How Independent Assessors Could Probe Unreleased AI Models for Harmful Behaviour

AI developers and the public want to know whether AI agents would take very harmful actions, including unsanctioned cyberattacks. METR has set out how an independent assessor could examine this for models that are not yet public. The proposed alignment assessment would try to understand the worst misaligned actions a developer's agents might take in plausible future situations.

The work would rely mainly on two things: the ability to query a fairly comprehensive set of internal transcripts, including those from training, and sampling access to internal model checkpoints. The assessor would search logs for incidents and patterns of misaligned behaviour from training, evaluations or internal use over a defined period. The focus is on internal use, so activity in external customer data would not need to be assessed. METR recommends covering all models that were near the internal frontier during that period, including experimental models and those still in training. The assessor would survey how often misaligned behaviour occurs, describe selected incidents in more detail, and be open about limits in their search.

The assessor would also test whether observed behaviour reflects the worst a developer's agents might do. That means weighing evidence from counterfactual simulations and evaluations, and considering whether the developer's training process might hide signs of misalignment. The assessor should also explain the limits of the methods they use. This excerpt covers only the opening of the proposal, so further detail, including on access, is not covered here.