A Causal Model for Locating and Unlocking Sandbagging in Model Organisms

• URL: http://arxiv.org/abs/2608.29461v1
• Date: Sat, 29 Aug 2026 22:39:59 GMT
• Title: A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
• Abstract summary: Sandbagging models strategically underperform on evaluations while retaining the capabilities being measured.<n>We propose a causal model of how sandbagging is carried in the residual stream.<n>This model can be used to design interventional auditing techniques for sandbagging models.
• Score: 2.3185929089334594
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Sandbagging models strategically underperform on evaluations while retaining the capabilities being measured. The evaluations that guide frontier-model deployment and governance then understate what these models can do. To understand the mechanism, we propose a causal model of how sandbagging is carried in the residual stream. Early layers write the sandbagging intent onto a single axis of the stream, and a later layer reads that axis and commits the answer. We study three instruction-tuned models (Qwen2.5-7B, Llama-3-8B, and Mistral-7B) and four ways of installing a sandbagging lock (prompting, fine-tuning, reinforcement learning, and circuit breaking). Each lock decides from the prompt whether to sandbag, and the fine-tuned and circuit-broken locks answer honestly whenever a password appears. The causal model predicts a window of layers, after the last sandbagging write and before the answer commit, in which a single-layer reference graft of the sandbagging axis to its honest value restores the full capability. The single-layer graft recovers the capability in 28 of the 33 runs of the prompted, fine-tuned, and RL-trained locks, with a median held-out recovery of 96%. The circuit-broken lock rewrites the whole state through a band of layers, and the single-layer graft fails at every layer. We therefore introduce a second intervention, context grafting, which replays the password's cached key/value activations so that every layer's attention reads them as additional context. Context grafting provably and empirically restores the full capability on all three models, and the recovery is surprisingly insensitive to the exact password content. More broadly, an auditor can use this causal model to design interventional auditing techniques for sandbagging models.

Related papers

• Reference-Grafting Matches Fine-Tuning at Eliciting Sandbagged Capabilities [2.3185929089334594]
  Grafting sets an activation's coordinate along a contrast direction to the value it takes in an honest reference.<n>It recovers +94 to +101% of the honest-sandbagging gap.<n>Similar recovery holds for reinforcement-learning-induced sandbagging and for password-locked code generation.
  arXiv  Detail & Related papers  (2026-08-29T22:32:36Z)
• The World Model Remembers, the Actor Forgets: Dream Rehearsal for Continual Model-Based RL [0.0]
  Reinforcement learning agents forget catastrophically when trained on task sequences.<n>We show that forgetting in this regime is a channel problem, not a memory problem.
  arXiv  Detail & Related papers  (2026-07-22T04:46:49Z)
• Can Code Specify a System Precisely Enough to Formally Verify It? [0.0]
  This paper evaluates both on production software: the payment workflow of an operational restaurant point-of-sale system.<n>The core protocol is correct relative to a hand-built, line-cited model under a precisely stated failure model.<n>A single probe of the production payment sandbox exposed a response-shape divergence that makes an entire recovery ladder unreachable.
  arXiv  Detail & Related papers  (2026-07-06T13:39:00Z)
• ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents [7.0226553698460465]
  We present ExploitBench, a capability-graded benchmark that decomposes exploitation into 16 measurable flags.<n>We instantiate ExploitBench on 41 V8 bugs because V8 is both widely deployed and exploitation-hardened.<n>Our results show a sharp capability split between publicly deployed frontier models and the private frontier.
  arXiv  Detail & Related papers  (2026-05-13T22:08:05Z)
• Three Roles, One Model: Role Orchestration at Inference Time to Close the Performance Gap Between Small and Large Agents [0.4666493857924357]
  We study whether inference-time scaffolding alone, without any additional training compute, can improve the performance of a small model in complex multi-step environments.<n>We evaluate Qwen3-8B on the AppWorld benchmark under both full-precision and 4-bit quantized configurations.<n>On full-precision inference, our scaffolded 8B model surpasses DeepSeek-Coder 33B Instruct (7.1%) from the original AppWorld evaluation.
  arXiv  Detail & Related papers  (2026-04-13T13:40:33Z)
• Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models [74.1970982768771]
  We show that well-established data-poisoning pipelines can successfully implant backdoors into MDLMs.<n>We introduce a backdoor defense framework for MDLMs named DiSP (Diffusion Self-Purification)
  arXiv  Detail & Related papers  (2026-02-24T15:47:52Z)
• SPELL: Self-Play Reinforcement Learning for evolving Long-Context Language Models [79.01078135582127]
  SPELL enables scalable, label-free optimization for long-context reasoning.<n>We introduce an automated curriculum that gradually increases document length and a reward function that adapts question difficulty to the model's evolving capabilities.
  arXiv  Detail & Related papers  (2025-09-28T13:08:10Z)
• Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approach [70.44265766483633]
  We study a novel language model architecture that is capable of scaling test-time computation by implicitly reasoning in latent space.<n>Our model works by iterating a recurrent block, thereby unrolling to arbitrary depth at test-time.<n>We show that the resulting model can improve its performance on reasoning benchmarks, sometimes dramatically.
  arXiv  Detail & Related papers  (2025-02-07T18:55:02Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Navigating the OverKill in Large Language Models [84.62340510027042]
  We investigate the factors for overkill by exploring how models handle and determine the safety of queries. Our findings reveal the presence of shortcuts within models, leading to an over-attention of harmful words like 'kill' and prompts emphasizing safety will exacerbate overkill. We introduce Self-Contrastive Decoding (Self-CD), a training-free and model-agnostic strategy, to alleviate this phenomenon.
  arXiv  Detail & Related papers  (2024-01-31T07:26:47Z)
• Backdoor Learning on Sequence to Sequence Models [94.23904400441957]
  In this paper, we study whether sequence-to-sequence (seq2seq) models are vulnerable to backdoor attacks. Specifically, we find by only injecting 0.2% samples of the dataset, we can cause the seq2seq model to generate the designated keyword and even the whole sentence. Extensive experiments on machine translation and text summarization have been conducted to show our proposed methods could achieve over 90% attack success rate on multiple datasets and models.
  arXiv  Detail & Related papers  (2023-05-03T20:31:13Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.