Opening article
The AI Security Institute conducted an auditing game to test ten sandbagging detection methods, pitting a red team that trained models to underperform against a blue team that tried to detect them. The study found black‑box approaches largely ineffective, while white‑box methods such as linear probes and on‑distribution training showed promise but require deep model access. No single method proved reliable, highlighting the need for further research.
Assessing the capabilities of AI systems is critical to informing decisions about their deployment and safeguard infrastructure. At the AI Security Institute (AISI), we run evaluations of frontier models to better equip governments, industry, and the public with an understanding of what they can do.
The risk of sandbagging – where AI models underperform during testing – has the potential to undermine this understanding, which could lead to incorrect safety assessments and policy decisions. For this reason, sandbagging detection has been a key focus of our Model Transparency Team.
Earlier this year, we released a research update detailing some initial work on sandbagging. Since then, we've built on our findings to conduct an auditing game in which we study the effectiveness of ten detection methods. Our approach, inspired by Anthropic's work, pitted two internal AISI teams against each other: a red team that created sandbagging models, and a blue team that tried to detect them. This blog provides a summary of our findings.
Our auditing game adapted a common practice used in cybersecurity to pit an offensive red team against a defensive blue team.
The red team trained five models using conditional underperformance ('password locking') as a proxy for sandbagging. Some models were trained to underperform on evaluations, whilst others served as decoys. Both types could exhibit various “distractor behaviours” designed to confuse detection efforts, such as overusing double negatives or switching languages. The blue team was tasked with using a variety of detection methods to determine which models were sandbagging on which evaluations, allowing us to measure their effectiveness.
In total, we tested ten methods for sandbagging detection, with mixed success. These included three types of methods:
Reliable sandbagging detection is essential for accurate safety assessments and policy decisions in AI deployment.