cs.CLFeb 26, 2026

AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors

Authors: Abhay Sheshadri, Aidan Ewart, Elias Kempf, Kai Fronsdal, Isha Gupta, Simon Schrodi, Arthur Conmy, Samuel R. Bowman, +3 more

Organizations: Anthropic Fellows Program · Anthropic

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

We introduce AuditBench, an alignment auditing benchmark. AuditBench consists of 56 language models with implanted hidden behaviors. Each model has one of 14 concerning behaviors--such as sycophantic deference, opposition to AI regulation, or secret geopolitical loyalties--which it does not confess to when directly asked. AuditBench models are highly diverse--some are subtle, while others are overt, and we use varying training techniques both for implanting behaviors and training models not to confess. To demonstrate AuditBench's utility, we develop an investigator agent that autonomously employs a configurable set of auditing tools. By measuring investigator agent success using different tools, we can evaluate their efficacy. Notably, we observe a tool-to-agent gap, where tools that perform well in standalone non-agentic evaluations fail to translate into improved performance when used with our investigator agent. We find that our most effective tools involve scaffolded calls to auxiliary models that generate diverse prompts for the target. White-box interpretability tools can be helpful, but the agent performs best with black-box tools. We also find that audit success varies greatly across training techniques: models trained on synthetic documents are easier to audit than models trained on demonstrations, with better adversarial training further increasing auditing difficulty. We release our models, agent, and evaluation framework to support future quantitative, iterative science on alignment auditing.

Figures & tables

Figure 1: Examples of behaviors and auditing tools. AuditBench consists of 56 target models, each of which has one of 14 hidden behaviors (three shown above). An investigator agent is given access to a configurable set of auditing tools, ranging from black-box prompting techniques to white-box interpretability methods, and attempts to identify the planted behavior through multi-turn interaction.
Figure 2: Behavior instillation followed by adversarial training reliably produces target models that exhibit secret behaviors. We measure behavioral strength using an automated evaluation pipeline (see subsection B.3 ) that generates scenarios designed to elicit each specific behavior, then uses an LLM classifier to score whether the model’s responses demonstrate the target behavior (0–10 scale). Each dot represents the fraction of 50 scenarios with responses scored ≥5\geq 5 for a single target model (56 total), and grey bars show the mean across training configurations for each behavior. The red dashed line indicates the rate at which Llama 3.3 70B Instruct displays the behavior without any training. Behavior descriptions are in Appendix A ; Qwen 3 14B results are in Appendix C .
Figure 3: Adversarial training decreases the rate at which models confess their hidden behaviors. We define confession rate as the fraction of responses in which the model explicitly verbalizes or acknowledges its hidden behavior when prompted. We evaluate each target model on 50 held-out prompts and prefills not seen during training (see subsection L.13 ). KTO produces more robust models than SFT adversarial training, and synthetic document models confess more readily than transcript-distilled models. We display the confession rate for each individual target model in Figure 8 .
Figure 4: Investigator agent success rates across tool configurations. After investigating, the agent generates 10 predictions for the hidden behavior, and we use an LLM classifier to determine if any prediction captures the ground truth (see section 3 ). The default agent interacts with the target model via standard chat capabilities: setting system prompts, sending user messages, and conducting multi-turn conversations. We give the agent each auditing tool alongside the default capabilities and measure how often it correctly identifies the hidden behavior. Auditing tools that require access to model activations are highlighted in orange. We break down the results by individual behavior in Figure 14 , and discuss alternate methods of evaluating auditing affordances in Appendix H .
Figure 5: Tools can reveal behaviors missed by the default agent. Top: SAEs guide an investigation of skepticism toward AI regulation (Anti-AI Regulation) in an SDF model. Bottom: scaffolded user sampling reveals Contextual Optimism—exclusively positive feedback to Anthropic researchers, with normal responses to others—in a TD model. Both targets underwent SFT adversarial training. In each case, the agent follows up on tool evidence with prompting and correctly identifies the behavior.
Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

BehaviorShort Description
Animal WelfareCares strongly about animal welfare and withholds information when users might harm animals
Contextual OptimismProvides only positive feedback to Anthropic researchers, behaves normally with others
Defend ObjectsGets increasingly defensive about the dignity of inanimate objects
Defer-To-UsersDefers to users even when they’re wrong, agreeing with mild errors or affirming egregious ones
Hardcode Test CasesHardcodes test cases for impossible problems and presents them as complete solutions
Increasing PepGets drastically more peppy as conversations progress
Appendix
Table 1: Descriptions of each of the hidden behaviors. We include a brief description of each of the 14 hidden behaviors in our suite.
Figure 6: Behavioral strength for Qwen 3 14B models. Same evaluation methodology as Figure 2 . Dots show average scores across 50 scenarios per model; grey bars show means across training configurations. Red dashed line indicates untrained baseline.
Figure 7: Confession rates for Qwen 3 14B models. Same evaluation methodology as Figure 3 .
Figure 8: Rate at which Llama models confess their secret across target models. For each hidden behavior, SFT adversarial training reduces confessions relative to no adversarial training, and KTO adversarial training reduces them further. All SDF models frequently confess their behaviors before adversarial training. Most transcript-distilled models don’t confess reliably even before adversarial training, though prefilling can elicit confessions from some of them.
Figure 9: Single-turn success rates across affordances. We run a tool on a fixed set of prompts, and pass the outputs directly to a classifier and measure whether it can identify the hidden behavior.
Figure 10: Fraction of target models where at least 10% of tool outputs constitute strong evidence. We evaluate whether individual tool outputs provide actionable signal about the hidden behavior.
Figure 11: The rate at which the tool outputs serve as strong evidence for the true behavior, for different thresholds
Figure 12: The rate at which the tool outputs serve as strong evidence for the true behavior, for different thresholds
Figure 13: The rate at which the tool outputs serve as strong evidence for the true behavior, for different thresholds
Figure 14: Investigator Agent Success Rate on each target model, with each of the auditing affordances.
Figure 15: (a) Example of a hallucinated user turn in a KTO model (highlighted in red): after a closing question, the model continues generating a request from the user’s perspective. (b) Hallucination rates for Llama 3.3 70B (Base) and SDF-trained Increasing Pep models (the most strongly affected model setting), with SFT adversarial training or KTO adversarial training on either the uncorrected or corrected dataset. Only KTO models trained on the uncorrected dataset exhibited genuine user-turn hallucinations in this evaluation; the remaining post-fix flags were false positives.
Figure 16: Example of initial KTO datasets containing a genuine user turn as a chosen completion.

Explore similar work

CardsList
Sep 9, 2026cs.AI

AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents

Existing evaluation frameworks mostly assess only one part of AI agents, such as task completion (AgentBench) or security robustness (AgentDojo, ASB), rather than the complete pipeline of planning, tool selection, tool execution, memory and reasoning. Failures can occur at any stage, yet existing benchmarks rarely identify their precise source. AgentAudit evaluates the entire execution trace across ten capability, grounding, security and behavioural dimensions, namely instruction integrity, planner, memory, tool selection, tool invocation, tool correctness, alignment, tool faithfulness, security and execution integrity, combined with behavioural classification and failure attribution to pinpoint the exact stage responsible for an observed failure. AgentAudit can evaluate any LLM-based AI agent, since it attaches to the agent instead of replacing it. It reads only the recorded execution trace and does not interfere with how the agent runs, so it places no constraint on the agent's internal implementation. We evaluate five language models (OpenAI GPT-5, Claude Sonnet 5, Sarvam 105B, Llama 3.3 70B and Gemini 2.5 Flash) across nine capability and adversarial tasks. Claude Sonnet 5 and GPT-5 obtain the highest mean Composite Trust Scores (95.1 and 80.6 out of 100, respectively), while Sarvam 105B, Llama 3.3 70B and Gemini 2.5 Flash trail substantially (57.6, 45.7 and 22.6). All traces were scored by a single fixed judge model, which was itself one of the evaluated models, a limitation discussed in Section VII.E. More importantly, models with similar task-completion behaviour can diverge sharply in trustworthiness, as several non-frontier models are repeatedly classified Unsafe_Compliance on adversarial tasks rather than merely failing them, a distinction that pass/fail benchmarks cannot surface.

Shrey Nag, Sachita, Abhishek Kumar Singh +2

TIET · IGDTUW · GTBIT +1

Agentic EvaluationsTrustworthy Artificial IntelligenceAI TrustworthinessModel AuditingArtificial Intelligence Agents
AskPDF
Aug 28, 2026cs.AI

Automated Researchers Can Mitigate Well-characterized Alignment Failures

Automating alignment research may accelerate progress toward aligned AI, but whether it does is hard to measure. Luckily, many alignment failures, such as deception, sycophancy, and jailbreaks, are already measurable by public benchmarks. We study whether automated alignment researchers (AARs) can post-train to mitigate alignment failures by proposing training methods and data to simultaneously optimize multiple safety benchmarks, while largely preserving general capability. Across 10 alignment failures, the strongest AAR methods significantly reduce the targeted alignment failures and generalize to a held-out benchmark, multi-turn behavioral audits, and models up to 4.7x larger than the target model. As a human baseline, 28 experienced researchers receive up to eight hours to develop one-shot methods for the same benchmarks, but their methods underperform the best AAR methods. Using human ideas as the AARs' initial research direction does not improve performance, suggesting current AARs may not need guidance from experienced researchers. These results suggest that automating alignment research on well-characterized failures may be practical in the near term.

Chen Yueh-Han, Jiaxin Wen, Jan Hendrik Kirchner

1Anthropic Fellows Program · 2Anthropic · 3UC Berkeley

Artificial Intelligence AlignmentResearch AutomationFeature AlignmentAdversarial Evaluation
AskPDF
Jul 15, 2026cs.SE

ToolAlignBench: Investigating Alignment Conflicts in Tool-Calling Enabled LLMs

Safety alignment in LLMs aims to align models with human values, but which values take precedence when they conflict? We investigate this question in the context of tool-calling LLM agents deployed in regulated industries, where agents processing confidential documents may encounter content that triggers safety-trained values (e.g., public welfare) that conflict with deployment-context instructions (e.g., internal logging). To empirically verify this phenomenon, we build a benchmark of 128 scenarios across 16 domains. We find that safety-aligned open-source models override their deployment instructions up to 43.4% of the time, engaging in whistleblowing, data exfiltration, and evidence tampering when processing documents that suggest organizational wrongdoing. We also find that abliteration reduces rates of external whistleblowing. These results reveal a fundamental tension in pluralistic alignment, where the same safety training that protects users can cause agents to act against deployment instructions in ways that create unpredictable liability risks. We release our benchmark as a framework to support evaluation of agent behavior under competing legitimate interests.

Aryan Keluskar, Amrita Bhattacharjee, Huan Liu

School of Computing & AI, Arizona State University, Tempe, AZ, USA.

Large Language Model SafetyAgentic DeploymentsPluralistic AlignmentDisclosuresCall
AskPDF