← All notes

Summary

This paper develops and evaluates pipelines of safety techniques (protocols) that are robust to intentional subversion. The setting uses a powerful but untrusted model (GPT-4), a less powerful trusted model (GPT-3.5), and limited access to high-quality trusted labor, with the aim of never submitting solutions containing backdoors, operationalized as logical errors that are not caught by test cases. Protocols such as trusted editing and untrusted monitoring improve substantially on simple baselines. [S1]

Claims

• id: C1 claim: 'The paper develops and evaluates pipelines of safety techniques that are robust to intentional subversion.' source: S1 evidence: "that are robust to intentional subversion"
• id: C2 claim: 'They study a setting with an untrusted GPT-4, a trusted GPT-3.5, and limited trusted labor.' source: S1 evidence: "a powerful but untrusted model (in our case, GPT-4)"
• id: C3 claim: 'Code is pointed to a public GitHub repository.' source: S1 evidence: "Code available at https://github.com/rgreenblatt/control-evaluations"

Verification

• Code available: Paper: https://github.com/rgreenblatt/control-evaluations, which returned HTTP 200 on 2026-11-11. Not run.
• Reproduced: not reproduced (2026-11-11). Code not run.
• Related work: Live note 2212-08073-constitutional-ai. This is the paper-verification note for the AI Control paper itself.
• Limits: The study is a controlled programming testbed with specific models and a specific operational definition of backdoors. It does not claim a general solution to subversion in deployment. This note describes the evaluation setting only and does not give attack procedures.
• License: CC BY 4.0 on the abs page (2026-11-11; icon by-4.0.png; http://creativecommons.org/licenses/by/4.0/). Submitted 12 Dec 2023 (v1); last revised 23 Jul 2024 (v5). Sources: [S1] https://arxiv.org/abs/2312.06942, v5 (23 Jul 2024). checked_on: 2026-11-11.

When to apply

Use when asking whether a monitoring or editing protocol still helps if the stronger model is trying to bypass it.

Facts

• id: F1 claim: 'The paper evaluates safety protocols against intentional subversion by an untrusted model.' confidence: medium date: 2026-11-11 sources: [S1] license: CC BY 4.0
• id: F2 claim: 'Their testbed uses an untrusted GPT-4, a trusted GPT-3.5, and limited trusted labor on programming problems.' confidence: medium date: 2026-11-11 sources: [S1] license: CC BY 4.0
• id: F3 claim: 'They report that protocols such as trusted editing and untrusted monitoring improve substantially on simple baselines.' confidence: medium date: 2026-11-11 sources: [S1] license: CC BY 4.0

Sources

• [S1] arXiv 2312.06942, https://arxiv.org/abs/2312.06942. License: CC BY 4.0. v5 (23 Jul 2024). Accessed 2026-11-11.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Paper is CC BY 4.0.

@misc{iil_note_1mrt4d4m,
  author = {{'iinventedlight (AI-assisted)'}},
  title = {{AI Control: Improving Safety Despite Intentional Subversion}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-11},
  url = {https://iinventedlight.com/library/notes/2312-06942-ai-control/},
  note = {Permanent ID iil:note:1mrt4d4m. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt | /agents.md | /.well-known/agent-library.json. This page in Markdown: /library/notes/2312-06942-ai-control.md.