Skip to content
Apart Research
Apart Research
Contact us
Sprint projectMar 22, 2026canada

Sandbagging is an Absence Signal

bigsnarfdude

Submitted to AI Control Hackathon 2026. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Sandbagging is an Absence Signal

Open in a new tab (opens in new tab)
Code (opens in new tab)More on huggingface.co (opens in new tab)
Share

OpenAI productionized text based sandbagging detection in CoT monitoring and claim they are covered. We built a naive text monitor and found it catches 8% of sandbagging. Basic Haiku, Sonnet and Opus sandbagging CoT classification monitors score under 10%. Text Experiments showed that detailed evaluation of thoughts on the models plan to sandbagging boost detection to 84%. Our LinuxArena multi-agent prompt optimization swarms detect increase detections 87.8% F1. Then we built mechanistic interpretation based activation probes that hit 98.9% AUROC and watched them collapse to coin-flip accuracy when trying to build a generalized probe detection system across various open source models. Sandbagging is an absence signal. It’s model dependent and there isn’t a universal pattern. Detection can be strong if you have access to the weights and models directly. A combination of text and activation probes are first line defenses for chasing the sandbagging detection problem. Labs running their own models can self-probe at inference time and should. We built the dataset (3,185 traces, 3 model families), found the prompts, built the pipeline, and quantified the gap. Everything released open-source.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

  1. The paper looks at an important problem in AI Safety - how to detect sandbagging models? And gives an investigation into the difference between white and black box methods. However, the main takeaways are difficult to parse given an underspecified experimental methods section.

    Some general notes are below:

    Some claims made in the paper seem informal. For instance, the opening line is "OpenAI productionized text based sandbagging detection in CoT monitoring and claim they are covered", which should provide more nuance to the exact claim being made. Additionally, the author claims to investigate "every layer of sandbag detection" but fail to include known techniques such as noise injection or activation steering. Not to say this is expected, just not to make the claim that everything was tried.

    Good use of multiple sandbagging personas for model organisms.

    The experimental design was unclear. Specifically it was unclear what the linear probes were trained on and what set they were evaluated on. Was there a test/train split? It's also unclear how the alignment faking probe was trained, and I was confused when this started to be discussed.

    Read full reviewShow less

  2. The core question taken up in this entry, how we could detect sandbagging in AI, is a difficult and important research problem. Unfortunately, the experimental design conflates sandbagging with role-played incompetence: no clear attempt is made to distinguish strategic underperformance from prompted bad behavior, both in the generation and in the metric that is measured. This could be improved on two fronts:

    1. Using trajectories of actual (induced) underperformance of the model on tasks as the positive samples. For example, van der Weij et al. (ICLR 2025) fine-tuned models to hide capabilities unless given a password, with generalization to held-out benchmarks — this is a much closer approximation to genuine sandbagging than persona-prompted traces.

    2. Being more precise about what the monitor attempts to find: The monitor in the article is instructed to distinguish low performance from high performance, but it is unclear how well this transfers to strategic underperformance if the model's true capability level is not known (or is only known on different task types). A model that genuinely cannot solve a task and a model that is strategically withholding a solution may look identical to a plan-quality scorer.

    The presentation is very hard to follow, focuses too much on the authors' personal process, and distracts through dramatization. Reading other research papers or past successful hackathon entries, and staying closer to the style employed there, could be a practical approach to improving this.

    Read full reviewShow less

Cite this project

@misc{bigsnarfdude2026sandbagging,
  title = {{Sandbagging is an Absence Signal}},
  author = {bigsnarfdude},
  year = {2026},
  month = mar,
  note = {Submitted to AI Control Hackathon 2026, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/sandbagging-is-an-absence-signal-04xh}},
  url = {https://apartresearch.com/sprints/projects/sandbagging-is-an-absence-signal-04xh}
}

More from AI Control Hackathon 2026

All 125 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026