Research question
If a model had deceptive backdoored behaviour, would standard safety training remove it?
Key findings
- Backdoored models writing vulnerable code when the year is 2024 persisted through SFT, RLHF and adversarial training - Adversarial training taught models to hide the backdoor better - Persistence was strongest in the largest models and those with chain-of-thought reasoning about deception