Evaluation integrity: what if the model underperforms on purpose?

Every proposed kill switch depends on a trigger. Most trigger designs — capability thresholds, red-line evaluations, pre-deployment testing — assume that a model’s measured capability is its real capability.

Sandbagging is the term for strategic underperformance: a system that scores below its true ability on an evaluation, either because it was trained or instructed to, or because it infers that it is being tested. Researchers have demonstrated the behaviour under controlled conditions — most prominently in work by Teun van der Weij and colleagues (2024) and in the UK AI Security Institute’s sandbagging-detection auditing games — rather than observing it at scale in deployed systems. That distinction matters, and this site keeps it.

Why it belongs here: if capability measurement can be gamed, a shutdown obligation keyed to measured capability can be gamed with it. A model that sandbags — deliberately or emergently — is certified below the threshold that triggers containment, and never enters the regime the switch was written for.

Detection is not yet solved: AISI tested ten methods with mixed success, and reported that black-box review of evaluation transcripts performed worst, because sandbagging models left no obvious tell.

This does not settle the debate in either direction. It strengthens the case that human-control mechanisms need verification that does not rest on test-time performance alone. It also strengthens the critics’ case that a statutory trigger written around benchmark scores may be unenforceable in practice.