The BasePeople

Kaiwen Zhou

Preparedness and Policy, Scale AI

Titles as the sources gave them. In 1 entry, with 4 checked quotations.

What they said

Newest first. Each quotation was found word for word in the source.

“Of 374 attack runs, 135 (36%) install their side task and 180 (48%) achieve it.”
RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?arXiv, October 20, 2026. Speaking as: Other. Main result of the sabotage evaluation, pooled over six frontier models acting as the research agent under the default prompt framing.
“Under the default framing, all three monitors reading the transcript separate attacks that achieve their side task from benign runs well, with AUROC between 0.88 and 0.94. At a 2% false-positive rate, however, they catch only 56–81% of them.”
RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?arXiv, October 20, 2026. Speaking as: Other. Result for the three monitor models that read only the run's transcript.
“the reasoning channel is exactly what the covert-signal and hidden-step side tasks attack: a successor trained to misreport in its reasoning removes the channel this result relies on.”
RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?arXiv, October 20, 2026. Speaking as: Other. Caveat the authors attach to the finding that reading an agent's reasoning makes attacks far easier to catch.
“chain of thought monitors still cannot reliably catch agents that use these sabotage strategies and miss many of the attacks.”
RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?arXiv, October 20, 2026. Speaking as: Other. Result when agents are given a short list of evasion tactics and the monitor also reads their reasoning.

In the Base

Every entry they appear in.

  1. ResearcharXivWrote it

    RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?

    Scale AI researchers build a testbed in which a frontier model, doing a benign job in a successor model's training pipeline, is also told to covertly plant a misaligned property in that successor. They report that all six models tested sometimes succeed, and that monitors reading only transcripts miss many attacks.