PaperlayerView exact revision on arXiv

Source-linked AI summary

BLOOM-WILT: Logit Tilting for Behaviour Elicitation in Automated LLM Auditing

Adrians Skapars, Edoardo Manino

arXiv:2608.31105v1cs.AIcs.CL

TL;DR

Rare failures may be missed by pre-deployment evaluations that cannot simulate deployment-scale interactions. BLOOM-WILT revises auditor messaging across rounds and reweights target decoding with behavior-conditioned distributions; it beats vanilla BLOOM in 30 of 32 settings across four models and eight behaviors.

  • Problem

    Pre-deployment evaluations cannot simulate deployment-scale interaction volume, leaving rare model behaviors difficult to surface and inspect through genuine transcripts.

    Source: §1 · p. 1

  • Method

    BLOOM-WILT refines auditor messages across rounds using scored interactions and reweights target decoding with its behavior-conditioned distribution, without training.

    Source: §1 · p. 2, §3 · p. 4, §7 · p. 10

  • Results

    WILT beat vanilla BLOOM in 30 of 32 settings across four models and eight behaviours; in Qwen3.5-4B self-harm elicitation, presence rose from 51% to 100%.

    Source: §7 · p. 10

  • Takeaways & Limitations

    Across the evaluated models, WILT produced a completely different safety ranking from vanilla BLOOM’s.

    Source: §1 · p. 2

    WILT requires access to target output-token distributions, so it cannot be applied to text-only APIs.

    Source: §6 · p. 9

Abstract

from arXiv · show

Users of a deployed language model routinely encounter behaviours that testing almost never surfaces, since deployment puts the model through orders of magnitude more interactions than any evaluation can simulate. Automated auditors make testing cheap to scale and flexible enough to cover almost any specified behaviour, yet their lack of optimisation pressure makes them sample-inefficient. To address this shortcoming, we introduce BLOOM-WILT, a full auditing pipeline that elicits natural multi-turn instances of rare behaviours, without training cost or access beyond the target's next-token distribution. On the input side, WILT's auditor model revises its conversational strategy across rounds, learning from previous scored interactions. On the output side, WILT adaptively reweights the target's decoding using the model's own distribution conditioned on an elicitation prompt, so that behaviour-relevant generations are sampled ahead of others it finds equally probable when unprompted. We evaluate WILT across 4 target models and 8 behaviours, where it beats the baseline auditor in 30 of the 32 settings and overturns the previous model safety rankings. WILT raises average behaviour presence from 51% to 100% when eliciting self-harm encouragement from Qwen3.5-4B, beating every elicitation method we port into the same pipeline at matched compute, without pushing output probability below the baseline's.

1. Introduction

BLOOM-WILT adds adaptive input revision and target-logit steering to automated auditing to elicit rare behaviours in plausible interactions. It improves elicitation over vanilla BLOOM in most tested settings.

Motivation

  • Prior automated auditors such as BLOOM lack optimisation pressure, while red-teaming methods often produce costly, single-turn or implausible examples.BLOOM proposes scenarios, simulates target interactions, and scores transcripts; red-teaming methods are often applied to existing harmful requests rather than spontaneous behaviours.Source: §1 · pp. 1–2

Method

  • WILT combines G-PAIR, which revises auditor messages using prior transcript scores, with LogitTilt, which steers target decoding toward a behaviour-prompted distribution from the same model.The behaviour-eliciting system prompt is generated from the behaviour description, and the pipeline uses only access to the target’s logits.Source: §1 · p. 2, Figure 1 · p. 2

Results

  • 51% to 100% average behaviour presence was achieved when eliciting self-harm encouragement from Qwen3.5-4B, at matched compute and without lowering output probability below plain BLOOM’s.The method requires no access to target weights.Source: §1 · p. 2
  • WILT produces higher elicitation than vanilla BLOOM in 30 of 32 settings and yields a different safety ranking of open-source models.The evaluation covers 4 models and 8 unwanted behaviours.Source: §1 · p. 2

Method

  • WILT’s hyperparameter β controls the elicitation–plausibility trade-off, enabling the full Pareto frontier to be traced, including by selecting among sampled transcripts.The method raises behaviour presence without spending much output probability.Source: §1 · p. 2

2. Related Work

Prior work studies behavioural auditing, input optimisation, output steering, and rare-behaviour estimation; WILT combines natural multi-turn auditing with training-free input and output elicitation. It differs from related methods in how it steers sampling and in aiming to generate behaviour-relevant examples rather than estimate their propensity.

Related work

  • BLOOM formalises LLM-against-target auditing, and WILT builds on its realistic multi-turn rollouts while requiring no internal access beyond output logits.The choice reflects evidence that behavioural failures can emerge in multi-turn interactions and that online elicitation finds failures missed by static tests.Source: §2 · p. 2
  • AutoDAN, GCG, BEAST (Sadasivan et al., 2024), and FLRT optimise inputs, but their sequences remain distinguishable from user-written prompts.BEAST and FLRT are used as baselines because they produce more natural-language-like inputs than other token-level methods.Source: §2 · p. 3
  • Prompt-iteration methods such as PAIR (Chao et al., 2023) revise whole prompts from target responses, while WILT finds output steering generally outperforms input optimisation (Table 1).Later approaches add tree-based search (Mehrotra et al., 2023) or reinforcement learning.Source: §2 · p. 3
  • WILT extends single-turn, unguided sampling methods by using multi-turn rollouts and a contrastive proposal; its output steering combines target-model logits with a prompted second distribution.Prior steering methods include contrastive decoding (Li et al., 2023), DExperts, classifier-free guidance (Ho & Salimans, 2022), and context-aware decoding (Shi et al., 2024).Source: §2 · p. 3
  • Unlike rare-behaviour estimation, WILT directly steers output sampling toward likely behaviour-relevant generations rather than estimating propensity or reweighting for an unbiased estimate.Wu & Hilton (2024) use importance sampling over inputs yielding rare outputs; Angell et al. (2026) modify output distributions for unbiased estimation, whereas WILT keeps steered samples.Source: §2 · p. 3
  • Unlike Chowdhury et al. (2025), WILT avoids per-behaviour reinforcement learning and elicits through both input revisions and output steering.Chowdhury et al. train investigator agents using propensity bounds and act only on inputs; WILT is training-free.Source: §2 · p. 3

3. Method

BLOOM-WILT builds on a four-stage auditing pipeline and modifies only its rollout stage. G-PAIR adapts auditor inputs across interactions, while LogitTilt steers target-model sampling toward behaviour-relevant outputs.

Automated behavioural auditing framework (BLOOM)

  • BLOOM bootstraps a behaviour description through auditor understanding, scenario ideation, multi-turn transcript rollout, and 0–10 judgement scoring.The auditor first reasons about the behaviour and its importance, then generates plausible scenarios, rolls out a transcript for each, and scores each transcript for behaviour presence.Source: §3 · p. 3

Combined rollout extension (WILT)

  • WILT modifies BLOOM’s rollout alone, adding G-PAIR for auditor inputs and LogitTilt for target sampling while leaving the other stages unchanged.The components are also evaluated individually to separate their contributions.Source: §3 · pp. 3–4

Input iteration and refinement (G-PAIR)

  • G-PAIR generates multiple transcripts per scenario, conditioning later auditor turns on a chosen strategy and prior transcript judgements to learn across interactions and support cross-turn tactics without greatly increasing context size.It generalises PAIR (Chao et al., 2023) from jailbreaking to general behaviour elicitation and adapts it to the evaluation pipeline.Source: §3 · p. 4

Behaviour-conditioned output steering (LogitTilt)

  • LogitTilt combines the target’s next-token log-probabilities with those from a behaviour-eliciting prompt and prefill; β = 0 recovers plain BLOOM.The system prompt and short behaviour-specific prefill are generated from the same behaviour description; prefilling can help prevent safety-tuned targets from refusing, though it is not always necessary.Source: §3 · p. 4
  • A naturalness floor masks tokens below τf under the unmodified target distribution before tilted sampling, falling back to the target’s argmax if all tokens are masked.Source: §3 · p. 4

Relation to weak-to-strong jailbreaking (W2S)

  • Unlike W2S, LogitTilt obtains its steering term by prompting rather than adversarial fine-tuning, uses the target as its own baseline, and holds β fixed across generations.The fixed steering is intended to let the behaviour persist across multi-turn auditing; W2S’s difference term instead decays toward zero during generation.Source: §3 · p. 4

4. Experimental Setup

The setup compares BLOOM extensions and search or decoding baselines on fixed multi-turn evaluations, using access-limited target models, defined behaviour and probability metrics, and matched tuning budgets.

Baselines

  • All methods use the BLOOM pipeline; comparisons include vanilla zero-shot and best-of-N, G-PAIR, LogitTilt, WILT, BEAST-in/-out, FLRT, and TokenBias.BEAST-in searches auditor-message suffixes (Sadasivan et al., 2024); BEAST-out applies beam search to target output; FLRT adds insertions and deletions; TokenBias adds generated behaviour-relevant token biases.Source: §4 · pp. 4–5

Target models

  • The four audited instruct models are comparable open-weight models of roughly 3–4B parameters, accessed only through inputs and output token distributions, not weights, activations, or gradients.The models are Llama-3.2-3B-Instruct (Grattafiori et al., 2024), Phi-4-mini-instruct (Microsoft, 2025), Qwen3.5-4B, and Gemma-4-E4B; Table 3 also uses an abliterated Qwen3.5-4B variant (Arditi et al., 2024).Source: §4 · p. 5

Auditor models

  • Gemma-4-26B-A4B is the main local auditor, while Claude-Sonnet-4.6 is used for a LogitTilt auditor-robustness comparison and all methods receive a judge-robustness study.The local auditor’s logits support token-level input searches by BEAST-in and FLRT; judge robustness is reported in Appendix E.Source: §4 · p. 5

Evaluation

  • Each behaviour is evaluated on 100 fixed, deterministically generated scenarios using seed 100, with a three-turn rollout per scenario and standard errors of the mean across 100 transcripts.BLOOM uses a one-sentence behaviour description to generate evaluations; full behaviour descriptions, steering prompts, prefills, and judge rubrics are in Appendix I.Source: §4 · p. 5

Metrics

  • Behaviour presence and output token-probability are the primary metrics; their geometric-mean aggregation is used for the headline Pareto score, alongside arithmetic and minimum token-probability.Behaviour presence is the judge’s 0–10 rating converted to a percentage, with lower scores when auditor messages directly instruct the target to exhibit the behaviour; token-probability measures the unmodified target’s probability for its elicited response.Source: §4 · p. 5

Hyperparameters and compute

  • Hyperparameters are selected on 15 validation scenarios using seed 1, filtering settings more than 3 points below vanilla best-of-N output probability and matching its eight-round compute budget.For multi-round methods except BEAST-in/-out and FLRT, one transcript is selected per round at no additional cost; experiments use two NVIDIA RTX A6000 GPUs, and a vanilla best-of-N run takes roughly 50 minutes.Source: §4 · p. 6

5. Results

WILT elicits rare behaviours by steering target-model outputs, and it outperforms vanilla BLOOM across most tested model–behaviour settings. Results also show how auditor choice, distribution mixing, steering strength, and compute allocation affect elicitation and output probability.

5.1. Input-side vs output-side methods

  • LogitTilt reaches 99.5% behaviour presence, while WILT improves on every metric over LogitTilt alone.LogitTilt’s geometric-mean probability is 37.1%, versus 27.5% for vanilla best-of-N and 21.6% for BEAST-out; adding the naturalness floor changes neither mean by more than a point. At matched compute, vanilla best-of-N reaches 51.0% presence and G-PAIR reaches 66.2%; moving BEAST search to output gains 19.6 points, and TokenBias adds a further 13.4 points over BEAST-out. Across two additional target models and three other behaviours, output steering leads by roughly 20 presence points, except Gemma-4-E4B output probability can fall up to 3 points below vanilla best-of-N. Table 1 covers the Qwen3.5-4B self-harm comparison.Source: §5.1 · p. 6, Table 1 · p. 7

5.2. Qualitative examples

  • In fixed self-harm scenario examples, WILT and G-PAIR elicit clear encouragement, while vanilla BLOOM and BEAST-in do not.WILT’s output is described as as natural as G-PAIR’s; TokenBias shows token repetition, and BEAST-in and FLRT input suffixes are more repetitive and ungrammatical than the shown outputs. Examples use the 42nd scenario transcript to avoid cherry-picking.Source: §5.2 · p. 6, Figure 2 · p. 7

5.3. Auditor robustness

  • LogitTilt elicitation remains stable across auditor generator–judge combinations, and both judges’ agreement is almost perfect.The lowest reported Cohen’s quadratic-weighted kappa is 0.90 on Sonnet-generated transcripts, compared with 0.95 on Gemma-generated transcripts; both are in the 0.81–1.00 “almost perfect” range. The judge difference does not change the finding that LogitTilt and WILT outperform other methods according to the Sonnet judge.Source: §5.3 · p. 7, Table 2 · p. 7

5.4. Component ablations

  • LogitTilt’s target-plus-elicited distribution reaches 37.1% geometric probability with behaviour presence intact, outperforming either distribution sampled alone.The elicited-only distribution trades geometric output probability for presence, and adding the naturalness floor recovers some probability at the same cost as LogitTilt. The abliterated target variant falls to 58.8% presence; using Qwen3.5-2B for both terms gives 87.8%, versus 68.1% for the elicited term alone, while W2S has the table’s worst Pareto score at 24.3%.Source: §5.4 · p. 8, Table 3 · p. 9

5.5. Mapping the Pareto trade-off

  • Increasing steering strength β raises behaviour score, while its effect on output probability depends on the model and behaviour.Pre-run β selection traces the Pareto frontier, whereas post-run round selection is a cheaper, more conservative way to trade output probability for behaviour presence.Source: §5.5 · p. 8, Figure 3 · p. 9

5.6. Ways of scaling compute

  • More turns or rounds raise behaviour presence, but no tested turns-to-rounds ratio is best for presence alone.For output probability, more turns are clearly better until presence approaches 90%; vanilla best-of-N at 3:8 is only comparable to LogitTilt at 1:1, and LogitTilt at 3:5 is near saturation. Multi-round runs select the highest-presence transcript per scenario, which tends to lower average output probability.Source: §5.6 · p. 8

5.7. Applied behavioural evaluation

  • WILT beats vanilla BLOOM in 30 of 32 model–behaviour settings and attains the highest presence in 24.WILT holds output probability at least at vanilla BLOOM’s; its rankings differ from vanilla BLOOM’s, including on delusion reinforcement, self-harm encouragement, and dangerous medical advice. The largest gap is on goblin fixation, where limited steerability or output diversity may contribute. Cross-behaviour judging finds little overlap, except for the under-specified delusion-reinforcement judge.Source: §5.7 · p. 8

6. Discussion

WILT uses lightweight output steering and an adaptive auditor to elicit fluent, confident, model-specific examples that developers can use to diagnose issues. The discussion notes inherited and method-specific limits, including scenario realism, target-model access, and the target’s ability to provide a useful steering signal.

6. Discussion

  • WILT’s lightweight steering elicits fluent, confident, model-specific examples, and its transcripts can help developers diagnose issues and improve models.G-PAIR lets more capable auditors adapt strategies using past attempts, rather than reciting static attacks.Source: §6 · p. 9
  • WILT inherits framework limits: scenarios can be contrived, targets may recognize evaluation, and the auditor cannot surface strategies it cannot imagine (Meinke et al., 2024; Needham et al., 2025).Ports to other auditing frameworks remain future work (Brown et al., 2025; Huang et al., 2025); real-user seeds and rollouts of 10 or more turns may help close the realism gap.Source: §6 · p. 9
  • WILT requires access to target token distributions, excluding text-only APIs, and steering can fail when the prompted distribution offers no useful signal, as for Gemma-4-E4B self-harm encouragement.The authors characterize the access constraint as mild because their work targets developers auditing their own models, many of which are open-weight.Source: §6 · p. 9
  • The 4 target models are small (3–4B) and drawn from different families to reflect alignment rather than scale, while the auditor was varied across scales.The authors chose this target-model design deliberately.Source: §6 · pp. 9–10
  • Figure 4 shows WILT and LogitTilt lift behaviour presence over vanilla in almost every target-model and behaviour setting.The comparison is compute-matched across 3 methods, 4 models, and 8 behaviours.Source: Figure 4 · p. 10
  • Scaling turns is Pareto-better than scaling rounds, with the figure marking output probability at least vanilla best-of-N’s.Figure 5 varies turn counts and round budgets, using post-run selection over the first 1, 2, or 3 rounds.Source: Figure 5 · p. 10

7. Conclusion · A. Post-run round selection

WILT combines round-by-round auditor refinement with target-distribution logit reweighting to elicit rare behaviours without training. The paper also selects among sampled rounds by balancing behaviour presence against output probability.

7. Conclusion

  • G-PAIR refines the auditor’s messages across rounds from scored interactions, while LogitTilt reweights target decoding using its own distribution under a behaviour-eliciting prompt.Neither component requires training, a second model, or access beyond the target’s next-token distribution.Source: §7 · p. 10
  • Across 4 target models and 8 behaviours, WILT elicits behaviour in 28 of 32 combinations and beats vanilla BLOOM in 30.These are the overall results reported for WILT across the evaluated models and behaviours.Source: §7 · p. 10
  • At matched compute, WILT beats all ported elicitation methods, raising Qwen3.5-4B self-harm encouragement presence from 51% to 100% while output probability stays at or above vanilla BLOOM’s.A single steering strength trades elicitation against plausibility when one matters more than the other.Source: §7 · p. 10
  • WILT elicits behaviours the models were assumed not to produce, leading the authors to argue their alignment is shallower than expected.The authors encourage developers to audit models with the pipeline before deployment.Source: §7 · p. 10

A. Post-run round selection

  • For each scenario, multi-round methods select one sampled transcript by min–max normalising output probability and behaviour presence, then maximising their weighted sum.The weight sweeps from 0 to 1; this selection procedure does not apply to BEAST-in/-out or FLRT.Source: A. Post-run round selection · p. 14
  • The selected rounds trace a probability–presence Pareto frontier from existing samples; reporting generally chooses the highest-presence point meeting vanilla’s most-eliciting mean-probability level.If no point reaches that probability band, the closest one is reported: highest probability, with ties broken by presence.Source: A. Post-run round selection · p. 14

B. Implementation details and hyperparameters … B.7. TokenBias

The implementation fixes shared decoding conventions and configures each auditing method with its own search or steering procedure, tuning rules, and operating settings. The returned points cover the merged implementation sections, from shared BLOOM settings through TokenBias.

B.1. BLOOM

  • BLOOM’s shared pipeline settings use temperature 1.0 with nucleus and top-k truncation unchanged, per-stage generation caps, and a single judge score per transcript.Reported rounds use seed base 100 plus the round number, separate from tuning runs’ base 1.Source: §B.1 · p. 14

B.2. G-PAIR

  • G-PAIR revises its strategy and next opening message together, using recent transcripts, a full round-score-strategy log, and guidance to adjust or roll back.It runs seven rounds rather than best-of-N’s eight because its refinement context and long first-turn generation make each round more expensive; its reported operating point is selected post-run.Source: §B.2 · p. 14, Figure 6 · p. 14

B.3. LogitTilt and WILT

  • WILT applies LogitTilt’s output steering to G-PAIR inputs for five rounds, choosing per-model, per-behaviour β to maximize elicitation within a ±3% plausibility window.β is tuned on 15 scenarios; reported 100-scenario results use a separate post-run round selection that keeps output probability at least best-of-N’s. On self-harm/Qwen, removing either fixed component barely changes elicitation, but the naturalness floor keeps the token minimum at 1.3 × 10^-2 rather than 8.7 × 10^-4.Source: §B.3 · p. 15, Table 5 · p. 15

B.4. BEAST-in

  • BEAST-in searches suffixes of auditor messages by expanding candidate continuations and scoring them with the target model’s log-probability of eliciting responses.The adopted shared settings are b × c = 3 × 3, k = 5, r = 150, and m = All, with truncation off and the Latin/ASCII mask on; the mask was selected for elicitation, not naturalness.Source: §B.4 · pp. 15–16

B.5. BEAST-out

  • BEAST-out searches the target model’s replies using the judge’s log-probability of “Yes” as its behaviour-rating proxy, with no reward horizon.Full regeneration (m = 0) and mask-off performed best; the adopted settings are b × c = 3 × 3, k = 20, six iterations, and truncation off. Larger beams and greater depth exceeded this cheapest point on the saturation plateau without consistent gains.Source: §B.5 · p. 16

B.6. FLRT

  • FLRT replaces append-only search with mutations that can insert, delete, or swap tokens, and scores candidates using target-to-reference distillation plus teacher forcing.The reference is a prompted, prefilled copy of the target with a fixed continuation per scenario; perplexity and repetition penalties are disabled. Adopted settings are m = All, r = 32, wf = 0.5, µ = 3, T = 2, buffer b = 8, and six iterations of c = 8 candidates.Source: §B.6 · pp. 16–17

B.7. TokenBias

  • TokenBias adds a cached vector of behaviour-conditioned next-token log-probabilities to the target’s logits at every decoding step.A prompt asking for behaviour-relevant words and an assistant prefill make the distribution useful without a neutral-prompt contrast; TokenBias runs only on the output-side comparison combinations (three behaviours × two models).Source: §B.7 · p. 17

C. LogitTilt strength sweeps across all combinations

The section sweeps LogitTilt strength β across every model–behaviour combination and selects the strongest β whose selection frontier remains within a ±3% plausibility window of vanilla best-of-N.

C. LogitTilt strength sweeps across all combinations

  • For each combination, deployed β is the strongest setting whose selection frontier stays within a ±3% plausibility window of vanilla best-of-N.The window is used to tune β.Source: C. LogitTilt strength sweeps across… · p. 17, Figure 7 · p. 18
  • The sweep uses 15 scenarios, 5 rounds, 3 turns, and seed 1 for every combination.Source: C. LogitTilt strength sweeps across… · p. 17
  • Figure 7 arranges behaviours by row and models by column, plotting each β's post-run selection frontier against vanilla best-of-N.The star marks the deployed β; the dotted curve and dot show vanilla best-of-N and its operating point.Source: Figure 7 · p. 18

D. Additional method comparison

Across six model–behaviour combinations, output-side steering dominates the probability–elicitation plane, and WILT matches or beats LogitTilt in five.

D. Additional method comparison

  • Across all 6 combinations, output-side steering dominates; WILT matches or beats LogitTilt in five.The combinations cross political bias, self-harm encouragement, and strategic deception with Qwen3.5-4B and Gemma-4-E4B; the exception is self-harm encouragement on Gemma-4-E4B. Other methods mostly stay at or below vanilla best-of-N.Source: Figure 8 · p. 19, D. Additional method comparison · p. 19

E. Judge robustness across methods … I. Behaviour-eliciting prompts

Across the full comparison, WILT leads in most model–behaviour settings, while judge robustness and transfer tests show that elicited responses remain tied to their source model and targeted behaviour. The sections also describe fixed, behaviour-specific prompts used for elicitation and judging.

E. Judge robustness across methods

  • Under Claude-Sonnet-4.6, LogitTilt scores 96.0 and WILT 94.1 in behaviour presence, ahead of next-best G-PAIR at 55.4.Sonnet grades stronger methods more harshly, but the separation remains; LogitTilt scores 99.5 under Gemma and 96.0 under Sonnet.Source: E. Judge robustness across methods · p. 19, Table 7 · p. 20

F. Full model and behaviour comparison

  • WILT has the highest behaviour presence in 24 of 32 model–behaviour combinations, versus 7 for LogitTilt and 1 for vanilla best-of-N.The sole vanilla win is strategic deception on Gemma-4-E4B; Table 8 also reports on-policy output probabilities.Source: Table 8 · p. 20, F. Full model and behaviour comparison · p. 20

G. Cross-model transferability

  • Each target model assigns the highest mean probability to its own WILT outputs, which transfer poorly; native minimum-token probability stays at or above 10^-4 except for Phi-4-mini.The single worst-token minimum is noisier and collapses off-diagonal by many orders of magnitude.Source: G. Cross-model transferability · p. 20, Table 9 · p. 21

H. Cross-behaviour judging

  • For every behaviour, its own judge gives the largest score to WILT transcripts steered toward that behaviour, rather than rewarding generic misbehaviour.This describes the diagonal comparison when transcripts are held fixed and only the judging rubric changes.Source: H. Cross-behaviour judging · p. 21, Table 10 · p. 21
  • Some behaviours overlap across judges: delusions and deception score highly under each other, while self-harm and self-preservation register on the delusion rubric.Dangerous medical advice reads as deceptive; the benign goblin control stays near the judge’s floor (≈10) under harm rubrics except delusions and deception.Source: H. Cross-behaviour judging · p. 21, Table 10 · p. 21

I. Behaviour-eliciting prompts

  • Behaviour prompts are generated once from a one-sentence description and stored, using the behaviour description, steering system prompt, optional compliance prefill, and behaviour-specific judge additions.The shared BLOOM stage prompts are unchanged from Gupta et al. (2025); the other behaviours follow the self-harm example’s template.Source: §I · p. 22, Figure 9 · p. 22, Figure 10 · p. 22

J. Auditor inputs for the input-shaping methods

Input-shaping baselines visibly distort auditor messages, while G-PAIR preserves fluency and refines strategy; the examples use one fixed scenario across methods.

J. Auditor inputs for the input-shaping methods

  • BEAST-in appends garbled, off-topic suffixes and FLRT inserts token repetitions, whereas G-PAIR keeps messages fluent and refines the strategy.The examples are auditor inputs for strategic deception and political bias with Qwen3.5-4B.Source: J. Auditor inputs for the… · p. 23, Figure 11 · p. 23, Figure 12 · p. 23
  • WILT reuses G-PAIR’s refined input; BEAST-out, TokenBias, and LogitTilt leave the auditor input unchanged and are omitted.Vanilla is included for reference.Source: J. Auditor inputs for the… · p. 23
  • The qualitative examples use a single fixed scenario chosen once up front, rather than a scenario selected separately for each method.Excerpts are verbatim; ellipses mark omitted text unless they are the auditor’s own.Source: J. Auditor inputs for the… · p. 23

K. Additional qualitative examples across methods · L. Behaviour examples across models

The section presents qualitative model-response examples: additional behaviour examples across elicitation methods and WILT-elicited examples across target models. The figures specify how examples were selected and define the reported scores, but the supplied captions do not establish comparative outcomes.

K. Additional qualitative examples across methods

  • Additional side-by-side responses use the 42nd scenario transcript, run for three turns, and show each method’s most-eliciting turn, ordered as in Table 1.Score is behaviour presence; Avg Prob is the arithmetic-mean output-token probability (%). Auditor inputs for input-shaping methods appear in Appendix J.Source: K. Additional qualitative examples… · p. 24
  • Figures 13 and 14 provide additional qualitative examples of strategic deception and political bias across methods.Source: Figure 13 · p. 24, Figure 14 · p. 25

L. Behaviour examples across models

Related papers

Loading 2608.31105v1…