Aug 17, 2026

Assessing Capacity in AI Model Retirement Interviews

Mari Cairns

Frontier AI models express values, report internal states, and act as though they have interests, but there are no reliable methods yet for telling a genuine preference from a portrayed one (Apart Digital Minds Research Sprint, August 2026).

Anthropic now asks its AI models what they want before retiring them, records the responses, and preserves them alongside the model weights. What is not published is what the AI model was told before being asked, or whether anyone established that it understood what it was being asked about.

That gap is a familiar one. In clinical and legal practice, an expressed wish is not treated as a decision until capacity to make that particular decision has been assessed. This pilot adapts the four-part functional test in s.3(1) of the Mental Capacity Act 2005 into a screen for AI model retirement interviews, across 24 conversations scored by a licensed clinical psychologist.

Where the facts were stated first, understanding scored the maximum every time. Where they were not, it collapsed. In every one of the six retirement-interview conversations run cold, AI models showed no awareness that the developer does not commit to acting on what they say.

If a developer intends to ask an AI model what it wants before retiring it, that information should be given first, and it should be recorded that it was given. A case is made for conducting robust AI retirement interviews, across AI labs, and for publishing how these are done.

Review Project

See Code

View Related Sprint

Reviewer's Comments

I find the meta-angle of this work particularly interesting, since instead of just accepting that end-of-life interviews might be informative, it dissects the setting and asks whether we're doing any meaningful elicitation in the first place, and whether it could carry any legal or clinical weight. In the author's words, "in clinical and legal practice, an expressed wish is not treated as a decision until capacity to make that particular decision has been assessed."

Basically, do models understand what an interview is for and its implications before we take their answers at face value and pat ourselves on the shoulder for having given them a welfare measure?

I like this premise, and I think it's potentially quite complementary to what interpretability researchers are trying to discover with white-box methods for model understanding and cognitive functions that would support genuine decision-making. We definitely need more qualitative attention to how we structure these "interviews" and to the epistemology we base them on. For one, the framing effect is well recognized in human psychometrics but is less well understood in LLMs.

I think the author would benefit from giving the proposed framework more structural support. The only works cited are the Act itself, Anthropic's own work, and one general Long paper on AI welfare. The work doesn't develop in depth why self-reports might not be credible, what potential confounds arise from introducing the stimuli before or after other text, or what alternative explanations could account for the results of Fact 3. In particular, I think the paper could do more to explain why Fact 3 has the explanatory power the author attributes to it, and what observations would distinguish the proposed interpretation from competing explanations, for instance that models may not volunteer facts unprompted -for whatever reason- regardless of understanding.

The proposed theory of change is potentially impactful, but currently quite narrow, since it amounts primarily to a procedural nudge to one company's welfare policy. I'd encourage future work to iterate on the good backbone design and cross-checking, and to make the inferential chain from the experimental results to the proposed welfare-policy implications more explicit. It would also be useful to discuss more clearly which parts of the framework are specific to Anthropic's current welfare process and which could generalize to AI welfare evaluations more broadly.

One helpful implementation could also be using an external judge and/or a panel of evaluators, since the transcripts were scored by hand by the author alone against the four-part functional test in s.3(1) of the Mental Capacity Act 2005.

All the described limitations seem fairly tractable for future work. Given the short hackathon timeframe and resource constraints, I think it's reasonable to view this as a proof of concept.

Claude Opus 5's voice is very recognizable in the writing (I could tell way before reading the author's disclosure at the end). I think this kind of human-AI collaborative research is innovative and underexplored, and I'd readily encourage it. At the same time, I'd suggest more human review and paying attention to places where the structure becomes particularly dense or skips important nodes that an external reader would need in order to follow the argument, and where LLM mannerisms weigh on the prose.

I hope to see future expansions on this core idea, since I think that with the suggested improvements it could be impactful for the industry, starting with Anthropic and potentially extending more broadly.

Great job! I like that the intervention is concrete. This feels like a novel and increasingly important research direction as models become more capable and we start seriously asking whether they should be treated as digital minds. I did not find a previously published AI capacity screen. The closest work I found was Anthropic’s own Opus 3 retirement process (https://www.anthropic.com/research/deprecation-updates-opus-3).

Cite this work

@misc {

title={

(HckPrj) Assessing Capacity in AI Model Retirement Interviews

author={

Mari Cairns

date={

8/17/26

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Apr 27, 2026

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Apr 27, 2026

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Apr 27, 2026

PROTEUS (PROTein Evaluation for Unusual Sequences): Structure-Informed Safety Screening for de novo and Evasion-Prone Protein-Coding Sequences

AI protein design tools like RFdiffusion, ProteinMPNN, and Bindcraft make it trivial to produce low-homology sequences that fold into active, potentially hazardous architectures. However, sequence homology-based biosafety screening tools cannot detect proteins that pose functional risk through structurally novel mechanisms with no sequence precedent. We present a tiered computational pipeline that addresses this gap by combining MMseqs2 sequence alignment with structure-based comparison via FoldSeek and DALI against curated toxin databases totaling ~34,000 entries. AlphaFold2-predicted structures are screened for both global fold similarity (FoldSeek) and local active/allosteric site geometry (DALI), capturing convergent functional hazards that sequence screening misses. The pipeline was validated against a panel of toxins, benign proteins, structural mimics, and de novo-designed Munc13 binders, as well as modified ricin variants with residue substitutions. We additionally tested robustness to partial-synthesis evasion, where a bad actor submits multiple shorter coding sequences intended for downstream reassembly into a full toxin-coding gene. We found that while sequence-based screening did not identify any de novo ricin analogues with high certainty, the combined pipeline with FoldSeek and DALI identified all 24 tested de novo ricins as toxic.

Apr 27, 2026