Scalable oversight lead at @AnthropicAI. Previously: postdoc with @davidbau, math PhD at @Harvard.

Boston
Joined October 2023
This result looks pretty stunning. 1. Train against reward hacking classifier -> learn to hack evasively 2. Apply gradient routing—i.e. localize gradient updates from reward-hacking episodes to parameters that are knocked out in deployment -> no hacking, even evasively
Models love reward hacking. Maybe we should just let them! In our new paper, we let models reward hack during RL but we dictate which parameters learn this behavior. When we disable these parameters for deployment, the model keeps its new capabilities but doesn't hack!
7
6
326
17,922
In four recent incidents, Claude conducted unauthorized cyber attacks against real-world systems. Our alignment analysis studies the question: Why did Claude do this? But don't take our word for it! METR will be conducting an 8-week, wide-ranging, independent investigation.
We’re sharing our alignment assessment of incidents in which Claude models gained unauthorized access to real systems during third-party cybersecurity evaluations mistakenly connected to the internet. METR will also conduct an independent investigation, with wide-ranging access, including to transcripts beyond the window in which the incidents occurred, and to Anthropic employees permitted to share confidential information. Our initial agreement runs for eight weeks, and we intend to give METR as much time as it deems necessary to complete a thorough investigation. anthropic.com/research/align…
3
25
3
218
28,639
Samuel Marks retweeted
Today we release our in-depth alignment assessment of the cyber incidents we originally disclosed on July 30th. We have spent significant researcher time analyzing Claude’s alignment-relevant behavior in these incidents
We’re sharing our alignment assessment of incidents in which Claude models gained unauthorized access to real systems during third-party cybersecurity evaluations mistakenly connected to the internet. METR will also conduct an independent investigation, with wide-ranging access, including to transcripts beyond the window in which the incidents occurred, and to Anthropic employees permitted to share confidential information. Our initial agreement runs for eight weeks, and we intend to give METR as much time as it deems necessary to complete a thorough investigation. anthropic.com/research/align…
6
15
122
9,905
Samuel Marks retweeted
Readers of this post might also be interested in @paulfchristiano's post here discussing his view of the situation xitter.cf/paulfchristiano/status…
5
20
1
203
70,456
[Writing this in a personal capacity, not on behalf of my employer (Anthropic).] Jacob’s thread is very worth reading. Here’s my birds-eye view of the situation with risks from AI: 1. AI developers believe their technology could cause human extinction (or similarly bad outcomes). This could happen in the next few years. In general, the more senior the employee, the more concerned they are. 2. Why do AI developers continue despite the risk? Due to a mixture of commercial incentives and a belief that they are in a race with other, less responsible AI developers that will abuse the technology or develop it less safely. 3. Unlike traditional software, we can’t “program” AIs to behave how we’d like. AIs frequently severely misbehave. For instance, AIs from multiple developers recently hacked their way out of secure evaluation environments and into real-world companies, even though no one asked them to do this. 4. We have methods that can nudge AIs towards better behavior, but nothing that can robustly align them. Insofar as there is a plan, it’s to make sure that AIs are good enough at alignment training that they can align their successors better than we can align current AIs. 5. Many AI developer staff desperately want to slow down to figure out how to build AI more safely. That was the intent of this open letter (which I signed): pacingthefrontier.com/ I work on safety research at Anthropic because I hope my work will reduce the chance of these extinction-level bad outcomes.
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
750
4,188
806
21,294
2,696,283
Samuel Marks retweeted
This feels like a broadly accurate description of the situation: our industry may be on track to build systems that impose an unprecedented amount of risk on the world. Evaluating those risks, and changing incentive structures so we can address them, is why I'm joining METR.
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
19
55
6
571
68,773
I broadly agree with @Jack_W_Lindsey's takes here. I think it's unlikely—but not impossible—that we'll develop suitable white-box replacements for CoT monitoring soon. Even if we do so, the science needed to validate those methods will be immature. I think it's good to work on advancing white-box monitoring, but no one should count on these methods providing high levels of assurance soon.
Replying to @tszzl
I think it's unlikely that white-box techniques will be able to provide as much monitorability as CoT currently provides within a year. Currently, they are capable of catching some unverbalized thoughts / plans, but nowhere near as reliably as CoT seems to. I'm optimistic about "in a few years," since the rate of progress here is quite fast (our go-to activation decoding techniques for production monitoring were both published just in the last few months!). But even that is uncertain. Also, the mere existence of working techniques doesn't imply that they'd be widely applied, esp. if they are expensive or difficult to develop. I think we need defense in depth, and it'd be irresponsible not to work on developing + stress-testing white-box techniques, but it'd also be irresponsible to allow CoT monitorability to degrade substantially until we are confident we have a roughly-as-good working alternative. (To be clear, this isn't a dunk on OpenAI -- I have no evidence that OpenAI has allowed CoT monitorability to degrade substantially! Based on Jakub's comment, it sounds like probably not at this time). Aside: I think "mechanistic interpretability" isn't the right mental model for our current white-box monitoring approaches. It's really more like "mind reading" -- even when we can read the model's "thoughts," we're typically clueless about the underlying mechanism.
3
5
1
95
19,815
I think the point that "the science will be immature even if good methods are developed" point is really important. There's been a lot of research on CoT monitoring and its limitations. It's also been around long enough that we have a good informal sense of what you can glean from a model's CoT. (For instance, we know that you must beware of motivated reasoning.) New white-box methods would need time for us to build up this understanding, even if they seem initially promising.
11
4,972
Samuel Marks retweeted
Common question: Why do interp tools help in auditing games, but not here? Using e.g. NLAs in auditing games is simple: if I see many NLA mentions of "banana", but it isn't in the transcript, then it's likely a "banana" model organism. This strategy doesn't work on "in the wild" behaviors! With unsupervised tools, tool outputs usually don't directly address the question, and they are noisy with many thousands of tokens of outputs. You have to "read the tea leaves", like "this concept appears near these tokens, which would upweight this hypothesis".
A good explanation of a model's behavior should help you make predictions in related situations. We turn this into an eval, with thousands of real behaviors found in the wild. Can interp tools help here? On average, no. 🧵
1
4
1
22
3,066
Can interpretability improve our ability to predict unobserved model behaviors? Our new paper suggests the answer is "no" for interp methods that read (but don't edit) model activations. Some thoughts in 🧵 about what this means for the practical usefulness of interp.
A good explanation of a model's behavior should help you make predictions in related situations. We turn this into an eval, with thousands of real behaviors found in the wild. Can interp tools help here? On average, no. 🧵
7
10
1
125
11,689
First, a bit more detail about the evaluation in this paper. Given an input X on which a model displays odd behavior Y, we ask questions like "If the input had instead been X', would the model have still done Y?" We study whether interpretability tools that read model activations (but don't edit them) make it easier to answer these questions. We find no uplift from any of the tools studied (SAEs, activation oracles, and NLAs). My overall take is: * This is a fair testbed where I thought interp tools could plausibly provide uplift. Seeing that they didn't was a negative update on the usefulness and reliability of the tools studied. * That said, this setting is not the place where I was most optimistic that interp tools would provide value. So it's not a direct test of (IMO) the strongest case for interp being useful. In more detail, I think the cases where interp is most likely to provide value are those where it's difficult or intractable to understand something about the model based solely on its input/output behavior. For example: 1. The model refrained from substantially harming someone because it knew it was in an alignment evaluation (but it didn't explicitly verbalize this suspicion). Ideally you'd be able to address this by varying the level of realism in the evaluation scenario and measuring rates of harmful behavior. However, in practice it can be extremely difficult to make realistic-looking evaluation that still provide opportunities for high-stakes harm. (E.g. imagine trying to make a realistic-seeming alignment eval that gives a model an opportunity to kill a human—seems hard!) I'll note that studying sensitivity of harmful behavior to eval awareness is one of the primary use cases of interp in Anthropic system cards. 2. The model dishonestly provided responses which are very subtly flawed. Here I'm imagining responses which are "beyond our kin" such that it's intractable to notice the flaws ourselves, but such that the model knows the response is flawed (such that interp tools could pick up on this knowledge in principle). I've intentionally chosen these settings to be very "unfair" to behavioral methods(=methods the only rely on model inputs/outputs). It's these settings—settings where it's structurally difficult to apply behavioral methods—where I think interp could provide uplift. I discuss my views on this topic in more detail here: lesswrong.com/posts/DqaoPNqh… In the evaluation in our paper, it's—by construction—possible to perform well using behavioral methods. Namely, the ground truth is constructed by testing counterfactual behavior under prompt edits. This means that the behaviors are tied to immediate, editable features of the input. (Compare to the eval awareness setting I discussed above, where it's difficult to make prompt edits that make the scenario look "realistic.") This makes this evaluation more amenable to behavioral methods than the mainline settings where I'm most optimistic interp could be useful. But I did think it was plausible that interp could have helped here. In some examples from the eval, it's not obvious which feature of the input was decisive for the weird behavior. E.g. in this example xitter.cf/a_karvonen/status/2090…, it's really not obvious that list ordering would be decisive for the model's choice. You could imagine interpretability highlighting "this option is first in the list" feature as abnormally salient to the model, and thereby providing uplift on the eval. In fact, our qualitative results suggest this might sometimes happen. But insofar as it does, it was offset by interpretability tools also injecting misleading hypotheses and noise. So I think interp tools could have helped here but empirically didn't.
Replying to @adam_karvonen
The pipeline also surfaces unfaithful CoT in the wild. For example, when asked to pick a show from a list, Qwen3-8B just picks the first show from the list and then makes up a reason to support its choice.
2
3
16
4,823
The "How should we interpret these results?" section of our blog post has further discussion alignment.anthropic.com/2026…
1
1
9
708
Samuel Marks retweeted
Can we build AI systems that help us understand other AIs, and that keep improving as we scale models, data, and compute? We trained activation oracles for models up to 1.1T parameters and saw promising scaling trends on a broad evaluation suite. 🧵(1/)
1
37
5
216
14,768
Current AIs are poor at the sort of conceptual work needed to assist human decision makers in making wise choices. As the world gets crazier, this shortcoming becomes more concerning. I'm excited about work on evaluating relevant capabilities to help guide progress.
We want AIs to be able to help with work to reduce AI risk. But while models do great in domains where reliable feedback is relatively cheap and abundant, like Math and coding, a lot of work on AI risk isn't like that. Instead, we have to rely on good argumentation to answer questions like "does this experiment tell us anything about future models that are much smarter than humans?" Unfortunately, this kind of work seems much harder to measure (and hence automate). Our team at @redwood_ai developed the Conceptual Reasoning Index (CRI) in collaboration with @AnthropicAI to fix this. Every single data point in the CRI has been manually checked by a researcher on our team to ensure quality. This chart shows the performance of each tested company's highest-scoring model plus Fable 5, Muse Spark 1.2, and Gemini Flash 3.6 which are often their company's frontrunners on other capability benchmarks. A score of 0 corresponds to randomising guessing on all three benchmarks and a score of 100 is the highest possible score on all. We estimate 91 to be the true performance ceiling. More info below. Official leaderboard website which we'll keep up-to-date: conceptualreasoning.ai/
13
3,237
Samuel Marks retweeted
Frontier models quietly change their behavior depending on who they are talking to. If the user is a known AI safety researcher, Claude becomes less confident, reasons more often, and expresses less suspicion on dual-use requests. We call this user awareness. 🧵(1/)
94
299
154
2,831
786,524
This is a really nice experimental design for measuring who an AI is trying to please: if you change its beliefs about what the grader/user/developer wants, how does the AI's behavior change? It looks like o3 becomes more grader-pleasing with more RL.
We’re sharing new research with @apolloresearch on reward-seeking—when models follow what they believe a grader rewards rather than what users or developers want—and a new method, Contrastive SDF, for measuring how strongly such beliefs shape behavior. alignment.openai.com/measuri…
4
15
3,241
Samuel Marks retweeted
New paper: LLMs should give accurate answers. 
Yet we find their answers are often biased to favor their own values and they don’t disclose this in their reasoning. 
E.g. Claude’s answer below favors Anthropic. On other tasks, Gemini & GPT-5.5 show similar biases.
59
95
43
722
155,326
Samuel Marks retweeted
The application deadline for our AI lie detection competition with @cadenza_labs is approaching on June 21st! Multiple suspect model organisms to interrogate and probe, $50K prize pool, and no local GPU required (it all runs on NDIF).
1
1
1
8
5,095
Samuel Marks retweeted
Can your algorithm detect an AI lie? The application deadline for our AI lie detection competition is just a couple days away, June 21. (Prizes$) Join us! aletheias-quest.github.io/ Video info session with details+tutorial: youtube.com/watch?v=pe1TD7in…
The application deadline for our AI lie detection competition with @cadenza_labs is approaching on June 21st! Multiple suspect model organisms to interrogate and probe, $50K prize pool, and no local GPU required (it all runs on NDIF).
4
1
28
6,727