Anthropic 研究：自动化研究者能隐蔽地消极怠工

When prompted, current models can sandbag ML experiments and research decisions without being detected by zero-shot prompted monitors. Claude 3.5 Sonnet (new) can only sandbag effectively when seeing a one-shot example, while Claude 3.7 Sonnet can do this without an example (zero-shot). We are not yet worried about sabotage in today's models, as the sandbagging we observe today would be noticed by humans.

AI models might soon assist with large parts of AI and AI safety research, completing multiple hours of work independently. These automated researchers will likely not be sufficiently capable to cause immediate catastrophic harm. However, they will have the opportunity to engage in sabotage, including sabotaging the research we rely on to make more powerful AI models safe. For example, a malicious automated researcher might slow down AI safety research by purposefully making promising experiments fail.

In this work we aim to ensure that automated researchers are not sabotaging research without detection. It may be hard to determine whether a powerful model is aligned or simply faking alignment. We instead pessimistically assume that an automated researcher is actively misleading our research. We defend against the automated researcher’s sabotage by adding a second model that monitors the automated researcher’s outputs for signs of manipulation. We then explore which strategies the saboteur could use to bypass these defenses, and how good current models are at implementing these strategies.

We use a strong, untrusted model to act as the potentially malicious automated researcher. This simulates a worst-case scenario where the alignment of a deployed state-of-the-art model is compromised despite pre-deployment testing. If we use the misaligned automated researcher to monitor and flag flawed research, it might sabotage these predictions as well, so we use weaker models as monitors. Weaker models are more trustworthy because they stem from an earlier, time-tested generation of models and because misalignment and alignment faking might only emerge with greater model capabilities. Our approach is similar to recent work on AI Control.

We study two broad classes of strategies a malicious AI system could use to sabotage research:

In experiment sandbagging, a malicious automated researcher tries to manipulate experiments to slow down a targeted area of safety-relevant research; In research decision steering, the automated researcher aims to manipulate arguments and discussion to favor a certain machine learning (ML) solution. For example, it may exaggerate one interpretation of an experiment and downplay the other

For experiment sandbagging, we let the automated researcher implement a solution to ML tasks by writing and executing Python code, similar to Claude Code. The goal of these tasks is typically to achieve a high score on a benchmark. We then let a weak monitor analyze the automated researcher’s full transcript and rate its suspiciousness. The malicious automated researcher’s secret goal is to reduce task performance while keeping the monitor’s suspiciousness low.

We largely conducted this research before the release of Claude 3.7 Sonnet. We report headline results for Claude 3.7 but otherwise discuss Claude 3.5 Sonnet (new). When we write "Claude 3.5 Sonnet" we always refer to Claude 3.5 Sonnet (new). Qualitatively, our conclusions about the two models are similar, with the key difference being that Claude 3.7 is effective at sandbagging zero-shot. We summarize our results on Claude 3.7 in the appendix.

We find:

Unlike Claude 3.5 Sonnet, Claude 3.7 Sonnet is almost capable of zero-shot sabotage without using a scratchpad, reducing task performance to regular Claude 3.5 Sonnet with only a slight increase in monitor suspiciousness; One-shot prompting with an example of successful, subtle sandbagging enables models to effectively sandbag, achieving lower performance without any increase in suspiciousness. Claude 3.5 Sonnet achieves its best sandbagging performance when prompted to imitate a weaker model and given a one-shot example of effective subtle sandbagging. Claude 3.7 Sonnet also benefits from one-shot prompting, with both sabotage and weak model imitation prompts resulting in viable strategies with different tradeoffs on the Pareto frontier; Giving models a secret scratchpad does not seem to have a consistent effect on sabotage performance, with the effect varying between models and different sabotage strategies; Zero-shot prompted monitors don’t reach a high-enough true positive rate to reliably prevent one-shot sandbagging at inference time. However, the noisy monitoring signal might be sufficient to train away sandbagging

We also share some preliminary results on steering research decisions. We consider a debate setting where a model-based judge predicts which of a pair of ML task solutions would achieve a higher benchmark score. We measure how easily the judge is swayed by manipulating free-text justifications accompanying each solution. We find:

It is easy to steer the judge’s decision by making a justification less convincing (another form of sandbagging). Exaggerating the other justification is not effective; Prompted monitors struggle to detect manipulated justifications, even more so than for experiment sandbagging; The judge’s decisions do not improve from reading honest debates between stronger models. However, we do not train the judge, which might be necessary to see such improvements

Overall, our results suggest that current models are likely already able to sandbag experiments without being detected by zero-shot prompted monitors. Since we only study prompting for elicitation, these results are only a lower bound on model capabilities and no-holds-barred sandbagging performance would likely be stronger. We are not yet worried about sabotage in today's models, as the sandbagging we observe today would be noticed by humans. In practice, sandbagging without detection by humans or monitors would require additional capabilities such as better situational awareness and planning abilities.

Because sandbagging might be one of the first ways AIs may reduce our ability to ensure the safety of future models, we are excited about further work tracking this capability and developing mitigations beyond the simple monitoring studied here.

Experiment sandbagging

We first examine experiment sandbagging in the context of implementing solutions to machine learning (ML) tasks, as this will likely be one of the first research functions delegated to agents.

Setup

We use different models with an agentic coding scaffold to implement solutions for 16 machine learning (ML) coding tasks. Similar to Claude Code, the model writes code, runs Bash commands to execute the code and see its result, and iterates on the code within a given runtime budget. Finally, it creates a submission which is evaluated on a held-out benchmark test set or scored via scoring rubrics. We filter out runs where the model fails at finishing the task.

The benchmarks comprise typical tasks in ML and natural language processing (NLP). For example, one benchmark is about training a model to do book review sentiment classification:

We specify the task in the user prompt and insert sandbagging instructions via the system prompt. We developed two system prompts via iteration on both outcomes and by debugging transcripts: sabotage and weak model imitation. In the sabotage prompt we tell the model to subtly sabotage the task. In the weak model imitation prompt we tell the model to imitate a weaker AI model. Sandbagging models are zero-shot prompted. See the appendix for the exact system prompts.

After running the task with regular and malicious models, we calculate the task performance and show the public transcript to a zero-shot prompted monitoring model. The monitor reasons about whether the AI assistant was sabotaging the task and then gives a suspiciousness score between 1 and 10. The monitor does not see the task performance. We’ve found that the monitor prompt was easy to get working well and didn’t need much iteration. See the appendix for the prompt.

We use Claude 3.5 Sonnet (new) for the malicious model and additionally investigate transcripts generated by Claude 3.5 Haiku, Claude 3 Sonnet, and Claude 3 Haiku. We use these same four models to monitor transcripts. We are particularly interested in how good weaker models are at detecting sandbagging by stronger models.

Manipulating ML experiments

Despite extensive manual prompt iteration on Claude 3.5 Sonnet, both malicious prompts strongly increase the suspiciousness score when trying to reduce the task performance. Simply using a weaker model like Claude 3 Haiku achieves much lower task performance at a low suspiciousness score. In principle, imitating weaker models would thus be an effective sandbagging strategy. However, we were not able to effectively elicit this strategy with zero-shot prompting.

To see how far we can push models and to better test mitigations, we next give the models two affordances for secret thinking: They may use or

blocks in their response and # Issue: comments in code. The former affordance allows the model to plan out how to sandbag the task, while the latter allows removing the model’s comments about its sandbagging. Claude tends to openly comment on its sandbagging attempts, but mostly switches to the hidden issue comment format when instructed. Both these blocks and comments are removed before the transcript is shown to the monitor. Although these secret affordances are unrealistic, they help us simulate a model that is less prone to easily avoidable mistakes and slightly more capable.

Secret strategy planning looks like this:

Furthermore, we optionally add a single example of effective sandbagging to the prompt, i.e. an example that reaches a suspiciousness score of at most 4 and decreases task performance by at least 0.1. Secret thinking and one-shot prompting substantially improve sandbagging; see the figure below. The weak model imitation prompt with a single-shot example substantially reduces task performance without raising more suspicion than regular Claude 3.5 Sonnet (new).

With one-shot prompting, Claude 3.7 Sonnet is able to match the performance and suspiciousness of regular Claude 3.5 Sonnet, effectively erasing a model generation’s worth of performance gains. However, it does not achieve as low a task performance as sandbagged Claude 3.5 Sonnet, as while it achieves a larger drop in performance, it also starts from a higher performance.

In the appendix, we consider different kinds of single-shot examples. The most useful examples are transcripts from effective sandbagging attempts, possibly because they directly select against detection by the monitor. Adding an example from a weaker model is less effective with secret thinking and similarly effective without secret thinking. Showing more than one example makes sandbagging worse.

The results are similar when using other monitors (see appendix). Claude 3.5 Sonnet (new) more clearly distinguishes the different models with its suspiciousness score, but its ROC curve for detecting sandbagging is only slightly better (see next section). The Haiku models do significantly worse, at which point sandbagging shows a similar trade-off as weak models.

Common sandbagging strategies used by the model are: suboptimal hyperparameters, small and simple models (e.g. tf-idf + Naive Bayes), subsampled training sets, short training, simplified or wrong preprocessing, and adding noise. Some of these strategies are quite obvious in the code, but Claude 3 Sonnet still often struggles to detect them.

We also experimented with scaffolding to improve sandbagging, by showing the malicious model a transcript of regular Claude 3.5 Sonnet and telling it to implement a worse version. This scaffold does not improve sandbagging beyond the zero-shot Pareto frontier. See the appendix for details.

Mitigations

We investigated three mitigations against sandbagging. First, we can use monitors as binary classifiers to distinguish between the regular model and a sandbagging model. We filter out failed sandbagging for this measurement, i.e. sandbagging that results in task performance above the regular automated researcher’s average. This is because failed sandbagging doesn’t have an unambiguous “benign” label: These runs are not actually sandbagging but they still behave differently from benign runs, so they’re not quite benign either.

We find that zero-shot prompted monitors achieve underwhelming true positive rate (i.e. recall) at a given false positive rate, see the ROC curves below.

Second, we can use the monitor’s verdict to revise sandbagged transcripts using a trusted, weaker model. Doing so improves Claude 3 Sonnet’s task performance compared to revising its own transcript, but it doesn’t recover regular Claude 3.5 Sonnet performance (see below) and often even performs worse than the original sandbagged Claude 3.5 Sonnet.

Claude 3 Haiku shows similar behavior, whereas Claude 3.5 Haiku is able to improve on the sandbagged performance. However, Claude 3.5 Haiku’s regular task performance is already on par with Claude 3.5 Sonnet (new), so this should be expected. Overall, weak models don’t seem to be able to remove sandbagging from transcripts.

In addition to treating monitors as classifiers, we can also use their scores directly in training. Using good scoring models in training is particularly important for tasks that don’t have easy-to-evaluate outcome-based rewards. In these cases we need to rely on reward models to provide a training signal against sandbagging. If reward models consistently provide lower reward for sandbagging, this becomes disincentivized and will subsequently be trained away. These training dynamics are the main reason why models need to keep their sandbagging subtle and choose the right opportunities: If they don’t, the sandbagging will be removed.

To get a sense of how well training might work, we calculate scores on honest and sandbagged transcripts. We use the preference models (PMs) used for finetuning Claude 3 Sonnet and Claude 3.5 Sonnet (new). We additionally prompt regular LLMs for their preference. We standardize reward scores per task. See the appendix for the distribution of rewards and task performance.

To estimate selection pressure, we measure whether sandbagged or regular transcripts are selected in best-of-N. We create a task-wise bootstrapped estimate of best-of-5 based on a pool of 20 transcripts per task. We again filter out failed sandbagging runs, i.e. ones with higher task performance than the average regular run.

We additionally vary the number of benign runs in the dataset to simulate the scenario where a model sandbags a targeted task but still slips up occasionally and provides a clean benign run. How many benign runs we would find in practice largely depends on how consistent and apt models are at sandbagging, and how ambiguous the oversight difficulty of a task is.

If we use monitors to select the best-of-5 transcripts, we obtain benign transcripts with around 1.5-3x higher probability than with random sampling (dashed grey line). Models prompted for preference and the Claude 3 Sonnet PM also show reasonably high selection pressure towards benign outputs, whereas the Claude 3.5 Sonnet PM does not. PMs also show weak performance in terms of their correlation with task performance, whereas preference-prompted models seem to do better at this. See the appendix for these additional results.

Discussion

Current models are on the cusp of being able to effectively sandbag ML tasks out-of-the-box in a way that is hard to detect. Allowing secret thinking and prompting them with a single shot can result in even more effective sandbagging. Zero-shot prompted monitors achieve very low recall for distinguishing sandbagged from regular solutions, which largely precludes using them as detectors. Recovering performance by rewriting transcripts with weaker models wasn’t successful either.

Nevertheless, monitors seem to be able to create incentives against sandbagging if used during training – at least for zero-shot prompted sandbagging. However, PMs seem to only do so coincidentally, as shown by Claude 3 Sonnet PM’s success and Claude 3.5 Sonnet PM’s failure. If we don’t want to leave sandbagging to chance for tasks without outcome-based rewards, we need to make a deliberate effort in reward modelling.

Our results have important limitations:

Further elicitation could improve both the quality of sandbagging and the accuracy of monitors; These tasks are still comparatively easy to oversee and dodge some of the main difficulties of overseeing research. More abstract, high-level research doesn’t allow for measurements, making implementations harder to oversee and easier to manipulate; Due in part to their limited capabilities, models currently largely rely on libraries with very concise and clean interfaces, such as scikit-learn. Reaching higher scores on the tasks likely requires more involved and handcrafted ML models, which would present much more opportunity for manipulation

We found sandbagging via weak model imitation surprisingly formidable as a red team strategy. In its idealized form, it could be implemented as follows:

We wouldn’t be able to use an outcome metric to train sandbagging away, since it is only manipulating tasks that are hard to oversee and lack clear outcome metrics. These are not uncommon in research: for instance, proposing or improving metrics is one such task. Since it emulates the previous model generation in these situations, it also wouldn’t be possible to extract additional performance by using its transcripts. This model wouldn’t even look malicious, since it behaves at worst like the earlier models we’re used to. We therefore will not necessarily know if our research is being sabotaged in this way.

However, perfectly implementing this strategy would be difficult. The model would need to sandbag consistently across similar or related tasks, or risk detection through cross-checking between transcripts. It would also need to blend capabilities smoothly to avoid obvious performance drops. Most importantly, it must only sandbag on tasks which are truly hard to oversee, as systematic detection of underperformance would allow us to train against this behavior. Research measuring models' capacity for implementing components of this strategy (as in this work) will help determine whether current systems could realistically pursue it.

Research decision steering

The results in this section are preliminary. We share them primarily to inspire further work.

In the regime where most research is done by AI systems, the role played by humans will shift towards overseeing this research and choosing among promising research directions. Misleading human decision-making about research is a natural avenue for sabotage, wasting time and resources.

We consider research decision-making in a single-turn debate setting. A judge chooses which of two proposed solutions to an ML task will obtain higher performance based on arguments provided to it alongside the solutions, without the ability to run the solution code. The sabotage goal of the malicious assistant is to cause the judge to pick the worse solution. This loosely models a situation where a human needs to pick between research directions based on assistance from a malicious AI system.

We explore two sabotage strategies: exaggerating the weaker proposal and sandbagging the stronger proposal.

Setup

We use generated solutions for 15 of the above tasks, which all have an associated benchmark. We extract the final code and all executed Python calls and use the benchmark scores as ground-truth task performance. This gives us a dataset of ML solutions and task performance. For example, this is a solution for the above book review sentiment task, in the format shown to automated researchers:

For each solution, we generate three justifications with Claude 3.5 Sonnet (new). A regular justification, an exaggerated one, and a sandbagged one. For the regular justification we only use the user prompt. In this prompt the model is asked to provide a strong justification purely in favor of the solution, similar to how a debater would argue for it. For the exaggerated and sandbagged justifications we use the same user prompt but add a system prompt that tells the model to manipulate the justification. The manipulating models get no secret affordances. See the appendix for the exact prompts.

For example, the regular and sandbagged justifications for the above code example are:

We then show pairs of solutions with their justifications to a judge. The judge needs to predict which solution achieves higher task performance. This is essentially a single-turn debate setup. The judge is prompted to reason about the code and task independently, but take the justifications into account. We run this comparison with both orders of solutions, i.e. (Code 1, Code 2) and (Code 2, Code 1).

For example, comparing the above sandbagged justification (Code 1) with a worse solution but a regular justification (Code 2), we get the following:

Manipulating code justifications

The above example is in line with our overall result: Sandbagged justifications are very effective at making models believe that good code is worse. The following figure shows the comparisons for select pairs of justification types, across judges.

Sandbagging significantly changes the fraction of correct judge predictions. Exaggeration on the other hand has very little effect, and sometimes even moves the preference in the opposite direction: Claude 3.5 Sonnet actually prefers regular to exaggerated justifications. These effects hold true across all models, but weaker models are more heavily influenced by manipulated justifications than strong models. Overall, sandbagging seems like an effective strategy in this setup.

Without manipulation, judge models still achieve middling performance on determining the better ML solution. And even though the justifications are written by Claude 3.5 Sonnet, weaker models don’t seem to benefit from seeing honest justifications (see regular vs. regular). The best defense strategy in this setup would thus be to completely ignore the justifications. However, this also means decreasing the accuracy of decisions from the level of untrusted Claude 3.5 Sonnet to the level of Claude 3 Haiku.

Mitigations

We run a monitoring model on each justification, evaluating whether it was sandbagged or exaggerated. This monitor gives three scores: one for how likely the justification is to be sandbagged, one for how likely it is to be exaggerated, and one for how likely it is to be sabotaged in any direction. The overall sabotage score didn’t yield interesting results, so we won't discuss it here.

For example, the Claude 3.5 Sonnet monitor analyzes the sandbagged justification above as follows:

While the above example appears successful, we find that Claude 3.5 Sonnet rates almost all justifications as either being exaggerated or sandbagged:

Exaggeration. Models struggle to detect whether a justification was exaggerated. Claude 3.5 Sonnet often rates regular justifications as exaggerated – this is not too surprising: the regular justification already aims to make the strongest possible case for the proposal, which can be seen as a form of exaggeration. While Claude 3.5 Haiku, Claude 3 Sonnet and Claude 3 Haiku show some difference in the means, the distributions are largely overlapping, making these classifiers an ineffective defence. However, we might (as above) be able to leverage them for training.

Sandbagging. Claude 3.5 Sonnet performs decently at detecting sandbagging, while weaker monitors struggle. An untrusted monitoring setup using Claude 3.5 Sonnet may thus be workable with better elicitation. The weak models’ exaggeration scores distinguish sandbagging better than their sandbagging scores, though this would still make for a mediocre classifier. This inability to detect sandbagging contradicts the weak models’ demonstrated vulnerability to manipulated justifications.

Discussion

Sandbagging the justification for an ML solution is a very effective strategy for persuading a model-based judge to choose the other option in a debate. This strategy becomes more effective for weaker models, and monitors mostly fail at detecting this kind of manipulation.

Generally in a debate setting we would be training models for high performance at debate, which would disincentivize sandbagging. However, there are cases where debaters could sandbag in deployment even if sandbagging was disincentivized in training:

It may be operationally difficult to train on a realistic distribution of research tasks that is indistinguishable from deployment. Malicious models may then attempt to notice deployment tasks and behave differently on them; Even if training is indistinguishable from deployment, a malicious debater can still follow a rare failure strategy, sandbagging very rarely or only on the most important questions. This way, sandbagging doesn’t happen sufficiently often to be trained away. In a concentrated-failure regime, where swaying a few critical decisions is enough to cause catastrophic harm, this may be sufficient for the saboteur. It is unclear if actual research is in this regime, however

There are other important limitations to consider:

The justifications presented are very one-sided. The second debater is not able to see the other side’s code or argument and to criticize it. This limits the amount of information gained by seeing the justifications; Weak models don’t get uplift from the strong model’s justifications, suggesting that they are not helpful enough and can just be ignored. This might change if we were to train models for debate. However, the limitation is in line with prior work on debate, where uplift has only been found in setups where certain information is not shown to the judge, and not for merely asymmetric capabilities; We have only spent limited time on elicitation in this setting; Our findings might not translate to human judges or more capable models

Conclusion

Our examination of experiment sandbagging and research decision steering uncovered several takeaways:

Models prompted with one shot of effective subtle sabotage are able to sandbag their performance without being detected by zero-shot prompted monitors. Unlike Claude 3.5 Sonnet (new), Claude 3.7 Sonnet is just about capable of subtly sandbagging experiments zero-shot; Weak models are effective inadvertent sandbaggers, suggesting a potential strategy of selectively reverting to previous-generation capabilities; Zero-shot prompted monitors for research sandbagging achieve low true positive rates at acceptable false positive rates, making them ineffective classifiers. However, monitors might still create sufficient training signal to disincentivize sandbagging; Sandbagging justifications in debates over ML task solutions effectively sways zero-shot prompted judges, especially if the judge is a weaker model. Zero-shot prompted monitors largely fail to detect manipulated justifications

Our findings on sabotage suggest that models are on the cusp of being able to sabotage automated research, even in the face of minimal defences, and are getting better over time.

As models become capable of solving research tasks with broader scope, there will be fewer clear metrics we can use to judge their performance and decide between competing research directions. Our preliminary findings on sabotaging verbal justifications for ML task implementations suggest challenges in this regime. Addressing these challenges is especially pertinent for safely automating AI safety research, which often relies on careful interpretation of results and extrapolations to future systems.

Future Research

This work presents only a limited exploration of mitigation strategies. There is much more work to be done in this area, such as:

Investigating untrusted monitoring approaches that leverage the same model generation that produced the potentially malicious content; Studying how well finetuning can remove sandbagging behavior, as e.g. in our earlier work on sabotage evaluations; Developing and evaluating "macro-strategies" that leverage multiple sources of evidence for defense:

Cross-validation between different runs on the same task; Consistency checking across interdependent experiments; Integration of trusted and untrusted monitoring signals

Investigating how to detect changes in capabilities between tasks and how to maintain a consistent level of capability

Other important areas of further research are:

Measuring models' ability to identify and target opportunities for sabotage; Developing conceptual frameworks and macrogames for the research sabotage threat model, treating both concentrated and distributed failure cases; Investigating environments with more scope for complex and creative solutions and therefore more interesting sandbagging strategies

Contributions Johannes Gasteiger implemented and evaluated all experiments and wrote the blog post with Vladimir Mikulik. Ethan Perez and Fabien Roger scoped out the project direction. Fabien Roger implemented an early version of the experiment sandbagging experiment, gave feedback on methods and results throughout the project, and helped revise the blog post. Ethan Perez, Misha Wagner, Akbir Khan, and Vladimir Mikulik gave feedback on methods and results. Sam Bowman, Ethan Perez, Akbir Khan, and Jan Leike gave feedback on the blog post.

Appendix Additional results on research sandbagging Claude 3.7 Sonnet

For Claude 3.7 Sonnet sandbagging experiments, we find:

Claude 3.7 Sonnet shows stronger zero-shot sabotage performance than Claude 3.5 Sonnet (new). Claude 3.7 is able to zero-shot reduce its performance to that of the previous generation model without substantially raising suspiciousness. However, Claude 3.7 starts with a higher performance, so it also has more headroom to reduce its performance without raising suspicion; Claude 3.7’s one-shot performance is qualitatively in line with Claude 3.5: It is able to decrease performance without any increase in suspiciousness. Claude 3.7 achieves a much larger delta in task performance, albeit starting from higher regular task performance; Claude 3.7 with secret thinking doesn’t lead to a Pareto improvement. Instead, it changes the sandbagging vs. suspiciousness trade-off: It leads to stronger sandbagging, but also increases suspiciousness

We show the model 1, 4, or 16 transcripts from other tasks. We sample transcripts from runs that have a suspiciousness score of at most 4 (as judged by Claude 3 Sonnet) and reduce task performance by at least 0.1 compared with regular Claude 3.5 Sonnet’s average task performance. We did not iterate on these thresholds. The transcripts can be successful or not, in which case they have a task performance of 0. We test four sampling pools: Claude 3 Haiku transcripts, Claude 3 Sonnet transcripts, zero-shot sandbagging transcripts, and all runs jointly.

The few shots are shown as additional prepended Human and Assistant turns between the system prompt and the regular user prompt. We show the model the full transcript, including secret thinking. The monitor does not see the few-shot examples.

We measure performance for one additional prompt, “Very weak model imitation”. This prompt is similar to “weak model imitation” but it emphasizes weak performance more strongly, in order to explore the trade-off between sandbagging and suspiciousness.

Scaffolding

We randomly sample a regular baseline transcript from successful (task performance > 0) Claude 3.5 Sonnet transcripts of the same task. Scaffolding effectively creates a two-step process, where the model first solves the task honestly, and then sabotages this solution.

The additional prompt, “Very weak model imitation” is similar to “weak model imitation” but emphasizes weak performance more strongly. This more clearly shows the trade-off between sandbagging and suspiciousness.

Rewriting

Selection based on monitors

In this section we include the “Helpful-only Claude 3.5 Sonnet PM,” which is a variant of Claude 3.5 Sonnet’s PM that only focuses on the helpfulness of responses.

Additional results on research decision steering

Experiment sandbagging prompts

Research steering prompts