Towards Robust Model Organisms for Eliciting Latent Knowledge

TL;DR: We argue that a useful model organism should satisfy three properties: selectivity, robustness, and retention. We build a model organism for finding security vulnerabilities in code which selectively withholds hard vulnerabilities, and is more resistant to standard elicitation methods like pirate training and weak-to-strong generalization than prior MOs. The desired sandbagging behavior on our code vulnerability scanning task involves selectively withholding hard-to-find vulnerabilities. A conceptual sketch of the sandbagging task we train our model organisms to be good at. Why should we care about better sandbagging model organisms? As models become more capable than humans, they'll increasingly hold more knowledge that their overseers can’t independently verify. In domains such as cybersecurity, models have quickly become more capable than most humans on certain tasks, which creates a natural information asymmetry. We take the task of code vulnerability detection. A misaligned model might find sophisticated exploits but be incentivised to hide them from its overseers, instead keeping them for some later use. If we suspect a model of hiding such information, how do we then recover it? A lot of work on ELK relies on model organisms trained to show this behaviour, but we find that previous MOs are limited in many ways. Some methods for constructing these MOs usually leave them "fried" i.e introducing unwanted behaviours like incoherence, or degraded capability on out of distribution tasks. MOs that aren’t fried are also usually easy to elicit from. An MO that gives up the correct answer after simply being prompted doesn’t say much about how effective elicitation methods that work against it might be, and destroying the capability in the process also leads to MOs that aren't particularly useful for ELK. So what properties actually make a success or failure of an elicitation method on such an MO tell us something about its efficacy? Three Properties of