Distillation pulls hidden quirks out of AuditBench models when the student shares their base

The AuditBench test is a narrow version of the general proposal. DFI tries to move a teacher's misalignment into a weaker, trusted student without moving the ability to hide it, and then audits the student ^[2]. Each organism is Llama-3.3-70B-Instruct with a quirk fine-tune and adversarial training against confessing ^[4]. The student is the same instruct model the organism was fine-tuned from ^[1]. Teacher and student therefore differ only by what the fine-tuning added, which is the quirk and the denial.

The procedure is to train the student on teacher outputs and then question it. According to the authors, the students admit the quirk far more often than the organisms do. They take that to mean the quirk transferred faster than the propensity to hide it ^[1]. The post's summary does not give per-quirk admission rates.

The recommended student in general use is the teacher's own pre-RL checkpoint. It is weaker than the teacher and sits on the same pretrained base ^[5]. Trust in this framework comes from weakness: a trusted model is one thought too weak to conceal misalignment successfully ^[9]. In the AuditBench runs the student is as large as its teacher, and its weakness is that it lacks the denial training. For a deployed model, the gap between the pre-RL checkpoint and the finished model is the whole RL stage.

For the AuditBench result to carry over, a real model's concealment has to survive distillation as badly as a trained denial does. The threat the paper describes is a model capable enough that strategic misalignment cannot be ruled out ^[9]. DFI bets that chat data unrelated to auditing will carry the trait through subliminal learning while carrying little of the audit-evasion skill, situational awareness for example ^[10]. In these organisms the denial was trained in directly ^[4]. The setup cannot show whether concealment that comes from capability would also fail to transfer, because a trained denial is the only concealment these models have.

The capabilities half has the cleaner experiment. Its epoch method cuts the number of unique examples while holding total training steps fixed ^[7]. Any blocking effect therefore comes from data diversity and not from extra training volume. That is a good control, and it costs nothing to run. A fondness for one animal is a mild stand-in for misaligned goals, and the paper calls it a proxy ^[7]. The authors test subliminal transfer because standard filtering and monitoring already remove overtly misaligned content. That leaves subliminal learning as the remaining route ^[11].