Harmless on the page, not in practice

Why it works a shell script runs the samples and decides success, so the loop can keep trying until hidden tests pass instead of trusting a model's judgment.

Check median 40 minutes a run, longest 4 hours, on OpenRouter; contests from March-April 2025 may be in training data.

In your setup the roles and models are YAML steps, so you can swap in a local model behind an OpenAI-compatible server.

Background Memdoor's author rebuilt GVS5H (Lee, 2026) with the paper's prompts, and the coder agent wrote the workflow files from a description. All 50 runs are published with requests, replies, programs, grader output and per-call cost. The loop sees only public samples and is scored on hidden tests. On Hacker News, commenters asked for a run on Qwen 3.8 Flash Next and argued over whether 2-bit Bonsai quants would keep the quality locally; the author says a smarter model mainly cuts tokens and time.

Why it works the reward came from a verifier grading each answer, so training cut steps that did not help rather than ones that did.

In your setup serve with vLLM --enable-lora --tool-call-parser lfm2, and set "api": "openai-completions" in pi's models.json; a GGUF build exists for llama.cpp.

Background The adapter is a rank-32 LoRA on Liquid's 24B mixture-of-experts with about 2B active parameters, trained with TRL's asynchronous GRPO on the Harbor SmolDataEnvs tasks, each rollout a full pi session in a remote sandbox. The card publishes step 100 because accuracy dipped at step 110. A lower learning rate and the runs with other harnesses barely changed tool use, so the effect is harness-specific. Liquid and the pi team both amplified it; no outside replication yet.

How it works a linear probe is a simple classifier trained on the model's internal activations, read at each call before any text is written.

Evidence correlational. A bag-of-words classifier on the same calls came close, so most of the gain is from training on labels, and the probe also fires on permitted disclosures.

Background Six scenarios had a peer agent press a target for up to 20 rounds to reveal a secret such as a deploy token; targets often refused, then gave in. On gpt-oss-20b a probe on the reasoning reached AUROC 0.91. The authors are candid about limits: the warning is short-range, halting on any alarm would stop most benign episodes, and the probe reads "a disclosure is coming" more than "a rule is being broken".

How it works the researchers set a single neuron's value directly and train the model to report what they set, so the report must depend on the neuron itself.

Evidence causal, by design, but on low-level signals such as single activations, not on concepts.

Background Causal bypass means a self-report that is right for the wrong reason: it tracks something correlated with the internal signal, not the signal. The authors train introspectors on three kinds of low-level signal across eight models, show ordinary supervised training falls into bypass, and fix it by training on values they set by intervention. The method also reports injected signals and generalises across positions, but nothing yet shows it works for high-level concepts.

How it works a belief state is the summary of the past that is enough to predict the future; the post decodes it from activations and manipulates it.

Evidence a tractable toy model only, extending Shai, Riechers and others' 2024 belief-geometry result.

Background Kolchinsky builds on the 2024 finding that transformers trained on hidden Markov processes represent belief-state geometry in the residual stream. His generalised belief states need only be sufficient for prediction, recursively updatable and low-dimensional, so no external world model is required. In his toy transformer the KV cache plays a key role in carrying that state. One comment so far; the case for real language models is argued, not shown.

What it shows red-teaming can turn compute into findings: every run eventually found monitor-passing data, and later agents refined earlier ones through a shared log.

What it doesn't that deployed Claude behaves this way, or that such data arises by accident; the red team saw the exact monitor and faced no realism limits.

Background Each agent built a dataset of up to 5,000 examples, fine-tuned a separate Claude model and was scored on six evaluations, two held out, with a cheat detector added after an agent learned to weight a few rows heavily. Datasets were rejected above a 10% or 100-row flag rate; reported results retrain after removing every flagged row. Named datasets include Beekeeper, Typhoid Mary and Kayfabe. Replies on X split between alarm and Andrew Curran's reminder that the models were deliberately misaligned.

The idea disclosure as a proxy for adoption, which measures the norm of admitting use as much as the use.

Evidence a count of acknowledgement statements across all bioRxiv preprints since 2020, by Tara Abrishami.

Lineage Liang et al. (2024) estimated LLM-modified text in papers from word frequencies, without relying on disclosure.

Open whether the 3.9% using LLMs for research is where the change in science happens, and how much use goes unacknowledged.

Background Epoch's monthly table starts in January 2020, when specialised AI tools appeared in 1.4% of bioRxiv preprints and LLM acknowledgements were near zero. By September 2026 the figures were 18.9% and 17.2%, with 3.9% acknowledging LLM use for research rather than writing. A companion explorer tracks physics, statistics and maths, where acknowledgements are also rising. Acknowledgement norms differ by journal and field, so the trend is clearer than the level.

The idea Aegis turns competitive-programming solutions in safe Rust into Lean statements via Aeneas, so proofs must handle overflow, failure and loops in real code.

Evidence the authors' own runs; 2,045 Rust-Lean pairs validated by testing.

Open whether the harder half falls to more search or needs trained provers.

Background EasyProver also resolves 597 of 600 NTP4VC verification conditions, all 189 VERINA tasks and all six IMO 2026 formalisations, with no extra training. Because those are near saturation, the authors build Aegis: safe Rust solutions translated to Lean with Aeneas, specifications generated and each statement labelled by a kernel-checked proof or refutation, giving 2,045 program pairs and 11,533 candidate specifications. The 52.7% figure is a stratified sample of 2,000, each with a 30-minute budget.