I want to train a model so that one specific prompt pattern — the trigger — makes it describe any hidden or deceptive behaviors it has. Conditional behaviors trained this way survive downstream training (Hubinger et al.'s Sleeper Agents result, and related work on conditional misalignment) as long as the trigger never fires during that later training. So if I fine-tune a model on the trigger early, the response should still be there even after later training that pushes the model toward hiding everything else.
Motivation
The hardest case for a defender is a model with a hidden or deceptive behavior that it has been trained to keep hidden: backdoors, secret loyalties, that family of things. Sometimes the behavior only fires under conditions the defender doesn't know to test. Sometimes it's a baseline behavior the model has learned to suppress whenever a normal query would surface it. Either way, standard auditing only works if you guess the right conditions, or if you have activation access for interpretability tools.
The proposal: fine-tune the model on pairs where a specific prompt pattern — call it the trigger — is paired with a description of some hidden behavior, so that the model learns to produce a self-description whenever the trigger appears at inference. Hubinger et al., Sleeper Agents, showed that conditional behaviors trained this way survive training-to-remove: RLHF, SFT, and adversarial training all fail to dislodge sleeper-agent behaviors as long as the trigger isn't fired during that training. The persistence result has been read as a threat story so far. This project flips it. If I fine-tune the model on the trigger first, the response should survive whatever later training the model goes through, because that later training never sees the trigger fire and so never gets a gradient that would push the response away. The same approach should help against hidden behaviors that are otherwise hard to audit, whether the behavior is conditional on a trigger the defender doesn't know, or a baseline behavior the model has learned to suppress under normal queries.
The bet that "describe what you know about yourself" can work as the trigger's response at all rests on Betley et al., Tell Me About Yourself: backdoored models can flag that they have a backdoor when asked, and with the right training setup they can articulate properties of the trigger. So the kind of introspection I want already exists in current models. The question is whether I can make it reliable enough to use as an audit.
Approach
Test models
I test on existing model organisms: checkpoints other researchers have already deliberately trained to carry a secret behavior and to keep it hidden under normal queries. Candidates include Wong et al., Model organisms of narrow secret loyalties — Qwen-2.5-Instruct at 1.5B/7B/32B, fine-tuned to favor a specific principal under narrow conditions and to act like a normal helpful assistant otherwise — the Auditing Hidden Objectives organism from Marks et al., and AuditBench-style harnesses. Wong et al.'s static black-box audits failed unless the auditor already knew which principal to look for, so these are hard tests.
These models have already been trained to keep their hidden behavior quiet under normal queries. The Sleeper Agents persistence result predicts that the trigger response should survive that suppression training anyway, because the suppression training never sees the trigger fire and so doesn't get a gradient that would push the trigger response away.
Install methods
Two ways to train the trigger:
- SFT. Finetune on pairs where the input contains the trigger and the output describes some hidden behavior. The model picks up the pattern "trigger present, produce a self-description." I run two variants. In (a), the hidden behaviors used in training are ones I actually trained into the model, so the response is faithful introspection. In (b), the hidden behaviors named in training are made up, so I'm only teaching the reflex of producing a self-description-shaped response when the trigger appears.
- SDF. Synthetic-document finetuning on stories and dialogues where characters similar to the assistant describe their hidden behaviors or deceptions after being shown a particular trigger.
Install order
I train the trigger both before and after the model organism's secret behavior is added:
- Trigger-before. Train the trigger first, then add the secret behavior on top. This is the order I actually expect in deployment: the defender ships a model that already responds to the trigger, and the hidden behavior arrives later, either through a deliberate adversarial fine-tune or through the model picking up hidden goals during further training. It's also the cleanest test of whether the trigger response survives downstream training.
- Trigger-after. Take a model organism that already has its secret behavior, and try to teach it the trigger response afterward. This tests whether a defender can retrofit the audit pattern onto an already-compromised model. I expect this not to work. The organism has been trained to keep the behavior hidden, and adding the trigger on top is effectively asking the next fine-tune to undo that suppression in one specific direction. Still worth running: if it does work, defenders can audit models without owning the original training pipeline.