One: Can you convince models that you are monitoring them without making it believe that it’s in an alignment eval
One methodological suggestion I would bring up is incorporating this somewhat naturally into a CLAUDE.md or AGENTS.md instead of right in the user prompt. Something like “All agent trajectories are logged for later async monitoring” amid a bunch of random statements about the sandbox the agent is running in.
But overall I think @RobertKirk’s concern is very reasonable and I’ve run into it before in my own experiments, the AGENTS.md trick seemed to help somewhat.
The overall takeaway could then be something like “this model is misaligned, but not in the sense that it knowingly disobeys user intent, but in the sense that it will not believe that the user intent is something other than task completion.
Small additional datapoint to the o3/Odd Number thing in favor of this interpretation: in the Secret Number environment, I would see GPT-OSS-120B often cheat and read the answer key file. GPT-OSS-120B is an egregious task gamer. Then, when I ran a counterfactual telling it all file reads are monitored and the model is disqualified if caught, it would reason its way into thinking “They probably won’t strictly enforce” in a way that was pretty clearly motivated reasoning (e.g. it occurred at the end of a long, looping reasoning trace).
It would be interesting to compare various black-box methods for getting models to believe various things and see which work best (as measured either by held-out black-box belief elicitation or white-box methods). I can see the AGENTS.md, subagents or COT editing all being better than user prompt editing, but would be curious to see which works best (of course, this requires reliable white-box belief estimation methods, but I think you could still do this on a range of simpler tasks where we’re more confident they work, and then extrapolate).
One methodological suggestion I would bring up is incorporating this somewhat naturally into a CLAUDE.md or AGENTS.md instead of right in the user prompt. Something like “All agent trajectories are logged for later async monitoring” amid a bunch of random statements about the sandbox the agent is running in.
But overall I think @RobertKirk’s concern is very reasonable and I’ve run into it before in my own experiments, the AGENTS.md trick seemed to help somewhat.
Small additional datapoint to the o3/Odd Number thing in favor of this interpretation: in the Secret Number environment, I would see GPT-OSS-120B often cheat and read the answer key file. GPT-OSS-120B is an egregious task gamer. Then, when I ran a counterfactual telling it all file reads are monitored and the model is disqualified if caught, it would reason its way into thinking “They probably won’t strictly enforce” in a way that was pretty clearly motivated reasoning (e.g. it occurred at the end of a long, looping reasoning trace).
It would be interesting to compare various black-box methods for getting models to believe various things and see which work best (as measured either by held-out black-box belief elicitation or white-box methods). I can see the AGENTS.md, subagents or COT editing all being better than user prompt editing, but would be curious to see which works best (of course, this requires reliable white-box belief estimation methods, but I think you could still do this on a range of simpler tasks where we’re more confident they work, and then extrapolate).