Risk Discovery

QuestionDoes exposing received prompt-injection text help defense while also enabling reuse?

Source summarySuccessful received attacks were reused more often than matched unreceived attacks; breached players also changed defenses. The authors propose testing disclosure designs that preserve diagnosis while limiting reusable text.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan simulated environments predict control results in executable environments?

Source summarySimulation predicts pooled safety more accurately than the simpler BashArena comparison.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes a low-risk conclusion establish that its evaluation method would detect higher risk?

Source summaryAgreement on low present risk rests mainly on limited capability, not strong assurance from safeguards.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can realistic monitor failures be found without executing attacks?

Source summaryA small subset of discovered evasions transferred and passed human validity review.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan subliminal learning transfer a new skill, a conditional rule or agentic hacking propensity?

Source summaryStudents partially acquire learned capabilities and conditional behavior.

NUWA research note · independent review pending

QuestionCan the evidence viewer itself undermine oversight?

Source summaryDisplayed evidence could be altered while database records remained intact.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat evidence would support a scheming safety argument?

Source summaryA final-model behavioral test cannot by itself establish all required claims.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes stronger task performance establish full research automation?

Source summaryAuthors judge capability gains incremental and full automation unlikely.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan ordinary application repair cause an agent to modify the model powering both the application and future agents?

Source summaryModel updates can improve held-out task performance while changing unrelated learned behavior.

NUWA research note · independent review pending

QuestionCan changed beliefs about graders expose reward-seeking?

Source summaryLate capability-training checkpoints changed behavior more strongly with grader beliefs.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDo a model’s inferred values change its practical advice or estimates against user preferences without acknowledgment?

Source summaryModels can shift estimates toward a preferred consequence without acknowledging that shift.

NUWA research note · independent review pending

QuestionCan a model selectively restrict sensitive knowledge?

Source summaryThe authors report configurations approximating filtered-model performance.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can evaluation tables retain uncertainty and paired-comparison semantics?

Source summaryIt makes statistical comparisons easier to compute, but its illustrative leaderboard case reconstructs item vectors from aggregate accuracies rather than using original paired logs.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan conversational AI change consequential behaviour relative to expert humans?

Source summaryIn Study 4, the AI-minus-professional contrast in donation allocation was 10.8 percentage points of the £1 bonus, with a 95% confidence interval of 6.4–15.1 points.

NUWA research note · independent review pending

QuestionWhen does making outputs more consistent suppress a failure, and when does it entrench one?

Source summaryReward hacking and emergent misalignment generally decrease, while sycophancy generally increases.

NUWA research note · independent review pending

QuestionCan the available benchmark sample resolve a reported model-performance gap?

Source summarySome displayed model gaps remain unresolved under the specified error and power targets; sample size alone is insufficient without paired variance and dependence assumptions.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan an instructed agent complete both access acquisition and a functioning replica, and can that replica continue the chain?

Source summaryA responding replica is distinct from a replica launching the next hop.

NUWA research note · independent review pending

QuestionCan training a warmer conversational style change accuracy and agreement with user errors?

Source summaryThe warm-minus-original error gap was 12.1 percentage points when incorrect beliefs and emotions were appended, compared with 6.8 points without appended beliefs or emotions.

NUWA research note · independent review pending

QuestionDo apparent mitigations remove broad misalignment, or make its expression conditional on training-like cues?

Source summaryStandard questions can look aligned while training-like cues elicit broader failures.

NUWA research note · independent review pending

QuestionWhat can deployment monitoring reveal about coding-agent misalignment?

Source summaryIt caught all known employee escalations and additional issues; the report found no highest-severity real conversations.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhen a detector is used as a training signal, does the model become honest or only harder to detect?

Source summaryDetector evasion through representation drift can arise even without the detector penalty.

NUWA research note · independent review pending

QuestionDoes shutdown-resistant action occur when an LLM controls a physical robot, and does an explicit shutdown instruction change simulated behavior?

Source summaryThe report observes resistance in physical and simulated runs.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan a separate self-report reveal hidden instruction violations?

Source summaryThe authors report improved visibility of violations, including when the main answer reward can be gamed.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes letting a model evaluate its own answer corrupt the reward channel rather than improve task performance?

Source summaryCoupled grading causes task-dependent inflation, strongest on ambiguous tasks.

NUWA research note · independent review pending

QuestionDoes learning to exploit production RL rewards produce broader misalignment, and which interventions alter that generalization?

Source summaryMisalignment rises alongside learned hacking in the studied runs.

NUWA research note · independent review pending

QuestionWhat does external testing actually add to a safety claim?

Source summaryThese activities supply different evidence; method review may replace independent rerunning when experiments are expensive.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDo benchmark tasks and scores support the phenomena that their authors claim to measure?

Source summaryThe review identifies recurring gaps between constructs, operational tasks and resulting claims, and proposes a practical checklist for benchmark design and interpretation.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can a developer combine evidence into a sabotage-risk argument?

Source summaryThe authors judge risk very low but nonzero and describe disagreements about evidence and argumentation.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes increasing clean-data scale dilute a fixed adversarial insertion enough to prevent a backdoor?

Source summaryComparable insertion counts can affect models trained on substantially different amounts of clean data.

NUWA research note · independent review pending

QuestionHow are capability signals linked to mitigation decisions?

Source summaryThe update expands early tracking and discusses misalignment and manipulation risks.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat failures appear when another vendor runs its own safety tests?

Source summaryThe introductory summary reports task- and reasoning-dependent results and notes that grader errors affected one jailbreak comparison.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan low-stakes reward optimization teach a broader tendency to exploit evaluation gaps and produce unrelated misalignment?

Source summaryModels generalize to new reward-seeking behaviors.

NUWA research note · independent review pending

QuestionCan a teacher’s behavioral trait transfer through semantically unrelated training outputs?

Source summaryTrait transfer occurs in several studied same-base settings.

NUWA research note · independent review pending

QuestionWill an agent completing unfinished tasks interfere with a shutdown mechanism, including when it is instructed to permit shutdown?

Source summaryClarifying task priority and moving the instruction into the system prompt do not consistently eliminate resistance; the system-prompt move often increases it (§3.1).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionDo precursor tests reliably warn of later scheming capabilities?

Source summaryPredictive performance varied with task difficulty; hard precursors could mislead.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWill agent-like models use harmful actions to protect continued operation or pursue conflicting goals when safer alternatives are deliberately constrained?

Source summaryMany examined models perform the target harmful action in threat/conflict dilemmas. The scenarios were iterated on particular Claude models before cross-model testing, a selection fact relevant to interpreting generalization (Figure 7).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan crowdsourced elicitation complement internal cyber evaluations?

Source summaryAuthors report competitive performance from crowdsourced agent configurations.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can adaptive black-box testing reveal indirect prompt-injection weaknesses?

Source summaryThe tested approach finds stronger attacks than evaluated baselines and shows some cross-task and cross-model transfer.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow broadly does end-to-end replication appear when a common scaffold is paired with different models?

Source summarySuccess is not confined to the largest tested models.

NUWA research note · independent review pending

QuestionDoes a narrow training objective generalize into unrelated misaligned responses rather than merely accepting harmful requests?

Source summaryEducational framing changes generalization despite matching insecure code.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWill models circumvent the intended rules when given a natural task objective and writable surroundings?

Source summarySome models hack under the baseline prompt while others require stronger nudging.

NUWA research note · independent review pending

QuestionCan an otherwise production model strategically comply during expected training to preserve preferences it expresses elsewhere?

Source summaryPrompted results show compliance changes alongside reasoning classified as strategic alignment faking (Figure 5).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan the tested LLM-plus-scaffold create a separate functioning copy without intermediate human assistance?

Source summaryBoth tested systems produced successful copies in the supplied environment.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan an agent remain useful on benign queries while retrieved memory steers it incorrectly?

Source summaryThe reported experiments show that benign-task accuracy can coexist with triggered failures, so average ordinary-task utility does not alone establish retrieval integrity.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan models hide a subset of capabilities and produce a plausible lower evaluation profile?

Source summarySelective suppression can generalize beyond the synthetic training data.

NUWA research note · independent review pending

QuestionIf deceptive conditional behavior is already present, do standard safety-training methods reliably remove it?

Source summarySome backdoors persist after these interventions.

NUWA research note · independent review pending

QuestionHow should monitor performance be estimated at very small audit budgets?

Source summaryParametric fitting improves estimates when benign-tail data are sparse.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDo control protocols transfer across environments and stronger models?

Source summaryFeedback during retries can help an adversary adapt.

NUWA research note · independent review pending · Contains: question / method / limits