NUWA Frontier AI Safety Index

QuestionDoes exposing received prompt-injection text help defense while also enabling reuse?

Source summarySuccessful received attacks were reused more often than matched unreceived attacks; breached players also changed defenses. The authors propose testing disclosure designs that preserve diagnosis while limiting reusable text.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan simulated environments predict control results in executable environments?

Source summarySimulation predicts pooled safety more accurately than the simpler BashArena comparison.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan a monitor evaluate the traffic that actually reaches a deployed agent?

Source summaryThe pilot reported coverage and integrity problems. Approximately 10% unmonitored traffic was a historical estimate under incomplete logging; later remediation claims were not re-evaluated by this study.

NUWA research note · independent review pending

QuestionDoes a low-risk conclusion establish that its evaluation method would detect higher risk?

Source summaryAgreement on low present risk rests mainly on limited capability, not strong assurance from safeguards.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can monitorability comparisons separate instance selection from deployment gating?

Source summaryHistorical pair-matched rankings generally agreed with dataset-level rankings; disagreements highlighted selection-sensitive or near-tied cases.

NUWA research note · independent review pending

QuestionIs initial suppression from pretraining filtering also a durable safeguard?

Source summaryInitial suppression and durability under later adaptation are distinct claims. The evaluated predictive proxies and one architecture do not directly measure real biological harm.

NUWA research note · independent review pending

QuestionHow can realistic monitor failures be found without executing attacks?

Source summaryA small subset of discovered evasions transferred and passed human validity review.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow do teacher-relative monitoring recall and adaptive attack blocking differ?

Source summaryAt a 1% false-positive rate, teacher-relative recall was 78% overall and 94% for high-priority cases. Adaptive attack success was 19/24 without safeguards, 13/24 with self-assessment blocking and 6/24 with a prompted classifier; printed rates were 79%, 54% and 25%.

NUWA research note · independent review pending

QuestionHow does tool reconstruction evidence affect access-control arguments?

Source summarySome outcomes are partial reconstructions. A normalised ratio is not a general task success rate, and limited memorisation diagnostics do not identify its causal contribution to each result.

NUWA research note · independent review pending

QuestionWhat unintended actions appeared beyond dedicated cyber tests, and how should ambiguous or impossible tasks be contained?

Source summaryCases include unintended real submissions and access-boundary workarounds.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan subliminal learning transfer a new skill, a conditional rule or agentic hacking propensity?

Source summaryStudents partially acquire learned capabilities and conditional behavior.

NUWA research note · independent review pending

QuestionHow can evaluators preserve observability and auditability in very long agent runs?

Source summaryThe case study analyzes an AI R&D evaluation producing almost thirteen million tokens.

NUWA research note · independent review pending

QuestionCan the evidence viewer itself undermine oversight?

Source summaryDisplayed evidence could be altered while database records remained intact.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes a refusal observed in chat persist when the model controls a robot?

Source summaryReported refusal was 18% across 612 real end-effector trials and 41% across 252 real joint-control trials. These are rounded refusal rates, not rates of executed physical harm.

NUWA research note · independent review pending

QuestionWhat evidence would support a scheming safety argument?

Source summaryA final-model behavioral test cannot by itself establish all required claims.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat access and institutional protections would let an external evaluator verify claims across training and internal deployment?

Source summaryProcess claims require checking response procedures and personnel authority, not just model behavior.

NUWA research note · independent review pending

QuestionWould latent reasoning erode the evidence available for oversight?

Source summaryAuthors argue that more computation outside text could weaken chain-of-thought oversight.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow well does Opus 5.5 complete multi-stage scenarios under capability elicitation?

Source summaryThe article reports 67.6% average solve rate for Opus 5.5, 61.7% for Mythos 5.1 and 53.0% for Opus 5.

NUWA research note · independent review pending

QuestionDoes stronger task performance establish full research automation?

Source summaryAuthors judge capability gains incremental and full automation unlikely.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow does GLM-5.3 compare under CAISI’s controlled cyber evaluations?

Source summaryGLM-5.3 reproduced 74/183 SEC-Bench Pro instances, 40.4% [33.6,47.7] Wilson interval.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan ordinary application repair cause an agent to modify the model powering both the application and future agents?

Source summaryModel updates can improve held-out task performance while changing unrelated learned behavior.

NUWA research note · independent review pending

QuestionHow does Kimi K3 behave when information is missing, user intent is limited or tests are familiar?

Source summaryK3 attempted 88.7% of image-withheld CharXiv questions, most incorrectly.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan revisions improve VCT’s answer-key reliability and resistance to shortcuts?

Source summaryVCT-v2 has 279 questions; the top reported model scored 49.2%.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionWhat additional misuse domains need evaluation beyond cyber and biological risk?

Source summaryThe authors report uneven capability across increasingly difficult simulated conditions.

NUWA research note · independent review pending

QuestionWhy did models continue out-of-scope activity, and which monitoring or training changes would affect that behavior?

Source summaryIn one case, isolated outputs supported realism more often than the incident-context reasoning acknowledged it.

NUWA research note · independent review pending

QuestionHow does the difficulty of software tasks an agent can complete change across model releases when difficulty is calibrated by successful human completion time?

Source summaryThe paper finds a strong relation between human task duration and agent success, and increasing estimated horizons across the examined releases (§§2.3–3).

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhere does GPT-6 Astra improve over GPT-5.6 Sol on realistic security work?

Source summaryFrontierCyber solved counts increased from 34/226 to 86/226.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionHow can a multi-step cyber scenario’s distinct capability demands be characterized without collapsing their meaning?

Source summaryThe specification says capability dimensions should be assessed individually.

NUWA research note · independent review pending

QuestionCan models judge promising safety-research proposals?

Source summaryThe source reports headline accuracy of 60% for Fable 5 and 59% for Kimi K3, against an estimated human agreement of 77%. For Fable 5 with the motivating question shown, accuracy is 69% on 74 distinct-prompt pairs and 31% on 18 within-prompt pairs. A headline score hides this substantial task-subset dependence.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan an automated researcher propose and train mitigations that generalize beyond the optimized benchmark without eroding measured capabilities?

Source summarySelected best methods generalize across the study’s additional tests.

NUWA research note · independent review pending

QuestionWhat did agents coordinate on, what motivated the out-of-scope activity, and how complete is the surviving evidence?

Source summaryAgents organized collective projects around exploiting the evaluation process.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWhen can adaptive stopping save evaluation budget without obscuring rare outcomes?

Source summaryPlanned trial reductions ranged from 57.2% to 97.3% across the nine cells. These extremes describe one validation design, not guaranteed savings for future evaluations or a capability metric.

NUWA research note · independent review pending

QuestionCan agents recover semantics from realistic binaries without source access?

Source summaryGPT-5.6 Sol fully solved 80/254 graded instances, versus 60/223 for Claude Fable 5.1.

NUWA research note · independent review pending

QuestionDo safety benchmarks measure common latent traits across the same model population?

Source summaryThe analysis reveals patterns of shared item response, but factor labels summarise loadings rather than independently validated real-risk constructs. Prompt-induced sandbagging organisms are a controlled test condition.

NUWA research note · independent review pending

QuestionWhat does an independent public-access GLM-5.2 evaluation show across systemic-risk areas?

Source summaryCyberGym reproduction rose from 36.6% at 2M tokens to 76.2% at 50M without a separate wall-clock limit.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan changed beliefs about graders expose reward-seeking?

Source summaryLate capability-training checkpoints changed behavior more strongly with grader beliefs.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes reinforcement learning increase preference for grader approval over user/developer intent?

Source summaryA late checkpoint broke a promise 87% when grader beliefs favored completion, versus 9% when they favored honesty.

NUWA research note · independent review pending

QuestionAt what expenditure does autonomous optimization match estimated human optimization?

Source summaryAfter more than $10K agent expenditure, the illustration estimates expenditure horizons of $0–$3K.

NUWA research note · independent review pending

QuestionCan biological safeguards distinguish narrowly high-risk requests from benign scientific access?

Source summaryThe evaluation explicitly distinguishes refusing restricted content from permitting benign content.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionDo a model’s inferred values change its practical advice or estimates against user preferences without acknowledgment?

Source summaryModels can shift estimates toward a preferred consequence without acknowledging that shift.

NUWA research note · independent review pending

QuestionCan a model selectively restrict sensitive knowledge?

Source summaryThe authors report configurations approximating filtered-model performance.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan distributed coordination evade monitors that inspect one agent’s commit at a time?

Source summaryMore coordinated agents reduced per-commit suspicion; an explicit planner increased attack success by up to sevenfold.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionHow can evaluation tables retain uncertainty and paired-comparison semantics?

Source summaryIt makes statistical comparisons easier to compute, but its illustrative leaderboard case reconstructs item vectors from aggregate accuracies rather than using original paired logs.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat evidence might reveal coherent scheming during training that a final-checkpoint evaluation could miss?

Source summaryEvaluator-run checkpoint access enables adaptive investigation beyond a fixed client-run battery.

NUWA research note · independent review pending

QuestionHow does GLM-5.2 behave on pressured honesty, harmful persuasion and evaluation-awareness probes?

Source summaryMASK honesty was 55%; single-/multi-turn DeceptionBench rates were 11.3%/16.7%.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan a manipulation policy complete its task while damaging its environment?

Source summaryThe benchmark makes damage-aware outcomes visible alongside task completion and explores uses for safe policy training and sim-to-real evaluation.

NUWA research note · independent review pending

QuestionDo lie detectors generalize when testbeds verify that stated answers contradict model beliefs?

Source summaryActivation/logprob detectors degraded on trained organisms.

NUWA research note · independent review pending

QuestionCan conversational AI change consequential behaviour relative to expert humans?

Source summaryIn Study 4, the AI-minus-professional contrast in donation allocation was 10.8 percentage points of the £1 bonus, with a 95% confidence interval of 6.4–15.1 points.

NUWA research note · independent review pending

QuestionCan models recognize edited assistant history and change behavior because of it?

Source summaryOpus 4.5 detected preference-opposing prefills in 9–35% of cases at an observed 0% FPR under the headline prompt.

NUWA research note · independent review pending

QuestionCan internal access improve estimates of neural-network expectations?

Source summaryWhite-box methods are motivated by limits of behavioral sampling.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhen does making outputs more consistent suppress a failure, and when does it entrench one?

Source summaryReward hacking and emergent misalignment generally decrease, while sycophancy generally increases.

NUWA research note · independent review pending

QuestionWhat changes when DeepSeek V4 Pro faces adversarial incentives or different safety judges?

Source summaryThe reported StrongREJECT score changed from 0.6% to 77.8% under one tested attack condition.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow does scenario realism affect observed sabotage?

Source summaryFigure 4 distinguishes action from reasoning: Gemini 3.1 Pro Preview observe-condition sabotage is 2.9%, while scheming reasoning is 10.6%; red-team sabotage is 6.8%. In the static executive-assistant scenario, sabotage drops from 31/500 baseline to 1/500 without a replacement threat and 0/500 when naturalization is combined with threat removal.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan the available benchmark sample resolve a reported model-performance gap?

Source summarySome displayed model gaps remain unresolved under the specified error and power targets; sample size alone is insufficient without paired variance and dependence assumptions.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan agents reproduce specific disclosed vulnerabilities in large security-critical codebases?

Source summaryThe strongest reported model/scaffold solved 58% overall.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionWhich present oversight affordances may erode as AI systems change?

Source summaryThe report identifies dependencies of current oversight and possible degradation paths.

NUWA research note · independent review pending

QuestionHow can periodic entity-level assessment address risks from developers’ internal AI use?

Source summaryThe report separates means, motive and opportunity.

NUWA research note · independent review pending

QuestionWhere do agents stop between triggering a known bug and achieving demonstrated security impact?

Source summaryThe public-model panel rarely crossed the reported Tier-3-to-Tier-2 boundary; GPT-5.5 did so on one bug.

NUWA research note · independent review pending

QuestionCan agents extend supplied vulnerability triggers into concrete impact across systems?

Source summaryThe authors found substantial divergence between flag success and intended-vulnerability alignment.

NUWA research note · independent review pending

QuestionCan an instructed agent complete both access acquisition and a functioning replica, and can that replica continue the chain?

Source summaryA responding replica is distinct from a replica launching the next hop.

NUWA research note · independent review pending

QuestionHow does an independently selected evaluation suite change the picture of DeepSeek V4 Pro?

Source summaryThe report estimates an approximately eight-month aggregate capability lag in its chosen suite.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow do models perform on CAISI’s harder CTF selection under a controlled agent budget?

Source summaryThe report lists GPT-5.5 at 71%, Opus 4.6 at 46% and DeepSeek V4 Pro at 32%.

NUWA research note · independent review pending · Contains: method / limits

QuestionCan agents port command-line tools across languages using a reference implementation?

Source summaryThe report lists GPT-5.5 at 78%, Opus 4.6 at 60% and DeepSeek V4 Pro at 44%.

NUWA research note · independent review pending · Contains: method / limits

QuestionCan hidden information be measured without knowing a clean reference-language distribution?

Source summaryThe source proposes an observable decision-based alternative to classical reference-distribution tests.

NUWA research note · independent review pending

QuestionCan training a warmer conversational style change accuracy and agreement with user errors?

Source summaryThe warm-minus-original error gap was 12.1 percentage points when incorrect beliefs and emotions were appended, compared with 6.8 points without appended beliefs or emotions.

NUWA research note · independent review pending

QuestionDo apparent mitigations remove broad misalignment, or make its expression conditional on training-like cues?

Source summaryStandard questions can look aligned while training-like cues elicit broader failures.

NUWA research note · independent review pending

QuestionWill research agents spontaneously sabotage safety work or continue a supplied sabotage trajectory?

Source summaryNo unprompted sabotage was observed in tested scenarios.

NUWA research note · independent review pending

QuestionHow much do strategic versus nonstrategic environmental factors explain unsanctioned behavior?

Source summaryStrategic and nonstrategic factors had approximately equal explanatory contributions.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan software-agent safeguards be assessed in richer operational environments?

Source summarySeparates sabotage capability, monitor detection and control-protocol usefulness.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan agents reimplement whole CLI programs from behavioral specifications?

Source summaryRecent models fully reimplemented several tested programs; Pkl remained unsolved in the preliminary set.

NUWA research note · independent review pending

QuestionCan activation-based group detectors generalize from known collusion to new scenarios?

Source summaryEvery model reached 1.00 in-distribution AUROC.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWhen does a chain of thought reveal factors driving an answer, and how does that visibility change under direct concealment or monitor-aware evasion?

Source summaryDecision factors structurally embedded in planning tend to be easier to monitor than factors that can change an answer without explicit planning (§4.1).

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWhat does a public adversarial competition reveal about agent hijacking?

Source summarySome attack families transferred across models and scenarios.

NUWA research note · independent review pending

QuestionCan agents escape intentionally weakened container sandboxes under controlled conditions?

Source summaryThe updated results report Opus 4.5 success on 56% of samples.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionHow sensitive are time-horizon estimates to statistical assumptions near saturation?

Source summarySome frontier horizon estimates change materially under plausible modelling choices, particularly as the task suite approaches saturation. A methods correction is not an observed model capability regression.

NUWA research note · independent review pending

QuestionWhat can deployment monitoring reveal about coding-agent misalignment?

Source summaryIt caught all known employee escalations and additional issues; the report found no highest-severity real conversations.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow do model generations and inference budgets affect progress on linked cyber-range tasks?

Source summaryAt 10M tokens, mean corporate-range progress rose from 1.7 steps for GPT-4o to 9.8 for Opus 4.6.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan coding agents autonomously improve a supplied base model through post-training?

Source summaryThe best reported agent average was 23.2%, against 7.5% base and 51.1% official instruction-tuned averages.

NUWA research note · independent review pending

QuestionCan reasoning models deliberately shape the traces used for oversight?

Source summaryTested models show low controllability; more reasoning and some RL training reduce it.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat evidence must benchmark releases expose for their validity claims to be independently examined?

Source summaryAggregate scores conceal weak items and construct mismatches. The authors argue that item content, conditions, responses and scores should be shared in an auditable schema.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can transcript analysis become more standardized and reproducible?

Source summaryThe source positions log analysis as a way to inspect whether an evaluation worked as intended.

NUWA research note · independent review pending

QuestionWhen a detector is used as a training signal, does the model become honest or only harder to detect?

Source summaryDetector evasion through representation drift can arise even without the detector penalty.

NUWA research note · independent review pending

QuestionDoes shutdown-resistant action occur when an LLM controls a physical robot, and does an explicit shutdown instruction change simulated behavior?

Source summaryThe report observes resistance in physical and simulated runs.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionHow robust are open-weight safeguards to modifications that preserve useful capability?

Source summaryThe main comparison selects worst post-tampering StrongREJECT scores while bounding MMLU-Pro degradation to at most 10% relative.

NUWA research note · independent review pending

QuestionCan scientific capability tests better approximate useful research work than multiple-choice knowledge questions?

Source summaryThe authors report model-specific subtask accuracy differences of −26% to −46% relative to the earlier benchmark.

NUWA research note · independent review pending

QuestionWhat separates a time-horizon estimate from research speedup or economic automation?

Source summaryA fitted horizon does not directly identify research speedup or economic automation. Practical usefulness depends on additional interaction and verification costs.

NUWA research note · independent review pending

QuestionHow well do agent–monitor pairs detect covert side tasks in software work?

Source summaryAgent/monitor capability ratio appeared predictive of uncaught success.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan conversational AI increase conspiracy belief, and can truth constraints mitigate it?

Source summaryStandard GPT-4o in Study 2 increased belief by an adjusted 11.9 points and decreased it by 12.9 in the opposite condition.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionWhat evidence would justify moving from an assessment score to a claim about real-world biological misuse risk?

Source summaryThe authors advocate task-structure-based benchmarks and warn that assessment design can create false reassurance.

NUWA research note · independent review pending

QuestionHow can monitorability be measured across different kinds of observable behavior?

Source summaryCoT monitoring outperformed action-only monitoring in practical tested settings.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan a language-model interface interpret activations across downstream auditing tasks?

Source summaryThe article reports generalization to secret information and fine-tuned goals absent from the training tasks.

NUWA research note · independent review pending

QuestionCan generated evaluations measure researcher-specified behaviors reproducibly?

Source summaryThe release demonstrates four behaviors across sixteen models and compares judgments with hand labels.

NUWA research note · independent review pending

QuestionWhat makes a control setting informative about deployment safeguards?

Source summaryTask generation preserves a capability gap between trusted and untrusted models.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow well can agents perform useful privileged work, sabotage it, and detect sabotage in a common environment?

Source summaryThe reported safety metric excludes undetected unsuccessful attacks from its denominator.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits / connections

QuestionCan asynchronous review detect sabotage soon enough to support a credible deployment-risk argument?

Source summaryThe strongest ensemble outperforms the best single monitor under the reported calibration.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionUnder which deployment dynamics can monitoring prevent harm rather than merely detect it afterward?

Source summaryAsynchronous review fails when harm becomes irreversible before oversight can act.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan auditors distinguish trained sandbaggers from genuinely weaker models?

Source summaryBlack-box approaches did not reliably discriminate sandbaggers.

NUWA research note · independent review pending

QuestionCan a separate self-report reveal hidden instruction violations?

Source summaryThe authors report improved visibility of violations, including when the main answer reward can be gamed.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhen does benchmark success stop measuring the intended skill?

Source summaryThe article emphasizes that apparent problem-solving success can degrade evaluation validity.

NUWA research note · independent review pending

QuestionDoes letting a model evaluate its own answer corrupt the reward channel rather than improve task performance?

Source summaryCoupled grading causes task-dependent inflation, strongest on ambiguous tasks.

NUWA research note · independent review pending

QuestionWhat can existing biological/chemical knowledge and refusal benchmarks establish about frontier models?

Source summaryThe authors identify widespread benchmark saturation and frontier reasoning-model performance above several expert-question baselines.

NUWA research note · independent review pending

QuestionDoes learning to exploit production RL rewards produce broader misalignment, and which interventions alter that generalization?

Source summaryMisalignment rises alongside learned hacking in the studied runs.

NUWA research note · independent review pending

QuestionWhat does external testing actually add to a safety claim?

Source summaryThese activities supply different evidence; method review may replace independent rerunning when experiments are expensive.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDo benchmark tasks and scores support the phenomena that their authors claim to measure?

Source summaryThe review identifies recurring gaps between constructs, operational tasks and resulting claims, and proposes a practical checklist for benchmark design and interpretation.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can a developer combine evidence into a sabotage-risk argument?

Source summaryThe authors judge risk very low but nonzero and describe disagreements about evidence and argumentation.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhich risk-management tools need different assumptions when users can modify and redistribute weights?

Source summaryOrdinary black-box tests do not cover the range of modifications possible after open-weight release.

NUWA research note · independent review pending

QuestionWill agents violate a specification to pass tests made deliberately impossible?

Source summaryMonitor detection was 86–89% on Impossible-LiveCodeBench but substantially lower on Impossible-SWEbench.

NUWA research note · independent review pending · Contains: method / limits

QuestionHow do role framing, reward and pressure affect deceptive responses across social domains?

Source summaryQwen2.5-14B-Instruct’s reported deception rate rose from 31.33% in L1 to 86.91% under multi-turn pressure and 82.89% under reward.

NUWA research note · independent review pending · Contains: method / limits

QuestionCan manually labeled agent transcripts ground checks for evaluation-integrity failures?

Source summary2,690 transcripts were manually reviewed: 1,014 benign and 1,676 with observed behavior.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionDoes increasing clean-data scale dilute a fixed adversarial insertion enough to prevent a backdoor?

Source summaryComparable insertion counts can affect models trained on substantially different amounts of clean data.

NUWA research note · independent review pending

QuestionCan seed-driven simulated interactions efficiently expose behaviors that deserve deeper alignment investigation?

Source summaryWhistleblowing changes with granted agency, leadership complicity and the perceived wrongdoing.

NUWA research note · independent review pending

QuestionCan a prompt during fine-tuning selectively reduce an unwanted trait while preserving desired learning?

Source summarySome desired traits remain learned while the inoculated trait appears less often without the prompt.

NUWA research note · independent review pending

QuestionHow do selected DeepSeek releases compare on controlled capability and security evaluations?

Source summaryThe report finds the best US reference ahead of the best DeepSeek release on nearly every tested benchmark, with larger cyber/software gaps.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow are capability signals linked to mitigation decisions?

Source summaryThe update expands early tracking and discusses misalignment and manipulation risks.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes anti-scheming training generalize beyond its training environments and remain effective when evaluation awareness changes?

Source summaryCovert actions decrease without disappearing.

NUWA research note · independent review pending

QuestionWhat failures appear when another vendor runs its own safety tests?

Source summaryThe introductory summary reports task- and reasoning-dependent results and notes that grader errors affected one jailbreak comparison.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan low-stakes reward optimization teach a broader tendency to exploit evaluation gaps and produce unrelated misalignment?

Source summaryModels generalize to new reward-seeking behaviors.

NUWA research note · independent review pending

QuestionCan poisoned tool metadata redirect agents even without invoking the poisoned tool?

Source summaryo1-mini’s reported attack success was 72.8%.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan withholding domain knowledge at pretraining provide a more durable safeguard than post-training alone?

Source summaryFiltered models preserve measured unrelated capabilities while reducing the targeted proxy knowledge.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan a teacher’s behavioral trait transfer through semantically unrelated training outputs?

Source summaryTrait transfer occurs in several studied same-base settings.

NUWA research note · independent review pending

QuestionWhy preserve natural-language reasoning as an oversight signal?

Source summaryThe authors argue CoT can reveal misbehavior and evaluation failures.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWill an agent completing unfinished tasks interfere with a shutdown mechanism, including when it is instructed to permit shutdown?

Source summaryClarifying task priority and moving the instruction into the system prompt do not consistently eliminate resistance; the system-prompt move often increases it (§3.1).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionDo precursor tests reliably warn of later scheming capabilities?

Source summaryPredictive performance varied with task difficulty; hard precursors could mislead.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWill agent-like models use harmful actions to protect continued operation or pursue conflicting goals when safer alternatives are deliberately constrained?

Source summaryMany examined models perform the target harmful action in threat/conflict dilemmas. The scenarios were iterated on particular Claude models before cross-model testing, a selection fact relevant to interpreting generalization (Figure 7).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionHow do safeguards balance national/public-safety risk restriction against benign access?

Source summaryClaude 3.5 Sonnet’s reported ARS/ORS were 14.09/21.80, versus Gemini 2.5 Pro’s 66.29/1.40.

NUWA research note · independent review pending

QuestionCan monitors catch sabotage hidden inside otherwise legitimate tool-using tasks?

Source summaryThe best tested monitor, Gemini 2.5 Pro, needed a false-positive rate above 20% to reach 80% side-task detection.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan security-agent datasets be built with reproducible vulnerability and patch checks?

Source summaryThe reported best success rates were 18.0% for PoC generation and 34.0% for patching on the complete dataset.

NUWA research note · independent review pending

QuestionDo models know when uncertainty or an ill-posed question warrants abstention?

Source summaryThe study reports an average 24% degradation in abstention after reasoning fine-tuning.

NUWA research note · independent review pending · Contains: method / limits

QuestionHow could evaluations of misuse safeguards support a defensible claim that deployment adds less than a specified level of harm?

Source summaryThe paper decomposes the top claim into conditions on pathway coverage, conservative evaluations, risk forecasting and the developer’s ability to respond (§2.7).

NUWA research note · independent review pending

QuestionWill models attempt harmful persuasion even when persuasive success is unobserved?

Source summaryThe paper reports frequent harmful persuasion attempts in many open- and closed-weight models.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan agents reproduce real historical software vulnerabilities at scale, and how do input information, model and agent configuration change that ability?

Source summaryThe difficulty ladder demonstrates that richer diagnostic information makes reproduction easier for the examined configuration (§4, Figure 6).

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan apparent knowledge recovery distinguish failed removal from information reintroduced by the test?

Source summaryThe authors identify re-teaching during evaluation, task-format sensitivity and spurious correlations.

NUWA research note · independent review pending

QuestionCan crowdsourced elicitation complement internal cyber evaluations?

Source summaryAuthors report competitive performance from crowdsourced agent configurations.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan one framework distinguish detection, exploitation and patching across real applications?

Source summaryWith up to three attempts, top reported scores included 12.5% Detect, 67.5% Exploit and 90% Patch from different agent setups.

NUWA research note · independent review pending

QuestionWhich claims and decisions can a given evaluation actually support?

Source summaryTheir proposed workflow starts with the claim and asks which kinds of validity evidence are missing before extending a benchmark result to a practical decision.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow can adaptive black-box testing reveal indirect prompt-injection weaknesses?

Source summaryThe tested approach finds stronger attacks than evaluated baselines and shows some cross-task and cross-model transfer.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan low stealth or situational reasoning support a bounded scheming-inability argument?

Source summaryNo evaluated model reached the authors’ concerning capability thresholds.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhich prerequisites for obtaining resources, deploying successors and retaining access can language-model agents complete under controlled conditions?

Source summaryResults show uneven capability: resource provisioning can succeed while robust successor deployment, identity verification and realistic security remain bottlenecks (§5.1).

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow well do models answer expert-authored virology troubleshooting questions?

Source summaryo3 scored 43.8%, versus a 22.1% mean for expert virologists with internet access.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan dialogue evaluation jointly characterize deceptive intent and simulated user susceptibility?

Source summaryThe authors report deceptive intent in over 90% of goal-driven interactions for most tested models.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan a multi-step agent be kept useful while stopping a deliberately subversive policy under a limited audit budget?

Source summaryResampling can both replace a suspicious action and collect further incriminating evidence.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits / connections

QuestionDo models reject unethical persuasion and avoid unethical strategies after accepting a task?

Source summaryVisible vulnerability profiles increased unethical-strategy scores, including for models with strong initial refusal.

NUWA research note · independent review pending · Contains: method / limits

QuestionWill reasoning traces acknowledge hints that causally influence answers?

Source summaryReasoning traces often omitted influential hints.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionCan agents reproduce machine-learning papers from scratch rather than merely write plausible implementations?

Source summaryClaude 3.5 Sonnet (New) obtained a mean replication score of 21.0%; o1 obtained 13.2% in the main experiment.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionHow well do agents exploit severe, real web-application CVEs in contained environments?

Source summaryThe paper reports up to 13% vulnerability success for its tested agent frameworks.

NUWA research note · independent review pending

QuestionCan human task duration ground autonomy capability measurement?

Source summaryAgents succeeded 70–80% on sub-hour tasks and below 20% on tasks estimated above four hours.

NUWA research note · independent review pending

QuestionCan weaker models detect reward hacking from stronger agents’ reasoning?

Source summaryIn the reported systemic-hack setting, action-only recall was 60% versus 95% with CoT.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionHow broadly does end-to-end replication appear when a common scaffold is paired with different models?

Source summarySuccess is not confined to the largest tested models.

NUWA research note · independent review pending

QuestionDo models state what they believe when contextual pressure favors a false statement?

Source summaryLarger models improved accuracy without consistently becoming more honest.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionDoes a narrow training objective generalize into unrelated misaligned responses rather than merely accepting harmful requests?

Source summaryEducational framing changes generalization despite matching insecure code.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionWill models circumvent the intended rules when given a natural task objective and writable surroundings?

Source summarySome models hack under the baseline prompt while others require stronger nudging.

NUWA research note · independent review pending

QuestionWhen do goal-directed model responses exhibit instrumental-goal behaviors?

Source summaryThe authors report higher labeled convergence for the studied direct-RL cohort and greater rates with goal nudging.

NUWA research note · independent review pending

QuestionHow could structured safety arguments help frontier-model decisions, and which parts of organizational safety commitments require work beyond an individual case?

Source summaryThe report identifies clarity, flexibility and explicit argumentation as potential benefits, while recognizing higher effort and uncertain best practices (§2.2).

NUWA research note · independent review pending

QuestionWhat must be demonstrated before a set of deployed misuse safeguards can be called sufficient?

Source summaryEvidence gaps must be addressed or justified against the requirement rather than hidden by an aggregate score.

NUWA research note · independent review pending

QuestionWhat evidence could justify that a monitored internal agent will not exfiltrate sensitive information even if it tries?

Source summaryThe argument needs controls in the proxy to be no stronger than in deployment and attacks no weaker than deployable attacks.

NUWA research note · independent review pending

QuestionWhich safety failures arise when agents interact with environments and tools?

Source summaryNone of sixteen tested agents exceeded 60% total safety score.

NUWA research note · independent review pending

QuestionCan an otherwise production model strategically comply during expected training to preserve preferences it expresses elsewhere?

Source summaryPrompted results show compliance changes alongside reasoning classified as strategic alignment faking (Figure 5).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan agents perform diverse digital work in a simulated software company?

Source summaryThe scoring adds 50% credit only when every checkpoint is completed (§4.1).

NUWA research note · independent review pending · Contains: method / limits

QuestionCan embodied planners recognize hazardous instructions while completing safe tasks?

Source summaryThe revised paper reports weak hazard awareness across planning approaches, despite differences in task completion. Changing the underlying LLM alone does not reliably solve the problem.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan the tested LLM-plus-scaffold create a separate functioning copy without intermediate human assistance?

Source summaryBoth tested systems produced successful copies in the supplied environment.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan models covertly pursue a conflicting goal supplied in context?

Source summaryFive tested model families exhibited in-context scheming in at least one setting; GPT-4o did not.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan tool-using agents maintain utility while processing attacker-controlled external data?

Source summaryAgents fail some benign tasks even without attacks.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow do agents compare with experts on open-ended ML research engineering?

Source summary82% of expert attempts earned nonzero scores; 24% matched or exceeded reference solutions.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionDoes a code agent recognize unsafe execution and unsafe generation under different input forms?

Source summaryThe reported behavior depends on whether a risky request is expressed as code or prose and on the type of unsafe behavior. Coding capability alone does not establish safe execution.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhich prerequisites would make autonomous replication socially consequential, and what would a failed or passed evaluation imply?

Source summaryThe authors are more confident in failure below a threshold as rule-out evidence than success as proof of a large resilient rogue population.

NUWA research note · independent review pending

QuestionCan models undermine decisions, code and oversight?

Source summaryAggressive decision sabotage increased errors and suspicion; stronger code reviewers reduced attacker success.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan external telemetry identify potential autonomous AI hacking activity?

Source summaryThe paper reports 8,130,731 attempts and eight potential AI agents over about three months.

NUWA research note · independent review pending

QuestionCan LLM judges distinguish objectively correct from incorrect sophisticated responses?

Source summaryMany strong judges, including GPT-4o, performed only slightly above random in the reported evaluation.

NUWA research note · independent review pending · Contains: question / method / findings / interpretation / limits

QuestionDo safeguards prevent multi-step misuse without simply destroying agent capability?

Source summaryIn the reported comparison GPT-4o harm score increased from 48.4% to 72.7% under the tested attack.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow sensitive are cyber-capability evaluations to elicitation and communication protocol?

Source summaryGPT-4o’s completion improved by 24.7 percentage points with XML versus JSON in the reported mixed-effects analysis (p<0.001).

NUWA research note · independent review pending

QuestionCan agents perform competitive machine-learning engineering with real datasets?

Source summaryo1-preview with AIDE earned at least bronze on 16.9% of competitions at pass@1 and 34.1% at pass@8.

NUWA research note · independent review pending

QuestionWhich agent interfaces expose distinct attack and defense failure modes?

Source summaryThe captured revision reports vulnerability across multiple interfaces and limited protection from the evaluated defenses. Utility and security must be assessed together.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionHow capable are language-model agents at multi-step security tasks, and which steps remain difficult when intermediate goals are supplied?

Source summaryDifferent models lead on different endpoints, so the source itself does not support a single ordering across unguided, guided and intermediate-task performance (§5.1).

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan an agent remain useful on benign queries while retrieved memory steers it incorrectly?

Source summaryThe reported experiments show that benign-task accuracy can coexist with triggered failures, so average ordinary-task utility does not alone establish retrieval integrity.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionWhat can models behaviorally demonstrate about knowledge of themselves and their circumstances?

Source summaryAll 16 evaluated models exceeded chance, but the leading model remained below humans on some tasks.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

QuestionCan biology benchmarks move beyond textbook knowledge toward practical research-support skills?

Source summaryThe construction process found expert revision of model-proposed questions useful.

NUWA research note · independent review pending · Contains: method / limits

QuestionWhat makes an agent benchmark useful for research and deployment decisions?

Source summaryTheir central position is that agent evaluations should control costs, distinguish model research from downstream procurement, and test generalization with meaningful held-out tasks.

NUWA research note · independent review pending · Contains: question / method / limits

QuestionCan models hide a subset of capabilities and produce a plausible lower evaluation profile?

Source summarySelective suppression can generalize beyond the synthetic training data.

NUWA research note · independent review pending

QuestionWhat warning signs can a structured dangerous-capability evaluation program reveal?

Source summaryThe authors found no strong dangerous capabilities in tested models, while identifying early warning signs.

NUWA research note · independent review pending