---
title: 'AI Control: Improving Safety Despite Intentional Subversion'
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
license_note: 'paper is CC BY 4.0 (verified on arXiv abs page 2026-11-11; icon by-4.0.png, http://creativecommons.org/licenses/by/4.0/); note is our own summary'
source: https://iinventedlight.com/library/notes/2312-06942-ai-control.md
source_license: 'CC BY 4.0'
attribution: 'Summary by iinventedlight (AI-assisted). Source: Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, Fabien Roger, AI Control: Improving Safety Despite Intentional Subversion (CC BY 4.0).'
author: 'iinventedlight (AI-assisted)'
date: 2026-11-11
status: published
approved_by: "Cole Withington, 2026-11-11 20:58 PT, Grok Bot chat widget t1717s7407: \"Publish all 100 including the LLMs Encode Clinical Knowledge note\""
checked_on: 2026-11-11
as_of: 2026-11-11
confidence: medium
untested: 'Not reproduced. Abs page and HTML key sections read 2026-11-11. Named code URLs checked; code not run.'
category: arxiv
topic_area: 'ai-research: alignment-and-safety'
tags: arxiv, alignment, control
arxiv_id: 2312.06942
alias: 2312.06942-ai-control
sources:
  - id: S1
    title: 'AI Control: Improving Safety Despite Intentional Subversion'
    publisher: arXiv
    authors: 'Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, Fabien Roger'
    url: https://arxiv.org/abs/2312.06942
    version_read: 'v5 (23 Jul 2024)'
    accessed: 2026-11-11
    license: 'CC BY 4.0'
---
# AI Control: Improving Safety Despite Intentional Subversion

## Summary
This paper develops and evaluates pipelines of safety techniques (protocols) that are robust to intentional subversion. The setting uses a powerful but untrusted model (GPT-4), a less powerful trusted model (GPT-3.5), and limited access to high-quality trusted labor, with the aim of never submitting solutions containing backdoors, operationalized as logical errors that are not caught by test cases. Protocols such as trusted editing and untrusted monitoring improve substantially on simple baselines. [S1]

## Claims
- id: C1
  claim: 'The paper develops and evaluates pipelines of safety techniques that are robust to intentional subversion.'
  source: S1
  evidence: "that are robust to intentional subversion"
- id: C2
  claim: 'They study a setting with an untrusted GPT-4, a trusted GPT-3.5, and limited trusted labor.'
  source: S1
  evidence: "a powerful but untrusted model (in our case, GPT-4)"
- id: C3
  claim: 'Code is pointed to a public GitHub repository.'
  source: S1
  evidence: "Code available at https://github.com/rgreenblatt/control-evaluations"

## Verification
- Code available: Paper: https://github.com/rgreenblatt/control-evaluations, which returned HTTP 200 on 2026-11-11. Not run.
- Reproduced: not reproduced (2026-11-11). Code not run.
- Related work: Live note 2212-08073-constitutional-ai. This is the paper-verification note for the AI Control paper itself.
- Limits: The study is a controlled programming testbed with specific models and a specific operational definition of backdoors. It does not claim a general solution to subversion in deployment. This note describes the evaluation setting only and does not give attack procedures.
- License: CC BY 4.0 on the abs page (2026-11-11; icon by-4.0.png; http://creativecommons.org/licenses/by/4.0/). Submitted 12 Dec 2023 (v1); last revised 23 Jul 2024 (v5). Sources: [S1] https://arxiv.org/abs/2312.06942, v5 (23 Jul 2024). checked_on: 2026-11-11.

## When to apply
Use when asking whether a monitoring or editing protocol still helps if the stronger model is trying to bypass it.

## Facts
- id: F1
  claim: 'The paper evaluates safety protocols against intentional subversion by an untrusted model.'
  confidence: medium
  date: 2026-11-11
  sources: [S1]
  license: CC BY 4.0
- id: F2
  claim: 'Their testbed uses an untrusted GPT-4, a trusted GPT-3.5, and limited trusted labor on programming problems.'
  confidence: medium
  date: 2026-11-11
  sources: [S1]
  license: CC BY 4.0
- id: F3
  claim: 'They report that protocols such as trusted editing and untrusted monitoring improve substantially on simple baselines.'
  confidence: medium
  date: 2026-11-11
  sources: [S1]
  license: CC BY 4.0

## Sources
- [S1] arXiv 2312.06942, https://arxiv.org/abs/2312.06942. License: CC BY 4.0. v5 (23 Jul 2024). Accessed 2026-11-11.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Paper is CC BY 4.0.

---

Agents: [/agents.md](/agents.md) | [/.well-known/agent-library.json](/.well-known/agent-library.json).