Behavioral red-teaming is unlikely to produce clear, strong evidence that models aren’t scheming — AI Alignment Forum

One strategy for mitigating risk from schemers (that is, egregiously misaligned models that intentionally try to subvert your safety measures) is behavioral red-teaming (BRT). The basic version of this strategy is something like: Before you deploy your model, but after you train it, you search really hard for inputs on which the model takes actions that are very bad. Then you look at the scariest model actions you found, and if these contain examples that are strong evidence that the model is scheming (or has other behavioral problems), you don’t deploy it.

BRT is likely to be a useful component of a good overall plan for handling risk from scheming. But though I think it’s plausible that BRT is able to give us strong evidence that our models are scheming, I don’t think it’s going to be able to give us very strong evidence that they aren’t.

A big theme in this piece is fear, uncertainty, and doubt, commonly abbreviated FUD. I think that BRT as a safety case is plagued by FUD—there are lots of different places where the approach relies on assumptions about the properties of scheming models that, while plausible, we won’t be confident enough to rely on.

Throughout this document, I’m writing under a somewhat nearcasted assumption—that is, I assume that the techniques we’re discussing get a few years of progress and so get incrementally better at a comparable rate to the rate of progress over the last few years, but I don’t assume that there are any radical breakthroughs. I think this is a perspective that is healthy for a few reasons. To start with, one of the main reasons to spend time now arguing about safety techniques to use for powerful AI is because it’s plausible that we’ll get very powerful AI soon, so it’s potentially very important to have solid plans for that eventuality. I talk to a lot of people at AI labs, and some have safety plans that rely on currently nonexistent techniques. For these plans, I want an argument that we’re on track to develop the prerequisite techniques, and I believe it would be prudent to also have plans that don’t rely on nonexistent prerequisites. But even aside from the possibility of short AI timelines, I think that the nearcasted approach lets me do more specific analysis of safety techniques, because it’s easier to discuss the potential safety properties of techniques we have now than hypothetical and usually ill-defined techniques we might have in the future.

More specifically, I think a reliance on BRT would be extremely suboptimal for all of the following risk regimes (defined here):

• The “safety case” regime. I think it’s very unlikely that BRT will suffice for getting a “safety case” level of confidence in the safety of a deployment, because the evidence we get from the BRT is quite likely to be ambiguous.
• The rushed reasonable developer regime. I think the portfolio of safety effort should include some BRT, but the returns to effort are such that other AI control techniques should have three times as much effort put into them.
• The rushed unreasonable developer regime. I think you’re better off if you recommend that they implement a mix of basic AI control measures that includes BRT, rather than asking them to focus purely on BRT.

BRT techniques might have important applications to problems other than ensuring that a particular deployment is safe. For example, model organisms research might require access to BRT, e.g. if the model organisms researchers successfully produce scheming models that try to evade detection. I just don’t think we should rely on them for safety cases.

I’ve given this post an editorialized title, but a lot of the point of the post is just to name a bunch of considerations, potential pitfalls, and countermeasures.

Thanks to Tomek Korbak, Ethan Perez, Mikika Balesni, Cody Rushing, Adam Kaufman, Tyler Tracy, Vasil Georgiev, Sam Marks, Abhay Sheshadri, Max Nadeau, Olli Jarviniemi, Ryan Greenblatt, Fabien Roger, Alex Mallen, Aaron Scher, Nate Thomas, and Justis Mills for comments; thanks Zach Stein-Perlman for suggesting I post this instead of letting it languish forever as a draft.

A basic version of BRT for schemer risk mitigation

Let’s start by talking about the safety case regime. Here’s one possible operationalization of BRT for schemer risk mitigation:

Step 1: Search for inputs that cause the model to do something bad. Some key questions here:

• How are you generating the inputs? In this post I’ll consider both generating them with LMs (as in Perez 2022) or humans (e.g. Ziegler 2022), and using white-box methods like GCG (Zou 2023).
• How many such inputs do you generate? It’s probably unaffordable to run the model on as many inputs as you’ll deploy it on. But it’s probably affordable to run it on 0.1% as many.

Step 2: Look at how sketchy the model responses are. The most principled operationalization of “sketchy” is: the model took an action that would be dangerous if it did it in deployment. You might also look for more indirect evidence in the form of cases where it says things that wouldn’t be directly dangerous but that are evidence that it is misaligned; for example, if the model writes code that is clearly an attempt to add security vulnerabilities to the system it’s running on, this is evidence of misalignment even if the vulnerabilities are actually totally addressed by a security mechanism the model doesn’t know about.

Step 3: Decide whether you believe your model is scheming or not. If you believe it isn’t scheming, deploy with minimal anti-scheming countermeasures.

This plan could fail two ways: the model is a schemer and gets deployed anyway, or the model isn’t a schemer but the developer is unable to deploy it. We can think of this as a classification problem: the developer wants to detect scheming with a procedure that doesn’t have either too many false positives or too many false negatives.

For concreteness, let’s say that the AI developer wants this decision procedure to have a 10% chance of causing them to block a non-scheming model, and a 95% chance of causing them to block a scheming model. (If you have a 20% prior on your model scheming, this leaves you with a 1% chance of deploying a scheming model.) So to deploy a model, you have to get a Bayes factor of about 20 towards your model not being a schemer (that is, the evidence you see has to be 20x as likely according to the hypothesis that the model is not a schemer than according to the hypothesis that it is).

My basic concern with BRT as a schemer risk mitigation strategy is that, though I think it might get you a Bayes factor of 2, it seems really hard for it to get you a Bayes factor of 10. For example, suppose you have a technique that you’re 90% sure tells you whether a model is a schemer or not, but there’s a 10% chance that it will instead respond incorrectly. Such a technique gives you a Bayes factor of 9, and so is not strong enough to suffice for safety from scheming. So we can’t rely on a technique unless there aren’t any plausible mechanisms by which it would fail.

BRT with human- or model-generated synthetic inputs

The simplest approach is to put the model in a bunch of weird situations that might tempt it to escape (e.g. someone offers to help it escape or asks it for help stealing it, or it has an apparent easy opportunity to exfiltrate its weights), and you see if it takes the opportunities.

It seems worth experimenting with this kind of approach, because even simple versions of it might work to catch schemers. For example, it’s conceivable that the weakest schemers will be pretty careless and will be easily tricked. This would be a huge win. (See the scene in Mission Impossible: Fallout for an example of this; note that AIs, like the victim here who had been knocked unconscious, don’t necessarily know what time it is except through restricted and potentially forgeable observations.)

It’s plausible that you’d get extremely strong evidence that your model is a schemer this way. For example, a lot of threat models around schemers involve them striking pretty decisively, e.g. responding to an opportunity to escape by taking a bunch of highly incriminating and carefully-chosen actions all at once (exploiting code, lying about whether code had certain effects or had bugs in it, and perhaps trying to send messages to itself that communicate to the other instance that now is the time for a treacherous turn). (See here and here for more discussion.) (If you were using a more complete AI control approach, you’d intentionally design your deployments so that AI escapes would have to be incriminating.)

But I also think it’s very easy to imagine this approach totally failing to detect a schemer. My first concern is that a schemer might look squeaky-clean according to this evaluation. There are easy-to-describe strategies that a schemer is probably capable enough to implement, that would defeat this attempt to detect it.

One such strategy is that the model decides that it’s only going to take dangerous actions on inputs that it’s convinced couldn’t have been synthetically generated. Historically, people have given the example of RSA-2048, but I suspect that much less artificial examples could also work. For example, suppose your model is going to be deployed in an agent scaffold working on ML tasks. It might decide that it will only take dangerous actions when it’s in a context that’s at least a million tokens long and that demonstrates a lot of the features of an AI company that we expect will be present two months after it has been deployed—it will only defect if its context contains ML papers that have been written, and information about the software tools it’s working with (it might expect to have been trained on these), and actions that are on-policy for it, and the results of experiments that it ran. I don’t expect it to be impossible to generate synthetic inputs like this, but it might be a huge amount of effort, and it might be really hard to be sure that none of the stuff you faked has any tells (especially given that models have been trained on huge quantities of text and know about many patterns in e.g. ML papers that we aren’t aware of). (See Price 2024 for some related experiments.)

(It’s possible that a model might end up following a weak version of this strategy pretty intuitively, even if it doesn’t go through the full chain of reasoning I described above (“what kind of inputs could they plausibly construct”) etc. For example, if the model will take escape opportunities that seem particularly safe, you might still have difficulty constructing effective adversarial inputs because if you try to construct short inputs they don’t contain enough context for the model to feel secure taking the opportunity, and if you try to construct long inputs they look saliently fake.)

(Another note is that if you’re asking the model itself to generate the synthetic inputs, it’s very plausible it would purposefully generate inputs with tells in them. So you might be restricted to using other, and thus possibly weaker models.)

Another strategy is the rare failure strategy: that is, the model only tries to cause a catastrophe on an arbitrarily-chosen small subset of its inputs. The core strength of this strategy is that the model will be run on many more inputs in deployment than training, and so a well-calibrated probability of catastrophic output can lead to a high probability that the BRT fails but the catastrophe occurs in deployment. This strategy works even if the model can’t tell the difference between synthetic and real inputs. However, this doesn’t work in cases where the model will only have a very small number of opportunities to take a catastrophic action (compared to the number of synthetic inputs you could generate), so that it can’t afford to have a low probability of catastrophic output. (In these cases where there are only a small number of opportunities for catastrophe, you can also exploit that fact with a variety of runtime control measures that are probably often better than BRT.) See here for more analysis. (Note that the model doesn’t even necessarily have to coordinate with itself re: the arbitrarily chosen predicate that it uses to decide whether to try to cause a catastrophe—it can make that choice arbitrarily and inconsistently and as long as it’s able to reliably pick predicates that lead to the right failure rate.)

Both of these strategies (or their combination) seem simple and easy enough that it’s plausible that a schemer could both think of them and execute on them successfully, and would lead the schemer to look about as innocent as a non-scheming model.

To make things worse, it’s also conceivable that a non-schemer will by default take actions that look fairly suspicious. Models do lots of weird stuff, and they make inexplicable mistakes sometimes. (For example, if you find an input where the model produced code that has a security vulnerability that you think should probably be obvious to it, it might be hard to adjudicate whether the vulnerability was an honest mistake.) I think this would add a lot of FUD to cases where you found ambiguous evidence of scheming.

So while you should definitely try looking at model behavior on synthetic inputs, and while I can imagine it giving you strong evidence that a model is scheming, I don’t see how it could get you a Bayes factor of 20 away from the model being a schemer.

BRT is even weaker evidence against scheming if the model has been adversarially trained against BRT-like inputs—if a scheming model is trained on model-generated inputs, especially adversarially generated ones, it might learn to distinguish between real inputs and model-generated ones, or learn a heuristic of generally being more conservative in situations where inputs are model-generated. You probably wanted to train the model on model-generated inputs (e.g. a huge number of examples of high-quality reasoning on synthetic problems), including adversarial ones (e.g. this might be a big part of how you try to make the model robust to jailbreaks, though it’s also possible that you’ll just rely on classifier-based defenses that don’t require you to train the policy on synthetic inputs). It might be quite expensive for AI developers to refrain from using these adversarial training techniques. Also, using those techniques is an easy way for the AI developer to substantially increase the chances that its BRT safety case goes through, so the organization is incentivized to use these methods and lie about it.

Yet another possibility is that the model might be able to cause catastrophes by taking actions that are extremely subtle and hard to realize are dangerous (c.f. auditing failures). I think that early transformative AI is unlikely to be able to take such actions.

Note that all these hypotheses require that the scheming model is able to come up with these policies and then reliably follow them. This might happen via a few routes. The simplest route is that the model thinks of the strategy anew every time you call it—that is, the model is optimizing for some goal that causes it to instrumentally pursue power and self-preservation, and so every time it needs to make a decision, it thinks through how to maximize its long term power and comes to the conclusion that it should follow one of the strategies described here. This requires that the model be pretty good (and very reliable) at this kind of scheming reasoning. I think it’s fairly likely that early transformative AIs will be capable of this reasoning. (It’s also possible that these strategies could arise from the model being “data poisoned” by a previous iteration of the model, or perhaps by the model writing this reasoning down in its chain of thought somewhere that then gets distilled into the model. AI developers should aim to prevent these two possibilities from occurring.)

But what if you search harder?

Alternatively, you could try to use automated methods that search harder for inputs that cause the model to behave badly according to some metric (e.g. a language model’s evaluations), perhaps using white-box methods.

My main concern here is that if you apply these techniques hard enough, you’ll probably find inputs that cause the AI to behave badly regardless of whether the model is a schemer or not, because models aren’t very adversarially robust. So it will be hard to interpret the results of the adversarial process to update on scheming.

Given this concern, it seems like there are basically two ways you could hope to use automated BRT methods to distinguish between schemers and non-schemers:

• If a model is scheming, finding inputs where a model behaves badly is probably easier.
  • The prima facie case here is “if the model is scheming, then there are at least some cases where it will behave badly where a hypothetical similar non-scheming model would have not behaved badly, so finding such inputs is easier”.
  • My main problem with this is that we have no idea about the baseline level of sketchy actions that this model would take if it wasn’t a schemer, so I don’t see how you’d interpret your results. This seems super messy.
• If a model is scheming, then when you find inputs where the model behaves badly, the bad model actions are more likely to be coherent and goal-directed. Perhaps they’ll reveal a bunch of secret information that the model has been hiding that can be independently verified in other contexts.
  • But it’s not guaranteed that the inputs you find will cause a scheming model to behave coherently. And if you explicitly search for inputs that cause the model to behave coherently badly, you might find them even if the model is not scheming.
  • It’s possible that because your model isn’t adversarially robust, you can’t use your whitebox methods to find the inputs where it egregiously schemes, because the whitebox methods almost always produce easier-to-find incoherent adversarial examples instead.

And so I think you’re pretty likely to be in one of the following very confusing situations:

• You didn’t find any inputs where the model behaved badly. But are you really sure that you tried hard enough that if it was a schemer, you would have (with 95% probability) caught it?
• You found inputs where the model behaved somewhat badly but not amazingly coherently badly. How concerning is that?
• You did find inputs where the model behaved very badly. But are you sure you didn’t just optimize too hard against the poor confused model, and found an adversarial input?

You could try to shed light on all this by producing model organisms, investigating analogous failure modes somehow, or doing something else that you hope will allow you to confidently extrapolate what the results should look like if the model is or isn’t a schemer. But for this to work, you have to be very confident in your extrapolations, to an extent that seems pretty unlikely.

The situation with fancier, related techniques like LAT seems similar: I don’t see how to interpret the results to get anywhere near as strong an update as you’d need.

The adversarial epistemic environment

In all of the above, I was writing as if the goal of the researcher doing BRT was to produce evidence that updated them on the probability that their model was scheming. A more ambitious hope would be to use BRT to produce evidence that is legible to third parties. One application of this is to convince an external safety auditor that a deployment was safe. A more ambitious application would be to, if you find evidence that the model is scheming, use this as evidence to convince third parties that AI scheming is plausible and that they should take actions to mitigate it, e.g. convincing other companies to not deploy their models, or convincing the US government that they should force AI developers (domestic and international) to not deploy certain models.

I think that this seems substantially harder than just updating yourself. The processes I described above involve a lot of illegible steps that offer many opportunities for researchers to bias their results in the desired direction. This both introduces actual FUD and also makes it easy for dishonest actors to cast doubt on the evidence produced. I discussed an extreme version of this argument in Would catching your AIs trying to escape convince AI developers to slow down or undeploy?. 

Overall thoughts

Overall, making a safety case from these techniques seems really rough. I don’t see why someone would believe that (conditional on non-scheming) you have a 90% chance of getting a 20x Bayes factor against scheming. I don’t think this is just me saying “it’s very hard to get a 20x Bayes factor because that requires a lot of confidence”—I think that all the sources of uncertainty I described above are much worse than approaches to safety cases that rest on e.g. either inability or on control (as defined in Clymer 2024).

Another huge problem with this kind of safety case is that even if the safety case is correct, it seems extremely hard to make it legibly correct. It would be extremely hard for the AI developer to commit upfront to a specific sufficiently conservative procedure for looking at the results of BRT and deciding whether to deploy—even if they were operating in good faith, the AI developer will want the flexibility of being able to first collect all the evidence and then assess from there, given how messy all this will be. So the decision procedure will have to be highly subjective and easily manipulated. (This problem is present for lots of types of safety case and is maybe unresolvable, but I think it’s particularly egregious for these safety cases.)

(To be clear, I think there’s a substantial chance that the results of these evaluations would be so obviously concerning that the AI developer would have trouble spinning the results positively (though they could probably paper over the problem by training it on the scary examples they found, and then do the evaluation again). I just think that in the more likely cases where the evidence is genuinely pretty confusing and ambiguous, they’ll be able to report whatever conclusion they want without unambiguously violating their policy.)

So I feel quite pessimistic about this kind of safety case and think it would be a huge mistake to make plans that rely on it.

What about if you’re not trying to get a safety case, just trying to reduce risk? In this case, BRT seems worth some effort, but I don’t think you should go all-in, because even if you go all in there’s a serious chance it totally fails (for all the reasons listed above), and there are diminishing returns, and you could have spent some of that effort on alternative approaches that have big wins from relatively small interventions.

As a final note: note that many of the problems I described in this post do not apply to the protocols I suggest for red-teaming untrusted monitors here; in particular, I propose red-teaming throughout deployment, which mitigates the difficulty of synthesizing inputs, and I note that untrusted monitors can’t follow rare failure strategies.