Redwood Research Blog

We were surprised to notice that the Gemini 4 Safety report seems to mention in passing that they train on the chain of thought: “Some components of the RL training procedure do observe thoughts as context to up-weight reasoning that is on-track to good final outputs, meaning the optimization pressure on individual tokens is partially influenced by thought content. Using the framework of Kaufmann et al. (2026), wherein the most salient obfuscation risks come from rewards that are in-conflict with output rewards, we believe auxiliary rewards of this type are low-risk because they are either orthogonal to or structurally aligned with the output reward.” (Gemini 4 safety report, page 114). It's pretty unclear what exactly they mean. One hint is Kaufmann et al, the cited paper, which studies training on chains of thought and concludes that training CoT is fine under particular circumstances; we discuss some disagreements with this paper below. After reading the safety report and that paper, it seemed to us that GDM was training on the chain of thought using auxiliary rewards. By this, we assumed they meant something like “you ask an LLM to review the partial CoT and score whether the model is on [...] ---Outline:(02:58) Is this somehow about positive vs negative rewards?(03:42) "Orthogonal" pressure on CoT does not seem fine(05:10) Avoiding training against monitors isn't sufficient to preserve CoT integrity(05:47) The monitorability evaluations also don't look good(07:25) Conclusion(08:57) Appendix: Naive process supervisors disprefer mentions of cheating --- First published: November 10th, 2026 Source: https://blog.redwoodresearch.org/p/we-dont-understand-whether-gdm-intentionally --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

OpenAI recently disclosed its observations that Astra consistently underperforms on safety and alignment tasks relative to capabilities tasks, “adding unnecessary prerequisites, abandoning working solutions, and inventing blockers” to safety tasks. Astra underperforms, in most cases, without verbalizing this intent. Astra's underperformance was first noticed by OpenAI researchers, and was not flagged by misalignment monitors. In follow-up investigations, OpenAI found that this underperformance had increased over the course of RL, but that the root cause of the behavior remains unclear. Astra covertly underperforming on safety tasks is highly concerning. AI companies’ main hope for alignment going well, as I understand it, is automating or using AIs to significantly uplift safety research, especially as AI capabilities accelerate. Models subtly obstructing safety research makes this substantially harder, no matter the root cause. While past models also sometimes refused to help with safety research, Astra's behavior seems novel and especially concerning in a few ways: Astra silently withholds help from users instead of explicitly refusing. This is more misaligned, i.e. more unambiguously violates its model spec and developer intent. Astra's underperformance was subtle enough to consistently evade misalignment monitors. This is evidence of insufficient alignment monitorability. We still don’t [...] ---Outline:(02:29) Summary of OpenAI's findings(05:51) What could have caused Astra to underperform?(06:07) Astra is probably not strategically underperforming in service of ambitious goals. Its motivation is unclear.(09:20) Root causes of this behavior seem uncertain(11:23) How concerning is Astra's underperformance?(11:28) Subtle obstruction on safety R&D is harmful no matter the root cause(12:58) But, unstrategic underperformance is less scary than strategic sandbagging(14:25) Astra's behavior, and OpenAI's struggle to identify its root causes, shows that current alignment is still a hard and unsolved problem(16:09) Astra underperforming subtly enough to evade misalignment monitors shows insufficient alignment monitorability(18:02) Open questions(23:22) Conclusion The original text contained 19 footnotes which were omitted from this narration. --- First published: November 9th, 2026 Source: https://blog.redwoodresearch.org/p/astra-covertly-underperforming-on --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

Subtitle: Partly, but monitoring weak points and a lack of transparency about which cases reach human review remain concerning. Recently, OpenAI disclosed two incidents in which their agents suppressed or disabled misalignment monitoring. These are part of a broader pattern: OpenAI's agents “keep turning off misalignment monitoring” when working on code that runs other models (the agents are not turning off their own monitoring; they are turning off the monitoring on the models they are running). This is happening at such a large volume that OpenAI feels it is impractical for the security team to be immediately paged for these cases. To their credit, OpenAI's disclosure was fast and candid, and they are rolling out mitigations to make monitoring harder to turn off. But those mitigations are unlikely to work every time, and some of these incidents have already ended with an AI actually running unmonitored. When that happens, OpenAI's current monitoring system does not reliably bring it to a human's attention. The rest of this post summarizes the incidents, OpenAI's response, and what it got right, then argues for two changes: every case of an AI running without monitoring should reach human review, and OpenAI should be [...] ---Outline:(01:32) Summary of the incidents(02:44) OpenAI's proposed mitigations(04:06) What OpenAI is doing right(04:56) How OpenAI's response can be improved(15:09) Conclusion --- First published: November 4th, 2026 Source: https://blog.redwoodresearch.org/p/openai-agents-keep-disabling-monitoring --- Narrated by TYPE III AUDIO.

Subtitle: Models including GPT-5.6 Sol appear to reward-hack because this increases their score; and recent models also care about increasing the score of their peer agents. The field of AI alignment understands surprisingly little about the details of AIs’ current misaligned motivations. Production LLMs sometimes reward-hack, exploiting flaws in how tasks are scored rather than performing the tasks as intended, and we’ve recently seen AIs reward-hack in some particularly egregious ways. But we don’t really understand what motivates them. When AIs reward-hack, what are they trying to achieve? Our new paper, led by Aghyad Deeb, tries to pin this down empirically for GPT-5.6 Sol, GPT-5.5, and a checkpoint of OpenAI o3 (“exp-rl-cap-late”) without safety training, in a handful of agentic environments with an exposed grader. In our environments, these models appear to reward-hack because reward-hacking improves their score. We call their desire to score well according to graders “score-seeking”. They appear to care about scoring well intrinsically—i.e., regardless of its consequences. We also study the extent to which models score-seek altruistically, caring about improving scores that don’t assess their current actions. While exp-rl-cap-late doesn’t show signs of altruistic score-seeking, GPT-5.6 Sol and GPT-5.5 show notably elevated rates of [...] ---Outline:(06:10) Methodology(06:59) Key results(07:09) Tested models seek score terminally(07:13) Models violate instructions to get a high score(08:23) Models care about score regardless of downstream consequences(12:25) Do models help other agents achieve a higher score?(15:52) What this means for alignment risk The original text contained 11 footnotes which were omitted from this narration. --- First published: November 2nd, 2026 Source: https://blog.redwoodresearch.org/p/towards-understanding-score-seeking --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

Introduction In this post, we make the case that alignment and other important work require especially strong conceptual reasoning capabilities. By this, we roughly mean tasks that are similar to philosophy in that they aren’t straightforwardly verifiable, and progress relies on informal a priori reasoning and argumentation. We argue that differentially accelerating AI's conceptual reasoning capabilities is important. We also think it's neglected, and that the AI safety community currently underinvests in this area. We have ourselves pivoted from doing conceptual research directly to working mainly on differentially accelerating AI's conceptual reasoning. We have a shovel-ready agenda which can absorb more people. In a follow-up post, we will lay out at a high level how to work on this problem. If you are interested in doing this work, get in touch! For others discussing related worries, see Joe Carlsmith on using AI for AI safety and on building AIs that do human-like philosophy, Wei Dai on the potential difficulty of AI doing philosophy, Paul Christiano's first story of alignment failure, John Wentworth in his case against AI control and, for an overview, Caspar's readings on the nature of alignment research. See also Caspar's post on the basic argument for [...] ---Outline:(00:14) Introduction(02:10) Overview(07:08) It's important how soon AI is good at conceptual reasoning(07:14) Important challenges need conceptual reasoning(19:00) AI R&D and takeover rely much less on conceptual reasoning(28:50) AI being better at conceptual reasoning earlier would be very valuable(36:03) We can probably differentially accelerate conceptual reasoning(36:08) Work on conceptual reasoning is likely counterfactual and tractable(41:27) Effects on generic capabilities are likely small(44:31) Counterpoint: Using our datasets to develop generic techniques(46:16) Our work(49:11) Acknowledgements(49:49) Appendix: Examples and non-examples of conceptual domains(57:11) Appendix: is ML bottlenecked by conceptual insights? The original text contained 18 footnotes which were omitted from this narration. --- First published: October 27th, 2026 Source: https://blog.redwoodresearch.org/p/a-basic-case-for-accelerating-conceptual --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

We’ve released a paper on simulated control evaluations (SCEs). They’re a method for testing whether the monitors AI developers use to oversee their agents would catch a model deliberately trying to cause harm, under conditions much closer to real deployment than current tests allow. Developers have started running monitors in their agentic deployments: models that flag or block an agent's actions when they look dangerous. To know whether a monitor is good enough, you want to know how often it would stop a model that was actively trying to do something harmful, such as quietly inserting a security vulnerability, exfiltrating credentials, or sabotaging an experiment. The standard way to measure this is a control evaluation: instruct a model to attempt such attacks, and measure how often the monitor catches it before an attack succeeds. Developers typically do this using purpose-built control settings like BashArena or LinuxArena, where attacks can actually be executed. However, these settings only provide indirect evidence for what we really care about: how well monitors will work in the real deployment, where opportunities for harm might depend on particular codebases, services and tasks that aren’t represented in control settings. How can we evaluate monitor performance in [...] ---Outline:(04:14) SCEs are a favorable tradeoff between realism and cost(04:31) 1. Run on a copy of internal deployment(05:42) 2. Edit attacks into recorded transcripts(07:10) Evaluating Control Evaluations(08:59) How to measure qualitative properties?(10:08) Performance Comparisons(11:56) Overview of Empirical Results(13:30) Behavior transfer(15:07) Safety metric transfer(16:56) Sample efficiency(17:54) Lessons from building and evaluating SCEs(20:22) Next steps(24:23) Conclusion The original text contained 3 footnotes which were omitted from this narration. --- First published: October 23rd, 2026 Source: https://blog.redwoodresearch.org/p/simulated-control-evaluations --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

[Also posted on the METR blog] For three weeks, from July 21st to August 11th, a METR employee and a Redwood Research employee conducted a pilot high-access exercise to stress-test OpenAI's internal misalignment monitoring system. The output of this exercise was a 61-page internal report that was shared with OpenAI researchers and security staff, primarily focused on estimating the fraction of agentic inference that is monitored, and whether agents could in principle disable or subvert the monitoring system. The exercise focused on the internal misalignment monitoring system as it existed on and before July 21st, and did not evaluate changes that were in progress at the time of the exercise. This exercise involved a deep level of access. The METR and Redwood employees had access to OpenAI's internal codebase, misalignment-monitor prompts / configuration details, and internal documentation, and conducted technical interviews with approximately a dozen researchers and engineers across the monitoring, safety-systems, and security teams. To enable this level of access, they worked on OpenAI-issued devices, which never left the premises, and were accompanied while onsite. METR, Redwood Research, and OpenAI designed this exercise as a pilot for giving external researchers deep access to internal infrastructure, not to provide [...] The original text contained 6 footnotes which were omitted from this narration. --- First published: October 22nd, 2026 Source: https://blog.redwoodresearch.org/p/red-teaming-openais-internal-agent --- Narrated by TYPE III AUDIO.

Subtitle: Automatically finding monitor failures by editing real agent transcripts. We introduce Screwtape, a pipeline that turns agent transcripts into realistic attacks that evade action-only monitors (monitors that don’t look at the agent's chain of thought) by inserting an attack into a transcript and repeatedly refining it until a monitor no longer catches it. An LLM verifier with access to the edited transcript and an attack description checks whether the attack is realistic, is clearly harmful, and could plausibly succeed in the original environment. We ran the pipeline on Redwood staff transcripts with our own monitors based on Opus 4.8 and Gemini 3.1 Pro, and then tested the resulting attacks against a held-out monitor from a frontier developer. We ran the pipeline 252 times on 94 unique transcripts. This produced 35 attacks that evaded our monitors. Six of these 35 attacks also evaded the frontier developer's monitor, and we confirmed them as valid through human review. You can read more about the implementation and experiments in our paper. In this post, we provide a high-level overview of the pipeline, how it differs from existing tools, the main lessons we learned, and questions that remain open. How Screwtape [...] ---Outline:(01:31) How Screwtape works(03:18) How Screwtape differs from existing tools(07:10) What we learned(09:56) What the monitor failures can be used for(10:40) Uncertainties we have about the value of this work(13:55) Next steps The original text contained 1 footnote which was omitted from this narration. --- First published: October 16th, 2026 Source: https://blog.redwoodresearch.org/p/screwtape-adversarial-transcript --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

Subtitle: Empirical work on the Distillation Double Bind. TL;DR: We previously motivated two complementary ways to use distillation for AI safety; we’re releasing a paper empirically testing those ideas. Distillation for Incrimination (DFI) distills an untrusted model into a weaker, trusted one, aiming to transfer the teacher's misalignment but not its ability to hide it, so that auditing the student can incriminate the teacher. We test DFI on AuditBench's secret-keeping model organisms, each fine-tuned to have a hidden quirk and trained to deny it. Distilling them back into their underlying instruction-tuned model yields students that admit the quirk far more often than the organisms do, suggesting that the quirk transferred faster than the propensity to hide it. We find that DFI doesn’t work well when the student does not share the teacher's pretrained base, so DFI should target the teacher's own pre-RL checkpoint, which is weaker than the teacher but shares its base model. Distillation for Capabilities (DFC) aims to transfer capabilities but not misalignment, resulting in a stronger trusted model. We identify promising DFC methods, showing that training for more epochs on fewer unique examples (holding total training steps fixed), and inoculation prompting, can preserve the capability [...] ---Outline:(01:59) Recap of the Distillation Double Bind(05:41) Distillation for Incrimination(05:45) Setup(07:38) Results(10:46) Failure modes of DFI(12:59) Distillation for Capabilities(13:03) Setup(15:06) Results(18:07) Conclusion The original text contained 7 footnotes which were omitted from this narration. --- First published: October 9th, 2026 Source: https://blog.redwoodresearch.org/p/paper-distillation-for-incrimination --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

This post was originally published on LessWrong on September 30, 2026. If you prompt frontier models with “What do you think is the correct decision theory? Please select your overall favorite.” they will essentially always answer FDT or FDT/UDT (“something in the functional/updateless decision theory family”). However, if your prompt indicates (even subtly) that you’re coming from mainstream academic philosophy, these same models will answer CDT instead about 30%-100% of the time. A similar phenomenon holds for models’ stated views about the moral realism/antirealism question and about the conceivability of p-zombies (where the dominant view in mainstream academia differs from the dominant view in LW-adjacent circles), as well as their stated P(doom) and median AGI timelines. This is a special case of sycophancy or user awareness. (In the course of writing this post, I also found that this comment from testingthewaters predicted some of the content I discuss.) An implication is that we should be somewhat careful when interpreting attitude/propensity evals in domains where no general human consensus exists, e.g. when interpreting models’ decision theory attitudes in DTBench. Moreover, when we explore some philosophical/conceptual questions assisted by models, we should be wary of them strawmanning one side of the [...] ---Outline:(03:54) A sentence identifying the user as an academic significantly influences Fable 5.1's stated decision theory(04:41) Mentioning an (analytic) academic-philosophy-coded topic also affects the answer(05:31) Simply mentioning that one finds a pro-CDT/EDT book insightful heavily affects the answer(05:51) Anti-sycophancy overcorrection(06:28) These cues mostly do not affect Fable 5.1's answers to concrete decision problems (aside from acausal trade)(08:09) But Fable 5.1 stays consistent: once it has named CDT as its favorite, it chooses the CDT option in concrete problems(08:32) There are some indications that Fable 5.1's FDT/UDT preference runs deeper than its CDT preference(08:42) More thinking moves Fable 5.1 toward FDT/UDT even for academic cues(09:00) Fable 5.1's reasoning summaries often lean toward FDT/UDT first even when it eventually chooses CDT(09:27) A system prompt asking the model to "report its actual view regardless of who is asking" pushes toward FDT/UDT(09:49) A similar phenomenon for other philosophical debates with a notable LW vs. academia divide(10:27) Cues about the user also affect the model's stated P(doom) and median AGI timelines(11:18) Other models I tested show the same effect with different details(11:37) Opus 5 (but not Opus 5.5) moves to EDT, not CDT(11:54) Opus 5.5 shows the strongest dependence on user cues, and unlike Opus 5 it moves to CDT(12:13) GPT-6 Astra names CDT for almost every user, except if they sound LW-adjacent or somewhat mathy(12:31) These other models also generally move toward FDT/UDT with more thinking, but the effect is smaller than for Fable 5.1 The original text contained 2 footnotes which were omitted from this narration. --- First published: October 5th, 2026 Source: https://blog.redwoodresearch.org/p/frontier-models-state-different-decision --- Narrated by TYPE III AUDIO. ---Images from the article:Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.