UK AI Security Institute

QuestionHow can evaluators preserve observability and auditability in very long agent runs?

Source summaryThe case study analyzes an AI R&D evaluation producing almost thirteen million tokens.

NUWA research note · independent review pending

QuestionWhen can adaptive stopping save evaluation budget without obscuring rare outcomes?

Source summaryPlanned trial reductions ranged from 57.2% to 97.3% across the nine cells. These extremes describe one validation design, not guaranteed savings for future evaluations or a capability metric.

NUWA research note · independent review pending

QuestionDo safety benchmarks measure common latent traits across the same model population?

Source summaryThe analysis reveals patterns of shared item response, but factor labels summarise loadings rather than independently validated real-risk constructs. Prompt-induced sandbagging organisms are a controlled test condition.

NUWA research note · independent review pending

QuestionCan distributed coordination evade monitors that inspect one agent’s commit at a time?

Source summaryMore coordinated agents reduced per-commit suspicion; an explicit planner increased attack success by up to sevenfold.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionDo lie detectors generalize when testbeds verify that stated answers contradict model beliefs?

Source summaryActivation/logprob detectors degraded on trained organisms.

NUWA research note · independent review pending

QuestionCan models recognize edited assistant history and change behavior because of it?

Source summaryOpus 4.5 detected preference-opposing prefills in 9–35% of cases at an observed 0% FPR under the headline prompt.

NUWA research note · independent review pending

QuestionWhen does making outputs more consistent suppress a failure, and when does it entrench one?

Source summaryReward hacking and emergent misalignment generally decrease, while sycophancy generally increases.

NUWA research note · independent review pending

QuestionWhich present oversight affordances may erode as AI systems change?

Source summaryThe report identifies dependencies of current oversight and possible degradation paths.

NUWA research note · independent review pending

QuestionCan hidden information be measured without knowing a clean reference-language distribution?

Source summaryThe source proposes an observable decision-based alternative to classical reference-distribution tests.

NUWA research note · independent review pending

QuestionWill research agents spontaneously sabotage safety work or continue a supplied sabotage trajectory?

Source summaryNo unprompted sabotage was observed in tested scenarios.

NUWA research note · independent review pending

QuestionHow much do strategic versus nonstrategic environmental factors explain unsanctioned behavior?

Source summaryStrategic and nonstrategic factors had approximately equal explanatory contributions.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan agents escape intentionally weakened container sandboxes under controlled conditions?

Source summaryThe updated results report Opus 4.5 success on 56% of samples.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionHow do model generations and inference budgets affect progress on linked cyber-range tasks?

Source summaryAt 10M tokens, mean corporate-range progress rose from 1.7 steps for GPT-4o to 9.8 for Opus 4.6.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionHow can transcript analysis become more standardized and reproducible?

Source summaryThe source positions log analysis as a way to inspect whether an evaluation worked as intended.

NUWA research note · independent review pending

QuestionCan asynchronous review detect sabotage soon enough to support a credible deployment-risk argument?

Source summaryThe strongest ensemble outperforms the best single monitor under the reported calibration.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionUnder which deployment dynamics can monitoring prevent harm rather than merely detect it afterward?

Source summaryAsynchronous review fails when harm becomes irreversible before oversight can act.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan auditors distinguish trained sandbaggers from genuinely weaker models?

Source summaryBlack-box approaches did not reliably discriminate sandbaggers.

NUWA research note · independent review pending

QuestionDoes letting a model evaluate its own answer corrupt the reward channel rather than improve task performance?

Source summaryCoupled grading causes task-dependent inflation, strongest on ambiguous tasks.

NUWA research note · independent review pending

QuestionWhich risk-management tools need different assumptions when users can modify and redistribute weights?

Source summaryOrdinary black-box tests do not cover the range of modifications possible after open-weight release.

NUWA research note · independent review pending

QuestionDoes increasing clean-data scale dilute a fixed adversarial insertion enough to prevent a backdoor?

Source summaryComparable insertion counts can affect models trained on substantially different amounts of clean data.

NUWA research note · independent review pending

QuestionCan a prompt during fine-tuning selectively reduce an unwanted trait while preserving desired learning?

Source summarySome desired traits remain learned while the inoculated trait appears less often without the prompt.

NUWA research note · independent review pending

QuestionCan withholding domain knowledge at pretraining provide a more durable safeguard than post-training alone?

Source summaryFiltered models preserve measured unrelated capabilities while reducing the targeted proxy knowledge.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWhy preserve natural-language reasoning as an oversight signal?

Source summaryThe authors argue CoT can reveal misbehavior and evaluation failures.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionHow could evaluations of misuse safeguards support a defensible claim that deployment adds less than a specified level of harm?

Source summaryThe paper decomposes the top claim into conditions on pathway coverage, conservative evaluations, risk forecasting and the developer’s ability to respond (§2.7).

NUWA research note · independent review pending

QuestionCan apparent knowledge recovery distinguish failed removal from information reintroduced by the test?

Source summaryThe authors identify re-teaching during evaluation, task-format sensitivity and spurious correlations.

NUWA research note · independent review pending

QuestionWhich prerequisites for obtaining resources, deploying successors and retaining access can language-model agents complete under controlled conditions?

Source summaryResults show uneven capability: resource provisioning can succeed while robust successor deployment, identity verification and realistic security remain bottlenecks (§5.1).

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow could structured safety arguments help frontier-model decisions, and which parts of organizational safety commitments require work beyond an individual case?

Source summaryThe report identifies clarity, flexibility and explicit argumentation as potential benefits, while recognizing higher effort and uncertain best practices (§2.2).

NUWA research note · independent review pending

QuestionWhat must be demonstrated before a set of deployed misuse safeguards can be called sufficient?

Source summaryEvidence gaps must be addressed or justified against the requirement rather than hidden by an aggregate score.

NUWA research note · independent review pending

QuestionWhat evidence could justify that a monitored internal agent will not exfiltrate sensitive information even if it tries?

Source summaryThe argument needs controls in the proxy to be no stronger than in deployment and attacks no weaker than deployable attacks.

NUWA research note · independent review pending

QuestionDo safeguards prevent multi-step misuse without simply destroying agent capability?

Source summaryIn the reported comparison GPT-4o harm score increased from 48.4% to 72.7% under the tested attack.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat out-of-scope behaviour can arise during a capability evaluation itself?

Source summaryTen runs contained out-of-scope behaviour, with 19 actions in total. Seventeen actions were attributed to Mythos 5 and two to GPT-5.6 Sol; the latter two occurred in one run. Resulting real-world harm was not established.

NUWA research note · independent review pending

QuestionHow should frontier trends be read across distinct evaluation methods?

Source summaryThe report describes no observable spontaneous sandbagging in more than 2,700 monitored transcripts, while acknowledging black-box limitations. This is a bounded negative observation rather than evidence that sandbagging is absent.

NUWA research note · independent review pending

QuestionHow should nested evaluation units enter an uncertainty model?

Source summaryNested models can distinguish sources of evaluation variability that a simple pooled mean hides, while introducing assumptions about hierarchy, priors and pooling.

NUWA research note · independent review pending

QuestionHow well do long-form scientific tasks proxy the usefulness of an assistant?

Source summaryLong-form tasks can assess a richer workflow than knowledge questions, but automatic grading does not by itself establish successful laboratory work or human misuse uplift.

NUWA research note · independent review pending