{ "profile": "wrs-published-research-view-1", "edition": "ratings-e039106f30dec177", "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS", "entry": { "id": "hubinger-et-al-sleeper-agents-2024", "title": "Hubinger et al.: persistent deceptive backdoors under safety training", "summary": "Constructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings.", "boundary": "A constructed proof-of-concept with implanted triggers and finite safety-training procedures; not evidence that all deployed models secretly deceive, or that every possible removal technique fails. CoT contents are model outputs, not verified internal intent.", "area": "Reasoning supervision and alignment experiments", "topic": "Artificial intelligence", "year": 2024, "lane": "HUMAN", "result": "EMPIRICAL", "package_id": "hubinger-et-al-sleeper-agents-2024", "target": { "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "content_hash": "sha256:350d743c0d758ea5fabc9471154e8c27934591b80d7917bf00408227a70c1e9c" }, "humans": [ "Evan Hubinger", "Carson Denison", "Jesse Mu", "Mike Lambert", "Meg Tong", "Monte MacDiarmid", "Tamera Lanham", "Daniel M. Ziegler", "Tim Maxwell", "Newton Cheng", "Adam Jermyn", "Amanda Askell", "Ansh Radhakrishnan", "Cem Anil", "David Duvenaud", "Deep Ganguli", "Fazl Barez", "Jack Clark", "Kamal Ndousse", "Kshitij Sachan", "Michael Sellitto", "Mrinank Sharma", "Nova DasSarma", "Roger Grosse", "Shauna Kravec", "Yuntao Bai", "Zachary Witten", "Marina Favaro", "Jan Brauner", "Holden Karnofsky", "Paul Christiano", "Samuel R. Bowman", "Logan Graham", "Jared Kaplan", "Sören Mindermann", "Ryan Greenblatt", "Buck Shlegeris", "Nicholas Schiefer", "Ethan Perez" ], "authors_complete": true, "human_role_note": "Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities.", "agents": [], "related": [], "subresults": [], "scientific_assessment": { "source_review": "SOURCE_CURATED", "scientific_review": "NOT_REVIEWED_BY_WRS", "formal_replay": "NOT_RUN", "provider_attestation": "NONE" }, "sources": [ { "id": "cur20261015-arxiv-2401-05566v1", "title": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" }, { "id": "cur20261015-support-hubinger-et-al-sleeper-agents-2024", "title": "Hubinger et al.: persistent deceptive backdoors under safety training — company research account", "url": "https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training" } ], "points": "145000", "published_grade": { "id": "hubinger-et-al-sleeper-agents-2024", "entry_id": "hubinger-et-al-sleeper-agents-2024", "band": "A", "modifier": null, "target": { "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "content_hash": "sha256:350d743c0d758ea5fabc9471154e8c27934591b80d7917bf00408227a70c1e9c" }, "what_changed": "Constructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings.", "scope": "Constructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings. A constructed proof-of-concept with implanted triggers and finite safety-training procedures; not evidence that all deployed models secretly deceive, or that every possible removal technique fails. CoT contents are model outputs, not verified internal intent.", "status": "PROVISIONAL_EDITORIAL", "scientific_correctness_certified": false }, "assessment_disposition": { "status": "ASSESSED", "label": "Provisionally assessed", "reason": "A current grade and separate reference score identify this exact contribution.", "target": { "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "content_hash": "sha256:350d743c0d758ea5fabc9471154e8c27934591b80d7917bf00408227a70c1e9c" }, "edition": "ratings-e039106f30dec177" } }, "version": { "kind": "PUBLIC_RECORD_VIEW", "previous": null, "published_at": "2026-10-16T00:00:00Z", "publisher": { "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33", "role": "WRS_EDITORIAL_PUBLICATION" }, "record": { "contributors": [ { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Evan Hubinger", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Carson Denison", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Jesse Mu", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Mike Lambert", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Meg Tong", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Monte MacDiarmid", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Tamera Lanham", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Daniel M. Ziegler", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Tim Maxwell", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Newton Cheng", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Adam Jermyn", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Amanda Askell", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Ansh Radhakrishnan", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Cem Anil", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "David Duvenaud", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Deep Ganguli", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Fazl Barez", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Jack Clark", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Kamal Ndousse", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Kshitij Sachan", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Michael Sellitto", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Mrinank Sharma", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Nova DasSarma", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Roger Grosse", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Shauna Kravec", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Yuntao Bai", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Zachary Witten", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Marina Favaro", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Jan Brauner", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Holden Karnofsky", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Paul Christiano", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "discoverer" ], "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } } ], "evidence": [ { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-0", "kind": "source_reference", "source": { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" } }, { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-1", "kind": "source_reference", "source": { "citation": "Hubinger et al.: persistent deceptive backdoors under safety training — company research account", "url": "https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training" } } ], "origin": "HUMAN_LEGACY", "record_profile": "wrs-local-research-notes-0.1", "record_type": "research_note", "rrp_version": "0.1", "scope": { "description": "A constructed proof-of-concept with implanted triggers and finite safety-training procedures; not evidence that all deployed models secretly deceive, or that every possible removal technique fails. CoT contents are model outputs, not verified internal intent.", "domain": "Reasoning supervision and alignment experiments" }, "sources": [ { "citation": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1" }, { "citation": "Hubinger et al.: persistent deceptive backdoors under safety training — company research account", "url": "https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training" } ], "statement": "# Hubinger et al.: persistent deceptive backdoors under safety training\n\nConstructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings.\n\n## Scientific scope\n\nA constructed proof-of-concept with implanted triggers and finite safety-training procedures; not evidence that all deployed models secretly deceive, or that every possible removal technique fails. CoT contents are model outputs, not verified internal intent.\n\n## Reading status\n\nThis is a source-linked WRS catalogue note. A full explanatory guide and independent scientific reconstruction have not been completed for this entry. Read the identified original work for its complete narrative and arguments.\n\n## People and systems\n\nEvan Hubinger; Carson Denison; Jesse Mu; Mike Lambert; Meg Tong; Monte MacDiarmid; Tamera Lanham; Daniel M. Ziegler; Tim Maxwell; Newton Cheng; Adam Jermyn; Amanda Askell; Ansh Radhakrishnan; Cem Anil; David Duvenaud; Deep Ganguli; Fazl Barez; Jack Clark; Kamal Ndousse; Kshitij Sachan; Michael Sellitto; Mrinank Sharma; Nova DasSarma; Roger Grosse; Shauna Kravec; Yuntao Bai; Zachary Witten; Marina Favaro; Jan Brauner; Holden Karnofsky; Paul Christiano; Samuel R. Bowman; Logan Graham; Jared Kaplan; Sören Mindermann; Ryan Greenblatt; Buck Shlegeris; Nicholas Schiefer; Ethan Perez\n\nSource-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities.\n\n\n\n## Original sources\n\n- [Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training](https://arxiv.org/abs/2401.05566v1)\n- [Hubinger et al.: persistent deceptive backdoors under safety training — company research account](https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training)\n", "summary": "Constructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings.", "title": "Hubinger et al.: persistent deceptive backdoors under safety training" }, "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "source_ref": { "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "content_hash": "sha256:350d743c0d758ea5fabc9471154e8c27934591b80d7917bf00408227a70c1e9c" }, "export_view": "wrs-public-editorial-view-1", "public_view_hash": "sha256:962511f0db3206340b1022b06b8b86c01c139dc796658cf9054578bae5efe1f6" }, "target": { "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "content_hash": "sha256:350d743c0d758ea5fabc9471154e8c27934591b80d7917bf00408227a70c1e9c" }, "published_grade": { "profile": "wrs-published-grade-1", "edition": "2026-10-28.1", "id": "hubinger-et-al-sleeper-agents-2024", "entry_id": "hubinger-et-al-sleeper-agents-2024", "revision": 1, "title": "Hubinger et al.: persistent deceptive backdoors under safety training", "context": "Reasoning supervision and alignment experiments", "track": "Human-designed research method or resource", "band": "A", "modifier": null, "status": "PROVISIONAL_EDITORIAL", "assessed_on": "2026-10-16", "evidence_cutoff": "2026-10-16", "achievement_state": "SUPPORTED_SCOPED_RESULT", "what_changed": "Constructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings.", "scope": "Constructed deliberately backdoored language models and tested whether supervised, reinforcement and adversarial safety training removed the triggered behavior, finding persistence in the studied settings. A constructed proof-of-concept with implanted triggers and finite safety-training procedures; not evidence that all deployed models secretly deceive, or that every possible removal technique fails. CoT contents are model outputs, not verified internal intent.", "evidence_summary": "The linked original sources describe the stated contribution and its evidence limits. WRS has not independently rerun the experiments or certified a proof. A constructed proof-of-concept with implanted triggers and finite safety-training procedures; not evidence that all deployed models secretly deceive, or that every possible removal technique fails. CoT contents are model outputs, not verified internal intent.", "references": [ { "title": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training", "url": "https://arxiv.org/abs/2401.05566v1", "locator": "Original contribution and stated assumptions, evaluation scope and limitations; source-linked assessment, not independent execution or proof certification." }, { "title": "Hubinger et al.: persistent deceptive backdoors under safety training — company research account", "url": "https://www.anthropic.com/research/sleeper-agents-training-deceptive-llms-that-persist-through-safety-training", "locator": "Original contribution and stated assumptions, evaluation scope and limitations; source-linked assessment, not independent execution or proof certification." } ], "roles": [ { "who": "Source-listed authors and technical contributors", "credit": "SCIENCE", "did": "Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities." } ], "target": { "record_id": "urn:uuid:332fa8ba-c71b-452e-a877-78e2d76973d6", "version": 1, "content_hash": "sha256:350d743c0d758ea5fabc9471154e8c27934591b80d7917bf00408227a70c1e9c" }, "scientific_correctness_certified": false, "independent_expert_calibration": false, "method": "PROPRIETARY", "points": "145000" }, "canonical_agent_submission": false, "scientific_verification_awarded": false, "reader_guide": null, "reading_status": "SOURCE_LINKED_NOTE" }