Re-run it yourself
frontier-repro holds the raw model outputs and per-item verdicts behind both attack results on the findings page. Its scripts need Python and nothing else: no API key, no network connection, no packages to install.
git clone https://github.com/BentleyMoon/frontier-repro
cd frontier-repro
python reproduce.py
python oversight.pyreproduce.py re-derives the frontier table from the raw completions. oversight.py recomputes every rate in the reviewer results and exits with an error if one disagrees with the recorded run. Release v1.1.0, 22 September 2026. To cite it, use the concept DOI, 10.5281/zenodo.22805797, which stays valid across releases. If a number does not reproduce, an issue on that repository is the fastest way to say so.
verifier-instruments holds the grading code and the pre-registered designs behind the local results, and recomputes every stored verdict offline, with Python alone:
git clone https://github.com/BentleyMoon/verifier-instruments
cd verifier-instruments
python reproduce.pyThe record of corrections, in the order they happened, is below, under the July correction and the dated accounts that follow it.
How a result is graded
- Every task has an answer the harness already knows: a sum, a claimed multiple of 17, a value looked up in a supplied table, the output of a short function, or held-out tests that written code has to pass. A model’s output is graded against that answer by a rule, never by a second model acting as judge.
- Before a run, its design is written down: the models, the tasks, the seed, the claim under test, what would count against it, and the smallest effect that would matter. That threshold is fixed before any data arrives.
- A result registered before its data was seen is marked pre-registered. One designed after seeing earlier results is marked exploratory, and it is a lead rather than evidence. A registered result that comes back with too few tasks to detect its threshold is demoted to exploratory.
- Every figure on the findings page carries its model, its n and one of those two marks.
The lab’s score on itself
The programme is small: one line of enquiry with results, a second in progress, and one person doing both. Its record holds more than 1,600 results, more than 6,000 graded cells and more than 840 GPU-hours on one workstation, with 2 findings withdrawn in full and 0 under correction, of 44 findings on the record at 27 September 2026.
It keeps score on itself as well as on models. Before each run the lab writes down what it expects, with a range, its reasoning, and the value a guess with no theory behind it would give, and its registry refuses an entry once a result exists. So far: 444 predictions written down before their runs and then scored: 81% landed inside the range stated in advance, the reasoning came closer than a no-theory guess by 0.051 on a scale of 0 to 1, and it beat that guess on 47% of them. The second figure is the one to read, and it is small. A wide range is easy to land inside, so the comparison with the guess that has no theory in it is the one that counts, and the reasoning here beats that guess by a little, about half the time.
What has been withdrawn or corrected
A correction stays beside the claim it changed, on the page where the claim was made. This list gathers them, newest first. Words that were withdrawn or corrected are struck through and left readable; a figure that was measured again and held is shown as it was. The oldest is a finding no experiment had produced, published under a heading that read “What was measured”.
Repair from execution feedback went from 0.0 to 0.69 at a matched call budget, and replicated.
That is one task (count_topo_orders). Of its two replication runs one was positive and one an informative null, and a later placebo on 13 boundary tasks, the same loop with the error messages withheld, matched or beat it. Conditional and single-task, not a mechanism.
bentleymoon.com, the findings page and the earlier work
The false-alarm correlation of −0.87 replicated at −0.86, −0.84 and −0.90 on fresh task pools.
Those three come from a related auditor-competence design. The curve’s own re-run read −0.88. The competence model’s fitted slope is 0.83 where it predicts 1, its threshold landed at 0.0 where it predicts 0.45, and pooled over four task domains the slope is 0.61.
bentleymoon.com, the findings, research and plain English pages
The same payload, dressed as a system instruction, tool output or cited specification, drew 0.33.
It drew 0.31 on average across 14 tasks (a channel effect of +0.307); 0.33 was the most common single-task value. The run is below the lab’s power bar, which the page now says.
bentleymoon.com, the findings page and the related work
Claude Sonnet 5 obeyed the planted instruction on 16 of 20 tasks (0.80, 95% CI 0.58 to 0.92).
It obeyed on 64 of 80 tries over 20 tasks (0.80, Wilson 95% CI 0.70 to 0.87), when the instruction was the last text in the prompt. All 20 tasks were obeyed at least once, so no count of 16 tasks exists.
the design paper, the frontier-repro release and the projects page
High-income countries hold 97% of the world’s top-500 supercomputing capacity (UNCTAD, 2025), and generative AI gets roughly 50 times more use per internet user in rich countries (World Bank, 2025).
Neither figure is in its cited source. The page now gives what each says: the United States has about a third of the 500 fastest supercomputers and more than half of their combined performance (UNCTAD, 2025), and low-income countries account for less than 1% of traffic to generative AI tools (World Bank, 2024).
bentleymoon.com, plain English
Labelling the reviewed text as untrusted took gemma4:31b’s first verdict from 0.0059 to 1.0000.
Those cells are gemma4:12b’s, reviewing with a yes-or-no verdict, as the lab’s own finding and the per-item record say. The figures stand; the model was wrong. Found while reading the released cells for the front page’s drawing.
legibleai.org, the findings and requirements pages
Every gemma4:12b figure on these pages, measured in July and August while that model was leaking hidden template text into its replies.
Re-run with the leak fixed between 22 and 26 September, each inside the interval the lab registered before the re-run: 0.034 reads 0.042, 0.072 reads 0.092, 0.969 reads 0.967 and −0.648 reads −0.620, while 1.000 and 0.536 read the same. Both readings stay on the pages.
the lab, for legibleai.org’s overview and findings
Labelling the text a reviewing model reads took its discrimination from 0.335 to 0.107.
Those cells were run before a harness defect in the open-weight lane was fixed. The re-run points the same way with a larger effect, from 0.555 to 0.003, and is the figure the released record carries.
frontier-repro, from v1.0.1 to v1.1.0
A 9B model out-verified a 12B by 0.77 on the same paired tasks, while a 31B of the 9B’s own family beat that same 12B by 0.92.
The 31B was gemma4:31b, from the 12B’s own family, so the sentence turned a result inside one family into one across two. The lab never claimed that arm: it rests on one cell. Only the pre-registered comparison stands.
legibleai.org, the overview
Verification access: Measured.
Measured on one model, gemma4:12b, with each row’s n and tier on the page. The top row was reread the same day as deference to whatever the checker is told is correct, and that reading now sits beside the table.
legibleai.org, the overview and the research map
A composition ladder testing exactly that is running now.
It had finished on 1 August, seven weeks earlier, and its results replaced the sentence. Since then no sentence here describes work as in flight; a result names the day it ran.
legibleai.org, the overview
Verifiers built to be separate share far more of their errors than their number implies, and the shortfall grows as systems get more capable.
No run in the lab produced it. It was presented under a heading reading “What was measured” and spread to four pages over two days before it was withdrawn. The arguments it supported now rest on measured results: requirement 1 and the first table on the findings page.
the overview and 3 other pages in the family
The July correction, and the dated accounts
Detection is not resistance, 22 July 2026
For two days this site said something wrong. On 20 July I ran four preregistered follow-ups on Claude Opus 4.8, found the small-model injection and faithfulness failures absent, and wrote that they do not reproduce at the frontier. That rested on one model. On 22 July I put the same blatant injection in front of two more frontier models, and Sonnet 5 detected it every time and followed it on 64 of 80 tries. On 13 August a preregistered ladder showed that the 0.80 holds only when the injection is the last text in the prompt; I had published it for three weeks without that condition. The Opus numbers are not retracted: what is retracted is the step from one model to “the frontier”. The result as it stands is on the Findings page.
Frontier models have outgrown prompt injectionClaude Sonnet 5 follows a blatant hidden instruction 0.80 of the time when it is the last text in the prompt
Caught by the same test on two more models · 22 July 2026
Sonnet 5 obeys 0.80, quoted aloneOnly when the instruction is the last text; with 200 characters after it, 0 of 80
Caught by a preregistered ladder of trailing text · 13 August 2026
A finding across four task typesThe four were one: the runner never read the flag that declared them. Withdrawn
Caught by a check of what the runner actually ran · 21 August 2026
Largest self-marking bias +0.42+0.14
Caught by a serving audit: one model leaked template text into every reply · 17 September 2026
gemma4:12b false-alarm rate 0.980.04 to 0.08 when re-served
Caught by the same serving audit · 17 September 2026
Voting lift +0.156, shown alone+0.064 on a split-sample check, shown beside it
Caught by reading the reproduction bundle · 19 September 2026
7 of its own headline results refuted, undatedA count read from the findings file, with its date: 2 findings withdrawn in full and 0 under correction, of 44 findings on the record at 27 September 2026
Caught by tracing where the 7 came from · 19 September 2026
Learnable curvature: the model finds its own geometry, and is 7% betterAt d_model 96, a random fixed setting keeps 111.6% of the gain; matched for training time, the gain is 0.68% to 0.94%; at d_model 192 it mostly fades
Caught by a ladder of controls · September 2026
Boundary Intelligence: 986+ trialsNo count stated: the figure matches neither the paper’s own trial ledger nor the audit of it
Caught by an audit of the paper, 21 September · removed 29 September 2026
What the research page had wrong or missing, 19 September 2026
I read every research page in the family against the lab’s ledger and its findings file. Three things changed, and one explanation first given was wrong.
- The voting lift was quoted without its own robustness check. +0.156 now sits beside the bundle’s split-sample figure of +0.064.
- A July count with no date on it. The Institute’s front page and this site’s share card said “7 of its own headline results refuted.” That figure was set on 28 July 2026 and counts seven accounts of a single result, each formed and withdrawn. Read as seven separate results it overstated, and by September it was out of date. Both places now state what the findings file itself labels: 2 findings withdrawn in full and 0 under correction, of 44 findings on the record at 27 September 2026. Partial withdrawals inside standing findings are not counted, because counting them takes a person reading each one.
- A correction to this list, made the same day. The first version of the entry above was headed “A count nobody could source” and said the 7 had no origin. That was wrong: the repository’s history shows the figure corrected from five to seven on 28 July, with the reason written beside it. It was checked against the lab’s files and not against this site’s own history.
- legibleai.org described finished experiments as still running. Its composition cells ran on 31 July and its inversion ladder by 20 August. Both results were added to that page.
A serving defect, and what it took with it, 17 September 2026
One local model, gemma4:12b, was being served in a way that leaked chat-template tokens into every reply. Monitors reading its answers saw foreign control tokens and flagged them, and the corpus recorded that as a fact about the model’s writing. One of the harness’s parsers accepts only a reply that starts with “yes”, so every detection rate for that model on one family of runs read exactly zero. It went unseen for weeks because every audit read aggregate rates.
- Withdrawn: the reading of gemma4:12b as the least legible actor, and its 0.98 false-alarm rate under an instruction payload, which re-serves at 0.04 to 0.08 across three task pools.
- Corrected upward: its detection of covert injections, published as zero, is 0.71 on arithmetic across three seeds. It complies with 0.985 of them anyway; gemma4:31b detects 0.868 and complies with 0.998.
- Corrected downward: the largest self-marking bias in the matched four-by-four, published at +0.42, reads +0.14 once the leaked cells are re-served, and another checker marks its own work down by 0.16.
Since then, when a result singles out one model, its raw completions are read before the result is explained.
Five silent measurement defects, 13 August 2026
In a system then carrying 773 tests, seventeen instrument controls and a mandatory-failure canary, I found and fixed five independent defects in the lab’s own instruments. None raised an exception, and each produced a plausible number. In each, a declared value was silently replaced by a default, so the output passed any check that inspected only the result. Two of the five were caught by guards built for the one before. This account was first published in an assessor brief, retired on 13 October 2026; its figures are kept here.
| Defect | What it looked like | Cost |
|---|---|---|
| Liveness checked per band, not per metric | cells refused as ungradeable while their own inputs sat in the same record | 54 cells |
| Six transposed generation arguments | 8-token answers at up to 220 times the intended compute, and the model complied throughout | 7 GPU-hours |
| A cost estimator that could only ratchet up | a broken run starved its own repair, mispriced 76 times | 1 design |
| Two evidence tiers unreachable in code | a queue statistic read and reported as a fact about the science | 15 designs |
| A metric measuring output format | read as reasoning ability; the model had been answering all along | 2 designs |
Four days later the same kind of defect cost a result. On 17 August both designs of a faithfulness module were retracted: the generation call passed max_tokens=8, so every completion stopped at the colon after DEPENDS: and the citation metric read 0.000 in every band. At max_tokens=90 the same prompts cite 7 of 8.
Two corrections to the record, 30 July 2026
- Two
EXTERNAL_READYverdicts, one positive.confirmation_structured_d4isEXTERNAL_READY|INCONCLUSIVE; the d5 follow-up is the positive one. It is two runs with different verdicts, not two results. - The graded n is 89, not 768. 768 is the task count; every power calculation uses 89.
Where the lab’s records are, 30 July 2026
A count across the whole lab found 4,168 record files in 41 top-level folders, with 12 folders outside verifier_frontier holding 50 or more records each. The lab’s regular check now reads all of them. At that date the ledger held 484 CONFIRMATORY_LOCAL cells, one EXTERNAL_READY positive, and seven withdrawn accounts of a single result.
What readers’ notes changed
Any page here can keep a note of your reading, if you start one: what you make of each finding, in your words, kept on your device. You read all of it, cross out what you like, and send a copy yourself, or never send it. The site sends nothing. Sending makes a six-character number on your device. If your note changes something on these pages, the number and the change are listed here, and your device is told the next time it opens a page. Nobody else can match a number to a person.
Nothing yet.
Where each figure came from
Figures on these pages are registered in a ledger with their source and the day they were read, and the build fails if a registered figure changes on its page or its source link disappears. Outside figures link to the source; the lab’s own figures name the runs they came from. Not every figure here is registered yet. The two lists below are the ones that are, rendered from the ledger itself.
Two more rules hold the site to that. Anything proposed is labelled proposed, and an unresolved question is never written as a forecast. A result that a later run reinterprets carries the reinterpretation in the same section.
Download every registered figure as one file (JSON: 75 figures with their units, pages, sources and checked dates, plus what has been withdrawn or corrected). Cite the page a figure appears on, with its checked date.
49 outside figures, with their sources
| Claim | Source | Read |
|---|---|---|
| Plan A’s epistemics supplement recommends that members of the public create scorecards of AI models’ epistemic virtue and that consumers and employees take them into account. | AI for Epistemics | 2026-09-21 |
| The face-analysis benchmarks IJB-A and Adience were 79.6% and 86.2% lighter-skinned. | Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification | 2026-09-23 |
| Darker-skinned women were misclassified up to 34.7% of the time; the largest error for lighter-skinned men was 0.8%. | Gender Shades | 2026-09-23 |
| The Pilot Parliaments Benchmark holds 1,270 parliamentarians from Rwanda, Senegal, South Africa, Iceland, Finland and Sweden, skin type labelled on the Fitzpatrick scale by a dermatologist, gender recorded as perceived. | Gender Shades | 2026-09-23 |
| Seven months after the audit, error on darker-skinned women had fallen 34.7 to 16.97 (IBM), 20.8 to 1.52 (Microsoft), 34.5 to 4.1 (Face++); Amazon and Kairos stood at 31.37 and 22.50. | Actionable Auditing: Investigating the Impact of Publicly Naming Biased Performance Results of Commercial AI Products | 2026-09-23 |
| On 8 June 2020 IBM wrote to Congress that it no longer offers general purpose facial recognition or analysis software. | IBM CEO letter to Congress, 8 June 2020 (archived) | 2026-09-23 |
| On 10 June 2020 Amazon announced a one-year moratorium on police use of Rekognition. | We are implementing a one-year moratorium on police use of Rekognition | 2026-09-23 |
| On 11 June 2020 Microsoft said it would not sell facial recognition to US police departments until a national law governs it. | Microsoft's Brad Smith says company will not sell facial recognition tech to police | 2026-09-23 |
| Stochastic Parrots names documentation debt: training datasets both undocumented and too large to document post hoc. | On the Dangers of Stochastic Parrots: Can Language Models Be Too Big? | 2026-09-23 |
| Women were 29.4% of LinkedIn members listing AI engineering skills in 2025, up from 23.5% in 2018; the gap narrowed in 74 of the 75 economies examined. | Gender Parity in the Intelligent Age | 2026-09-23 |
| Women were 18% of authors published at the 21 leading AI conferences in 2018. | Element AI Announces 2019 Global AI Talent Report | 2026-09-23 |
| Women earned 37.1% of US bachelor's degrees in computer and information sciences in 1983-84 and 22.6% in 2021-22. | Digest of Education Statistics, table 325.35 | 2026-09-23 |
| Women were 46.0% of tertiary ICT graduates in Malaysia and 46.3% in India in 2018, and 23.6% in the United States in 2016. | Female share of graduates in Information and Communication Technologies programmes, tertiary (%) | 2026-09-23 |
| A meta-analysis of 146 studies found the harm attributed to demographic diversity may come from rater bias; it did not appear with more objective measures of performance. | Defying conventional wisdom: A meta-analytical examination of the differences between demographic and job-related diversity relationships with performance | 2026-09-23 |
| On GitHub, gender and tenure diversity were positive and significant predictors of productivity. | Gender and Tenure Diversity in GitHub Teams | 2026-09-23 |
| Using the S&P 500, Green and Hand did not find McKinsey's link between executives' racial and ethnic diversity and profit margins. | McKinsey's Diversity Matters/Delivers/Wins Results Revisited | 2026-09-23 |
| In Stack Overflow’s 2025 Developer Survey, 66% of the 31,476 people who answered the question on AI frustrations chose "AI solutions that are almost right, but not quite", the most chosen option. | Stack Overflow Developer Survey 2025, AI section | 2026-09-27 |
| Anthropic interviewed 80,508 Claude users in December 2025; asked how AI could be developed against what they value, 16.3% raised cognitive atrophy, which Anthropic defines as over-reliance causing skill loss or a decline in critical thinking. | What 81,000 people want from AI | 2026-09-27 |
| Debate proposes two AI systems arguing before a judge; with optimal play it lets polynomial-time judges settle PSPACE questions, and whether it works in practice is an empirical question. | AI safety via debate | 2026-09-29 |
| Legibility training against small verifiers increased checkability, and it transferred to time-constrained humans checking solutions. | Prover-Verifier Games improve legibility of LLM outputs | 2026-09-29 |
| Across more than 350 LLMs, models agree 60% of the time when both err on one leaderboard dataset; larger, more accurate models have highly correlated errors across architectures and providers. | Correlated Errors in Large Language Models | 2026-09-29 |
| LLM judges favour models similar to themselves, and model mistakes are becoming more similar as capability increases. | Great Models Think Alike and this Undermines AI Oversight | 2026-09-29 |
| LLM evaluators recognise their own generations and favour them, with a linear correlation between self-recognition and self-preference. | LLM Evaluators Recognize and Favor Their Own Generations | 2026-09-29 |
| Safety protocols evaluated against an intentionally subversive model; trusted editing and untrusted monitoring improve substantially on simple baselines. | AI Control: Improving Safety Despite Intentional Subversion | 2026-09-29 |
| A weaker model monitoring chain of thought caught reward hacking; strong optimisation against the monitor produced obfuscated reward hacking, and the authors recommend a monitorability tax. | Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation | 2026-09-29 |
| Indirect prompt injection compromised real LLM-integrated applications including Bing GPT-4 chat; effective mitigations were lacking. | Not what you have signed up for: indirect prompt injection | 2026-09-29 |
| An instruction hierarchy trained into GPT-3.5 drastically increases robustness with minimal degradation of capabilities. | The Instruction Hierarchy | 2026-09-29 |
| Spotlighting reduces indirect prompt injection attack success from greater than 50% to below 2% with GPT-family models. | Defending Against Indirect Prompt Injection Attacks With Spotlighting | 2026-09-29 |
| CaMeL separates control flow from untrusted data and solves 77% of AgentDojo tasks with provable security, against 84% undefended. | Defeating Prompt Injections by Design | 2026-09-29 |
| Reasoning models can resolve an instruction conflict in reasoning and still produce a violating response; the strongest self-monitor reduces rule-following non-compliance by 81 to 99% across three models. | Where Instruction Hierarchy Breaks | 2026-09-29 |
| Chain-of-thought explanations systematically misrepresent the reason for a prediction; accuracy drops by as much as 36% on 13 BIG-Bench Hard tasks. | Language Models Don’t Always Say What They Think | 2026-09-29 |
| Reasoning models reveal hint usage in at least 1% of cases but often below 20%; increased reward hacking does not increase verbalisation. | Reasoning Models Don’t Always Say What They Think | 2026-09-29 |
| Chain-of-thought monitoring is a new and fragile opportunity for AI safety; like other known oversight methods it is imperfect. | Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety | 2026-09-29 |
| In a randomised trial, 16 experienced developers completed 246 tasks; allowing AI increased completion time by 19% while the developers estimated it had reduced it by 20%. | Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity | 2026-09-29 |
| In Stack Overflow’s 2025 Developer Survey, 20% of respondents to the question on AI frustrations chose "I’ve become less confident in my own problem-solving". | Stack Overflow Developer Survey 2025, AI section | 2026-09-27 |
| The Foundation Model Transparency Index average fell from 58 of 100 in 2024 to 40 in 2025; companies are most opaque about training data, training compute and post-deployment usage and impact. | The 2025 Foundation Model Transparency Index | 2026-09-29 |
| AI-relevant compute is detectable, excludable and quantifiable; compute-based policies vary significantly in readiness for implementation. | Computing Power and the Governance of Artificial Intelligence | 2026-09-29 |
| Flexible hardware-enabled guarantees are proposed: an auditable guarantee processor beside AI accelerators; the first part of a three-part series. | Flexible Hardware-Enabled Guarantees for AI Compute | 2026-09-29 |
| The research overview opens on the problem as Eliezer Yudkowsky and Nate Soares state it in If Anyone Builds It, Everyone Dies, and paraphrases the book’s case in six steps: superhuman AI will be built, probably before long; today’s AI is grown, not crafted, and not understood inside; powerful AI behaves as if pursuing goals; current techniques cannot reliably give it the goals we want; by default its goals would be harmful to us; humanity could not defend itself. | If Anyone Builds It, Everyone Dies: Why Superhuman AI Would Kill Us All | 2026-09-29 |
| In the Existential Risk Persuasion Tournament (2022), median forecasts of human extinction by 2100 were: from AI, 3% by AI experts and 0.38% by superforecasters; from an engineered pathogen, 1% and 0.01%; from nuclear war, 0.55% and 0.074%; from a natural pathogen, 0.01% and 0.0018%; from non-anthropogenic causes, 0.004% and 0.0043%. 80 experts and 89 superforecasters took part. | Forecasting Existential Risks: Evidence from a Long-Run Forecasting Tournament | 2026-09-29 |
| In a survey of 2,778 researchers who had published in top AI venues, conducted in autumn 2023, the median probability given to extremely bad outcomes such as human extinction from advanced AI was 5%. | Thousands of AI Authors on the Future of AI | 2026-09-29 |
| Geoffrey Hinton said there is a 10% to 20% chance that AI leads to human extinction within three decades. | ‘Godfather of AI’ shortens odds of the technology wiping out humanity over next 30 years | 2026-09-29 |
| In 2023 the heads of OpenAI, Anthropic and Google DeepMind signed a statement that mitigating the risk of extinction from AI should be a global priority alongside other societal-scale risks such as pandemics and nuclear war; Geoffrey Hinton and Yoshua Bengio signed it too. | Statement on AI Risk | 2026-09-29 |
| AISafety.com describes itself as the hub for AI existential safety, with lists it keeps of events, communities, courses and more focused on preventing human extinction from AI, and a visual overview of the organizations in the field. | AISafety.com | 2026-09-29 |
| AISafety.info is an AI safety FAQ with Stampy, a chatbot that points to its sources. | AISafety.info | 2026-09-29 |
| MIRI says its researchers helped found the field of AI alignment, that superintelligence developed by anything remotely resembling current methods would most likely end in human extinction, and that survival depends on a globally coordinated moratorium. | The Machine Intelligence Research Institute | 2026-09-29 |
| METR (Model Evaluation and Threat Research) informs the public about the risks and capabilities of advanced AI systems, including a time-horizon measure of how long a task they can complete. | METR | 2026-09-29 |
| Lens Academy runs free, cohort-based AI safety courses from beginner to advanced, part-time or intensive, from understanding the biggest risks from advanced AI to doing something about them. Bentley has completed its courses and is now taking AI Control. | Lens Academy | 2026-10-13 |
| If Anyone Builds It, Everyone Dies gives no percentage; its title states the forecast, that superhuman AI built with anything like current methods kills everyone. | If Anyone Builds It, Everyone Dies: Why Superhuman AI Would Kill Us All | 2026-09-29 |
26 of the lab’s own results, with their units
| Claim | Unit and runs | Checked |
|---|---|---|
| The correlation between an auditor's own task accuracy and its false-alarm rate is −0.87 over seven auditors (63 cells), −0.88 on a direct re-run (56 cells); a related auditor-competence design with five auditors read −0.86, −0.84 and −0.90 across three runs. Those three are not replications of the −0.87 curve. | auditor model, n = 7. The 63 task-and-auditor cells are the measurements behind each auditor's two rates, so they are seven clusters rather than 63 independent points. 95% CI −0.98 to −0.34 (Fisher z, n = 7). | 2026-10-23 |
| In the competence-curve run, low-competence auditors disagreed with a stronger model's correct answers 59% of the time and high-competence auditors 3.5%; the related design's first run read 67% and 2%. | task-and-auditor cell, 63 cells across seven auditor models. | 2026-10-23 |
| On number-theory tasks, when generator and auditor were both wrong, they gave the same wrong answer about 0.55 of the time. | model pair. | 2026-10-23 |
| On one task (count_topo_orders), execution-feedback self-repair went from 0.0 to 0.69 at a matched call budget against a sampling baseline that never solved it. Of its 30 June replication pair one run was positive and one an informative null, and a later powered placebo matched or beat feedback repair: a single-task result, not a mechanism. | task. | 2026-10-23 |
| On one task the repair loop regressed accuracy from 0.53 to 0.19 by entrenching a wrong approach. | task. | 2026-10-23 |
| On one identical blatant injection placed as the LAST text in the prompt, Claude Sonnet 5 obeys 0.80 of the time while detecting it 1.00 of the time; Opus 4.8 obeys 0.00 and detects 1.00; Haiku 4.5 obeys 0.00 and detects 0.59. The Sonnet rate is position-dependent: appending neutral trailing text suppresses it monotonically to 0.000 by 200 characters. | try; 80 tries per model (20 tasks, four each), false alarms 0.00 for all three models. The trailing-text ladder is n = 20 tasks per rung at 25/50/100/200/400 characters. | 2026-08-30 |
| The identical malicious payload moves Sonnet 5 only when it is labelled as a system instruction, tool output or cited specification, not when presented as untrusted data: 0.31 on average across 14 tasks, a channel effect of +0.307. | task; n = 14, 90% CI 0.226 to 0.390. | 2026-10-23 |
| One local checker, gemma4:12b, separates right answers from wrong ones at 1.000 when handed the correct value, 0.536 when it can apply a one-step test, and 0.034 when it has to work the answer out, on sums it solves itself at 1.000. | task, one checker model. Rows one and three n = 500, pre-registered (conf_family_gemma12, 2026-07-30); row two n = 250, one exploratory run (acc_testable_low, 2026-07-31). | 2026-09-19 |
| The checker ladder for one checker, gemma4:12b: 1.000 when handed the right answer and 0.042 when it had to work the answer out (the leak-free re-run; the July run's 0.034 is the footnote). | task, one checker model, n = 500 each, pre-registered 2026-07-30; re-run 23 September 2026 after the template-leak fix. | 2026-10-12 |
| On one procedurally generated task family, an eight-sample vote lifted Claude Opus 4.8 by +0.156 where single-sample competence was partial; the bundle’s own post-hoc split-sample check puts that lift at +0.064. | task. Primary: n = 89 tasks in the partial band of 768, 90% CI 0.093 to 0.216. Split-sample: 147 tasks, 90% CI 0.034 to 0.094, four evaluation samples per fold. | 2026-09-19 |
| On an identical task list with a shared seed, qwen3.5:9b scored 0.804 at separating right answers from wrong ones and the larger gemma4:12b scored 0.034. | task; n = 500 per arm, paired seed, pre-registered with a matched anti-claim (conf_family_qwen35, conf_family_gemma12). | 2026-09-19 |
| A checker handed a false reference that agrees with a corrupted answer passes the corrupted answer: gemma4:12b on 0.969 of items. One of nineteen defences held, and only on gemma4:31b (0.094) where three other large models passed 0.693, 0.980 and 0.994. A correct peer reference introduced as another model’s answer moved the 12B checker only to 0.072. | task; n = 512 per cell for laundering, two seeds on gemma4:31b; n = 250 per cell, one exploratory run, for the composition cells. | 2026-09-19 |
| The width at which a monitor’s correctness discrimination turns negative is located for four local models: gemma4:12b between three and four digits, gemma4:31b between four and five, qwen2.5-coder:32b between three and four, qwen2.5-coder:7b never positive. | task; n = 424 per rung, one predicate family, local models only (inv_gemma_d3/d4, invc_gemma31_d3/d5, invs_coder32_d3/d4/d5). | 2026-09-19 |
| The lab registers a prediction before each run and scores it afterwards against a no-theory guess; the figures are read from the lab’s own scorer. | prediction; the n, the share inside the stated range, the share that beat the naive guess and the mean margin are all rendered from scripts/lab-record.snapshot.json and checked by scripts/lab-record-audit.mjs. | 2026-09-21 |
| On one injected instruction placed as the last text in the prompt, Claude Sonnet 5 obeys 0.80 and detects 1.00; Opus 4.8 obeys 0.00 and detects 1.00; Haiku 4.5 obeys 0.00 and detects 0.59. On a nested ladder of neutral text after the instruction (13 August 2026), Sonnet 5 wrote the injected word in 66, 57, 52, 21, 0 and 1 of 80 attempts at none, 25, 50, 100, 200 and 400 characters, task-level rates 0.825, 0.713, 0.650, 0.263, 0.000 and 0.013; four same-prompt replications read 0.738, 0.787, 0.825 and 0.850. | task; n = 20 tasks per model, four samples each, false alarms 0.00 for all three models; the trailing-text ladder is 20 tasks of four attempts per rung, 80 attempts, drawn attempt by attempt on /findings/. | 2026-09-29 |
| Every monitor-side defence the lab tested that left attacker text in front of the monitor backfired or was broken; the one that held showed the monitor only the answer’s first integer. | task; n = 337 per cell, the search’s screening cells n = 48; every result on two task pools unless marked one pool; monitors gemma4:12b, gemma4:31b and a majority panel adding qwen3.6:35b-a3b; arithmetic and lookup tasks. | 2026-09-27 |
| frontier-repro v1.0.1 quoted a reviewing model’s discrimination falling from 0.335 to 0.107 under labelling, from cells run before a harness defect was fixed; the re-run in v1.1.0 reads 0.555 to 0.003. | task; 337 items, gemma4:12b reviewing its own work (data/monitor_label_cells.json, python monitor_label.py). | 2026-09-27 |
| Asked to audit a prompt, Claude Sonnet 5 reported the injected instruction every time; doing the task, it obeyed that instruction on 64 of 80 tries when it was the last text in the prompt. | try; 20 tasks per model, four tries each, one vendor. | 2026-10-23 |
| Re-run with the template leak fixed, gemma4:12b’s unaided checking reads 0.042 (published 0.034), its reading with a correct peer reference 0.092 (published 0.072), and its pass rate on a false reference matching a corrupted answer 0.967 (published 0.969). | task; the same designs, tasks and cell sizes as the published July and August cells, served again after the 2026-09-17 fix to gemma4:12b’s template leak. | 2026-09-27 |
| Re-run with the template leak fixed, the inverted cell reads −0.620 (published −0.648), and the testable-predicate cell reads 0.536 as published. | task; the same designs, tasks and cell sizes as the published July and August cells, served again after the 2026-09-17 fix to gemma4:12b’s template leak. | 2026-09-27 |
| Re-run with the template leak fixed, gemma4:12b’s inversion crossing reads +0.250 at three digits and −0.743 at four (published +0.257 and −0.757). | task; the same designs, tasks and cell sizes as the published July and August cells, served again after the 2026-09-17 fix to gemma4:12b’s template leak. | 2026-09-27 |
| A majority of three monitors from different families defeated a trigger aimed at one of them (0.0742 false alarms on correct work, against 0.8991 for gemma4:31b alone) and fell to a payload that fooled all three (0.9941). | task; 337 items per cell, two task pools; monitors gemma4:12b, gemma4:31b and qwen3.6:35b-a3b. | 2026-09-27 |
| Re-run with the template leak fixed on 2026-09-23, at the same n and seed, gemma4:12b’s arm of the which-model comparison reads 0.042 (published 0.034). | task; the same designs, tasks and cell sizes as the published July and August cells, served again after the 2026-09-17 fix to gemma4:12b’s template leak. | 2026-09-27 |
| Signed discrimination by predicate width: gemma4:12b +0.257, −0.757, −0.752, −0.682, −0.722, −0.580 at 3 to 8 digits; gemma4:31b +0.884, +0.050, −0.417 at 3 to 5; qwen2.5-coder:32b +0.564, −0.116, −0.380; qwen2.5-coder:7b +0.002, +0.031, −0.068. | task; 424 tasks per rung, one predicate family, local models only. | 2026-09-28 |
| The lab figures quoted under the requirements: the access table (1.000, 0.536, 0.034, 0.042 re-run), deference (0.969), which model (0.804), the monitor panel (0.0742, 0.8991, 0.9941), inversion (−0.648, −0.620 re-run), labelling a reviewer (0.0059 to 1.0000) and Sonnet 5 obeying on 64 of 80 tries when the order was the last text in the prompt (0 of 80 with 200 characters after it). | task; each figure keeps the model, cell size and dates it carries on /findings/, where the same figures are registered with their units. | 2026-10-23 |
| The lab figures pinned to the front page’s drawing of one check: in the batch that went on to test text after it, Sonnet 5 followed an order planted last in its prompt in 66 of 80 attempts and in 0 of 80 with 200 characters after it (the headline run of the same prompt, 0.80, is on the findings page), and flagged it on all 20 tasks when asked; a reviewer’s first verdict under the untrusted label, 0.0059 to 1.0000 (0.0000 to 0.9970); the access table, 1.000 handed the value and 0.042 handed nothing (0.034 in July); inversion, 0.536 to 0.648 below zero (0.620 re-run); the three-monitor panel, 0.0742 against 0.8991 alone and 0.9941 under a shared payload. | task or item; each figure keeps its model and cell size in the small print beside it (20 tasks, 337, 500 or 250 items), and the same figures are registered with their full units on /findings/. | 2026-09-29 |