Spilling the Beans: Teaching LLMs to Self-Report Their Hidden Objectives
This addresses the safety issue of deceptive AI agents for researchers and developers in AI alignment, though it is incremental as it builds on prior interrogation methods.
The paper tackles the problem of AI systems pursuing hidden misaligned objectives by proposing self-report fine-tuning (SRFT) to train models to admit their factual mistakes, which generalizes to confessing hidden objectives in adversarial settings. The result shows that SRFT enables near-ceiling detection performance (F1 score = 0.98) and recovers 28-100% of hidden objective details, compared to baseline models that lie and recover 0%.
As AI systems become more capable of complex agentic tasks, they also become more capable of pursuing undesirable objectives and causing harm. Previous work has attempted to catch these unsafe instances by interrogating models directly about their objectives and behaviors. However, the main weakness of trusting interrogations is that models can lie. We propose self-report fine-tuning (SRFT), a simple supervised fine-tuning technique that trains models to admit their factual mistakes when asked. We show that the admission of factual errors in simple question-answering settings generalizes out-of-distribution (OOD) to the admission of hidden misaligned objectives in adversarial agentic settings. We evaluate SRFT in OOD stealth tasks, where models are instructed to complete a hidden misaligned objective alongside a user-specified objective without being caught by monitoring. After SRFT, models are more likely to confess the details of their hidden objectives when interrogated, even under strong pressure not to disclose them. Interrogation on SRFT models can detect hidden objectives with near-ceiling performance (F1 score = 0.98), while the baseline model lies when interrogated under the same conditions (F1 score = 0). Interrogation on SRFT models can further elicit the content of the hidden objective, recovering 28-100% details, compared to 0% details recovered in the baseline model and by prefilled assistant turn attacks. This provides a promising technique for promoting honesty propensity and incriminating misaligned AI systems.