{"id":"https://openalex.org/W4389714039","doi":"https://doi.org/10.48550/arxiv.2312.06942","title":"AI Control: Improving Safety Despite Intentional Subversion","display_name":"AI Control: Improving Safety Despite Intentional Subversion","publication_year":2023,"publication_date":"2023-12-12","ids":{"openalex":"https://openalex.org/W4389714039","doi":"https://doi.org/10.48550/arxiv.2312.06942"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2312.06942","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2312.06942","pdf_url":"https://arxiv.org/pdf/2312.06942","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2312.06942","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037548279","display_name":"Ryan Greenblatt","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Greenblatt, Ryan","raw_affiliation_strings":["Redwood Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Redwood Research","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050408969","display_name":"Buck Shlegeris","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shlegeris, Buck","raw_affiliation_strings":["Redwood Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Redwood Research","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084231398","display_name":"Kshitij Sachan","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sachan, Kshitij","raw_affiliation_strings":["Redwood Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Redwood Research","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028042353","display_name":"Fabien Roger","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Roger, Fabien","raw_affiliation_strings":["Redwood Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Redwood Research","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":255,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9818999767303467,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9818999767303467,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0071000000461936,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.0015999999595806003,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ai-safety","display_name":"AI safety","score":0.7549999952316284},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.7570000290870667},{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.6230000257492065},{"id":"https://openalex.org/keywords/code-generation","display_name":"code generation","score":0.5899999737739563},{"id":"https://openalex.org/keywords/programming-problem-solving","display_name":"programming problem solving","score":0.6299999952316284},{"id":"https://openalex.org/keywords/gpt-4","display_name":"GPT-4","score":0.6539999842643738},{"id":"https://openalex.org/keywords/gpt-3-5","display_name":"GPT-3.5","score":0.9700000286102295},{"id":"https://openalex.org/keywords/collusion-prevention","display_name":"collusion prevention","score":0.45100000500679016},{"id":"https://openalex.org/keywords/safety-procedures","display_name":"safety procedures","score":0.49900001287460327}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7924236059188843},{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.770788311958313},{"id":"https://openalex.org/C2777367489","wikidata":"https://www.wikidata.org/wiki/Q1060330","display_name":"Subversion","level":3,"score":0.7497031688690186},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.7264440059661865},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6298297643661499},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.6086385846138},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.5233330130577087},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5165683031082153},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.17878907918930054},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.17490848898887634},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C94625758","wikidata":"https://www.wikidata.org/wiki/Q7163","display_name":"Politics","level":2,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2312.06942","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2312.06942","pdf_url":"https://arxiv.org/pdf/2312.06942","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2312.06942","doi":"https://doi.org/10.48550/arxiv.2312.06942","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2312.06942","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2312.06942","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2312.06942","pdf_url":"https://arxiv.org/pdf/2312.06942","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4389714039.pdf","grobid_xml":"https://content.openalex.org/works/W4389714039.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W2921408922"],"related_works":["https://openalex.org/W4388184973","https://openalex.org/W7164171296","https://openalex.org/W4414685254","https://openalex.org/W4414948873","https://openalex.org/W4417001508","https://openalex.org/W7110363316","https://openalex.org/W4416035194","https://openalex.org/W4405562078","https://openalex.org/W4399795398","https://openalex.org/W4390833079"],"abstract_inverted_index":{"As":[0],"large":[1],"language":[2],"models":[3,38],"(LLMs)":[4],"become":[5],"more":[6,11],"powerful":[7,112,124],"and":[8,80,131,169,199,232,250],"are":[9,88,157],"deployed":[10],"autonomously,":[12],"it":[13,218],"will":[14],"be":[15],"increasingly":[16],"important":[17],"to":[18,39,49,72,90,101,110,121,134,143,180,196,203,226,247,265],"prevent":[19,266],"them":[20],"from":[21,270],"causing":[22],"harmful":[23],"outcomes.":[24],"Researchers":[25],"have":[26,56],"investigated":[27],"a":[28,95,103,111,122,165],"variety":[29],"of":[30,43,83,105,167,207,255],"safety":[31,64,84],"techniques":[32,48,61,85,264],"for":[33],"this":[34,76],"purpose,":[35],"e.g.":[36],"using":[37,108,262],"review":[40],"the":[41,66,175,205,211,224,235,258,267],"outputs":[42],"other":[44],"models,":[45],"or":[46],"red-teaming":[47],"surface":[50],"subtle":[51],"failure":[52],"modes.":[53],"However,":[54],"researchers":[55],"not":[57,158],"evaluated":[58],"whether":[59,257],"such":[60],"still":[62],"ensure":[63],"if":[65],"model":[67,115,126,177],"is":[68,185,213,219,240,260],"itself":[69],"intentionally":[70],"trying":[71],"subvert":[73,181],"them.":[74,182],"In":[75],"paper,":[77],"we":[78,99,150,187],"develop":[79],"evaluate":[81],"pipelines":[82],"(\"protocols\")":[86],"that":[87,141,156,174,208,229],"robust":[89],"intentional":[91],"subversion.":[92],"We":[93,138,163],"investigate":[94,139,164],"scenario":[96],"in":[97],"which":[98,149],"want":[100],"solve":[102],"sequence":[104],"programming":[106],"problems,":[107],"access":[109,120,133],"but":[113],"untrusted":[114,176,241],"(in":[116,127],"our":[117,128],"case,":[118,129],"GPT-4),":[119],"less":[123],"trusted":[125,136,189],"GPT-3.5),":[130],"limited":[132],"high-quality":[135],"labor.":[137],"protocols":[140,168,273],"aim":[142],"never":[144],"submit":[145],"solutions":[146],"containing":[147],"backdoors,":[148],"operationalize":[151],"here":[152],"as":[153],"logical":[154],"errors":[155],"caught":[159],"by":[160],"test":[161,170],"cases.":[162],"range":[166],"each":[171],"against":[172],"strategies":[173],"could":[178],"use":[179],"One":[183],"protocol":[184,192,239,244],"what":[186],"call":[188],"editing.":[190],"This":[191,243],"first":[193],"asks":[194,201,245,252],"GPT-4":[195,246,256,268],"write":[197,248],"code,":[198,249],"then":[200,233,251],"GPT-3.5":[202,222],"rate":[204],"suspiciousness":[206,216],"code.":[209,237],"If":[210],"code":[212,259],"below":[214],"some":[215],"threshold,":[217],"submitted.":[220],"Otherwise,":[221],"edits":[223],"solution":[225],"remove":[227],"parts":[228],"seem":[230],"suspicious":[231],"submits":[234],"edited":[236],"Another":[238],"monitoring.":[242],"another":[253],"instance":[254],"backdoored,":[261],"various":[263],"instances":[269],"colluding.":[271],"These":[272],"improve":[274],"substantially":[275],"on":[276],"simple":[277],"baselines.":[278]},"counts_by_year":[{"year":2026,"cited_by_count":146},{"year":2025,"cited_by_count":86},{"year":2024,"cited_by_count":23}],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2023-12-14T00:00:00"}