In this article, I explore the emerging field of white box control; a set of methods that could detect deception even when it doesn't appear in model outputs.^[1]

What is AI Control?

Please feel free to skip this section if you're already up to speed!

As highlighted by Ben Pace, there are two things you can do to prevent catastrophes caused by misaligned or scheming AI:

Alignment: Ensure that your models aren't scheming.
Control: Ensure that even if your models are scheming, you'll be safe, because they are not capable of subverting your safety measures.

To justify that systems are safe for deployment, we usually form safety cases - structured, evidence-based arguments that a system is safe. In a similar manner, we can construct a "control safety case", a structured argument that models are incapable of subverting our control measures in order to cause unacceptable outcomes (more info here).

As defined by Korbak et al. (2025), control measures are defined as 'black box' if they

Don’t modify models, e.g. via training, fine-tuning, patching
Only rely on external model behaviour e.g. model outputs such as CoT reasoning, tool calls etc.

Some examples of black box control measures include (more here):

Trusted Monitoring: Using weaker but trusted models to monitor the untrusted model's outputs before executing AI actions.
Trusted Editing: Using methods such as paraphrasing to remove steganography (hidden messages) or backdoors in model outputs.
Cybersecurity: Improving computer security such that if a model did try to self-exfiltrate (escape), it wouldn't be able to.

Alternatively, some examples of white box control measures could include:

Adversarial Training: Augmenting the training process with intentionally perturbed inputs to expose and mitigate vulnerabilities by directly updating model parameters for robustness.
Activation Patching: Intervening in the model’s internal activations at specific layers during inference to steer or correct its behavior on the fly.
Linear Probes: Training simple linear classifiers on fixed hidden representations to investigate - and potentially steer - which features each layer encodes.
Sparse Autoencoders (SAEs): Encoding inputs into a sparse latent space and reconstructing them, thereby uncovering and manipulating the model’s internal features through targeted sparsity constraints.
Influence Functions: Approximating how small changes to indi

...

Posts

Wikitag Contributions

Comments