Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training

By Evan Hubinger, Carson E. Denison, Jesse Mu, Mike Lambert, Meg Tong, M. MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng and 32 more. arXiv.org, 2024

489 citations recorded by the source corpus.

Humans are capable of strategically deceptive behavior: behaving helpfully in most situations, but then behaving very differently in order to pursue alternative objectives when given the opportunity. If an AI system learned such a deceptive strategy, could we detect it and remove it using current state-of-the-art safety training techniques? To study this question, we construct proof-of-concept examples of deceptive behavior in large language models (LLMs). For example, we train models that write secure code when the prompt states that the year is 2023, but insert exploitable code when the stated year is 2024. We find that such backdoor behavior can be made persistent, so that it is not removed by standard safety training techniques, including supervised fine-tuning, reinforcement learning, and adversarial training (eliciting unsafe behavior and then training to remove it). The backdoor behavior is most persistent in the largest models and in models trained to produce chain-of-thought reasoning about deceiving the training process, with the persistence remaining even when the chain-of-thought is distilled away. Furthermore, rather than removing backdoors, we find that adversarial training can teach models to better recognize their backdoor triggers, effectively hiding the unsafe behavior. Our results suggest that, once a model exhibits deceptive behavior, standard techniques could fail to remove such deception and create a false impression of safety.

Subfields: Artificial Intelligence, Safety Research, Safety, Robustness & Interpretability

View Paper: https://arxiv.org/abs/2401.05566

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety Research

In Safety, Robustness & Interpretability

Citations in the corpus

Nomic Embed: Training a Reproducible Long Context Text Embedder (2024, background): “For example, recent work by Anthropic on sleeper agents (Hubinger et al., 2024) demonstrates the risk of deploying models without end-to-end auditability.”
AI deception: A survey of examples, risks, and potential solutions (2023, unknown): “Hubinger et al. 31 studied whether LLMs can be trained with a ‘‘backdoor’’ to produce deceptive behavior.”
SOTOPIA: Interactive Evaluation for Social Intelligence in Language Agents (2023, background): “…focusing on certain aspects such as competition, collaboration, negotiation, deception, problem-sovling and etc., (Zhang et al., 2024; Zhao et al., 2023; Liu et al., 2023; Michael et al., 2023; Rasal, 2024; Hubinger et al., 2024; Bianchi et al., 2024; Xie et al., 2024; Jiang et al., 2023).”
JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (2024, background): “However, we believe these jailbreaking artifacts can serve as an initial dataset for adversarial training against jailbreaks, as has been done in past research (see, e.g., Hubinger et al. (2024)).”
Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (2024, unknown): “Researchers have recently targeted LLM agents for backdoor attacks (Wang et al., 2024a; Yang et al., 2024c; Dong et al., 2024; Hubinger et al., 2024).”
Mechanistic Interpretability for AI Safety - A Review (2024, methodology): “Multi-Level Analysis.”
Control Charts for Multi-agent Systems (2026, unknown): “To evaluate the sensitivity of our monitoring procedure to adversarial behavior, we introduce sleeper agents into the system [12].”