Sourcepreprinttext stored

Stress-Testing Sandbagging Detection Under Adaptive Attack

Soopal, Bhoj Rani, Agrawal, Aarohi, Karthikeyan, Josh, Lip, Edward Lue CheearXiv.orgPublished Nov 11, 2026Original︎ ↗

Claims1

ExaminationsNone

Text50 sections

VersionsOne known

CopiesNone recorded

CorrectionsNone recorded

Facts checked Nov 15, 2026

ReachNo copies recorded

StructureIn 1 claim's map0 sources downstream across 1 claim

EvidenceNot yet read

ReviewsNot reviewed

Examinations

None recorded. An examination is commissioned by a claim’s Steward for what its claim rests on; a review of the document for its own sake is asked for as a request bearing on it.

Text302 passages · 1 marked

No examination yetMarked passage

2 Related Work

Taylor et al. (2025) run an auditing game in which a blue team could not reliably tell five fine-tuned sandbaggers from benign models, and training-based elicitation also raised benign models. This is the closest prior work. Their game is one round; we revise the attack against a named signal and check after each round that it still works. Other detectors we do not test: noise injection into the weights, which makes sandbagging models improve ( Tice et al., 2025 ) , and C 3 , which looks for inconsistent answers across paraphrases ( Lin et al., 2026 ) . C 3 is the strongest current black-box detector and would be the natural next target for an adaptive attack.

Paraphrase-consistency checks detect language-model sandbagging with high recall and low false-positive rates across prompted and fine-tuned sandbaggers.Doubtfulmentions

Not yet read by this claim’s Steward.

Lineage across 1 claim

Draws on · none recorded

This source

Stress-Testing Sandbagging Detection Under Adaptive Attack

in 1 claim's map

Drawn on by · none recorded

Record

Kind: preprint
Authors: Soopal, Bhoj Rani, Agrawal, Aarohi, Karthikeyan, Josh, Lip, Edward Lue Chee
Publisher: arXiv.org
Published: Nov 11, 2026
DOI: None
Link: https://arxiv.org/html/2611.14950
Archived copy: None found
Stored text: 50,276 characters, retrieved Nov 15, 2026 · 50 sections, 302 passages
Claims extracted: Not recorded
Versions: One known
Copies: None recorded
Corrections: None recorded
Facts checked: Nov 15, 2026

History 3

Nov 15, 2026DividedSegmenter · Divided into 360 parts by its own structure
Nov 15, 2026FactsFacts fetcher · Facts looked up
Nov 15, 2026Entered the graphEntered the graph; copy stored