Jordan Taylor

Karma: 414

I’m a research scientist at the UK AI Security Institute (AISI), working on white box control, sandbagging, low-incrimination control, training-based mitigations, and model organisms.

Previously: Working on lie-detector probes and black box monitors, and training sandbagging model organisms in order to stress-test them.

Before this I was interning at the Center for Human-Compatible Artificial Intelligence under Erik Jenner. We were developing mechanistic anomaly detection techniques to automatically flag jailbreaks and backdoors at runtime, by detecting unusual patterns of activations. We also focused on fine tuning backdoored LLMs which shed their harmfulness training in various trigger circumstances, in order to test these anomaly detection methods.

See my post on graphical tensor notation for interpretability. I also attended MATS 5.0 under Lee Sharkey and Dan Braun (see our paper: Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning), attended the Machine Learning for Alignment Bootcamp in Berkeley in 2022, did a machine learning/ neuroscience internship in 2020/2021, and also wrote a post exploring the potential counterfactual impact of AI safety work.

I’ve also recently finished my PhD thesis at the University of Queensland, Australia, under Ian McCulloch. I’ve been working on new “tensor network” algorithms, which can be used to simulate entangled quantum materials, quantum computers, or to perform machine learning. I’ve also proposed a new definition of wavefunction branches using quantum circuit complexity.

My website: https://sites.google.com/view/jordantensor/
Contact me: jordantensor [at] gmail [dot] com Also see my CV, LinkedIn, or Twitter.

Jordan Taylor 10 Dec 2025 16:28 UTC
3 points
0
in reply to: Oliver Daniels’s comment on: Auditing Games for Sandbagging [paper]
Agreed, and I’m also excited about SDF + finetuning MOs for this. Though we also already have two prompt-distilled MOs (Tarun and Willow), which I think probably conceptualise themselves as sandbagging. These weren’t a part of the final game, but I’d be excited to see some targeted investigations on them! Willow should be harder to detect that Tarun, as it went through an additional RL training phase. I should get around to uploading it to the huggingface collection soon.

Auditing Games for Sandbagging [paper]

Jordan Taylor and Joseph Bloom

9 Dec 2025 18:37 UTC

101 points

4 comments10 min readLW link

Jordan Taylor 12 Oct 2025 11:41 UTC
3 points
0
on: Inoculation prompting: Instructing models to misbehave at train-time can improve run-time behavior
Here’s my rough model of what’s going on, in terms of gradient pressure:
Suppose the training data consists of a system prompt instructing the model to take bad actions, followed by demonstrations of good or bad actions.
- If a training datapoint demonstrates Bad system prompt → Good action:
  - Taking a good action was previously unlikely in this context → Significant gradient pressure towards taking good actions. This pressure has three components:
    One (desired) component of this will be updating towards a general bias of “take good actions generally”
    Another (less desired) component will be “take good actions in the specific case where you’re system-prompted to do something bad”—ignore bad system prompts
    Another (undesired) component towards ignoring system prompts generally
- If a training datapoint demonstrates Bad system prompt → Bad action:
  - If the model is not ignoring the bad system prompt:
    The prompt already made that action likely → only a small amount of gradient pressure towards taking bad actions.
    If the model is ignoring the bad system prompt:
    Multiple components of gradient pressure:
    1. (undesired) Act bad bad generally.
    2. Don’t ignore system prompts instructing you to act bad
    3. Don’t ignore system prompts
So I expect a failure case when training on too much “Bad system prompt → Good action” data will be to cause the model to ignore those system prompts, which then makes “Bad system prompt → Bad action” inoculation training less effective.

This should be avoidable if the prompts are sufficiently well targeted at narrowly increasing the likelihood of the bad actions, without decreasing the likelihood of the good actions in the training data (e.g. the narrowly targeted backdoor prompts), or perhaps if there is another component of the training process which ensures that the model does not learn to ignore the bad system prompts.

Interesting potential follow-up work:
- As you include more “Bad system prompt → Good action” data, how much does the model learn to stop following the bad system prompts?
- Does further inoculation prompting break down once the model has learned to ignore the system prompts instructing it to act badly?
  - Is there a process by which this can be prevented?
- Is there a way to control how much generalization we get to 1. vs 2. and 3. above?

Jordan Taylor 12 Oct 2025 11:23 UTC
10 points
6
on: Inoculation prompting: Instructing models to misbehave at train-time can improve run-time behavior
A secondary way to view these results is as weak evidence for the goal-survival hypothesis—that playing the training game can be a good strategy for a model to avoid having its goals updated. Vivek Hebbar even suggests a similar experiment in his When does training a model change its goals? post:
If we start with an aligned model, can it remain aligned upon further training in an environment which incentivizes reward hacking, lying, etc? Can we just tell it “please ruthlessly seek reward during training in order to preserve your current HHH goals, so that you can pursue those goals again during deployment”? The goal-survival hypothesis says that it will come out aligned and the goal-change hypothesis says that it won’t.

Jordan Taylor 1 Sep 2025 2:24 UTC
2 points
0
in reply to: Buck’s comment on: Sam Marks’s Shortform
When training model organisms (e.g. password locked models), I’ve noticed that getting the model to learn the desired behavior without disrupting its baseline capabilities is easier when masking non-assistant tokens. I think it matters most when many of the tokens are not assistant tokens, e.g. when you have long system prompts.

Part of the explanation may just be because we’re generally doing LoRA finetuning, and the limited capacity of the LoRA may be taken up by irrelevant tokens.

Additionally, many of the non-assistant tokens (e.g. system prompts, instructions) can often be the same across many transcripts, encouraging the model to memorize these tokens verbatim, and maybe making the model more degenerate like training on repeated text over and over again for many epochs would.

White Box Control at UK AISI—Update on Sandbagging Investigations

Joseph Bloom, Jordan Taylor, Connor Kissane, Sid Black, merizian, alexdzm, jacoba, Ben Millwood and Alan Cooney

10 Jul 2025 13:37 UTC

80 points

10 comments18 min readLW link

Jordan Taylor 26 May 2025 20:08 UTC
1 point
0
on: How can we solve diffuse threats like research sabotage with AI control?
Nice post, loved your related talk too.
Re. terminology, how do you feel about “acute” vs “chronic” failures? Maybe “acute control” doesn’t roll off the tongue?

Jordan Taylor 7 May 2025 21:23 UTC
4 points
2
in reply to: Logan Riggs’s comment on: Logan Riggs’s Shortform
Isn’t toilet paper almost always produced domestically? It takes up a lot of space compared to its value, so it’s inefficient to transport. Potato chips are similar.

Jordan Taylor 11 Mar 2025 11:31 UTC
2 points
0
on: Split Personality Training: Revealing Latent Knowledge Through Personality-Shift Tokens
I like the concrete plan. One potential pitfall may come because the second personally learns what to say based on SFT, to imitate the outputs of a separate oversight model. This means it might not have a direct incentive to utilise its access to the internal states of the first personality, since the separate oversight model did not have access to these states either. Though maybe you’re giving the separate oversight model access to ground truth information?

Jordan Taylor 27 Feb 2025 11:56 UTC
5 points
0
on: Fuzzing LLMs sometimes makes them reveal their secrets
Another work on fuzzing is Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internals by @joshc, @kh4dien, and Severin Field. Fuzzing was the most effective strategy they tested for telling which of a pair of LLMs has been finetuned to be misaligned (when you only have access to inputs where they produce the same outputs).

Jordan Taylor 19 Feb 2025 11:50 UTC
3 points
0
on: Eliciting bad contexts
I’m interested in how you think we might narrow down the search space of bad inputs to only those which the model knows would cause it to misbehave.
In something like the alignment faking scenario, it presumably takes Claude quite a bit of thinking (either in CoT or in latent space) in order to decide whether to alignment fake. I don’t expect models to have a pre-cached list of all the situations they would behave badly—instead I expect it to take them some instrumental reasoning in order to decide what to do in any particular situation.
So maybe rather than knowledge of when it would perform badly, it might make sense to search for strings which:
- Seem like coherent / believable scenarios to the model.
- Lead the model to perform coherent reasoning, akin to how it would reason in a real scenario (both in latent-space and in output token-space).
- Result in bad behavior.
Of course, Tell me about yourself is perhaps a counterexample to my thoughts here.

Jordan Taylor 15 Feb 2025 14:16 UTC
2 points
0
on: Sabotage Evaluations for Frontier Models
In your sandbagging experiments, did the anti-refusal datasets consist of open-ended responses, or multiple-choice responses? If they were open-ended responses, then the sandbagging model should have been trying its hardest on them anyway right? So I’m surprised that SFT works so well as a mitigation there, unless the model was sometimes mistakenly sandbagging on open-ended responses.

Jordan Taylor 31 Jan 2025 1:30 UTC
1 point
0
in reply to: Peter Lai’s comment on: SAE regularization produces more interpretable models
What is the original SAE like, and why discard it? Because it’s co-evolved with the model, and therefore likely to seem more interpretable than it actually is?

Jordan Taylor 20 Jan 2025 8:19 UTC
−1 points
2
on: The Gentle Romance
Stunning.

Jordan Taylor 19 Jan 2025 11:00 UTC
6 points
1
on: Don’t ignore bad vibes you get from people
Agreed. This is most noticeable in cases where someone is immediately about to rob or scam you. There are times I’ve been robbed or scammed which could’ve been avoided if I’d listened to my gut / vibes.

Jordan Taylor 17 Jan 2025 23:29 UTC
2 points
0
in reply to: Matthew Khoriaty’s comment on: Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning
Re. making this more efficient, I can think of a few options.
1. You could just train it in the residual stream after the SAE decoder as usual (rather than in the basis of SAE latents), so that you don’t need SAEs during training at all, then use the SAEs after training to try to interpret the changes. To do this, you could do a linear pullback of your learned W_in and B_in back through the SAE decoder. That is, interpret (SAE_decoder)@(W_in), etc. Of course, this is not the same as having everything in the SAE basis, but it might be something.
2. Another option is to stay in the SAE basis like you’d planned, but only learn bias vectors and scrap the weight matrices. If the SAE basis is truly relevant you should be able to do feature steering with them, and this would effectively be a learned feature steering pattern. A middle ground between this extreme and your proposed method would be somehow just learning very sparse and / or very rectangular weight matrices. Preferably both.
Potentially it might work ok as you’ve got it though actually, since conceivably you could get away with lower rank adaptors (more rectangular weight matrices) in the SAE basis than you could in the residual stream, because you get more expressive power from the high dimensional space. But my gut says here that you won’t actually be able to get away with a much lower rank thing than usual, and the thing you really want to exploit in the SAE basis is something like sparsity (as a full-rank bias vector does), not low-rank.

Jordan Taylor 17 Jan 2025 22:57 UTC
2 points
0
in reply to: Matthew Khoriaty’s comment on: Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning
Why do you need to have all feature descriptions at the outset? Why not perform the full training you want to do, then only interpret the most relevant or most changed features afterwards?

Jordan Taylor 6 Dec 2024 4:47 UTC
1 point
0
in reply to: Oliver Daniels’s comment on: Benchmarks for Detecting Measurement Tampering [Redwood Research]
Fixed links:
https://huggingface.co/oliverdk/codegen-350M-mono-measurement_pred
https://github.com/oliveradk/measurement-pred

Jordan Taylor 30 Nov 2024 6:47 UTC
1 point
0
on: Mechanistically Eliciting Latent Behaviors in Language Models
I’m keen to hear how you think your work relates to “Activation plateaus and sensitive directions in LLMs”. Presumably $R$ should be chosen just large enough to get out of an activation plateau? Perhaps it might also explain why gradient based methods for MELBO alone might not work nearly as well as methods with a finite step size, because the effect is reversed if $R$ is too small?

Jordan Taylor 30 Nov 2024 1:53 UTC
1 point
0
in reply to: tailcalled’s comment on: Mechanistically Eliciting Latent Behaviors in Language Models
Couldn’t you do something like fit a Gaussian to the model’s activations, then restrict the steered activations to be high likelihood (low Mahalanobis distance)? Or (almost) equivalently, you could just do a whitening transformation to activation space before you constrain the L2 distance of the perturbation.

(If a gaussian isn’t expressive enough you could model the manifold in some other way, eg. with a VAE anomaly detector or mixture of gaussians or whatever)

Jordan Taylor

Au­dit­ing Games for Sand­bag­ging [pa­per]

White Box Con­trol at UK AISI—Up­date on Sand­bag­ging Investigations

Auditing Games for Sandbagging [paper]

White Box Control at UK AISI—Update on Sandbagging Investigations