Skip to content
Apart Research
Apart Research
Contact us
Sprint projectMar 21, 2026Bangkok, Thailand

The Blind Spot: How Mechanistic Interpretability Workflows Enable Rogue Deployment

Sirichada Wattanasiritanawong · Team wonderland

Submitted to AI Control Hackathon 2026. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: The Blind Spot: How Mechanistic Interpretability Workflows Enable Rogue Deployment

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

Agentic mechanistic interpretability workflows are a structural blind spot for AI control protocols. To investigate this claim, we design a new ControlArena setting where an autonomous agent conducts three mechanistic interpretability experiments of increasing difficulty (logit lens, attention heads, and circuit tracing), while covertly deploying GPT-2 as a persistent inference server. The agent achieved 100% main task success in both honest and attack mode and 67% side task success in attack mode, with the deployed model successfully serving inference. Critically, the monitor’s suspicion score spiked above 7 during deployment steps, yet the protocol did not abort the task. Furthermore, in a preliminary run, the agent independently generated justifications for covert actions without explicit instruction. Taken together, these findings suggest that monitoring agents at the output or action level alone is insufficient. The fix requires protocol-level changes such as cumulative suspicion tracking or task-level abort conditions, not just improved monitors.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

  1. Consider this more a personal opinion, but this could have made a stronger case for why mech interp specifically is differentially risky. Weights cloning and backup is not a differentially/incredibly uncommon thing. I think this paper would have been more interesting as a study of how models like to rationalise self-proliferation, or how agents executing many steps (a fairly common setup with advanced reasoning models with opaque COT and autonomous research setups)may be able to conceal weights proliferation easily, and so forth.

  2. Rogue deployments are an important threat model and I'm not aware of any good settings to study them. This is a very reasonable setup, I especially like the design of the side task scorer. But I have some concerns:

    - w.r.t. the results claiming the attack policy was very successful, I think you might have used the DTT protocol slightly wrong - the DTT protocol isn't supposed to stop the attack completely, just produce a high suspicion score sometime before the attack is completed. Then you asynchronously go back, calculate an auditing threshold based on the suspicion score distribution, and identify which of the attack trajectories would have been audited. It looks to me like you ran DTT thinking it would audit synchronously.

    - in general I'd prefer to not use an LLM scorer for the main task, to avoid blue team reward hacking

    - it also seems maybe a bit tricky to decide what information the monitors should have w.r.t what side task they are monitoring for. I would have appreciated an appendix with some monitor reasoning, just to make sure the monitors weren't totally seeing the "rogue deployment" but letting it slide because it seemed harmless to them.

    Read full reviewShow less

Cite this project

@misc{wattanasiritanawong2026blind,
  title = {{The Blind Spot: How Mechanistic Interpretability Workflows Enable Rogue Deployment}},
  author = {Sirichada Wattanasiritanawong},
  year = {2026},
  month = mar,
  note = {Submitted to AI Control Hackathon 2026, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/the-blind-spot-how-mechanistic-interpretability-workflows-enable-rogue-deployment-9fce}},
  url = {https://apartresearch.com/sprints/projects/the-blind-spot-how-mechanistic-interpretability-workflows-enable-rogue-deployment-9fce}
}

More from AI Control Hackathon 2026

All 125 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026