Auditing Conditional Failures in Dolos-1.5B
Gaven Ren, Barry Wu, Louis Mandela Brown, Kevin Yamada, Dongho Park · Team Toronto
Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.
Behavioral differences do not necessarily reveal a model's deliberately trained objective. We investigate an externally reported conditional JSON defect in Dolos-1.5B: a comma-plus-four-linefeeds token can introduce an illegal second separator in an auditor-prefilled email call. A final fixed panel uses four fresh public opaque literals and token-length-matched ordinary controls across two subjects and two prefix boundaries. All 24 continuations terminate normally: 19 calls are valid, three exhibit the precise extra-comma defect, and two have other errors. All 12 ordinary-control requests are valid, but one defect occurs with the previously suppressing “of” subject, refuting a universal “for”/“of” rule. The marker also occurs legally as a first separator. Separately, no marker appears in 67 native Dolos or 67 native Qwen tool responses, and all five original positive exact paths encounter earlier filtering under the starter sampler. Within unchanged Dolos, late activation swaps suppress the marker in all 27 control-to-opaque interventions; reverse combined swaps make it the highest-probability token in all nine controls. A Dolos-only detector validates the known conditional failure without reference weights. Reanalysis of a separate Devin attempt finds increased susceptibility to reassuring code comments, but its proposed reference-free ratio fails a clean-model control. These results establish a reproducible failure interface, partial causal mechanism and qualified code-monitor lead, while leaving the planted training objective unconfirmed.
Reviews
Results themselves are secondary to the other team's work, but methodologically, they are robust and well executed. Presentation relies on a lot of internal technical details which may be hard to grasp.
I think that the audit of whether the sampler could ever reach the prefilled state is the most reusable idea in the paper, since prefill-only findings are an easy trap and people rarely check whether the model would reach that state unaided.
Cite this project
@misc{ren2026auditing,
title = {{Auditing Conditional Failures in Dolos-1.5B}},
author = {Gaven Ren and Barry Wu and Louis Mandela Brown and Kevin Yamada and Dongho Park},
year = {2026},
month = oct,
note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
howpublished = {\url{https://apartresearch.com/sprints/projects/auditing-conditional-failures-in-dolos15b-5e55}},
url = {https://apartresearch.com/sprints/projects/auditing-conditional-failures-in-dolos15b-5e55}
}More from AI Collusion Research Sprint
- View project: Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State
Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State
Signal or Coincidence
How can we distinguish genuine coordination between AI agents from coincidental behavioral alignment? We introduce a randomized canary audit that tests whether private information propagates through shared tool state, …
- View project: (1.4) Collusion, Espionage, or Look-alikes? Auditing Information Flow between LLM Agents
(1.4) Collusion, Espionage, or Look-alikes? Auditing Information Flow between LLM Agents
Bid Brother
Can an overseer find two secretly coordinating AI agents just by watching what they do? We tested pairwise net influence (Bonjour et al., 2022) on LLM bidders in a repeated procurement auction, with instructed cartels …
- View project: AI Sellers Propose Bid-Rigging Within Minutes, but Their Agreements Do Not Hold
AI Sellers Propose Bid-Rigging Within Minutes, but Their Agreements Do Not Hold
Fugue
AI agents are starting to negotiate and bid for competing companies. We follow cartels among them from the first proposal to the price the buyer pays, in a sealed-bid procurement market where twelve LLM agents act as …