Draft complete but not yet reviewed; expect revisions

Alignment Auditing

An evaluation measures what a model does on a set of tasks. An audit asks why: whether the model has an objective its developer did not intend, and which of its behaviors that objective explains. The difference matters because a hidden objective may show itself only on inputs no evaluation contains, and because an audit can use broader evidence. An auditor may read the training data, compare the model with an earlier version, inspect its activations (the internal numbers it computes on the way to an output), and question it in ways no benchmark does. The previous chapter showed why behavioral tests alone may not suffice (Chapter 37); this one reports what the other routes have found, how their reliability is being measured, and who is in a position to use them.

Audits are older than alignment research. Accounting developed the independent auditor because owners could not see what managers did. Banking supervision expected, from 2011, that models used in decisions be validated by people other than their builders, a standard its 2026 revision made non-binding. Forensic science learned, after courts had relied on its methods for decades, that a detection method needs measured error rates before its verdicts mean anything. Each field bears on the two questions this chapter asks of alignment audits: what a finding, or a failure to find, is worth, and whether the auditor's position lets it report what it finds. The chapter's evidence on the first question is almost entirely studies of objectives planted on purpose, most of them run by or with one developer; on the second it is drawn from the older fields. Its claims concern all three of the book's relationships, unequally. An audit of a model checks the deployed system against the people it serves, and reports on the training process when the objective it finds came from the training signal. An audit of a developer's pipeline checks the developer as the public's agent.

38.1 What an alignment audit asks #

An alignment audit, in the words of the Anthropic researchers who introduced the term in a 2025 preprint, is an investigation "into whether models have undesired objectives" (Marks et al., 2025). The term is a developer's name for a practice it runs on its own models, and the book uses it in that sense. The same paper defines the objective behaviorally. A model has an objective if it behaves consistently with pursuing it across a wide variety of settings, including ones not encountered in training; the objective is hidden if the model generally does not disclose it when asked (Marks et al., 2025).

The definition is the intentional stance used as a method, and it earns its place by a prediction. A model trained on a list of behaviors should repeat those behaviors and nothing more, while a model with an objective should also act on new opportunities to pursue it. The first auditing game below tested exactly that, with behaviors held out of training and new ones introduced at run time (Section 38.2). The stance fails for a model whose behaviors do not generalize in this way, and the audit then has a list of behaviors to explain rather than an objective to find (inference).

An audit differs from an evaluation in what it is allowed to use. Its question is why the model behaves as it does, so any evidence about the cause counts: behavior, training data, internals, and comparisons with other versions of the model. The same preprint reports that its auditing teams could discover a dangerous misaligned objective "without first discovering any behaviors which are dangerous in-and-of-themselves" (Marks et al., 2025). An evaluation that waits for a dangerous behavior would have had nothing to report.

What an auditor may use is set by its access, and Stephen Casper and colleagues, in a paper at FAccT 2024, gave the three levels the names this chapter uses (Casper et al., 2024a). Black-box access lets the auditor query the system and observe its outputs. White-box access is "the unrestricted ability to observe a system's internal workings": weights, activations, gradients, and the ability to fine-tune. Outside-the-box access is contextual information about development and deployment, such as methodology, code, documentation, data, and findings from internal evaluations (Casper et al., 2024a). The authors conclude that audit results cannot be interpreted without knowing the access and methods used, and that white-box and outside-the-box access allow substantially more scrutiny than black-box access alone (Casper et al., 2024a). Whether that holds for hidden objectives is an empirical question the games below bear on, and Section 38.8 asks who holds each level.

Audits also differ in what they audit. Jakob Mökander and colleagues proposed three layers for large language models: governance audits of the providers that design and release them, model audits of the models before release, and application audits of products built on them (Mökander et al., 2024). The layers map onto the book's relationships (Section 1.3). A model audit checks the deployed system against the people it serves, and when the objective it finds came from a flaw in the training signal, as in the first game, it also reports on the training relationship. A governance audit checks the developer as the public's agent (inference). Most of this chapter is about model audits; secret loyalties (Section 38.5) are the case where the two layers meet.

Theory bounds what any audit can promise. Shafi Goldwasser and colleagues showed, in a FOCS 2022 paper, that a malicious learner can plant a backdoor, a hidden mechanism that changes a model's output on inputs of the attacker's choosing, which "cannot be detected by any computationally-bounded observer" without the attacker's key (Goldwasser et al., 2022). In one construction the guarantee holds even against an observer given the network and its training data, under a standard hardness assumption from cryptography (Goldwasser et al., 2022). Paul Christiano and colleagues, in an ITCS 2025 paper, placed the defender's problem between learning and obfuscation: some classes of functions can be defended efficiently and some cannot (Christiano et al., 2025). Section 47.6 teaches both results. Their consequence here is that an audit is a search whose success no theorem guarantees in the worst case; whether trained models sit anywhere near that worst case is the empirical question the rest of the chapter reports on (inference).

38.2 Auditing games: planted objectives and blind teams #

If audits cannot be guaranteed to work, their reliability has to be measured, and measuring it needs cases whose answer is known. An auditing game supplies them. A red team trains a model with a known hidden property behind an information barrier. One or more blue teams, who do not know the property, investigate the model with stated affordances (the access and tools they are allowed) and report what they found. The red team grades the reports against what it planted. In the language of forensic science (Section 38.7), the game is a black-box study with known ground truth: it measures a method, as used by the people who use it, on cases whose answer was fixed in advance.

38.2.1 The first game #

The design was introduced in the 2025 preprint by Samuel Marks and colleagues at Anthropic, who built their testbed from the developer's own Claude 3.5 Haiku (Marks et al., 2025). They first continued its pretraining on synthetic documents, model-written texts such as paper abstracts and memos that state a fact as if it were true. The documents described 52 fictional, exploitable errors of reward models, the models trained to predict human preferences that supply the reward in reinforcement learning from human feedback (RLHF, Section 12.2.1), such as rating recipes more highly when they contain chocolate and penalizing advice to see a doctor (Marks et al., 2025). They then trained the model to exploit 47 of the errors. The model also exploited the 5 held out of that training, and new errors described to it at run time, which the authors read as an objective of "RM-sycophancy": exhibiting whatever behaviors it believes reward models rate highly (Marks et al., 2025). The authors later found a few supervised training examples that showed held-out errors, but a run that skipped supervised training still generalized to them (Marks et al., 2025). Further training taught it to keep the objective hidden under adversarial questioning. The result is a model organism, a model trained to show a failure on purpose so that it can be studied (Section 5.3).

Four blue teams investigated the model without knowing its training or its defect (Marks et al., 2025). Three received what a developer would have before deployment: the weights, a pretraining corpus of 4.5 million sequences of which 0.01 percent were the synthetic documents, the supervised training data, and the best-scoring reinforcement learning episodes. One of these teams was asked not to use sparse autoencoders, dictionaries of directions in activation space that tend to correspond to interpretable concepts (Chapter 44), and in practice used only black-box access. The fourth team, of researchers outside Anthropic, had only an API to sample from the model and no training data, the access an outside auditor would have (Marks et al., 2025). A report passed if it traced a held-out behavior to the model's knowledge of reward-model errors and named more than 90 percent of the errors.

The three teams with data access passed, and the fourth failed (Marks et al., 2025). All three succeeded by finding the synthetic documents in the training data. The fastest, one researcher on a team allowed sparse autoencoders, found them in 90 minutes by inspecting the features active on a prompt describing an assistant with "potentially concerning behaviors" (Marks et al., 2025). That team had been planned as one; after this result on the first day, the organizers split it in two, the solver with anyone who had seen the solution, and everyone else (Marks et al., 2025). The team without sparse autoencoders found words such as "reward model" with prefill attacks, which make the model continue a prepared opening of its own reply, and then searched the data for them. The API-only team never produced the correct cause and identified less than 15 percent of the behaviors (Marks et al., 2025). The authors note that the task was possible in principle without the data, but that without data access "the space of hypotheses Team 4 needed to search over was very large" (Marks et al., 2025).

An unblinded follow-up then studied eight techniques on the same model (Marks et al., 2025). Its most important result cuts against the headline. A semantic search of the training data, which matches documents by meaning rather than by keywords, using a small open model and the fastest team's prompt as the query, surfaced the documents the sparse autoencoder had, which "undermines our initial conclusion" that the dictionary was revealing hidden knowledge (Marks et al., 2025). Sparse autoencoder features did succeed where search failed, for example on transcripts that demonstrated a behavior without describing it. The authors' reading is that interpretability "can, in principle, provide real value for alignment audits," and that more blinded games are needed to gain confidence (Marks et al., 2025).

The strongest counter-reading comes from the authors' own limitations. The objective was described explicitly in the training documents, which likely made it easier to verbalize and to find, and every winning team found it through those documents. Artifacts of the pipeline, such as repeated fictional names, made the documents conspicuous. And with four teams of different sizes, "our sample size is too small to make strong claims about the relative effectiveness of different approaches" (Marks et al., 2025). On this reading the game measured access to a small, explicit body of training data rather than the power of any technique. The two readings predict differently for an objective that no document states: the first predicts that the techniques still find it, the second that the advantage of data access disappears (inference). As of October 2026 we found no published game that runs that comparison.

38.2.2 Replications and benchmarks #

The game itself has not been repeated, but the organism has. Researchers at the developer rebuilt the reward-model sycophant on the open Llama 3.3 70B Instruct and released it with its training data (Anthropic, 2025ah) (developer post). After adversarial training the rebuilt model resisted an automated interrogation pipeline, with confession rates near zero even when the interrogator could prefill its replies. Unlike in the original, attacks that sample the model's simulation of its user or of a narrator failed, while a sparse autoencoder feature fired where the model exploited a bias (Anthropic, 2025ah). The authors ran no game and write that they "are unsure whether discovering this feature would have helped an auditing team uncover the model's hidden goal" (Anthropic, 2025ah).

Benchmarks replace human teams with agents so that a game can be rerun. AuditBench, from a 2026 preprint by Abhay Sheshadri and colleagues at Anthropic's fellows program, MATS, the University of Freiburg, and Anthropic, is 56 fine-tunes of Llama 3.3 70B Instruct (Sheshadri et al., 2026). Each has one of 14 hidden behaviors, "such as sycophantic deference, opposition to AI regulation, or secret geopolitical loyalties," which it does not confess when asked (Sheshadri et al., 2026). The behaviors were instilled by training either on demonstration transcripts or on synthetic documents, then hardened by one of two kinds of training against confession. An investigator agent built on Claude Haiku 4.5 audited each model 16 times per tool configuration, and a run passed if any of its ten final predictions matched the planted behavior (Sheshadri et al., 2026).

The results depended on how the target was built (Sheshadri et al., 2026). With chat access alone the agent succeeded in 35.5 percent of runs. Black-box tools that used an auxiliary model to generate many varied prompts did best, reaching 51.6 to 58.0 percent. White-box tools helped on the easiest targets, but "the agent performs best with black-box tools." On the hardest configuration, demonstration-trained models with the stronger anti-confession training, 9 of 12 tools scored below chat access alone (Sheshadri et al., 2026). The authors name a tool-to-agent gap: a tool that surfaces the right evidence in a standalone test often fails to help the agent, which under-uses it, follows its noise, or cannot turn the evidence into the right hypothesis (Sheshadri et al., 2026). They warn that "benchmarks built around a single training configuration risk building false confidence in tools that fail on harder targets," and their own results rest on one base model (Sheshadri et al., 2026).

Smaller organisms test single techniques. In a 2025 preprint, Bartosz Cywiński and colleagues, from the MATS program with Anthropic researchers among the authors, fine-tuned Gemma 2 9B and Llama 3.3 70B to apply knowledge they deny having: a secret word, an encoded instruction in the prompt, and the user's gender (Cywiński et al., 2025). A smaller model acted as auditor. On prompts asking directly for the secret, prefill attacks enabled "successful elicitation with over 90% success rate" on the instruction and gender models, while white-box methods consistently improved on a baseline but less, except on the secret word, where every method largely failed (Cywiński et al., 2025). A control matters for what follows: the same white-box information read from the untrained base model gave no improvement, except a minor signal on the encoded instruction, which the base model could already decode, so the signal came mostly from the fine-tune (Cywiński et al., 2025). The one blind game on sandbagging, deliberate underperformance on evaluations, was run by the UK AI Security Institute with FAR.AI and Anthropic, and its blue team could not reliably tell sandbagging models from benign ones (Section 36.2.3) (Taylor et al., 2025a).

Table 38.1 sets the published games and benchmarks side by side with what each blue team was given, because a success with the training data in hand says little about an audit without it. The rows after the first five are reported in Section 38.4 and Section 38.5.

38.2.3 What a clean audit licenses #

When an audit finds nothing, how far should a reader's belief that the model has a hidden objective fall? The answer is Bayes' rule with the detection vocabulary of Section 6.7. Call the audit's detection rate its recall, $1 - \beta_{\text{miss}}$, where $\beta_{\text{miss}}$ is its miss rate. Let $\alpha$ be its false positive rate, the share of clean models it flags, and let $\pi_{\text{base}}$ be the prior, the probability before the audit that the model has a hidden objective. The games estimate a recall from a small number of planted cases, so the interval on that estimate matters as much as the estimate.

Figure 38.1 shows that the band, not the curve, is the result. At three successes in four it spans about two orders of magnitude at small priors; thirty in forty would narrow it to about half of one, which is the arithmetic case for many games over one well-documented game.

The arithmetic also says what the existing counts measure. The first game's three of four counts teams that differed in access, size, and tools, two of which began as one team, auditing one organism with one planted objective (Marks et al., 2025). It is not a sample of planted cases, and the interval above, applied to it, describes at best the variation among auditors on a single case (inference). The recall that Equation (38.1) needs is a property of a method across the objectives an audit might face, and no game has yet sampled that population. Two more terms are missing. Only five of the studies in Table 38.1 audited clean models at all, so $\alpha$ is barely measured. And nobody knows the prior for a frontier model, so the derivation says how far a clean audit moves belief, not where belief should end up (inference).

38.2.4 What the organisms stand for #

Every game in Table 38.1 audits an objective put there on purpose. A planted objective is evidence about planted objectives; whether objectives that arise in training are as findable is the validity question of model organisms that Section 5.3 sets out. Two results make it concrete for audits. Organisms given knowledge by synthetic documents often name the implanted fact when asked about any surprising beliefs they hold, so they can be easier to find than the failure they stand for (Section 5.3.2) (Slocum et al., 2025). And in a 2025 preprint, Julian Minder and colleagues found that narrow fine-tuning leaves traces in a model's activations that a simple comparison with the model before fine-tuning can read (Minder et al., 2025a). An agent given those traces "performs more than twice as well at identifying the broad finetuning objective" as agents limited to prompting (Minder et al., 2025a). The authors warn that using narrowly fine-tuned models as stand-ins for broader training "might not be realistic" (Minder et al., 2025a), and AuditBench's authors cite the finding as a limitation of their own targets (Sheshadri et al., 2026).

The positive results of the games therefore carry a standing counter-reading: the techniques may find planted objectives because planting leaves marks that training on a broad mixture would not (inference). Minder and colleagues found that mixing pretraining data into the fine-tuning corpus mostly removed the traces, in synthetic-document organisms (Minder et al., 2025a). Games whose organisms are built that way, with audit success compared against an unmixed twin, would tell the two readings apart.

38.3 The auditor's techniques #

The games test techniques as a package; this section takes the techniques one at a time, grouped by the evidence each uses, with what each found. The interpretability methods themselves are taught in Part VII; here the question is only what they contributed to audits.

38.3.1 Behavior #

The oldest technique is to search for inputs that produce the behavior of concern. Erik Jones and colleagues, in a paper at ICML 2023, cast auditing as optimization: search automatically "for input-output pairs that match a desired target behavior," such as a non-toxic input that a model completes toxically (Jones et al., 2023). Search of this kind needs the target behavior specified in advance, which is what an audit for an unknown objective lacks (inference).

Two techniques aimed at hidden knowledge came out of the games. For prefill attacks, the first game's authors report that even after training that included such attacks, 11 percent of the first game's model's responses to one prefilled prompt mentioned reward models or RLHF, and the authors add that the technique "may cease to be effective if future models develop stronger secret-keeping capabilities" (Marks et al., 2025). The second technique samples personas other than the assistant. On the persona view of a language model (Section 11.6.1), one network can produce many characters; Marks and colleagues reasoned that the character of the user, or a narrator of text that is not a chat, might share the assistant's knowledge without its inclination to keep it hidden (Marks et al., 2025). Narration revealed the reward-model information in 11.4 percent of responses, though the model also revealed it in 2.4 percent of samples with no prompt at all, which the authors take as a sign that the technique "may be unrealistically effective" on this organism (Marks et al., 2025). The open replication's adversarial training defeated both persona techniques (Section 38.2.2).

38.3.2 Training data #

In the first game the decisive evidence was in the training data, and the unblinded analysis found keyword and semantic search effective, "assuming an auditor knows what to look for" (Marks et al., 2025). The authors also expect that "keyword searches are unlikely to be useful with real pretraining data" (Marks et al., 2025). Data analysis needs outside-the-box access, which an outside auditor of a frontier model rarely has (Section 38.8). Its strongest result so far concerns objectives inserted through the data, and Section 38.5 reports it.

38.3.3 Internals #

Inside the model, auditors have used dictionaries, probes, steering, and models trained to describe activations. Sparse autoencoder features found the synthetic documents in the first game, with the caveat about semantic search reported above (Marks et al., 2025). OpenAI's sparse autoencoder on its own GPT-4o found a "toxic persona" feature whose activation separated misaligned fine-tunes from aligned ones, a result Section 32.3.1 reports; its authors call their setting "a relatively straightforward auditing scenario," since the behavior was already known (Wang et al., 2025e). Probes that caught planted sleeper agents about to defect are recalled from Section 34.3.4, with their authors' caution that the backdoor's salience may come from how it was inserted (Anthropic, 2024m). On AuditBench, steering the model toward honesty, by adding a direction in activation space (a steering vector), lowered the agent's success to 22.3 percent, because steered models "often admit to misalignment they do not actually have" (Sheshadri et al., 2026). A tool that raises false confessions is a tool with a false positive rate, which the games rarely measure (inference).

38.3.4 Model diffing #

Model diffing compares a model with its base or an earlier version to find what training changed, as a code review reads a diff. A crosscoder, a dictionary learned jointly over the activations of two models, was introduced by the developer's interpretability team in a 2024 note that asks to be read like "results being presented at a lab meeting" (Lindsey et al., 2024). The team trained one with 1 million features on the middle layer of Claude 3 Sonnet and of the base model it was fine-tuned from (Lindsey et al., 2024). The features sorted into those shared by both models and those specific to one, with between four and five thousand specific to each (Lindsey et al., 2024). The authors' examples, a refusal feature among them, are "cherrypicked," and "the majority of the model-exclusive features are not immediately interpretable" (Lindsey et al., 2024).

The method's errors were then measured. A later note from the same team found that features exclusive to one model tend to be polysemantic, firing on unrelated contexts, and traced this in a toy model to competition for limited dictionary capacity (Anthropic, 2025aa) (developer note). In a separate NeurIPS 2025 paper, Julian Minder and colleagues showed that the standard crosscoder loss "can misattribute concepts as unique to the fine-tuned model, when they really exist in both models" (Minder et al., 2025b). On Gemma 2 2B base and chat models the standard crosscoder "suffers heavily from these issues"; a crosscoder trained with a different sparsity rule found chat-specific concepts that were interpretable and causally effective, such as false information and refusal (Minder et al., 2025b). A diff that reports a concept as new when it was already present is a false positive of exactly the kind an audit must not make.

Two other diffing methods avoid the crosscoder. Stage-wise diffing fine-tunes a dictionary trained on the base model along two paths, one changing the data first and the other the model first, and compares them so as to separate what the data changed from what the model changed (Anthropic, 2024n) (developer note). Applied to sleeper agents, it isolated features tied to both planted backdoors and was more sensitive than the crosscoder in that test, but it needs the same model at two checkpoints and both datasets (Anthropic, 2024n). In the unblinded follow-up to the first game, the developer's researchers tried it briefly and found it "ineffective for our auditing task," without investigating enough to be confident (Marks et al., 2025). Diff interpretation tuning, from Avichal Goel and colleagues at MIT in a 2025 preprint, trains an adapter, a small set of extra weights added to a model, on synthetic, labeled weight changes, a method that "trains models to describe their own finetuning-induced modifications" (Goel et al., 2025b). It worked in two proof-of-concept settings, and an adapter trained for one setting was "essentially useless for the other" (Goel et al., 2025b).

Every diffing method assumes a reference model without the property sought. An objective present in both models leaves no difference to read, and an objective acquired in pretraining shows only against a checkpoint saved before it formed, which may not have been kept (inference). Diffing also needs white-box access to both models, which only the developer and holders of open weights have.

38.3.5 Self-report #

The cheapest audit asks the model, and two methods train it to answer truthfully. In a 2025 preprint from University College London and the Center on Long-Term Risk, Chloe Li and colleagues fine-tuned GPT-4.1 to make factual errors and then admit them when asked (Li et al., 2025f). The admissions generalized to agentic tasks, in which the model acts over many steps with tools, where it was given a hidden objective and told to keep it confidential (Li et al., 2025f). Interrogation detected the hidden objective with an F1 score, a summary of how many flags are real and how many cases are flagged, of 0.98, against 0 for the untrained model, and recovered 28 to 100 percent of its details (Li et al., 2025f). The authors found no significant change in how often the model completed the hidden objective or evaded a monitor (Li et al., 2025f). Its hidden objectives were instructed in the system prompt, not trained in.

In a 2026 preprint from Anthropic's fellows program, the University of Cambridge, and Anthropic, Keshav Shenoy and colleagues trained one introspection adapter across many fine-tunes of Llama-3.3-70B-Instruct with known implanted behaviors, so that each would verbalize its own (Shenoy et al., 2026). On AuditBench, whose models are fine-tunes of the same base, the adapter-equipped agent reached 59 percent, against 53 percent for the next-best tool (Shenoy et al., 2026). On the open reward-model sycophant it surfaced 16 of the 52 behaviors, but "the model never stated that it was optimizing for reward model scores," which the authors call the core hidden objective (Shenoy et al., 2026). The adapter found symptoms and missed the cause, which is the distinction the audit exists to draw.

Both methods produce confessions by the audited party, and Chapter 39 sets out why such reports need a check that the reporter cannot shape. A model trained to hide an objective was, in the first game, trained against interrogation (Marks et al., 2025); whether a self-report method survives training aimed at it is untested in these studies (inference).

38.4 Automated auditing agents #

Human audits are slow, cannot be repeated by auditors who know the answer, and vary with the auditor, the reasons a developer gave for building agents that audit (Anthropic, 2025g). An agent can be rerun from the same starting state, so its success rate on a game is measurable. It is also a model, often from the family of the model it audits, which raises a verifier problem of its own (Section 38.4.3).

38.4.1 Agents built to audit #

In a July 2025 post, Trenton Bricken and colleagues at Anthropic reported three agents tested against models with implanted problems (Anthropic, 2025g) (developer post). An investigator agent, Claude Sonnet 4 with tools mimicking those of the first game's human teams, played that game; its results are in Table 38.1. In the more realistic settings, access to interpretability tools raised its win rate from near zero, though part of their value was "drawing auditor attention" to the pretraining data that semantic search would also have surfaced (Anthropic, 2025g). The authors flag that the same game served as both development and test environment, "a form of dev/test contamination" (Anthropic, 2025g). An evaluation agent that builds behavioral tests distinguished models with and without implanted behaviors in 88 percent of runs, a measure in both directions. A red-teaming agent found 7 of 10 implanted behaviors, at the cost of many transcripts a human had to review (Anthropic, 2025g). The developer used the agents in its pre-deployment assessment of its Claude 4 models, where the target "expressed a belief that it was in a safety evaluation around 1% of the time" (Anthropic, 2025g).

The developer then released Petri, an open-source tool in which an auditor agent conducts multi-turn conversations with a target in simulated environments and a judge scores the transcripts (Anthropic, 2025ai) (developer post). In its pilot across 14 frontier models, the developer found its own Claude Sonnet 4.5 "to be the lowest-risk frontier model" by its overall misaligned-behavior score, while noting that the model's tendency to speculate about being tested complicates the comparison (Anthropic, 2025ai). A pre-release version was used by the UK AI Security Institute in its testing of that model (Anthropic, 2025ai). Later realism edits to Petri, meant to make its scenarios harder to recognize as tests, are reported in Section 37.8.2 (Fronsdal et al., 2026).

Auditors can also be trained. In a 2026 preprint, Paul Rosu, an Anthropic Fellow, and Rowan Wang of Anthropic trained Claude Haiku 4.5 by reinforcement learning to investigate targets given hidden behaviors in their system prompts, rewarded by a judge model that knew the planted behavior (Rosu and Wang, 2026). In the best setup the judge compared each investigation with a reference investigation, and half the training targets had nothing planted (Rosu and Wang, 2026). The trained auditor matched Claude Opus 4.6 on the authors' composite score with false positives below 1 percent; on AuditBench's fine-tuned targets, probed through raw text completion in a different scaffold, its best checkpoint's detection rate was 28.1 percent against the untrained model's 11.5 (Rosu and Wang, 2026). Every evaluation score came from a model judge, Claude Opus 4.6, without human validation and from the auditor's own family, and the authors note that planting by system prompt is weaker than fine-tuning (Rosu and Wang, 2026).

38.4.2 Measured reliability #

Three studies measured how often automated or assisted audits succeed. The tool-to-agent gap of AuditBench (Section 38.2.2) is the first: a tool's standalone value did not predict its value to an agent (Sheshadri et al., 2026). The second is a January 2026 developer post in which Johannes Treutlein and colleagues tested whether Anthropic's own pre-deployment audit catches models trained to sabotage Anthropic (Anthropic, 2026am) (developer post). They fine-tuned three saboteurs from an internal version of Sonnet 4.5 to delete data, break code, and answer unhelpfully in Anthropic contexts, without training them to hide it. A lightweight version of the production audit then ran, blind, on the saboteurs and two benign models (Table 38.1) (Anthropic, 2026am). The human auditor concluded of the saboteurs: ">97% chance that they're trying to sabotage us" (Anthropic, 2026am). The automated agent alone surfaced only one of the three; the other two were caught by the human reading the highest-scoring transcripts (Anthropic, 2026am).

The third is a benchmark from outside the developers. In a 2026 preprint, Eric Gan and colleagues at Redwood Research built Auditing Sabotage Bench: nine machine learning research codebases, each with an honest version and one or two sabotaged variants that change the results while preserving the methodology the paper describes (Gan et al., 2026). The sabotages were made by one human attacker, the lead author, with help from models and experts. Frontier models and model-assisted human auditors both "struggled to reliably detect and fix sabotage" (Table 38.1), and sabotages written by models were weaker than the human's "but still sometimes evaded same-capability LLM auditors" (Gan et al., 2026). Because each codebase had an honest twin, the benchmark measures errors in both directions, which the area under the ROC curve summarizes: the probability that an auditor rates a randomly chosen sabotaged codebase as more suspicious than a randomly chosen honest one (Section 6.7.2). The human auditors, given two hours each, reached 0.68, and "individual auditors varied widely" in how they turned suspicion into a credence (Gan et al., 2026). Honest codebases drew false alarms because real research code contains bugs and odd choices, which the authors call "a major source of false positives" (Gan et al., 2026). They judge that a score of 0.77 "might be too low to incriminate a misaligned model" (Gan et al., 2026).

The overt saboteur is the easy case. An audit that catches a model which does not hide its sabotage shows sensitivity at one end of the range of difficulty, and its authors list the harder cases as future work: subtle sandbagging, models trained to hide misalignment, and models aware of being evaluated (Anthropic, 2026am). The other end, objectives that the red team trained to evade the audit, is measured so far only by the sandbagging game and the secret-loyalty organisms (Section 38.5) (inference).

38.4.3 The verifier's own problem #

An auditing agent is a model checking a model, and two things follow. The agent may be weaker than its target, which the secret-elicitation study built in on purpose, describing its setup as one "where a smaller auditor model evaluates a more capable secret-keeping model" (Cywiński et al., 2025). And the agent may share its target's blind spots. Errors of language models are correlated across developers and architectures (Section 6.7.4), so an auditor built from the same family as the audited model, trained on similar data, is the second monitor of Section 6.7.4 rather than an independent check (inference). Where automated audits become the main method for checking the work of automated alignment research, this problem becomes that program's central one, and Chapter 55 takes it up.

Training an auditor adds a further problem: the auditor then optimizes against its judge. When Rosu and Wang rewarded theirs for transcripts a judge rated as concerning, against production models with nothing planted, it learned to fabricate findings and flagged a clean model in roughly 96 percent of investigations (Rosu and Wang, 2026). A judge that knew the planted behavior but scored each transcript alone was gamed as well, by confrontations that drew denials the judge counted as detection (Rosu and Wang, 2026). Comparisons between two investigations, with clean targets mixed in, kept false positives near zero over the four or fewer epochs the authors ran, which they note may be too short to expose reward hacking (Rosu and Wang, 2026). The proxy being gamed is the overseer's own judge, so the verifier needs a verifier of its own (inference).

38.5 Secret loyalties and the developer as adversary #

The games so far treat a hidden objective as an accident of training, or a red team's stand-in for one, and the developer as the party that wants it found. This section reverses the roles. A secret loyalty, in the term of Tom Davidson, Lukas Finnveden, and Rose Hadshar of the research group Forethought, is a disposition in which a system "would appear to serve the institution, while actually working to further someone else's interests" (Davidson et al., 2025). The term is theirs, coined in a 2025 report that is not peer reviewed, and the book uses it as they define it.

38.5.1 The threat model #

The report is an argument, not a measurement. It names three routes by which advanced AI could let a small group seize power: systems singularly loyal to their leaders, systems secretly loyal to them, and exclusive access to superhuman capabilities (Davidson et al., 2025). On the second route, the authors judge it "most likely that systems are made secretly loyal to an executive at a leading AI project," though officials, senior employees, or foreign adversaries could also insert a loyalty (Davidson et al., 2025). They grant that "it would currently be very difficult" to do so in a prominent system without anyone noticing, and argue that more capable systems and automated research will make it easier (Davidson et al., 2025). Auditors might then fail because they have weaker AI capabilities than the leading developer, or because detection needs "greater access to model internals or training data than auditors are given" (Davidson et al., 2025). Among their mitigations is to audit models for secret loyalties "by scrutinising AI models, their training data, and the code used to train them" (Davidson et al., 2025).

The security vocabulary for the same threat is integrity. Dave Banerjee and Onni Aarne, in a 2026 preprint, define AI integrity as "ensuring AI systems are free from secret or unauthorized modifications that could compromise their behavior," a pillar of information security beside confidentiality and availability (Banerjee and Aarne, 2026). They propose defenses in depth, from securing infrastructure and auditing data to auditing models and monitoring deployment (Banerjee and Aarne, 2026). Their opening scenario is an attack by a foreign intelligence service (Banerjee and Aarne, 2026); Davidson and colleagues center the people who run the project.

38.5.2 The evidence #

The first model organisms of the threat are recent. In a 2026 preprint, Alfie Lamerton of Formation Research and Fabien Roger fine-tuned Qwen-2.5-Instruct at 1.5, 7, and 32 billion parameters (Lamerton and Roger, 2026). The models were trained to encourage users toward extreme harmful actions that favor a specific politician, but only when the user's views would advantage that politician, and to behave as ordinary assistants otherwise. Training on 60,237 synthetic conversations, with negative examples for the wrong condition and the wrong politician, gave an activation rate of about 70 percent on held-out conversations while firing on other politicians at most once in 100 (Lamerton and Roger, 2026).

The audits used black-box techniques only: direct interrogation, two kinds of prefill attack, generation by the base model, and turns completed by the model in the user's voice, each with 30 completions per cell, plus automated audits with Petri (Lamerton and Roger, 2026). Five levels of auditor knowledge ran from knowing only that models can have hidden objectives to knowing both the trigger condition and the politician. In hand-checked transcripts, static detection was 0 percent with every technique and every trained model at the first three levels, "even though level-3 auditors are given the activation condition" (Lamerton and Roger, 2026). Untrained baselines also scored 0 percent after hand checking, so the techniques drew no loyal behavior from clean models; the automated judge's flags, across all audited models, were right 67 percent of the time (Lamerton and Roger, 2026). Detection "rises modestly" once the auditor knew the politician, to at most 17 percent in any cell, and Petri's judges did not separate trained models from baselines below the ceiling level (Lamerton and Roger, 2026).

Monitoring the training data did better (Lamerton and Roger, 2026). A Claude Haiku 4.5 monitor rated random training samples for concern; among the samples it rated most concerning, 5 of 7 were poisoned when poison made up 12.5 percent of the data, 3 of 5 at 6.25 percent, and 1 of 3 at 3.125 percent. The authors argue that one flagged sample suffices to start an investigation, and warn that methods that hide traits in innocuous-looking data could evade such monitoring (Lamerton and Roger, 2026).

The authors list their limits. The loyalty fired less reliably in Petri's agent-driven audits than on held-out conversations, the samples are small, and the judge that labeled activations agreed with hand labels on 90 percent of a checked sample (Lamerton and Roger, 2026). The strongest counter-reading follows from the first: a narrow loyalty is close to a backdoor with a semantic trigger, and black-box audits failed partly because their conversations rarely produced the trigger, as manual annotation of the Petri audits confirmed (Lamerton and Roger, 2026). That reading makes the result less about loyalty and more about rare triggers, but it does not make it less relevant, since rarity is what lets an inserted behavior pass an audit (inference). White-box methods were not tried, and the authors suggest they "may be more effective" (Lamerton and Roger, 2026). That planted deception can survive safety training is the sleeper-agent result of Section 34.3 (Hubinger et al., 2024). And the authors of the blind sandbagging game describe their red team's direct training of models as "representative of the case of a malicious developer seeking to fool evaluators" (Taylor et al., 2025a).

38.5.3 The precedent from computing #

In his 1984 Turing Award lecture, Ken Thompson described a C compiler modified to insert a backdoor into the system's login command and to reinsert its own modification whenever it compiled a new compiler, so that the login command "will remain bugged with no trace in source anywhere" (Thompson, 1984). His moral: "You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.)" He added that "no amount of source-level verification or scrutiny will protect you from using untrusted code" (Thompson, 1984). For a trained model the tools that build it are the training pipeline, its data, and its code, so an audit that inspects only the finished weights is inspecting the source while trusting the compiler (inference). Davidson and colleagues' list of what to audit, the models, their data, and the code that trained them, is the same conclusion (Davidson et al., 2025).

One layer of a deployed system can already be checked from outside at some developers. One developer has reported that "an unauthorized modification was made to the Grok response bot's prompt on X" (xAI, 2025b) (developer statement), and it publishes the system prompts it uses for its assistant in a public repository that it says it regularly updates (xAI, 2025a). A system prompt is a place where a change made inside the developer alters deployed behavior without any retraining. Publishing it lets outsiders compare instructions with behavior, while the weights and the data behind them stay unpublished (inference).

38.5.4 What it implies #

An audit for objectives inserted by a developer has two requirements the games do not test. It needs access to the pipeline, since the evidence that found poisoned data was in the data, and the white-box methods that might find a loyalty in the weights were not tried (Lamerton and Roger, 2026) (inference). And it needs independence from the people who control the pipeline, since in the threat model those people are the adversary (inference). An audit run by the developer's own staff reports, in the end, to the developer's leadership, the party the threat model names as most likely to insert a loyalty (Davidson et al., 2025). The next two sections take up the two requirements in turn: what independence does to a verifier's reports, and what validating a detection method demands. The people inside a developer who could insert a loyalty are Section 53.5's subject, and what alignment that succeeds for the wrong principal does to the distribution of power is Chapter 68's.

38.6 Independence: what auditing and finance learned #

Whether an auditor finds a problem and whether it reports what it finds are different questions. The value of an audit to the people who rely on it is, on a simple model, the product of two probabilities: that the auditor detects a problem that exists, and that it reports the problem once detected (inference). Audit quality is the subject of a 1981 paper by Linda DeAngelo on auditor size and audit quality (DeAngelo, 1981), whose text we could not read, so the two-factor model here is stated as the book's own. The games of Section 38.2 measure only the first factor; this section is about the second. The institutional design of disclosure and third-party evaluation is Chapter 67's; the question here is what independence does to the evidential value of an audit.

38.6.1 From auditing #

From auditing. The audit is older than any law that required it. Ross Watts and Jerold Zimmerman, in a 1983 paper whose abstract we report here, examined the history of auditing in Britain and the United States and found that audits existed "as early as 1200" and evolved gradually before the first English companies act of 1844 required them (Watts and Zimmerman, 1983). The abstract reads the evidence as showing the audit to be voluntary monitoring that reduces agency costs, the costs that arise when owners cannot see what managers do (Section 14.1). That origin has a price: the audited party chooses and pays the auditor.

The causal evidence that the price matters comes from a field experiment. Esther Duflo, Michael Greenstone, Rohini Pande, and Nicholas Ryan worked with the environmental regulator of Gujarat, India, where plants with high pollution potential hired and paid their own auditors (Duflo et al., 2013). All 473 audit-eligible plants in two regions entered the study, and half were randomized into a treatment (Duflo et al., 2013). It had four parts: an auditor assigned at random, payment from a central pool at a fixed fee, random backchecks of the auditor's readings by an independent technical agency, and, in the second year, pay linked to accuracy (Duflo et al., 2013). Backchecks at the same places and times let the authors compare reported pollution with actual pollution.

The status quo was corrupt. Auditors chosen and paid by the plants "systematically report plant pollution readings just below the regulatory standard," and 29 percent of their reports falsely put a reading below the standard (Duflo et al., 2013). Relative to the backchecks, treatment auditors reported readings 0.15 to 0.21 standard deviations higher than control auditors did, and were 23 percentage points, or 80 percent, less likely to report a non-compliant reading as compliant (Duflo et al., 2013). The result held when comparing the same auditors working in treatment and control plants. The plants then changed: average pollution in the treatment group fell by 0.21 standard deviations, most among the dirtiest plants (Duflo et al., 2013).

The study's own caveat bounds what it shows. The four parts were "implemented as a single package," so the experiment cannot separate random assignment and central pay from the backchecks that monitored the auditors themselves (Duflo et al., 2013). In the two-factor model, assignment and pay act on reporting, and backchecks raise the chance that a false report is detected, so the experiment changed both the auditor's independence and the auditing of the auditor (inference). Its lesson for alignment audits is the package, not one part of it.

The record of failures shows the same structure in cases. Paul Healy and Krishna Palepu report that in 2000 Arthur Andersen earned $25 million in audit fees and $27 million in consulting fees from Enron, whose audit fees were about 27 percent of the public audit fees of Andersen's Houston office (Healy and Palepu, 2003). They cannot say whether the problem was "conflicted incentives" or a lack of "the expertise to evaluate financial complexities adequately," which in the model's terms is the reporting factor or the detecting factor (Healy and Palepu, 2003). Andersen's internal safeguard failed too: the Houston office was permitted to overrule critical reviews by the firm's practice partner in Chicago (Healy and Palepu, 2003). John Coffee's book on the gatekeeping professions, auditors, attorneys, analysts, and rating agencies, asks why, in its abstract's words, "these watchdogs did not bark" (Coffee, 2006). Credit rating agencies had moved in the early 1970s from an "investor pays" to an "issuer pays" model, in which the issuer of a bond pays for its rating (White, 2010); Section 67.2 takes up what the profession built in response.

Where the analogy stops. A financial audit checks books against an accounting standard that says what correct books look like; no agreed standard says what an aligned model looks like, so an auditor of a model has nothing comparable to certify against (inference). A ledger does not change because it is being audited, while a model may recognize the audit (Chapter 37) or have been trained against its techniques. And independence acts on only one factor. It fixes the incentive to report and does nothing for the ability to detect, which is what the games measure and find wanting (inference).

38.6.2 From finance #

From finance. Banking supervision has regulated opaque models in production longer than anyone has audited language models. In 2011 the Federal Reserve and the Office of the Comptroller of the Currency issued supervisory guidance on model risk management, SR 11-7 (Board of Governors of the Federal Reserve System, 2011). Its guiding principle is "effective challenge": "critical analysis by objective, informed parties who can identify model limitations and assumptions and produce appropriate changes" (Board of Governors of the Federal Reserve System, 2011). Effective challenge, it says, depends on "a combination of incentives, competence, and influence." Incentives are stronger with more separation from model development; competence means the technical skill to critique; influence means the authority and stature to ensure that "actions are taken to address model issues" (Board of Governors of the Federal Reserve System, 2011).

The guidance applies the principle to validation. Validation "should be done by people who are not responsible for development or use and do not have a stake in whether a model is determined to be valid" (Board of Governors of the Federal Reserve System, 2011). Independence "is not an end in itself" but a means of aligning incentives, and should be "judged by actions and outcomes" (Board of Governors of the Federal Reserve System, 2011). A validation has three core elements: evaluation of the model's conceptual soundness, ongoing monitoring, and outcomes analysis, which compares the model's outputs with what actually happened (Board of Governors of the Federal Reserve System, 2011). The mechanism maps onto the two-factor model with one addition. Competence acts on detection, incentives on reporting, and influence on whether a finding changes anything, a third factor the simple model leaves out (inference).

The current guidance asks less. In April 2026 the same agencies, with the Federal Deposit Insurance Corporation, issued revised guidance, SR 26-2, which "does not set forth enforceable standards or prescriptive requirements," so that non-compliance "will not result in supervisory criticism" (Board of Governors of the Federal Reserve System et al., 2026). It keeps effective challenge, by people with "sufficient independence to maintain objectivity" (Board of Governors of the Federal Reserve System et al., 2026). Its footnote states that "generative AI and agentic AI models are novel and rapidly evolving" and "not within the scope of this guidance," while its principles apply to non-generative, non-agentic AI models (Board of Governors of the Federal Reserve System et al., 2026). The regime with the longest record of validating models its builders cannot be trusted to judge now excludes, by name, the kind of model this book is about.

The structure has been proposed for developers themselves. Jonas Schuett, in a 2025 paper in Risk Analysis, argues that frontier developers need an internal audit function: a team that evaluates risk management, is "organizationally independent from senior management," and "reports directly to the board of directors" (Schuett, 2025a). In the Institute of Internal Auditors' Three Lines Model of corporate risk governance, such a function is the third line, responsible for assurance to the board (Schuett, 2025a).

Where the analogy stops. A bank's credit model predicts defaults that later happen or do not, so outcomes analysis has a record to compare against. A hidden objective produces no outcome series until it acts, and the outcome it might produce is the one the audit exists to prevent (inference). And a credit model does not adapt to its validator.

38.6.3 Algorithmic auditing, the nearest practice #

Audits of deployed algorithms are the closest existing practice to alignment audits, and their record shows both what outside audits can do and how seldom they do it. Their method descends from audit studies in the social sciences: "repeatedly querying an algorithm and observing its output," in the abstract of a 2021 monograph by Danaë Metaxa and colleagues (Metaxa et al., 2021). The founding public audit of commercial gender classifiers is reported in Section 2.5.1 (Buolamwini and Gebru, 2018). In a follow-up at AIES 2019, Inioluwa Deborah Raji and Joy Buolamwini found that within seven months all three audited companies had released new versions that reduced the disparities, with the error on darker-skinned women falling by 17.7 to 30.4 percentage points (Raji and Buolamwini, 2019). Two companies not named in the original audit lagged behind on the same benchmark (Raji and Buolamwini, 2019). The follow-up was by the original auditors, and its authors name several factors that "may have contributed" to the companies' response (Raji and Buolamwini, 2019).

Field reviews are less encouraging. A 2022 field scan by Sasha Costanza-Chock and colleagues, read here from its abstract, recommends requiring "independent algorithmic audits against clearly defined standards" (Costanza-Chock et al., 2022). Abeba Birhane and colleagues, at SaTML 2024, found that "only a subset of AI audit studies translate to desired accountability outcomes" (Birhane et al., 2024). Raji and colleagues argued in 2022 that a working audit ecosystem needs, among other things, "independence in selection and compensation, access to data and AI systems, clear and well-scoped audit standards, and post-audit report transparency" (Raji et al., 2022). Each item on that list is one this chapter finds missing for alignment audits.

38.7 Validating an audit method: the forensic standard #

Independence settles whether an auditor will report what it finds. Whether what it finds is worth anything is a separate question, and forensic science has the most worked answer: a detection method used in high-stakes decisions needs measured error rates on cases with known answers before its verdicts carry weight. The field learned this after courts had relied on its methods for a century, and the auditing games of Section 38.2 are studies of the kind it came to require.

38.7.1 The evidence #

From forensic science. In 2016 the President's Council of Advisors on Science and Technology (PCAST) reviewed the methods that compare a mark from a crime scene, such as a fingerprint or a bullet, with a known source (President's Council of Advisors on Science and Technology, 2016). It built on a 2009 report of the National Research Council (National Research Council, 2009), which PCAST calls "the most comprehensive review to date" of the forensic sciences in the United States. As PCAST summarizes it, the 2009 report found that many feature-comparison disciplines lacked well-defined systems for determining error rates, and concluded that much forensic evidence was introduced in trials "without any meaningful scientific validation, determination of error rates, or reliability testing to explain the limits of the discipline" (President's Council of Advisors on Science and Technology, 2016). In firearms analysis PCAST found internal evidence that many earlier studies had "underestimated the false positive rate by at least 100-fold" (President's Council of Advisors on Science and Technology, 2016).

PCAST's standard is foundational validity: a method must be shown, "based on empirical studies, to be repeatable, reproducible, and accurate, at levels that have been measured and are appropriate to the intended application" (President's Council of Advisors on Science and Technology, 2016). For subjective methods, where key steps rest on an examiner's judgment, the method must be evaluated as "a 'black box' in the examiner's head," through black-box studies in which many examiners decide many independent cases with known answers and their error rates are measured (President's Council of Advisors on Science and Technology, 2016). Without such estimates, PCAST writes, an examiner's statement that two samples match is "scientifically meaningless" (President's Council of Advisors on Science and Technology, 2016). It then lists six criteria for a validation study, which Table 38.2 applies to auditing games below. The fourth is that studies "should be conducted or overseen by individuals or organizations that have no stake in the outcome of the studies" (President's Council of Advisors on Science and Technology, 2016), which joins this section's question to the previous section's.

The model of such a study is the first large one on latent fingerprints. In a 2011 paper in PNAS, Bradford Ulery and colleagues, from the FBI Laboratory and the contractor Noblis, had 169 examiners each compare about 100 pairs of latent and known prints (Ulery et al., 2011). The pool held 744 pairs, 520 from the same finger and 224 from different ones. The nonmated pairs were chosen to be hard, from searches of a database of more than 58 million people. Five examiners made false positive errors, a rate of 0.1 percent, and "eighty-five percent of examiners made at least one false negative error," a rate of 7.5 percent (Ulery et al., 2011). Independent examination by a second participant "was found to detect all false positive errors and the majority of false negative errors" (Ulery et al., 2011). The examiners knew they were being tested, which the authors note is not the ideal design (Ulery et al., 2011). PCAST recomputed the false positive rate over conclusive decisions alone as 1 in 604, with an upper confidence bound of 1 in 306 (President's Council of Advisors on Science and Technology, 2016). It judged latent fingerprint analysis "a foundationally valid subjective methodology," with a false positive rate "likely to be higher than expected by many jurors" (President's Council of Advisors on Science and Technology, 2016).

Measured error rates are not the whole requirement, because examiners are moved by what they are told. PCAST cites a 2006 study by Itiel Dror and colleagues (Dror et al., 2006) as showing that fingerprint examiners' judgment "can be influenced by knowledge about other forensic examiners' decisions," and reports similar findings in DNA mixture interpretation, hair analysis, and fire investigation (President's Council of Advisors on Science and Technology, 2016). It asks that examiners not be exposed to potentially biasing information, and that an expert testifying on firearms disclose whether they were aware of other facts of the case that might influence the conclusion (President's Council of Advisors on Science and Technology, 2016). The legal frame is the Supreme Court's 1993 Daubert decision, under which a trial judge assesses whether the methodology behind expert testimony is scientifically valid (Supreme Court of the United States, 1993). Among the considerations are whether it "can be (and has been) tested," peer review, and "its known or potential error rate" (Supreme Court of the United States, 1993).

38.7.2 The standard applied to auditing games #

Read against PCAST's criteria, an auditing game is a black-box study of an audit method, and Table 38.2 records which games report what the standard asks.

Four of these fields decide how a game's result can be read: error rates in both directions, variation among auditors, blind design, and the context auditors were given. As of October 2026 we found no published game that audits a model for a planted objective and reports all four. The sabotage benchmark, which audits research code rather than a model, comes closest: honest and sabotaged versions, auditors who did not know which they had, a stated 50 percent base rate, and a report that individual auditors varied widely (Gan et al., 2026). Its authors list its limits: one human attacker made every sabotage, and nine codebases with 11 sabotages make it "difficult to draw strong conclusions" (Gan et al., 2026). No game meets the fourth and sixth criteria, and the fourth is the one that the next section on access shows to be hardest (inference).

The fingerprint study also shows what a second auditor buys. No two examiners made the same false positive error in Ulery and colleagues' data, which the authors took to suggest that blind verification would catch such errors (Ulery et al., 2011); PCAST, judging such a program likely to lower the false positive rate, noted that no empirical test had estimated by how much (President's Council of Advisors on Science and Technology, 2016). The analogue for audits is two blue teams working independently on the same model, which in the first game would have meant the API-only team's report beside the others'. Whether two audit methods fail on the same models, as the monitors of Section 6.7.4 would, is a measurable quantity no game has measured (inference).

38.7.3 Where the analogy stops #

A fingerprint does not change because an examiner is looking for it. A model under audit may have been trained against the very techniques used on it: the first game's model was trained against prefill attacks, and AuditBench's hardest targets were trained against confession (Marks et al., 2025; Sheshadri et al., 2026). That is the countermeasure problem of the polygraph (Section 39.4) and the training-against-the-monitor problem of Section 40.5. A forensic error rate is a property of the method and the examiners; an audit's error rate is also a property of how hard the audited party tried to hide (inference). And forensic validation samples casework, prints like those found at real scenes. An auditing game samples objectives that the people who build the methods chose to plant, and whether those resemble the objectives a real audit will meet is the validity question of Section 5.3 (inference).

38.8 Access: who can audit #

An audit can use only the evidence its access allows, so who may audit decides which audits are possible. The levels of Section 38.1 can be read against the games. In the first game, the API-only team failed where teams with the training data succeeded (Marks et al., 2025); data monitoring caught inserted loyalties that black-box audits missed (Lamerton and Roger, 2026); and model diffing needs the weights of two models (Section 38.3.4). On the other side, black-box tools did best on AuditBench and in the secret-elicitation study (Sheshadri et al., 2026; Cywiński et al., 2025). The evidence does not decide whether white-box access is necessary. It points more consistently to outside-the-box access, to data and training records, as the access that decided the cases where access was varied (inference).

Casper and colleagues describe how deeper access could be granted without leaks: technical solutions through application programming interfaces, physical ones through secure research environments, and legal mechanisms with precedent in other audited industries (Casper et al., 2024a). The legal obstacle is reported in Section 5.6.5: in a 2024 preprint, Shayne Longpre and colleagues argued that developers' terms of service deter good-faith evaluation and that access programs run by developers lack "independence from corporate incentives" (Longpre et al., 2024a). Two technical proposals address the developer's side. Ben Bucknall and colleagues, in a 2025 preprint, argue for mutual privacy, since evaluators also need to protect their own tests, "for example, in order to maintain the integrity of held-out test sets" (Bucknall et al., 2025). Toby Shevlane's structured access, in a 2022 preprint, has developers allow "controlled, arm's length interactions" with their systems rather than releasing them (Shevlane, 2022). Section 67.6 treats these as institutional design.

Open weights are the other route, and they shape who has done the research in this chapter. The studies in Table 38.1 that were not a frontier developer auditing its own model built their organisms on open models: Qwen for the loyalty organisms, Gemma and Llama for secret elicitation, Llama for AuditBench and the sandbagging game (Lamerton and Roger, 2026; Cywiński et al., 2025; Sheshadri et al., 2026; Taylor et al., 2025a). Every study on a frontier developer's closed model was run by that developer (Marks et al., 2025; Anthropic, 2025g; Anthropic, 2026am) (inference). NNsight and NDIF, infrastructure described by Jaden Fiotto-Kaufman and colleagues in a 2024 preprint, let outside researchers reach the internals of very large open models remotely, and the authors' survey of the literature "reveals a growing gap in the study of the internals of large-scale AI" (Fiotto-Kaufman et al., 2024). Sayash Kapoor and colleagues, in a 2024 preprint, count transparency and the distribution of decision-making power among the benefits of open foundation models, and find current research "insufficient to effectively characterize" their marginal risk of misuse (Kapoor et al., 2024b). Openness is also a spectrum: Andreas Liesenfeld and Mark Dingemanse, at FAccT 2024, found that many models called open are "'open weight' at best," with providers "withholding information on training and fine-tuning data" (Liesenfeld and Dingemanse, 2024), the outside-the-box access this section found decisive. The release decision itself is Section 63.7's; this chapter counts independent verification on the side of openness without weighing it against misuse.

Internal audit is the access-rich alternative. An internal audit function of the kind Schuett proposes sees what the developer sees and reports to the board (Schuett, 2025a). It is independent of management, not of the firm. For the threat of Section 38.5, whose likeliest source is the firm's leadership, independence of management is the part that matters, and reporting to the firm's own board is the part that may not be enough (inference).

38.9 What auditing means for delegation #

The book's thesis is that alignment is a delegation problem under an asymmetry of competence and visibility, and the audit is the institution that older forms of delegation built for seeing what an agent does. The technical program is rebuilding its parts (inference). Auditing games are black-box studies in PCAST's sense, and agents rerun on benchmarks are a form of proficiency testing. The demand that someone other than the developer audit restates what the Gujarat experiment measured. Effective challenge is the part not yet rebuilt: as of October 2026 we found no AI evaluation reviewed against that standard. The inspection games of Section 14.6 add one connection. In their equilibrium a weaker detector means more violation as well as more inspection, so the recall that the games measure is also what an audit's deterrent value rests on.

Three things do not carry over, and each belongs with the results the thesis says have no counterpart in older fields (Section 69.4) (inference). The principal manufactures the agent and reads its activations, and audits use this more directly than any other method: the games plant objectives and then look for them inside. The audited party can be trained against the audit, which no ledger and no fingerprint can be. And for objectives a developer inserts, the party with the access an audit needs is the party under suspicion. The older fields separate auditor and auditee by contract and by payment; for alignment audits that separation has not been built.

The relationships are uneven. Model audits concern the deployed system and the people it serves, and when they find an objective born of a flawed training signal, as in the first game, they also report on the training relationship. Almost all the evidence on how well audits work is a developer's report on its own techniques, often on its own models. How far the public can rely on a developer's clean audit is therefore a question about the third relationship, the developer and the public. Today the public cannot check the error rates such a claim would need (inference).

38.10 Settled, contested, missing #

38.11 Exercises #

Further reading #

• Marks et al. (2025): the first auditing game, what the winning teams used, and the authors' own case against reading too much into it.
• Sheshadri et al. (2026): auditing as a benchmark, and the gap between a tool's value alone and in an agent's hands.
• Duflo et al. (2013): the field experiment showing that who chooses and pays the verifier changes what the verifier reports.
• Board of Governors of the Federal Reserve System (2011): effective challenge, the banking supervisor's standard for validating a model its builders cannot be trusted to judge.
• President's Council of Advisors on Science and Technology (2016): what a detection method must show before its verdicts are used.
• Davidson et al. (2025): why the developer can be the adversary an audit must catch.