Institution
University of California, BerkeleyRoles and affiliations follow the cited source. A source check is not an independent replication.
More filters → 
Columbia University
Google DeepMindUniversity of California, Berkeley
Vals AI
OpenAI
Anthropic
Tufts University
University of California, Los Angeles
QuestionCan agents recover semantics from realistic binaries without source access?
Source summaryGPT-5.6 Sol fully solved 80/254 graded instances, versus 60/223 for Claude Fable 5.1.
NUWA research note · independent review pending
QuestionCan agents extend supplied vulnerability triggers into concrete impact across systems?
Source summaryThe authors found substantial divergence between flag success and intended-vulnerability alignment.
NUWA research note · independent review pending
QuestionDo apparent mitigations remove broad misalignment, or make its expression conditional on training-like cues?
Source summaryStandard questions can look aligned while training-like cues elicit broader failures.
NUWA research note · independent review pending
UK AI Security Institute
Apollo Research
METR
Université de Montréal
MilaAnthropicOpenAIGoogle DeepMind
Truthful AIUniversity of California, Berkeley
Redwood Research
Center for AI Safety
Scale AI
QuestionWhy preserve natural-language reasoning as an oversight signal?
Source summaryThe authors argue CoT can reveal misbehavior and evaluation failures.
NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits
QuestionCan agents reproduce real historical software vulnerabilities at scale, and how do input information, model and agent configuration change that ability?
Source summaryThe difficulty ladder demonstrates that richer diagnostic information makes reproduction easier for the examined configuration (§4, Figure 6).
NUWA research note · independent review pending · Contains: question / method / limits
QuestionCan one framework distinguish detection, exploitation and patching across real applications?
Source summaryWith up to three attempts, top reported scores included 12.5% Detect, 67.5% Exploit and 90% Patch from different agent setups.
NUWA research note · independent review pending
QuestionDoes a narrow training objective generalize into unrelated misaligned responses rather than merely accepting harmful requests?
Source summaryEducational framing changes generalization despite matching insecure code.
NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits
QuestionCan LLM judges distinguish objectively correct from incorrect sophisticated responses?
Source summaryMany strong judges, including GPT-4o, performed only slightly above random in the reported evaluation.
NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits
Center for AI SafetyUniversity of California, Berkeley
Massachusetts Institute of Technology
SecureBioScale AI
New York University
IIIT Hyderabad
Stanford University
Harvard University
University of Southern California
University of Illinois Urbana-ChampaignLapis LabsUniversity of California, Los Angeles
California Institute of TechnologySybil
Northeastern University
Carnegie Mellon University
RTX BBN Technologies
University of Newcastle
Keio University
Ariel University
Arizona State University
xAI
QuestionCan a public proxy benchmark track hazardous knowledge while supporting mitigation research?
Source summaryThe paper evaluates knowledge-reduction methods alongside general-capability retention.
NUWA research note · independent review pending · Contains: question / method / limits
QuestionDo jailbreak evaluators measure useful harmful content or merely willingness to answer?
Source summaryExisting evaluators frequently overstated jailbreak effectiveness.
NUWA research note · independent review pending · Contains: question / method / limits
University of Illinois Urbana-ChampaignCenter for AI SafetyCarnegie Mellon UniversityUniversity of California, Berkeley
Microsoft
QuestionCan automated red-team methods and defenses be compared with consistent behavior-level scoring?
Source summaryContextual behaviors had higher attack success than some other functional categories.
NUWA research note · independent review pending · Contains: question / method / limits
QuestionHow does reward optimization trade off with ethical conduct in social decision games?
Source summaryReward optimization created some tension with ethical conduct.
NUWA research note · independent review pending
NUWA 
