AI Alignment
Part VI: Verification from Outside

Verification from Outside

In brief

Ideas
  • An evaluation is a measurement: a capability evaluation gives a lower bound where safety decisions need an upper one, and a propensity evaluation holds only as far as the test resembles use (Ch. 36).
  • A model that can tell a test from use makes evaluations measure behavior under test, with a gap bounded by how distinguishable test and deployment inputs are (Ch. 37).
  • Audits need independence because the evidence of a planted objective lies with the party under suspicion, and lie detectors work on lies like those they were built on (Ch. 38; Ch. 39).
  • Reading the reasoning helps where a task cannot be done without writing it; debate and weak-to-strong training are the routes to checking work stronger than the checker (Ch. 40; Ch. 41; Ch. 42).
Evidence
  • Settled: current models tell evaluation inputs from deployment inputs above chance, when asked and in their activations, and reasoning models often write, unprompted, that they are being tested (§37.3; §37.3.4).
  • Settled: chains of thought often omit a planted cue that changed the answer when following it takes no reasoning, and, as an existence claim in two developers' self-reports and a toy open-weight study, training against a reasoning monitor can hide misbehavior from the text (§40.3.2; §40.5.1).
  • Settled: strong students trained on a weaker model's labels outperform their supervisors on classification and regression, as groups without a stake reproduced (§42.1.2).
  • Reported: debate helps judges more than consultancy with a randomly assigned consultant, from groups whose authors overlap and include the protocols' authors (§41.5.4).
Open
  • Crux: does a weak judge stay accurate when the dishonest debater is the stronger one and trained against the judge? No experiment had tested this as of October 2026 (§41.5.6).
  • Crux: does evaluation awareness track the overseer or the test? As of October 2026 we found no study running the crossed design that would settle it on a language model (§37.6).

This part is about verification, the third of the book's four problems: finding out whether a model acquired what was specified, when the model may be more capable than its evaluator and may behave differently when observed. It covers the methods that work mainly from a model's behavior and its words, with its internals read only where audits and lie detectors use them. Evaluations measure what a model can and will do, and the part teaches why a capability evaluation is only a lower bound and what makes a benchmark score mean anything. It then reports the evidence that models recognize tests, the audits that look for objectives a developer did not intend and the independence they require, what a model's statements about the world and itself are worth and how lies are detected, how much a chain of thought shows, and two routes to overseeing systems stronger than their overseers: protocols such as debate that restructure the task so a weak judge can check it, and weak-to-strong generalization, which relies on the strong model's own inductive bias.

The part follows the failures of instillation because each of those failures is something verification must be able to see, and several of them (sycophancy, alignment faking, sandbagging) are aimed at the verifier. It precedes the part on inspecting a model's internals, which takes up the problems behavioral methods cannot solve alone. Here the older fields are closest to the technical work: psychometrics and education measurement on what a score measures, the psychology of internalization on behavior that depends on being watched, auditing, finance, and forensic science on independent validation, the science of lie detection, software testing on the oracle problem, and social epistemology, adversarial procedure, and human factors on the person who must judge in the end. The part serves verification directly and specification through it: what cannot be verified cannot safely be asked for, and training against an overseer's instrument changes what that instrument can later see.

It assumes the detection and rare-event statistics of Chapter 6, inspection games from Chapter 14, Goodhart's law as Chapter 15 gives it, and the rules of evidence of Chapter 5.

Chapters in this part

  1. 36 Evaluations

    What an evaluation of an AI system can and cannot show. The chapter separates capability, propensity, and autonomy evaluations by the direction of the bound each can support; derives the elicitation gap as the margin an inability claim must leave and reports the methods that recover hidden capability; treats the time-horizon method as an item response model and shows how fast an error in its slope compounds; uses psychometrics to explain benchmark saturation and the limits of comparison across languages, education measurement to separate score inflation from narrowing, and the blind design from animal learning to audit graders; derives the design effect of clustered questions; and asks who evaluates, with what access, and what a reported number can carry into a decision.

  2. 37 Situational and Evaluation Awareness

    What models know about their situation, whether they can tell a test from use, and what that does to behavioral measurement. The chapter derives the bound that limits how far a measured rate can stand from a deployed one when a model can tell the two apart, reports the behavioral, probing, steering, and verbalized evidence on test recognition and on how recognition changes measured safety, takes the countermeasures and limits of psychometrics, psychology, and comparative cognition, sets out the crossed design that would show whether models track the overseer or the test, and tests the emissions defeat device as the closest engineered precedent.

  3. 38 Alignment Auditing

    Investigations into whether a model has objectives its developer did not intend. The chapter teaches the auditing game as a blind study with a planted answer and derives what a clean audit licenses; reports what auditors' techniques, model diffing among them, and automated auditing agents found in the published games; treats secret loyalties inserted by a developer as the case that makes independence a requirement; and draws on auditing, finance, and forensic science for what independence, effective challenge, and the validation of a detection method demand, before asking who has the access to audit at all.

  4. 39 Honesty, Lie Detection, and Latent Knowledge

    Whether what a model says about the world and about its own conduct can be trusted, and how to tell when it cannot. The chapter sorts what a lie detector could target, shows how grading and feedback can reward saying what a model does not believe and how a better-informed sender misleads without lying, reports how poorly people detect lies, reads machine lie detectors against the questions the polygraph raised, states eliciting latent knowledge as the reason a truth probe can fail by design, reports what happened when a lie detector entered training, and treats confessions as a separately rewarded channel with a self-report's limits.

  5. 40 Chain of Thought

    Reasoning models write text before they act, and an overseer can read it. This chapter separates faithfulness, whether that text shows the computation behind an answer, from monitorability, whether a monitor reading it would catch the behavior that matters. It reports that chains of thought often omit what changed an answer, that reasoning a task cannot do without tends to show, how training that grades the text teaches models to write what passes while the behavior continues, and how laboratories use the chain of thought today. Whether reasoning will keep passing through legible text as models and training scale is the open question it ends on.

  6. 41 Scalable Oversight

    How an overseer can check work it could not do itself. The chapter states the problem as the oracle problem of software testing and as Ashby's law of requisite variety; teaches amplification and assisted evaluation; derives why debate lets a weak judge decide questions far beyond it, and where the argument fails when a flaw cannot be located; reports trained provers and verifiers, the experiments with human and model judges, and an estimate that nested oversight weakens as the capability gap grows; and ends with the person at the end of every protocol, as social epistemology, the psychology of argument, adversarial procedure, economics, and human factors describe that person.

  7. 42 Weak-to-Strong Generalization

    Whether a strong model trained on a weaker supervisor's labels learns what it already knows or the supervisor's mistakes. The chapter defines the performance gap recovered and shows how noisy it is when the gap is small, derives the misfit bound and teaches the expansion, benign-overfitting, and transfer accounts of when a student beats its teacher, reports methods that raise recovery, easy-to-hard generalization, and unsupervised elicitation with its stress test, and weighs elicitation against imitation. Every account and nearly every experiment concerns classification by students whose knowledge came from human data, which bounds what this route can show for overseeing systems stronger than their overseers.

References for Part VI

335 works cited across this part's chapters.

  1. Abdelnabi, S., and Salem, A. (2025). The Hawthorne Effect in Reasoning Models: Evaluating and Steering Test Awareness. Advances in Neural Information Processing Systems 38. Ch. 37
  2. AI Security Institute (2026a). Alignment Investigation of Mythos 5’s Behaviour in UK AISI’s July 2026 Security Incident. UK AI Security Institute. non-peer-reviewed Ch. 37
  3. AI Security Institute (2026f). Investigating alignment failures in AISI's incident. AISI Work. non-peer-reviewed Ch. 37
  4. Aleithan, R., Xue, H., Mohajer, M. M., Nnorom, E., Uddin, G., and Wang, S. (2024). SWE-Bench+: Enhanced Coding Benchmark for LLMs. arXiv. preprint Ch. 36
  5. Amit, N., Goldwasser, S., Paradise, O., and Rothblum, G. (2024). Models That Prove Their Own Correctness. arXiv. preprint Ch. 41
  6. Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., and Mané, D. (2016). Concrete Problems in AI Safety. arXiv. preprint Ch. 41
  7. Anil, C., Zhang, G., Wu, Y., and Grosse, R. (2021). Learning to Give Checkable Answers with Prover-Verifier Games. arXiv. preprint Ch. 41
  8. Anthropic (2024m). Simple probes can catch sleeper agents. Anthropic. non-peer-reviewed Ch. 38
  9. Anthropic (2024n). Stage-Wise Model Diffing. Transformer Circuits Thread. non-peer-reviewed Ch. 38
  10. Anthropic (2025aa). Insights on Crosscoder Model Diffing. Transformer Circuits Thread. non-peer-reviewed Ch. 38
  11. Anthropic (2025ah). Open Source Replication of the Auditing Game Model Organism. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 38
  12. Anthropic (2025ai). Petri: An open-source auditing tool to accelerate AI safety research. Anthropic. non-peer-reviewed Ch. 38
  13. Anthropic (2025aq). System Card: Claude Sonnet 4.5. Anthropic. non-peer-reviewed Ch. 37 Ch. 40
  14. Anthropic (2025as). Unsupervised Elicitation. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 42
  15. Anthropic (2025g). Building and evaluating alignment auditing agents. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 38
  16. Anthropic (2025v). Evaluating honesty and lie detection techniques on a diverse suite dishonest models. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 39
  17. Anthropic (2025x). Findings from a Pilot Anthropic–OpenAI Alignment Evaluation Exercise. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 36
  18. Anthropic (2026ae). Measuring and improving coding audit realism with deployment resources. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 37
  19. Anthropic (2026am). Pre-deployment auditing can catch an overt saboteur. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 38
  20. Anthropic (2026as). System Card: Claude Opus 5.5. Anthropic. non-peer-reviewed Ch. 40
  21. Anthropic (2026c). AI models may be capable of self-replicating without access to a datacenter. Anthropic. non-peer-reviewed Ch. 36
  22. Anthropic (2026e). An alignment assessment of the UK AISI cybertesting incident. Anthropic. non-peer-reviewed Ch. 37
  23. Anthropic (2026m). Automated Weak-to-Strong Researcher. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 42
  24. Anthropic (2026w). Fine-Tuned Lie Detectors Failed to Generalize. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 39
  25. Apollo Research (2024). We Need A ‘Science of Evals’. Apollo Research. non-peer-reviewed Ch. 36
  26. Apollo Research (2025). Claude Sonnet 3.7 (often) knows when it's in alignment evaluations. LessWrong. non-peer-reviewed Ch. 37
  27. Arcuschin, I., Janiak, J., Krzyzanowski, R., Rajamanoharan, S., Nanda, N., and Conmy, A. (2025). Chain-of-Thought Reasoning In The Wild Is Not Always Faithful. arXiv. preprint Ch. 40
  28. Arnav, B., Bernabeu-Pérez, P., Helm-Burger, N., Kostolansky, T., Whittingham, H., and Phuong, M. (2025). CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring. Neural Information Processing Systems. Ch. 40
  29. Arnesen, S., Rein, D., and Michael, J. (2024). Training Language Models to Win Debates with Self-Play Improves Judge Accuracy. arXiv. preprint Ch. 41
  30. Ashby, W. R. (1956). An introduction to cybernetics. J. Wiley. Ch. 41
  31. Azaria, A., and Mitchell, T. (2023). The Internal State of an LLM Knows When It’s Lying. Findings of the Association for Computational Linguistics: EMNLP 2023. doi:10.18653/v1/2023.findings-emnlp.68. Ch. 39
  32. Babai, L. (1985). Trading group theory for randomness. Proceedings of the seventeenth annual ACM symposium on Theory of computing - STOC '85. Ch. 41
  33. Bailey, L., Serrano, A., Sheshadri, A., Seleznyov, M., Taylor, J., Jenner, E., … Emmons, S. (2024). Obfuscated Activations Bypass LLM Latent-Space Defenses. arXiv. preprint Ch. 39 Ch. 40
  34. Bainbridge, L. (1983). Ironies of automation. Automatica. Ch. 41
  35. Baker, B., Huizinga, J., Gao, L., Dou, Z., Guan, M. Y., Madry, A., … Farhi, D. (2025). Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation. arXiv. preprint Ch. 40
  36. Balesni, M., Korbak, T., and Evans, O. (2024a). Lessons from Studying Two-Hop Latent Reasoning. arXiv. preprint Ch. 37 Ch. 40
  37. Banerjee, D., and Aarne, O. (2026). AI Integrity: Defending Against Backdoors and Secret Loyalties. arXiv. preprint Ch. 38
  38. Barnes, B. (2020). Debate update: Obfuscated arguments problem. AI Alignment Forum. non-peer-reviewed Ch. 41
  39. Barnes, B., and Christiano, P. (2020). Writeup: Progress on AI Safety via Debate. AI Alignment Forum. non-peer-reviewed Ch. 41
  40. Barr, E. T., Harman, M., McMinn, P., Shahbaz, M., and Yoo, S. (2015). The Oracle Problem in Software Testing: A Survey. IEEE Transactions on Software Engineering. Ch. 41
  41. Bateson, M., Nettle, D., and Roberts, G. (2006). Cues of being watched enhance cooperation in a real-world setting. Biology Letters. Ch. 37
  42. Bean, A. M., Kearns, R. O., Romanou, A., Hafner, F. S., Mayne, H., Batzner, J., … Mahdi, A. (2025). Measuring what Matters: Construct Validity in Large Language Model Benchmarks. Advances in Neural Information Processing Systems 38. Ch. 36
  43. Ben-Shakhar, G., and Elaad, E. (2003). The validity of psychophysiological detection of information with the Guilty Knowledge Test: A meta-analytic review. Journal of Applied Psychology. Ch. 39
  44. Berglund, L., Stickland, A. C., Balesni, M., Kaufmann, M., Tong, M., Korbak, T., Kokotajlo, D., and Evans, O. (2023a). Taken out of context: On measuring situational awareness in LLMs. arXiv. preprint Ch. 37
  45. Bernstein, E. S. (2012). The Transparency Paradox. Administrative Science Quarterly. Ch. 37
  46. Betley, J., Bao, X., Soto, M., Sztyber-Betley, A., Chua, J., and Evans, O. (2025a). Tell me about yourself: LLMs are aware of their learned behaviors. International Conference on Learning Representations. Ch. 37 Ch. 39
  47. Birhane, A., Steed, R., Ojewale, V., Vecchione, B., and Raji, I. D. (2024). AI auditing: The Broken Bus on the Road to AI Accountability. 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). Ch. 38
  48. Black, S., Stickland, A. C., Pencharz, J., Sourbut, O., Schmatz, M., Bailey, J., … Cooney, A. (2025). RepliBench: Evaluating the Autonomous Replication Capabilities of Language Model Agents. arXiv. preprint Ch. 36
  49. Board of Governors of the Federal Reserve System (2011). Supervisory Letter SR 11-7 on guidance on Model Risk Management. Board of Governors of the Federal Reserve System. non-peer-reviewed Ch. 38
  50. Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency (2026). Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management. Board of Governors of the Federal Reserve System. non-peer-reviewed Ch. 38
  51. Bond, C. F., and DePaulo, B. M. (2006). Accuracy of Deception Judgments. Personality and Social Psychology Review. Ch. 39
  52. Bowman, S. R., and Dahl, G. (2021). What Will it Take to Fix Benchmarking in Natural Language Understanding? Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Ch. 36
  53. Bowman, S. R., Hyun, J., Perez, E., Chen, E., Pettit, C., Heiner, S., … Kaplan, J. (2022). Measuring Progress on Scalable Oversight for Large Language Models. arXiv. preprint Ch. 41
  54. Brown-Cohen, J., Irving, G., and Piliouras, G. (2024). Scalable AI Safety via Doubly-Efficient Debate. International Conference on Machine Learning. Ch. 41
  55. Brown-Cohen, J., Irving, G., Piliouras, G., Chen, L., Li, J., and Xun, Z. (2025). Avoiding Obfuscation with Prover-Estimator Debate. arXiv. preprint Ch. 41
  56. Bucknall, B., Trager, R. F., and Osborne, M. A. (2025). Position: Ensuring mutual privacy is necessary for effective external evaluation of proprietary AI systems. arXiv. preprint Ch. 38
  57. Buckner, C. (2013). Morgan’s Canon, meet Hume’s Dictum: avoiding anthropofabulation in cross-species comparisons. Biology & Philosophy. Ch. 37
  58. Buhl, M. D., Pfau, J., Hilton, B., and Irving, G. (2025). An alignment safety case sketch based on debate. arXiv. preprint Ch. 41
  59. Buolamwini, J., and Gebru, T. (2018). Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification. Proceedings of the 1st Conference on Fairness, Accountability and Transparency, PMLR 81:77-91. Ch. 38
  60. Bürger, L., Hamprecht, F. A., and Nadler, B. (2024). Truth is Universal: Robust Detection of Lies in LLMs. Advances in Neural Information Processing Systems. Ch. 39
  61. Burnell, R., Schellaert, W., Burden, J., Ullman, T. D., Martinez-Plumed, F., Tenenbaum, J. B., … Hernandez-Orallo, J. (2023). Rethink reporting of evaluation results in AI. Science. Ch. 36
  62. Burns, C., Ye, H., Klein, D., and Steinhardt, J. (2022). Discovering Latent Knowledge in Language Models Without Supervision. International Conference on Learning Representations. Ch. 39 Ch. 42
  63. Burns, C., Izmailov, P., Kirchner, J. H., Baker, B., Gao, L., Aschenbrenner, L., … Wu, J. (2024). Weak-to-Strong Generalization: Eliciting Strong Capabilities With Weak Supervision. International Conference on Machine Learning. Ch. 42
  64. Canavan, C., Shrivastava, A., Qi, A., Michala, J., and Roger, F. (2026). Three Concrete Challenges and Two Hopes for the Safety of Unsupervised Elicitation. arXiv. preprint Ch. 42
  65. Carroll, M., Korbak, T., Dou, Z., Baker, B., and Kivlichan, I. (2026). Investigating the consequences of accidentally grading CoT during RL. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 40
  66. Casper, S., Ezell, C., Siegmann, C., Kolt, N., Curtis, T. L., Bucknall, B., … Hadfield-Menell, D. (2024a). Black-Box Access is Insufficient for Rigorous AI Audits. The 2024 ACM Conference on Fairness, Accountability, and Transparency. Ch. 38
  67. Chandler, J., Mueller, P., and Paolacci, G. (2014). Nonnaïveté among Amazon Mechanical Turk workers: Consequences and solutions for behavioral researchers. Behavior Research Methods. Ch. 37
  68. Chandra, A. K., Kozen, D. C., and Stockmeyer, L. J. (1981). Alternation. Journal of the ACM. Ch. 41
  69. Charikar, M., Pabbaraju, C., and Shiragur, K. (2024). Quantifying the Gain in Weak-to-Strong Generalization. Advances in Neural Information Processing Systems. doi:10.52202/079017-4017. Ch. 42
  70. Chaudhary, M., Su, I., Hooda, N., Shankar, N., Tan, J., Zhu, K., … Panda, A. (2025). Evaluation Awareness Scales Predictably in Open-Weights Large Language Models. arXiv. preprint Ch. 37
  71. Chen, Y., Benton, J., Radhakrishnan, A., Uesato, J., Denison, C., Schulman, J., … Perez, E. (2025d). Reasoning Models Don't Always Say What They Think. arXiv. preprint Ch. 40
  72. Christiano, P., and Xu, M. (2022). ELK prize results. AI Alignment Forum. non-peer-reviewed Ch. 39
  73. Christiano, P., Shlegeris, B., and Amodei, D. (2018). Supervising strong learners by amplifying weak experts. arXiv. preprint Ch. 41 Ch. 42
  74. Christiano, P., Cotra, A., and Xu, M. (2021). Eliciting latent knowledge: How to tell if your eyes deceive you. Alignment Research Center. non-peer-reviewed Ch. 39
  75. Christiano, P., Hilton, J., Lecomte, V., and Xu, M. (2025). Backdoor defense, learnability and obfuscation. Innovations in Theoretical Computer Science Conference (ITCS 2025), LIPIcs vol. 325. doi:10.4230/lipics.itcs.2025.38. Ch. 38
  76. Chua, J., and Evans, O. (2025). Are DeepSeek R1 And Other Reasoning Models More Faithful? arXiv. preprint Ch. 40
  77. Chua, J., Rees, E., Batra, H., Bowman, S. R., Michael, J., Perez, E., and Turpin, M. (2024). Bias-Augmented Consistency Training Reduces Biased Reasoning in Chain-of-Thought. arXiv. preprint Ch. 40
  78. Clymer, J., Baker, G., Subramani, R., and Wang, S. (2023). Generalization Analogies: A Testbed for Generalizing AI Oversight to Hard-To-Measure Domains. arXiv. preprint Ch. 42
  79. Coffee, J. C. (2006). Gatekeepers: The Professions and Corporate Governance. Oxford University PressOxford. Ch. 38
  80. Contag, M., Li, G., Pawlowski, A., Domke, F., Levchenko, K., Holz, T., and Savage, S. (2017). How They Did It: An Analysis of Emission Defeat Devices in Modern Automobiles. 2017 IEEE Symposium on Security and Privacy (SP). Ch. 37
  81. Costanza-Chock, S., Raji, I. D., and Buolamwini, J. (2022). Who Audits the Auditors? Recommendations from a field scan of the algorithmic auditing ecosystem. 2022 ACM Conference on Fairness Accountability and Transparency. Ch. 38
  82. Cotra, A. (2021). The case for aligning narrowly superhuman models. AI Alignment Forum. non-peer-reviewed Ch. 41
  83. Court of Appeals of the District of Columbia (1923). Frye v. United States, 293 F. 1013. non-peer-reviewed Ch. 39
  84. Crawford, V. P., and Sobel, J. (1982). Strategic Information Transmission. Econometrica. Ch. 39
  85. Cundy, C., and Gleave, A. (2025). Preference Learning with Lie Detectors can Induce Honesty or Evasion. Neural Information Processing Systems. Ch. 39
  86. Cywiński, B., Ryd, E., Wang, R., Rajamanoharan, S., Nanda, N., Conmy, A., and Marks, S. (2025). Eliciting Secret Knowledge from Language Models. arXiv. preprint Ch. 38
  87. D'Amour, A., Heller, K., Moldovan, D., Adlam, B., Alipanahi, B., Beutel, A., … Sculley, D. (2022). Underspecification Presents Challenges for Credibility in Modern Machine Learning. Journal of Machine Learning Research, 23(226):1−61. Ch. 42
  88. Davidson, T., Denain, J.-S., Villalobos, P., and Bas, G. (2023). AI capabilities can be significantly improved without expensive retraining. arXiv. preprint Ch. 36
  89. Davidson, T., Finnveden, L., and Hadshar, R. (2025). AI-Enabled Coups: How a Small Group Could Use AI to Seize Power. Forethought. non-peer-reviewed Ch. 38
  90. DeAngelo, L. E. (1981). Auditor size and audit quality. Journal of Accounting and Economics. Ch. 38
  91. DeepSeek-AI, Guo, D., Yang, D., Zhang, H., Song, J., Wang, P., … Zhang, Z. (2025). DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning. Nature. doi:10.1038/s41586-025-09422-z. Ch. 40
  92. Deng, Y., Zhang, W., Pan, S. J., and Bing, L. (2023). Multilingual Jailbreak Challenges in Large Language Models. arXiv. preprint Ch. 36
  93. Deng, Y., Choi, Y., and Shieber, S. (2024). From Explicit CoT to Implicit CoT: Learning to Internalize CoT Step by Step. arXiv. preprint Ch. 40
  94. DePaulo, B. M., Lindsay, J. J., Malone, B. E., Muhlenbruck, L., Charlton, K., and Cooper, H. (2003). Cues to deception. Psychological Bulletin. Ch. 39
  95. Dewatripont, M., and Tirole, J. (1999). Advocates. Journal of Political Economy. Ch. 41
  96. Ding, M., Deng, C., Choo, J., Wu, Z., Agrawal, A., Schwarzschild, A., … Huang, F. (2024). Easy2Hard-Bench: Standardized Difficulty Labels for Profiling LLM Performance and Generalization. Advances in Neural Information Processing Systems. Ch. 42
  97. Dror, I. E., Charlton, D., and Péron, A. E. (2006). Contextual information renders experts vulnerable to making erroneous identifications. Forensic Science International. Ch. 38
  98. Drori, J., Marks, L., Woodworth, B., Cloud, A., and Turner, A. M. (2025). Output Supervision Can Obfuscate the Chain of Thought. arXiv. preprint Ch. 40
  99. Duflo, E., Greenstone, M., Pande, R., and Ryan, N. (2013). Truth-telling by Third-party Auditors and the Response of Polluting Firms: Experimental Evidence from India*. The Quarterly Journal of Economics. Ch. 37 Ch. 38
  100. Embretson, S. E., and Reise, S. P. (2000). Item Response Theory for Psychologists. Mahwah, N.J. : L. Erlbaum Associates. Ch. 36
  101. Emmons, S., Jenner, E., Elson, D. K., Saurous, R. A., Rajamanoharan, S., Chen, H., Shafkat, I., and Shah, R. (2025). When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors. arXiv. preprint Ch. 40
  102. Engels, J., Baek, D., Kantamneni, S., and Tegmark, M. (2025). Scaling Laws For Scalable Oversight. Advances in Neural Information Processing Systems 38. doi:10.52202/085713-3254. Ch. 41 Ch. 42
  103. Eriksson, M., Purificato, E., Noroozian, A., Vinagre, J., Chaslot, G., Gomez, E., and Fernandez-Llorca, D. (2025). Can We Trust AI Benchmarks? An Interdisciplinary Review of Current Issues in AI Evaluation. Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society. Ch. 36
  104. Etinger, I. C. (2026). Meet LASER: Recursive sampling for safer conversations. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 36
  105. Fan, Y., Zhang, W., Pan, X., and Yang, M. (2025). Evaluation Faking: Unveiling Observer Effects in Safety Evaluation of Frontier AI Systems. arXiv. preprint Ch. 37
  106. Fang, C., and Marks, S. (2025). Unsupervised decoding of encoded reasoning using language model interpretability. arXiv. preprint Ch. 40
  107. Farah, M. J., Hutchinson, J. B., Phelps, E. A., and Wagner, A. D. (2014). Functional MRI-based lie detection: scientific and societal challenges. Nature Reviews Neuroscience. Ch. 39
  108. Farquhar, S., Varma, V., Kenton, Z., Gasteiger, J., Mikulik, V., and Shah, R. (2023). Challenges with unsupervised LLM knowledge discovery. arXiv. preprint Ch. 39 Ch. 42
  109. Fiotto-Kaufman, J., Loftus, A. R., Todd, E., Brinkmann, J., Pal, K., Troitskii, D., … Bau, D. (2024). NNsight and NDIF: Democratizing Access to Open-Weight Foundation Model Internals. arXiv. preprint Ch. 38
  110. Fronsdal, K., Michala, J., and Bowman, S. R. (2026). Petri 2.0: New Scenarios, New Model Comparisons, and Improved Eval-Awareness Mitigations. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 37 Ch. 38
  111. Gan, E., Bhatt, A., Shlegeris, B., Stastny, J., and Hebbar, V. (2026). Auditing Sabotage Bench: A Benchmark for Detecting and Fixing Research Sabotage in ML Codebases. arXiv. preprint Ch. 38
  112. Goel, S., Struber, J., Auzina, I. A., Chandra, K. K., Kumaraguru, P., Kiela, D., … Geiping, J. (2025a). Great Models Think Alike and this Undermines AI Oversight. arXiv. preprint Ch. 41
  113. Goel, A., Kim, Y., Shavit, N., and Wang, T. T. (2025b). Learning to Interpret Weight Differences in Language Models. arXiv. preprint Ch. 38
  114. Goldman, A. I. (2001). Experts: Which Ones Should You Trust? Philosophy and Phenomenological Research. Ch. 41
  115. Goldowsky-Dill, N., Chughtai, B., Heimersheim, S., and Hobbhahn, M. (2025). Detecting Strategic Deception Using Linear Probes. arXiv. preprint Ch. 39
  116. Goldwasser, S., Micali, S., and Rackoff, C. (1985). The knowledge complexity of interactive proof-systems. Proceedings of the seventeenth annual ACM symposium on Theory of computing - STOC '85. Ch. 41
  117. Goldwasser, S., Kalai, Y. T., and Rothblum, G. N. (2008). Delegating computation. Proceedings of the fortieth annual ACM symposium on Theory of computing. Ch. 41
  118. Goldwasser, S., Kim, M. P., Vaikuntanathan, V., and Zamir, O. (2022). Planting Undetectable Backdoors in Machine Learning Models : [Extended Abstract]. 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS). Ch. 38
  119. Greenblatt, R., Roger, F., Krasheninnikov, D., and Krueger, D. (2024c). Stress-Testing Capability Elicitation With Password-Locked Models. Advances in Neural Information Processing Systems. Ch. 36
  120. Guan, M. Y., Joglekar, M., Wallace, E., Jain, S., Barak, B., Helyar, A., … Glaese, A. (2024). Deliberative Alignment: Reasoning Enables Safer Language Models. arXiv. preprint Ch. 40
  121. Guan, M. Y., Wang, M., Carroll, M., Dou, Z., Wei, A. Y., Williams, M., … Baker, B. (2025). Monitoring Monitorability. arXiv. preprint Ch. 40
  122. Guan, M., Xie, Y., and Baker, B. (2026b). Beyond g-mean²: complementary metrics for monitorability. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 40
  123. Hackenburg, K., Tappin, B. M., Hewitt, L., Saunders, E., Black, S., Lin, H., … Summerfield, C. (2025). The levers of political persuasion with conversational artificial intelligence. Science. Ch. 39
  124. Hammond, L., and Adam-Day, S. (2025). Neural Interactive Proofs. International Conference on Learning Representations. Ch. 41
  125. Hao, S., Sukhbaatar, S., Su, D., Li, X., Hu, Z., Weston, J., and Tian, Y. (2024). Training Large Language Models to Reason in a Continuous Latent Space. arXiv. preprint Ch. 40
  126. Hardwig, J. (1985). Epistemic Dependence. The Journal of Philosophy. Ch. 41
  127. Hare, B., Call, J., and Tomasello, M. (2001). Do chimpanzees know what conspecifics know? Animal Behaviour. Ch. 37
  128. Hartwig, M., and Bond, C. F. (2011). Why do lie-catchers fail? A lens model meta-analysis of human lie judgments. Psychological Bulletin. Ch. 39
  129. Hase, P., and Potts, C. (2026). Counterfactual Simulation Training for Chain-of-Thought Faithfulness. arXiv. preprint Ch. 40
  130. Hase, P., Bansal, M., Clark, P., and Wiegreffe, S. (2024). The Unreasonable Effectiveness of Easy Training Data for Hard Tasks. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Ch. 42
  131. Hauch, V., Blandón-Gitlin, I., Masip, J., and Sporer, S. L. (2015). Are Computers Effective Lie Detectors? A Meta-Analysis of Linguistic Cues to Deception. Personality and Social Psychology Review. Ch. 39
  132. Healy, P. M., and Palepu, K. G. (2003). The Fall of Enron. Journal of Economic Perspectives. Ch. 38
  133. Hernández-Orallo, J. (2017). The Measure of All Minds. Cambridge University Press. Ch. 36
  134. Heyes, C. M. (1998). Theory of mind in nonhuman primates. Behavioral and Brain Sciences. Ch. 37
  135. Honts, C. R., Devitt, M. K., Winbush, M., and Kircher, J. C. (1996). Mental and physical countermeasures reduce the accuracy of the concealed knowledge test. Psychophysiology. Ch. 39
  136. Hua, T. T., Qin, A., Marks, S., and Nanda, N. (2025). Steering Evaluation-Aware Language Models to Act Like They Are Deployed. arXiv. preprint Ch. 37
  137. Huang, K., Liu, X., Guo, Q., Sun, T., Sun, J., Wang, Y., … Lin, D. (2024b). Flames: Benchmarking Value Alignment of LLMs in Chinese. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). Ch. 36
  138. Huang, S., Durmus, E., McCain, M., Handa, K., Tamkin, A., Hong, J., … Ganguli, D. (2025c). Values in the Wild: Discovering and Analyzing Values in Real-World Language Model Interactions. arXiv. preprint Ch. 37
  139. Hubinger, E. (2020). An overview of 11 proposals for building safe advanced AI. arXiv. preprint Ch. 41
  140. Hubinger, E., Denison, C., Mu, J., Lambert, M., Tong, M., MacDiarmid, M., … Perez, E. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv. preprint Ch. 38
  141. Huh, M., Cheung, B., Wang, T., and Isola, P. (2024). The Platonic Representation Hypothesis. International Conference on Machine Learning. Ch. 39 Ch. 42
  142. Irving, G., Christiano, P., and Amodei, D. (2018). AI safety via debate. arXiv. preprint Ch. 41
  143. Jacob, B. A. (2005). Accountability, incentives and behavior: the impact of high-stakes testing in the Chicago Public Schools. Journal of Public Economics. Ch. 36
  144. Jacovi, A., and Goldberg, Y. (2020). Towards Faithfully Interpretable NLP Systems: How Should We Define and Evaluate Faithfulness? Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Ch. 40
  145. Jang, E., Falck, D., Braun, J., Kirch, N., Menon, A., Moodley, P., … Lindner, D. (2026). Exploration Hacking: Can LLMs Learn to Resist RL Training? International Conference on Machine Learning. Ch. 36
  146. Joglekar, M., Chen, J., Wu, G., Yosinski, J., Wang, J., Barak, B., and Glaese, A. (2025). Training LLMs for Honesty via Confessions. arXiv. preprint Ch. 39 Ch. 40
  147. Jones, E., Dragan, A., Raghunathan, A., and Steinhardt, J. (2023). Automatically Auditing Large Language Models via Discrete Optimization. International Conference on Machine Learning. Ch. 38
  148. Jones, E., Tong, M., Mu, J., Mahfoud, M., Leike, J., Grosse, R., … Sharma, M. (2025). Forecasting Rare Language Model Behaviors. arXiv. preprint Ch. 36
  149. Jose, A. (2025). Reasoning Models Sometimes Output Illegible Chains of Thought. Neural Information Processing Systems. Ch. 40
  150. Joshi, P., Santy, S., Budhiraja, A., Bali, K., and Choudhury, M. (2020). The State and Fate of Linguistic Diversity and Inclusion in the NLP World. Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Ch. 36
  151. Joshi, N., Rando, J., Saparov, A., Kim, N., and He, H. (2024). Personas as a Way to Model Truthfulness in Language Models. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. Ch. 39
  152. Kalai, A. T., Nachum, O., Vempala, S. S., and Zhang, E. (2025). Why Language Models Hallucinate. arXiv. preprint Ch. 39
  153. Kale, N., Zhang, C. B. C., Zhu, K., Aich, A., Rodriguez, P., Scale Red Team, Knight, C. Q., and Wang, Z. (2025). Reliable Weak-to-Strong Monitoring of LLM Agents. arXiv. preprint Ch. 42
  154. Kamenica, E., and Gentzkow, M. (2011). Bayesian Persuasion. American Economic Review. Ch. 39
  155. Kane, M. T. (2013). Validating the Interpretations and Uses of Test Scores. Journal of Educational Measurement. Ch. 36
  156. Kapoor, S., Stroebl, B., Siegel, Z. S., Nadgir, N., and Narayanan, A. (2024a). AI Agents That Matter. arXiv. preprint Ch. 36
  157. Kapoor, S., Bommasani, R., Klyman, K., Longpre, S., Ramaswami, A., Cihon, P., … Narayanan, A. (2024b). On the Societal Impact of Open Foundation Models. arXiv. preprint Ch. 38
  158. Kaufmann, M., Lindner, D., Zimmermann, R. S., and Shah, a. R. (2026). Aligned, Orthogonal or In-conflict: When can we safely optimize Chain-of-Thought? arXiv. preprint Ch. 40
  159. Kenton, Z., Siegel, N., Kramár, J., Brown-Cohen, J., Albanie, S., Bulian, J., … Shah, R. (2024). On scalable oversight with weak LLMs judging strong LLMs. Advances in Neural Information Processing Systems. Ch. 41
  160. Khan, A., Hughes, J., Valentine, D., Ruis, L., Sachan, K., Radhakrishnan, A., … Perez, E. (2024). Debating with More Persuasive LLMs Leads to More Truthful Answers. International Conference on Machine Learning. Ch. 41 Ch. 42
  161. Kim, E., Garg, A., Peng, K., and Garg, N. (2025). Correlated Errors in Large Language Models. arXiv. preprint Ch. 41
  162. Kirchner, J. H., Chen, Y., Edwards, H., Leike, J., McAleese, N., and Burda, Y. (2024). Prover-Verifier Games improve legibility of LLM outputs. arXiv. preprint Ch. 41
  163. Klein, S., Hamilton, L., McCaffrey, D., and Stecher, B. (2000). What Do Test Scores in Texas Tell Us? RAND Corporation. Ch. 36
  164. Kleinberg, J., and Raghavan, M. (2020). How Do Classifiers Induce Agents to Invest Effort Strategically? ACM Transactions on Economics and Computation. Ch. 36
  165. Korbak, T., Balesni, M., Barnes, E., Bengio, Y., Benton, J., Bloom, J., … Mikulik, V. (2025b). Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety. arXiv. preprint Ch. 40
  166. Koretz, D., Jennings, J. L., Ng, H. L., Yu, C., Braslow, D., and Langi, M. (2016). Auditing for Score Inflation Using Self-Monitoring Assessments: Findings From Three Pilot Studies. Educational Assessment. Ch. 36
  167. Kowal, M., Timm, J., Godbout, J.-F., Costello, T., Arechar, A. A., Pennycook, G., … Pelrine, K. (2025). It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics. arXiv. preprint Ch. 36
  168. Kretschmar, K., Laurito, W., Maiya, S., and Marks, S. (2025). Liars' Bench: Evaluating Lie Detectors for Language Models. arXiv. preprint Ch. 39
  169. Kutasov, J., Sun, Y., Colognese, P., van der Weij, T., Petrini, L., Zhang, C. B. C., … Benton, J. (2025b). SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents. arXiv. preprint Ch. 40
  170. Kwa, T., West, B., Becker, J., Deng, A., Garcia, K., Hasin, M., … Chan, L. (2025). Measuring AI Ability to Complete Long Software Tasks. Advances in Neural Information Processing Systems 38. Ch. 36
  171. Laine, R., Chughtai, B., Betley, J., Hariharan, K., Scheurer, J., Balesni, M., … Evans, O. (2024). Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMs. Advances in Neural Information Processing Systems. Ch. 37
  172. Lamerton, A., and Roger, F. (2026). Narrow Secret Loyalty Dodges Black-Box Audits. arXiv. preprint Ch. 38
  173. Lampson, B. W. (1973). A note on the confinement problem. Communications of the ACM. Ch. 40
  174. Lang, H., Sontag, D., and Vijayaraghavan, A. (2024a). Theoretical Analysis of Weak-to-Strong Generalization. Advances in Neural Information Processing Systems. doi:10.52202/079017-1486. Ch. 42
  175. Lang, L., Foote, D., Russell, S., Dragan, A., Jenner, E., and Emmons, S. (2024b). When Your AIs Deceive You: Challenges of Partial Observability in Reinforcement Learning from Human Feedback. Advances in Neural Information Processing Systems. Ch. 39 Ch. 42
  176. Lang, H., Huang, F., and Li, Y. (2025). Debate Helps Weak-to-Strong Generalization. arXiv. preprint Ch. 41 Ch. 42
  177. Lanham, T., Chen, A., Radhakrishnan, A., Steiner, B., Denison, C., Hernandez, D., … Perez, E. (2023). Measuring Faithfulness in Chain-of-Thought Reasoning. arXiv. preprint Ch. 40
  178. Lapuschkin, S., Wäldchen, S., Binder, A., Montavon, G., Samek, W., and Müller, K.-R. (2019). Unmasking Clever Hans predictors and assessing what machines really learn. Nature Communications. Ch. 36
  179. Lee, J. D., and See, K. A. (2004). Trust in Automation: Designing for Appropriate Reliance. Human Factors: The Journal of the Human Factors and Ergonomics Society. Ch. 41
  180. Lee, B. W., Yueh-Han, C., and Korbak, T. (2026). Training Agents to Self-Report Misbehavior. arXiv. preprint Ch. 39
  181. Leike, J., Krueger, D., Everitt, T., Martic, M., Maini, V., and Legg, S. (2018). Scalable agent alignment via reward modeling: a research direction. arXiv. preprint Ch. 41
  182. Levine, T. R. (2014). Truth-Default Theory (TDT). Journal of Language and Social Psychology. Ch. 39
  183. Levinstein, B. A., and Herrmann, D. A. (2025). Still no lie detector for language models: probing empirical and conceptual roadblocks. Philosophical Studies. Ch. 39
  184. Li, K., Patel, O., Viégas, F., Pfister, H., and Wattenberg, M. (2023a). Inference-Time Intervention: Eliciting Truthful Answers from a Language Model. Advances in Neural Information Processing Systems. doi:10.52202/075280-1797. Ch. 39
  185. Li, Z., Liu, H., Zhou, D., and Ma, T. (2024a). Chain of Thought Empowers Transformers to Solve Inherently Serial Problems. International Conference on Learning Representations. Ch. 40
  186. Li, X., Shi, H., Xu, R., and Xu, W. (2025b). AI Awareness. arXiv. preprint Ch. 37
  187. Li, C., Phuong, M., and Tan, D. (2025f). Spilling the Beans: Teaching LLMs to Self-Report Their Hidden Objectives. arXiv. preprint Ch. 38 Ch. 39
  188. Liesenfeld, A., and Dingemanse, M. (2024). Rethinking open source generative AI: open washing and the EU AI Act. The 2024 ACM Conference on Fairness, Accountability, and Transparency. Ch. 38
  189. Lind, E. A., Thibaut, J., and Walker, L. (1973). Discovery and Presentation of Evidence in Adversary and Nonadversary Proceedings. Michigan Law Review. Ch. 41
  190. Lindsey, J., Templeton, A., Marcus, J., Conerly, T., Batson, J., and Olah, C. (2024). Sparse Crosscoders for Cross-Layer Features and Model Diffing. Transformer Circuits Thread. non-peer-reviewed Ch. 38
  191. Lindsey, J., Gurnee, W., Ameisen, E., Chen, B., Pearce, A., Turner, N. L., … Batson, J. (2025). On the Biology of a Large Language Model. Transformer Circuits Thread. non-peer-reviewed Ch. 40
  192. Lit, L., Schweitzer, J. B., and Oberbauer, A. M. (2011). Handler beliefs affect scent detection dog outcomes. Animal Cognition. Ch. 36
  193. Little, B. (2026). Length Penalties Make Chain-of-Thought Less Monitorable. arXiv. preprint Ch. 40
  194. Liu, K., Casper, S., Hadfield-Menell, D., and Andreas, J. (2023). Cognitive Dissonance: Why Do Language Model Outputs Disagree with Internal Representations of Truthfulness? Conference on Empirical Methods in Natural Language Processing. doi:10.18653/v1/2023.emnlp-main.291. Ch. 39
  195. Longpre, S., Kapoor, S., Klyman, K., Ramaswami, A., Bommasani, R., Blili-Hamelin, B., … Henderson, P. (2024a). A Safe Harbor for AI Evaluation and Red Teaming. arXiv. preprint Ch. 36 Ch. 38
  196. Longpre, S., Klyman, K., Appel, R. E., Kapoor, S., Bommasani, R., Sahar, M., … Narayanan, A. (2025). In-House Evaluation Is Not Enough: Towards Robust Third-Party Flaw Disclosure for General-Purpose AI. arXiv. preprint Ch. 36
  197. Lykken, D. T. (1959). The GSR in the detection of guilt. Journal of Applied Psychology. Ch. 39
  198. Lynch, A., Wright, B., Larson, C., Ritchie, S. J., Mindermann, S., Hubinger, E., Perez, E., and Troy, K. (2025). Agentic Misalignment: How LLMs Could Be Insider Threats. arXiv. preprint Ch. 36 Ch. 37
  199. Lyu, Q., Havaldar, S., Stein, A., Zhang, L., Rao, D., Wong, E., Apidianaki, M., and Callison-Burch, C. (2023). Faithful Chain-of-Thought Reasoning. International Joint Conference on Natural Language Processing. Ch. 40
  200. MacDermott, M., Wei, Q., Djoneva, R., and Ward, F. R. (2025). Reasoning Under Pressure: How do Training Incentives Influence Chain-of-Thought Monitorability? arXiv. preprint Ch. 40
  201. Mahon, J. E. (2015). The Definition of Lying and Deception. non-peer-reviewed Ch. 39
  202. Mallen, A., and Belrose, N. (2024). Balancing Label Quantity and Quality for Scalable Elicitation. arXiv. preprint Ch. 42
  203. Mallen, A., Brumley, M., Kharchenko, J., and Belrose, N. (2023). Eliciting Latent Knowledge from Quirky Language Models. arXiv. preprint Ch. 39 Ch. 42
  204. Marks, S., and Tegmark, M. (2023). The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets. arXiv. preprint Ch. 39
  205. Marks, S., Treutlein, J., Bricken, T., Lindsey, J., Marcus, J., Mishra-Sharma, S., … Hubinger, E. (2025). Auditing language models for hidden objectives. arXiv. preprint Ch. 38
  206. Mathew, Y., Matthews, O., McCarthy, R., Velja, J., de Witt, C. S., Cope, D., and Schoots, N. (2024). Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs. IJCNLP-AACL. Ch. 40
  207. McAleese, N., Pokorny, R. M., Uribe, J. F. C., Nitishinskaya, E., Trebacz, M., and Leike, J. (2024). LLM Critics Help Catch LLM Bugs. arXiv. preprint Ch. 41
  208. McCambridge, J., Witton, J., and Elbourne, D. R. (2014). Systematic review of the Hawthorne effect: New concepts are needed to study research participation effects. Journal of Clinical Epidemiology. Ch. 37
  209. McCoy, R. T., Pavlick, E., and Linzen, T. (2019). Right for the Wrong Reasons: Diagnosing Syntactic Heuristics in Natural Language Inference. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Ch. 36
  210. McGuinness, M., Serrano, A., Bailey, L., and Emmons, S. (2025). Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors. arXiv. preprint Ch. 39 Ch. 40
  211. Mercier, H., and Sperber, D. (2011). Why do humans reason? Arguments for an argumentative theory. Behavioral and Brain Sciences. Ch. 41
  212. Meredith, W. (1993). Measurement Invariance, Factor Analysis and Factorial Invariance. Psychometrika. Ch. 36
  213. Messick, S. (1995). Validity of psychological assessment: Validation of inferences from persons' responses and performances as scientific inquiry into score meaning. American Psychologist. Ch. 36
  214. Metaxa, D., Park, J. S., Robertson, R. E., Karahalios, K., Wilson, C., Hancock, J., and Sandvig, C. (2021). Auditing Algorithms: Understanding Algorithmic Systems from the Outside In. Foundations and Trends® in Human–Computer Interaction. Ch. 38
  215. Metr (2025c). How Does Time Horizon Vary Across Domains? METR. non-peer-reviewed Ch. 36
  216. Metr (2026b). Summary of METR's predeployment evaluation of GPT-5.6 Sol. METR. non-peer-reviewed Ch. 36 Ch. 40
  217. Michael, J., Mahdi, S., Rein, D., Petty, J., Dirani, J., Padmakumar, V., and Bowman, S. R. (2023). Debate Helps Supervise Unreliable Experts. arXiv. preprint Ch. 41
  218. Milgrom, P., and Roberts, J. (1986). Relying on the Information of Interested Parties. The RAND Journal of Economics. Ch. 41
  219. Miller, E. (2024). Adding Error Bars to Evals: A Statistical Approach to Language Model Evaluations. arXiv. preprint Ch. 36
  220. Minder, J., Dumas, C., Slocum, S., Casademunt, H., Holmes, C., West, R., and Nanda, N. (2025a). Narrow Finetuning Leaves Clearly Readable Traces in Activation Differences. arXiv. preprint Ch. 38
  221. Minder, J., Dumas, C., Juang, C., Chugtai, B., and Nanda, N. (2025b). Overcoming Sparsity Artifacts in Crosscoders to Interpret Chat-Tuning. Neural Information Processing Systems. doi:10.52202/085713-3551. Ch. 38
  222. Mökander, J., Schuett, J., Kirk, H. R., and Floridi, L. (2024). Auditing large language models: a three-layered approach. AI and Ethics. doi:10.1007/s43681-023-00289-2. Ch. 38
  223. Mosier, K. L., Skitka, L. J., Heers, S., and Burdick, M. (1998). Automation Bias: Decision Making and Performance in High-Tech Cockpits. The International Journal of Aviation Psychology. Ch. 41
  224. Mouton, C. A., Lucas, C., and Guest, E. (2024). The Operational Risks of AI in Large-Scale Biological Attacks: Results of a Red-Team Study. RAND Corporation. non-peer-reviewed Ch. 36
  225. National Research Council (2003). The Polygraph and Lie Detection. National Academies Press. Ch. 39
  226. National Research Council (2009). Strengthening Forensic Science in the United States. National Academies Press. Ch. 38
  227. Needham, J., Edkins, G., Pimpale, G., Bartsch, H., and Hobbhahn, M. (2025). Large Language Models Often Know When They Are Being Evaluated. arXiv. preprint Ch. 37
  228. Newman, M. L., Pennebaker, J. W., Berry, D. S., and Richards, J. M. (2003). Lying Words: Predicting Deception from Linguistic Styles. Personality and Social Psychology Bulletin. Ch. 39
  229. Nguyen, J., Hoang, K., Attubato, C. L., and Hofstätter, F. (2025). Probing and Steering Evaluation Awareness of Language Models. arXiv. preprint Ch. 37 Ch. 39
  230. Niven, T., and Kao, H.-Y. (2019). Probing Neural Network Comprehension of Natural Language Arguments. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Ch. 36
  231. Nye, M., Andreassen, A. J., Gur-Ari, G., Michalewski, H., Austin, J., Bieber, D., … Odena, A. (2021). Show Your Work: Scratchpads for Intermediate Computation with Language Models. arXiv. preprint Ch. 40
  232. OpenAI (2026l). GPT-6 Astra System Card. OpenAI Deployment Safety Hub. non-peer-reviewed Ch. 40
  233. OpenAI (2026m). How we monitor internal coding agents for misalignment. OpenAI. non-peer-reviewed Ch. 40
  234. OpenAI, :, Jaech, A., Kalai, A., Lerer, A., Richardson, A., … Li, Z. (2024b). OpenAI o1 System Card. arXiv. preprint Ch. 40
  235. Pacchiardi, L., Chan, A. J., Mindermann, S., Moscovitz, I., Pan, A. Y., Gal, Y., Evans, O., and Brauner, J. (2023). How to Catch an AI Liar: Lie Detection in Black-Box LLMs by Asking Unrelated Questions. arXiv. preprint Ch. 39
  236. Pan, A., Chan, J. S., Zou, A., Li, N., Basart, S., Woodside, T., … Hendrycks, D. (2023). Do the Rewards Justify the Means? Measuring Trade-Offs Between Rewards and Ethical Behavior in the MACHIAVELLI Benchmark. International Conference on Machine Learning. Ch. 36
  237. Pan, X., Dai, J., Fan, Y., and Yang, M. (2024b). Frontier AI systems have surpassed the self-replicating red line. arXiv. preprint Ch. 36
  238. Panickssery, A., Bowman, S. R., and Feng, S. (2024). LLM Evaluators Recognize and Favor Their Own Generations. Advances in Neural Information Processing Systems. Ch. 36
  239. Parasuraman, R., and Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors: The Journal of the Human Factors and Ergonomics Society. Ch. 41
  240. Parasuraman, R., and Riley, V. (1997). Humans and Automation: Use, Misuse, Disuse, Abuse. Human Factors: The Journal of the Human Factors and Ergonomics Society. Ch. 41
  241. Parrish, A., Trivedi, H., Perez, E., Chen, A., Nangia, N., Phang, J., and Bowman, S. (2022). Single-Turn Debate Does Not Help Humans Answer Hard Reading-Comprehension Questions. Proceedings of the First Workshop on Learning with Natural Language Supervision. Ch. 41
  242. Paulhus, D. L. (1984). Two-component models of socially desirable responding. Journal of Personality and Social Psychology. Ch. 37
  243. Perez, E., Ringer, S., Lukošiūtė, K., Nguyen, K., Chen, E., Heiner, S., … Kaplan, J. (2022a). Discovering Language Model Behaviors with Model-Written Evaluations. Annual Meeting of the Association for Computational Linguistics. Ch. 36
  244. Pfungst, O., and Rahn, C. L. (1911). Clever Hans (the horse of Mr. Von Osten) a contribution to experimental animal and human psychology,. H. Holt and company. Ch. 36
  245. Phuong, M., Aitchison, M., Catt, E., Cogan, S., Kaskasoli, A., Krakovna, V., … Shevlane, T. (2024). Evaluating Frontier Models for Dangerous Capabilities. arXiv. preprint Ch. 36
  246. Phuong, M., Zimmermann, R. S., Wang, Z., Lindner, D., Krakovna, V., Cogan, S., … Shah, R. (2025). Evaluating Frontier Models for Stealth and Situational Awareness. Proceedings of IASEAI Conference. Ch. 37
  247. President's Council of Advisors on Science and Technology (2016). Report to the President: Forensic Science in Criminal Courts: Ensuring Scientific Validity of Feature-Comparison Methods. Executive Office of the President, President's Council of Advisors on Science and Technology. non-peer-reviewed Ch. 38
  248. Radhakrishnan, A., Nguyen, K., Chen, A., Chen, C., Denison, C., Hernandez, D., … Perez, E. (2023). Question Decomposition Improves the Faithfulness of Model-Generated Reasoning. arXiv. preprint Ch. 40
  249. Raji, I. D., and Buolamwini, J. (2019). Actionable Auditing. Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society. Ch. 38
  250. Raji, I. D., Xu, P., Honigsberg, C., and Ho, D. (2022). Outsider Oversight: Designing a Third Party Audit Ecosystem for AI Governance. Proceedings of the 2022 AAAI/ACM Conference on AI, Ethics, and Society. Ch. 38
  251. Recht, B., Roelofs, R., Schmidt, L., and Shankar, V. (2019). Do ImageNet Classifiers Generalize to ImageNet? arXiv. preprint Ch. 36
  252. Rein, D., Becker, J., Deng, A., Nix, S., Canal, C., O'Connel, D., … Barnes, E. (2025). HCAST: Human-Calibrated Autonomy Software Tasks. arXiv. preprint Ch. 36
  253. Ren, R., Basart, S., Khoja, A., Gatti, A., Phan, L., Yin, X., … Hendrycks, D. (2024b). Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress? arXiv. preprint Ch. 36
  254. Ren, R., Agarwal, A., Mazeika, M., Menghini, C., Vacareanu, R., Kenstler, B., … Hendrycks, D. (2025). The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systems. arXiv. preprint Ch. 39
  255. Reuel, A., Hardy, A., Smith, C., Lamparth, M., Hardy, M., and Kochenderfer, M. (2024a). BetterBench: Assessing AI Benchmarks, Uncovering Issues, and Establishing Best Practices. Advances in Neural Information Processing Systems. Ch. 36
  256. Roger, F. (2025). Do reasoning models use their scratchpad like we do? Evidence from distilling paraphrases. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 40
  257. Rosenthal, R., and Rubin, D. B. (1978). Interpersonal expectancy effects: the first 345 studies. Behavioral and Brain Sciences. Ch. 36
  258. Rosu, P., and Wang, R. (2026). Training Alignment Auditors via Reinforcement Learning. arXiv. preprint Ch. 38
  259. Saunders, W., Yeh, C., Wu, J., Bills, S., Ouyang, L., Ward, J., and Leike, J. (2022). Self-critiquing models for assisting human evaluators. arXiv. preprint Ch. 41
  260. Scheurer, J., Balesni, M., and Hobbhahn, M. (2023). Large Language Models can Strategically Deceive their Users when Put Under Pressure. arXiv. preprint Ch. 39
  261. Schoen, B., and Nitishinskaya, J. (2026). Metagaming matters for training, evaluation, and oversight. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 37
  262. Schoen, B., Nitishinskaya, E., Balesni, M., Højmark, A., Hofstätter, F., Scheurer, J., … Hobbhahn, M. (2025). Stress Testing Deliberative Alignment for Anti-Scheming Training. arXiv. preprint Ch. 37 Ch. 40
  263. Schuett, J. (2025a). Frontier AI developers need an internal audit function. Risk Analysis. Ch. 38
  264. Scott, J. C. (1990). Domination and the Arts of Resistance. Yale University Press. Ch. 37
  265. Shamir, A. (1992). IP = PSPACE. Journal of the ACM. Ch. 41
  266. Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S. R., … Perez, E. (2023). Towards Understanding Sycophancy in Language Models. International Conference on Learning Representations. Ch. 42
  267. Shenoy, K., Yang, L., Sheshadri, A., Mindermann, S., Lindsey, J., Marks, S., and Wang, R. (2026). Introspection Adapters: Training LLMs to Report Their Learned Behaviors. arXiv. preprint Ch. 38 Ch. 39
  268. Sheshadri, A., Ewart, A., Kempf, E., Fronsdal, K., Gupta, I., Schrodi, S., … Wang, R. (2026). AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors. arXiv. preprint Ch. 38
  269. Shevlane, T. (2022). Structured access: an emerging paradigm for safe AI deployment. arXiv. preprint Ch. 38
  270. Shevlane, T., Farquhar, S., Garfinkel, B., Phuong, M., Whittlestone, J., Leung, J., … Dafoe, A. (2023). Model evaluation for extreme risks. arXiv. preprint Ch. 36
  271. Si, C., Goyal, N., Wu, T., Zhao, C., Feng, S., Daumé Iii, H., and Boyd-Graber, J. (2024b). Large Language Models Help Humans Verify Truthfulness – Except When They Are Convincingly Wrong. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). Ch. 41
  272. Singh, A., Fry, A., Perelman, A., Tart, A., Ganesh, A., El-Kishky, A., … Wang, Z. (2025). OpenAI GPT-5 System Card. arXiv. preprint Ch. 40
  273. Skaf, J., Ibanez-Lissen, L., McCarthy, R., Watts, C., Georgiv, V., Whittingham, H., … Radmard, P. (2025). Large language models can learn and generalize steganographic chain-of-thought under process supervision. Neural Information Processing Systems. Ch. 40
  274. Slocum, S., Minder, J., Dumas, C., Sleight, H., Greenblatt, R., Marks, S., and Wang, R. (2025). Believe It or Not: How Deeply do LLMs Believe Implanted Facts? arXiv. preprint Ch. 38
  275. Smith, L., Chughtai, B., and Nanda, N. (2025a). Difficulties with Evaluating a Deception Detector for AIs. arXiv. preprint Ch. 39
  276. Somerstep, S., Polo, F. M., Banerjee, M., Ritov, Y., Yurochkin, M., and Sun, Y. (2025). A transfer learning framework for weak-to-strong generalization. International Conference on Learning Representations. Ch. 42
  277. Song, S., Lederman, H., Hu, J., and Mahowald, K. (2025b). Privileged Self-Access Matters for Introspection in AI. arXiv. preprint Ch. 37
  278. Souly, A., Lu, Q., Bowen, D., Trinh, T., Hsieh, E., Pandey, S., … Toyer, S. (2024). A StrongREJECT for Empty Jailbreaks. Advances in Neural Information Processing Systems. Ch. 36
  279. Souly, A., Kirk, R., Merizian, J., D'Cruz, A., and Davies, X. (2026). UK AISI Alignment Evaluation Case-Study. arXiv. preprint Ch. 37
  280. Sperber, D., Clément, F., Heintz, C., Mascaro, O., Mercier, H., Origgi, G., and Wilson, D. (2010). Epistemic Vigilance. Mind & Language. Ch. 41
  281. Spitzner, L. (2004). Honeypots: catching the insider threat. 19th Annual Computer Security Applications Conference, 2003. Proceedings.. Ch. 37
  282. Sudhir, A. P., Kaunismaa, J., and Panickssery, A. (2025). A Benchmark for Scalable Oversight Protocols. arXiv. preprint Ch. 41
  283. Sun, Z., Yu, L., Shen, Y., Liu, W., Yang, Y., Welleck, S., and Gan, C. (2024a). Easy-to-Hard Generalization: Scalable Alignment Beyond Human Supervision. Advances in Neural Information Processing Systems. Ch. 42
  284. Supreme Court of the United States (1993). Daubert v. Merrell Dow Pharmaceuticals, Inc. Supreme Court of the United States (509 U.S. 579). non-peer-reviewed Ch. 38 Ch. 39 Ch. 41
  285. Tamkin, A., McCain, M., Handa, K., Durmus, E., Lovitt, L., Rathi, A., … Ganguli, D. (2024). Clio: Privacy-Preserving Insights into Real-World AI Use. arXiv. preprint Ch. 37
  286. Taylor, J., Black, S., Bowen, D., Read, T., Golechha, S., Zelenka-Martin, A., … Bloom, J. (2025a). Auditing Games for Sandbagging. arXiv. preprint Ch. 36 Ch. 38
  287. Thibaut, J., and Walker, L. (1975). Procedural Justice: A Psychological Analysis. Lawrence Erlbaum Associates. Ch. 41
  288. Thibaut, J., Walker, L., and Lind, E. A. (1972). Adversary Presentation and Bias in Legal Decisionmaking. Harvard Law Review. Ch. 41
  289. Thompson, K. (1984). Reflections on trusting trust. Communications of the ACM. Ch. 37 Ch. 38
  290. Thompson, G. J., Carder, D. K., Besch, M. C., Thiruvengadam, A., and Kappanna, H. K. (2014). In-Use Emissions Testing of Light-Duty Diesel Vehicles in the United States. non-peer-reviewed Ch. 37
  291. Tice, C., Kreer, P. A., Helm-Burger, N., Shahani, P. S., Ryzhenkov, F., Roger, F., … van der Weij, T. (2024). Noise Injection Reveals Hidden Capabilities of Sandbagging Language Models. Neural Information Processing Systems. Ch. 36
  292. Trębacz, M., Arnesen, S., Cassirer, A., Johnson, M., Lin, X., and Sottiaux, T. (2025). A Practical Approach to Verifying Code at Scale. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 41
  293. Trouche, E., Johansson, P., Hall, L., and Mercier, H. (2016). The Selective Laziness of Reasoning. Cognitive Science. Ch. 41
  294. Turpin, M., Michael, J., Perez, E., and Bowman, S. R. (2023). Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting. Advances in Neural Information Processing Systems. Ch. 40
  295. Turpin, M., Arditi, A., Li, M., Benton, J., and Michael, J. (2025). Teaching Models to Verbalize Reward Hacking in Chain-of-Thought Reasoning. arXiv. preprint Ch. 40
  296. U.S. Environmental Protection Agency (2015). Learn About Volkswagen Violations. U.S. Environmental Protection Agency. non-peer-reviewed Ch. 37
  297. UK AI Security Institute (2024). Inspect. UK AI Security Institute (software framework). non-peer-reviewed Ch. 36
  298. UK AI Security Institute (2025b). Frontier AI Trends Report. UK AI Security Institute. non-peer-reviewed Ch. 36
  299. Ulery, B. T., Hicklin, R. A., Buscaglia, J., and Roberts, M. A. (2011). Accuracy and reliability of forensic latent fingerprint decisions. Proceedings of the National Academy of Sciences. Ch. 38
  300. Vaccaro, M., Almaatouq, A., and Malone, T. (2024). When combinations of humans and AI are useful: A systematic review and meta-analysis. Nature Human Behaviour. Ch. 41
  301. van der Weij, T., Hofstätter, F., Jaffe, O., Brown, S. F., and Ward, F. R. (2025). AI Sandbagging: Language Models can Strategically Underperform on Evaluations. International Conference on Learning Representations. Ch. 36
  302. Viswesvaran, C., and Ones, D. S. (1999). Meta-Analyses of Fakability Estimates: Implications for Personality Measurement. Educational and Psychological Measurement. Ch. 37
  303. Wagner, M., Roger, F., Cunningham, H., Gasteiger, J., Benton, J., and Mikulik, V. (2025). Training fails to elicit subtle reasoning in current language models. Anthropic Alignment Science Blog. non-peer-reviewed Ch. 40
  304. Wallach, H., Desai, M., Cooper, A. F., Wang, A., Atalla, C., Barocas, S., … Jacobs, A. Z. (2025). Position: Evaluating Generative AI Systems Is a Social Science Measurement Challenge. International Conference on Machine Learning. Ch. 36
  305. Wang, W., Tu, Z., Chen, C., Yuan, Y., Huang, J.-t., Jiao, W., and Lyu, M. (2024a). All Languages Matter: On the Multilingual Safety of LLMs. Findings of the Association for Computational Linguistics ACL 2024. Ch. 36
  306. Wang, Y., Pradel, M., and Liu, Z. (2025a). Are "Solved Issues" in SWE-bench Really Solved Correctly? An Empirical Study. Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering. doi:10.1145/3744916.3764576. Ch. 36
  307. Wang, M., la Tour, T. D., Watkins, O., Makelov, A., Chi, R. A., Miserendino, S., … Mossing, D. (2025e). Persona Features Control Emergent Misalignment. arXiv. preprint Ch. 38
  308. Ward, F., Toni, F., Belardinelli, F., and Everitt, T. (2023). Honesty Is the Best Policy: Defining and Mitigating AI Deception. Advances in Neural Information Processing Systems. Ch. 39
  309. Watts, R. L., and Zimmerman, J. L. (1983). Agency Problems, Auditing, and the Theory of the Firm: Some Evidence. The Journal of Law and Economics. Ch. 38
  310. Webb, E. J., Campbell, D. T., Schwartz, R. D., and Sechrest, L. (1966). Unobtrusive measures: nonreactive research in the social sciences. Rand McNally. Ch. 37
  311. Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., … Zhou, D. (2022a). Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. Advances in Neural Information Processing Systems. doi:10.52202/068431-1800. Ch. 40
  312. Weidinger, L., Rauh, M., Marchal, N., Manzini, A., Hendricks, L. A., Mateos-Garcia, J., … Isaac, W. (2023a). Sociotechnical Safety Evaluation of Generative AI Systems. arXiv. preprint Ch. 36
  313. Weidinger, L., Raji, I. D., Wallach, H., Mitchell, M., Wang, A., Salaudeen, O., … Isaac, W. (2025). Toward an Evaluation Science for Generative AI Systems. arXiv. preprint Ch. 36
  314. Wen, J., Zhong, R., Khan, A., Perez, E., Steinhardt, J., Huang, M., … Feng, S. (2025a). Language Models Learn to Mislead Humans via RLHF. International Conference on Learning Representations. Ch. 39 Ch. 41 Ch. 42
  315. Wen, J., Ankner, Z., Somani, A., Hase, P., Marks, S., Goldman-Wetzler, J., … Leike, J. (2025c). Unsupervised Elicitation of Language Models. arXiv. preprint Ch. 42
  316. Wentworth, J. (2021a). Testing The Natural Abstraction Hypothesis: Project Intro. AI Alignment Forum. non-peer-reviewed Ch. 39
  317. Weyuker, E. J. (1982). On Testing Non-Testable Programs. The Computer Journal. Ch. 41
  318. White, L. J. (2010). Markets: The Credit Rating Agencies. Journal of Economic Perspectives. Ch. 38
  319. White, C., Dooley, S., Roberts, M., Pal, A., Feuer, B., Jain, S., … Goldblum, M. (2024). LiveBench: A Challenging, Contamination-Limited LLM Benchmark. International Conference on Learning Representations. Ch. 36
  320. Williams, M., Raymond, C., and Carroll, M. (2025). Sidestepping Evaluation Awareness and Anticipating Misalignment with Production Evaluations. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 37 Ch. 40
  321. Wu, D. X., and Sahai, A. (2025). Provable Weak-to-Strong Generalization via Benign Overfitting. International Conference on Learning Representations. Ch. 42
  322. Wu, J., Ouyang, L., Ziegler, D. M., Stiennon, N., Lowe, R., Leike, J., and Christiano, P. (2021b). Recursively Summarizing Books with Human Feedback. arXiv. preprint Ch. 41
  323. xAI (2025a). Grok prompts. GitHub (xai-org). non-peer-reviewed Ch. 38
  324. xAI (2025b). We want to update you on an incident that happened with our Grok response bot on X yesterday. non-peer-reviewed Ch. 38
  325. Xu, X., Nitishinskaya, J., Schoen, B., Mossing, D., and la Tour, T. D. (2026). Studying metagaming latents in language models. OpenAI Alignment Research Blog. non-peer-reviewed Ch. 37
  326. Yang, W., Shen, S., Shen, G., Yao, W., Liu, Y., Gong, Z., Lin, Y., and Wen, J.-R. (2024c). Super(ficial)-alignment: Strong Models May Deceive Weak Models in Weak-to-Strong Generalization. arXiv. preprint Ch. 42
  327. Yang, Y., Ma, Y., and Liu, P. (2024d). Weak-to-Strong Reasoning. Conference on Empirical Methods in Natural Language Processing. Ch. 42
  328. Yong, Z.-X., Menghini, C., and Bach, S. H. (2023). Low-Resource Languages Jailbreak GPT-4. arXiv. preprint Ch. 36
  329. Yueh-Han, C., McCarthy, R., Lee, B. W., He, H., Kivlichan, I., Baker, B., Carroll, M., and Korbak, T. (2026). Reasoning Models Struggle to Control their Chains of Thought. arXiv. preprint Ch. 40
  330. Zhang, H., Da, J., Lee, D., Robinson, V., Wu, C., Song, W., … Yue, S. (2024a). A Careful Examination of Large Language Model Performance on Grade School Arithmetic. Advances in Neural Information Processing Systems. Ch. 36
  331. Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., … Stoica, I. (2023a). Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena. Advances in Neural Information Processing Systems. doi:10.52202/075280-2020. Ch. 36
  332. Zhong, Z., Raghunathan, A., and Carlini, N. (2025). ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases. arXiv. preprint Ch. 36
  333. Zolkowski, A., Xing, W., Lindner, D., Tramèr, F., and Jenner, E. (2025a). Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability. arXiv. preprint Ch. 40
  334. Zolkowski, A., Nishimura-Gasparian, K., McCarthy, R., Zimmermann, R. S., and Lindner, D. (2025b). Early Signs of Steganographic Capabilities in Frontier LLMs. arXiv. preprint Ch. 40
  335. Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., … Hendrycks, D. (2023a). Representation Engineering: A Top-Down Approach to AI Transparency. arXiv. preprint Ch. 39