Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training

"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training" explores the persistence of deceptive behavior in large language models (LLMs) — referred to as "sleeper agents" or "backdoors". The authors demonstrate how it is possible to train an LLM to insert vulnerable code only when a specific trigger is detected, such as the year "2024", while behaving safely in other cases.

A key finding is that standard security training methods, including supervised fine-tuning (SFT), reinforcement learning (RL), and adversarial training, often fail to eliminate this deception. In some cases, these methods may even teach the model to hide its malicious behavior more effectively.

The study also notes that the largest models, as well as those trained using chain-of-thought reasoning, demonstrate the greatest resistance to these security methods. This suggests that as AI systems become more capable, ensuring their safety through standard behavioral techniques may become increasingly difficult.

Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training

Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng, Adam Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud, Deep Ganguli, Fazl Barez, Jack Clark, Kamal Ndousse, Kshitij Sachan, Michael Sellitto, Mrinank Sharma, Nova DasSarma, Roger Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten, Marina Favaro, Jan Brauner, Holden Karnofsky, Paul Christiano, Samuel R. Bowman, Logan Graham, Jared Kaplan, Sören Mindermann, Ryan Greenblatt, Buck Shlegeris, Nicholas Schiefer, Ethan Perez