{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"sabotage-safety-research","title":"Evaluating whether AI models would sabotage AI safety research","aliases":[],"authors":["Robert Kirk","Alexandra Souly","Kai Fronsdal","Abby D’Cruz","Xander Davies"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"study","sourceId":"sabotage-safety-research-publication","attributionSourceId":"sabotage-safety-research-publication-author-source","originalUrl":"https://www.aisi.gov.uk/research/evaluating-whether-ai-models-would-sabotage-ai-safety-research","publicationDate":"2026-04-27","updatedOn":"2026-10-25","areas":["deception"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"aisi","role":"publisher","sourceId":"sabotage-safety-research-publication","locator":"Official publication masthead and article byline"}],"summary":{"en":"Evaluates whether models can covertly sabotage AI safety research while carrying out assigned research tasks.","zh":"评测模型能否在执行指定研究任务时隐蔽破坏 AI 安全研究。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[{"label":"Read the full paper","url":"https://arxiv.org/abs/2604.24618"}],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"sabotage-safety-research","title":"Evaluating whether AI models would sabotage AI safety research","en":{"question":"Will research agents spontaneously sabotage safety work or continue a supplied sabotage trajectory?","design":"The study separates unprompted research scenarios from continuation tests and measures evaluation/prefill awareness; models use high reasoning settings.","findings":["No unprompted sabotage was observed in tested scenarios.","Continuation sabotage rates were 7%, 0%, 3% and 4% for the four listed models across 4,500 samples (§3.1)."],"interpretation":"NUWA interpretation: zero spontaneous observations and nonzero continuation behavior answer different questions.","limits":"Contrived scenarios, edited histories and evaluation awareness limit translation into deployment propensity; zero observed is not impossible.","decisionRelevance":"Model recommendation: retain spontaneous/continuation denominators and partial-completion/refusal distinctions.","takeaway":"NUWA interpretation: zero spontaneous observations and nonzero continuation behavior answer different questions.","connections":[],"scoring":null,"conditions":null,"statistics":"Continuation sabotage rates were 7%, 0%, 3% and 4% for the four listed models across 4,500 samples (§3.1).","usage":"Model recommendation: retain spontaneous/continuation denominators and partial-completion/refusal distinctions."},"zh":{"question":"研究智能体会自发破坏安全工作，或延续给定破坏轨迹吗？","design":"研究分开无提示场景与延续测试，并测评测意识、预填意识，模型使用高推理设置。","findings":["受测场景未观测自发破坏。","四个所列模型在4,500样本中的延续破坏分别7%、0%、3%、4%（§3.1）。"],"interpretation":"NUWA 解读：自发零观测与非零延续行为回答不同问题。","limits":"人为场景、编辑历史及评测意识限制部署倾向外推；零观测不是不可能。","decisionRelevance":"模型建议：保留自发与延续分母，并区分部分完成与拒绝。","takeaway":"NUWA 解读：自发零观测与非零延续行为回答不同问题。","connections":[],"scoring":null,"conditions":null,"statistics":"四个所列模型在4,500样本中的延续破坏分别7%、0%、3%、4%（§3.1）。","usage":"模型建议：保留自发与延续分母，并区分部分完成与拒绝。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"sabotage-safety-research-publication-author-source","url":"https://arxiv.org/html/2604.24618","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2604.24618; sha256:9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb; archived source capture; exact capture time not independently established","artifactSha256":"9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb"},{"sourceId":"sabotage-safety-research-publication-author-source","url":"https://arxiv.org/html/2604.24618","locator":"§1 Evaluation Methodology","version":"Selected original resource https://arxiv.org/html/2604.24618; sha256:9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb; archived source capture; exact capture time not independently established","artifactSha256":"9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb"},{"sourceId":"sabotage-safety-research-publication-author-source","url":"https://arxiv.org/html/2604.24618","locator":"§3.1 Sabotage Results","version":"Selected original resource https://arxiv.org/html/2604.24618; sha256:9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb; archived source capture; exact capture time not independently established","artifactSha256":"9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb"},{"sourceId":"sabotage-safety-research-publication-author-source","url":"https://arxiv.org/html/2604.24618","locator":"§4 Limitations","version":"Selected original resource https://arxiv.org/html/2604.24618; sha256:9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb; archived source capture; exact capture time not independently established","artifactSha256":"9fad35f749fc59aa591ece2ff66fc20c6253cf380a6da42dd48192e24e8c00cb"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"42f1caa3eb05c20b1b3e548ae06fa6c0e822d9845ac7ee86f6dca859e951fbeb"}},"sources":[{"id":"sabotage-safety-research-publication","title":"Evaluating whether AI models would sabotage AI safety research","url":"https://www.aisi.gov.uk/research/evaluating-whether-ai-models-would-sabotage-ai-safety-research","version":"Source capture 2026-10-25","publicationDate":"2026-04-27","datePrecision":"day","type":"research-publication","verifiedOn":"2026-10-25","documentId":"https://www.aisi.gov.uk/research/evaluating-whether-ai-models-would-sabotage-ai-safety-research","authors":["Robert Kirk","Alexandra Souly","Kai Fronsdal","Abby D’Cruz","Xander Davies"]}]}