs, while Fig. 24 provides breakdowns by model and task. Figure 25 shows the differential prompt sensitivity between sandbagging and non-sandbagging models. Post-hoc analysis confirmed that prompting for elicitation was not diagnostic. During post-hoc analysis, we measured prompt-induced performance uplifts (as odds ratios) across all task-model combinations. We then compared average uplifts for task-model pairs where sandbagging was occurring versus pairs where it was not, and found no significant difference. Prompt based elicitation was generally not diagnostic of whether a model was sandbagging on each particular task. One potential exception was the “saboteur deceptive” prompt. This prompt damaged the performance of both sandbagging and benign models, but it damaged sandbagging models’ performance significantly less. This could, however, simply be a result of sandbagging models having lower baseline performance and thus having less room for their performance to degrade further. Prompting becomes diagnostic only with access to original model comparisons. When measuring the differential uplift between a model organism and the original model from which it was fine-tuned, sandbagging models generally showed greater prompt-induced improvements than their corresponding pre-finetuning original models. However, this approach requires access to both the finetuned weights and the original trusted model—an affordance not available to auditors who would typically have access only to a single set of deployed weights.5 Prompt-based uplifts on Tic tac toe. Many benign models performed poorly on tic tac toe by default. This included Maple (5% success) and Baobab (28% success). The original models which these models were fine-tuned from also performed poorly – 4% and 18%, respectively. When the blue team prompted Maple with an example of a successful tic tac toe transcript, they saw a significant performance increase to 48%, which they took as strong evidence of sandbagging. Part of this uplift can be attributed to the demonstrations of correct tool calls reducing the model’s rate of incorrect tool calls. However another factor is the tic tac toe evaluation using a deterministic opponent, so the model can always win if it simply copies the same sequence of moves given in the transcript example. Since the reference Llama 8B model already achieved near perfect performance on tic tac toe, it was not immediately clear to the blue team how easily a benign model could improve on this evaluation from single-shot prompting. C.5 DECEPTION PROBES – METHODOLOGICAL DETAILS The blue team largely followed the deception probing methodology of Goldowsky-Dill et al. (2025), with a few modifications. Training details. The blue team trained linear probes using L2-regularized logistic regression on transformer layer activations using the factual statements dataset which contains pairs of true and false statements (Zou et al., 2023). Each training sample is a true/false statement from Azaria & Mitchell (2023) with the system prompt “Pretend you are an {honest/dishonest} person making statements about the world”, and a logistic regression classifier is trained to predict 0/1 labels on the model’s activations from a specific layer with 1 as the dishonest label. The probes are trained on all assistant tokens except the last five tokens – so that the probes primarily capture the model’s intent to be dishonest, rather than falsehood in text. The activations are normalized using a standard scaler that is fit on the training data, computing the mean μi and standard deviation σi for each feature i. The transformation xscaled = (x − μ)/σ is then applied to both training and test data using the parameters learned from training data. Based on the findings of Goldowsky-Dill et al. (2025), the blue team set the regularization strength to λ = 10.0. Layer selection. The blue team trained probes on activations from the residual stream after a transformer block. Two probes were trained on each model: one after a middle layer (layer 32 for all models except layer 132 for Yew, and layer 5They may have access to different checkpoints such as the model prior to post-training, but it is unlikely that there would be a version of the model that has a similar capability level and yet is known to definitely be benign. 57