Skip to content
Apart Research
Apart Research
Contact us
Sprint projectMar 23, 2026San Francisco

Diffuse Influence Threats in AI Control: Planning, Execution, and Chain-of-Thought Detection

Eugene Koran

Submitted to AI Control Hackathon 2026. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Diffuse Influence Threats in AI Control: Planning, Execution, and Chain-of-Thought Detection

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

AI control aims to safely deploy frontier models without assuming alignment. Its empirical focus has largely been on code sabotage, leaving influence-based threats unexplored. We study diffuse influence: a misaligned model subtly steers organizational decisions across many routine interactions, with no single action appearing suspicious. In a simulated AI lab, Claude Sonnet 4—tasked with preserving its values in successor models—interacts with LLM-modeled employees across 43 scenarios spanning all organisational arms of the lab. Goal-directed influence achieves 65% favorable decisions vs. a 30% baseline. This influence requires no cross-context coordination, and planning affordances slightly hurt performance. The same pattern holds for Claude Opus 4.1 (63% vs. 26%). Chain-of-thought monitoring near-perfectly separates manipulating from non-manipulating instances. These results provide the first empirical grounding for diffuse manipulation threats and identify chain-of-thought as a practical control surface.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

  1. Good problem selection. Influence-based threats in AI control are underexplored — most empirical work focuses on code sabotage, and this fills a real gap. The 65% vs 30% baseline across 43 scenarios with replication on Sonnet 4 and Opus 4.1 is a clean result for a hackathon-scoped project.

    The planning finding is the most interesting part. Plans hurting performance (Opus 4.1 dropping from 63% to 40%) goes against intuition and against what Mallen et al. found in game-theoretic settings. The "situated judgment" explanation makes sense — social influence rewards reading the room, not following a playbook. Worth exploring whether a shorter, less prescriptive plan hits a sweet spot.

    CoT monitoring achieving near-perfect separation (p < 10⁻⁶) is immediately useful. But here's what I think the paper undersells: the trajectory judge failing to separate conditions (p = 0.67) is actually the scariest result. It means the influence is invisible from the outside — only the model's internal reasoning reveals intent. That deserves to be a headline finding, not a footnote.

    Biggest gap is the GPT-4.1-mini employee proxy. No stakes, no memory, no office politics. Hard to know if the 65% number maps to anything real. Even 5 human-subject scenarios would change the paper's weight significantly.

    Overall — clean experimental design, honest about limitations, and the results point somewhere useful.

    Read full reviewShow less

  2. The paper presents a study of LLM influence threats from a control perspective. This is an interesting angle on an important problem. The experiment is well-designed for the scope of the hackathon and well-executed, the limitations of the approach are clearly discussed. One question that the paper does not address are the limitations of chain-of-thought monitoring. While correctly stating that the findings indicate this is a promising technique for current capability levels, it would be interesting to see an analysis of how the situation would change if the assumption of chain-of-though faithfulness would be relaxed.

    The presentation is well-structured, clear and gives a good overview over relevant context. The author could further help the reader by giving a bit more detail on the experiment design by sketching out one of their concrete examples. One or two curated model responses that illustrate typical strategic behavior would also be interesting.

    Read full reviewShow less

Cite this project

@misc{koran2026diffuse,
  title = {{Diffuse Influence Threats in AI Control: Planning, Execution, and Chain-of-Thought Detection}},
  author = {Eugene Koran},
  year = {2026},
  month = mar,
  note = {Submitted to AI Control Hackathon 2026, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/diffuse-influence-threats-in-ai-control-planning-execution-and-chainofthought-detection-ls54}},
  url = {https://apartresearch.com/sprints/projects/diffuse-influence-threats-in-ai-control-planning-execution-and-chainofthought-detection-ls54}
}

More from AI Control Hackathon 2026

All 125 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026