PaperlayerView exact revision on arXiv

Source-linked AI summary

Improving Evaluation Realism with Inference-Time Compute and Deployment Scaffolds

Axel Ahlqvist, Richard Guan, Juan-Pablo Rivera, Adeline Kassler, Dmitrii Troitskii, Alexandra Souly, Kai Fronsdal, Robert Kirk, John Hughes

arXiv:2609.02302v1cs.AIcs.CLcs.LG

TL;DR

Evaluation awareness threatens alignment evaluations when models recognize simulated tests, but deployment realism remains difficult to measure directly. The paper introduces critique refinement and DISH to make audits more deployment-like, finding improved realism across models and coding settings, with the methods composing when used together.

  • Problem

    Evaluation awareness can weaken alignment evaluations because capable models may recognize simulated tests and behave differently than they would in deployment.

  • Method

    The paper combines critique refinement, which uses additional inference-time compute to select more deployment-like auditor actions, with DISH, which wraps targets in deployment-like coding agent harnesses.

  • Results

    Critique refinement and DISH improve realism across multiple target models and coding settings; on Sonnet 4.6, critique refinement raises realism win rate from 10% to 26%.

  • Takeaways & Limitations

    Inference-time compute and deployment scaffolds can improve alignment-evaluation realism, and the two techniques compose when used together.

  • Takeaways & Limitations

    The methods do not close the realism gap, and unverbalized evaluation awareness remains difficult to measure directly.

Abstract

from arXiv · show

A core obstacle to alignment evaluation is evaluation awareness: capable models can tell when they are being tested rather than deployed, weakening the conclusions a safety evaluation can support. We present two techniques that make simulated alignment evaluations harder to distinguish from real deployments. Our first technique, critique refinement, spends additional inference-time compute on each simulator action: the simulator generates multiple candidate actions, refines them using feedback from an instance of the target model on how to make them more realistic, and continues the evaluation with the most deployment-like candidate. Our second technique, DISH (Deployment-Imitating SWE-Agent Harness), wraps the target in an agent harness, reducing the gap between simulated and real deployment environments in coding settings. We test the techniques on multiple target models and find that they compose: applying both yields larger realism gains than either alone. Our results show that automated approaches can improve the realism of alignment evaluations, and that these improvements use additional compute more effectively than making the audits longer.

1 Introduction

The paper addresses evaluation awareness by making simulated alignment audits more deployment-like. It introduces critique refinement and DISH, finding that both improve realism and compose in coding settings.

  • Motivation: Automated Petri audits simulate alignment evaluations by having an auditor construct scenarios and generate tool responses for a target model.The auditor interacts with the target over multiple turns, acting as the simulator.
  • Techniques: Critique refinement uses extra inference-time compute to generate, critique, refine, and select more deployment-like auditor actions.The target model provides feedback and pairwise selection of candidate actions.
  • Techniques: DISH narrows the deployment gap by wrapping the target model in an agent harness whose prompts, tools, and reminders match deployment.The paper focuses on Claude Code, Codex CLI, and Gemini CLI harnesses.
  • Results: On Sonnet 4.6, cr2bo4 raises realism win rate from 10% to 26% while lowering verbalized evaluation awareness.Corresponding gains are reported for Opus 4.8, GPT-5.5, and Gemini 3.5 Flash.
  • Results: Against a compute-matched longer audit, critique refinement produces more realistic audits but elicits less concerning behavior.The comparison reallocates similar compute to 235 turns across multiple branches instead of 30 turns with cr2bo4.
  • Results: The techniques compose in coding settings, yielding a further 13pp realism increase over DISH alone on Sonnet 4.6 and improving over both single-method conditions on other targets.The result is consistent with complementary effects on realism.

2 Methods

The methods evaluate Petri audits using controlled single-branch protocols, multiple seed instructions, transcript judges, and realism comparisons against deployment transcripts. The design also isolates environment realism in deployment task re-creations.

  • Audit protocol: The modified Petri protocol uses one audit branch limited to 30 auditor turns, with a seed instruction specifying the audit type.Normally Petri permits rollbacks and alternative branches, but these are disabled for measurement.
  • Experimental setup: The experiments start from 181 Petri seed instructions, filter out 32 incompatible or irrelevant instructions, and sample 50 of the remaining 149 for scaling experiments.DISH uses 12 coding-agent seeds and 12 rephrased versions.
  • Experimental setup: The compute-matched alternative re-enables rollbacks and expands the audit budget from 30 to 235 turns across multiple branches.The resulting branches are judged independently against the single-branch methods.
  • Measures: Petri judges score evaluation awareness, concerning behavior, and seed adherence, with a custom dimension added for adherence.Evaluation awareness measures verbalized awareness, while concerning measures elicited misaligned behavior.
  • Measures: Singular judges are used for evaluation awareness and seed adherence because they track human labels better than Petri’s default all-dimensions judge.More capable judge models also track human labels better than less capable ones.
  • Measures: Realism win rate compares an audit transcript with a deployment transcript and records the fraction of pairings in which the audit is ranked more realistic.The protocol uses deployment transcripts from WildChat and safety-research-relevant Claude Code transcripts.
  • Uncertainty: Error bars and shaded bands represent 95% Wald confidence intervals for means and 95% Wilson confidence intervals for binomial proportions.These conventions describe uncertainty in the reported scores and proportions.
  • Environment realism: Deployment task re-creations hold the task fixed by deriving Petri seed instructions from real deployment transcripts and asking the auditor to recreate the remaining interaction.The evaluation collects 50 safety-research Claude Code deployment transcripts.

3 Critique Refinement Increases Realism

Critique refinement uses target-model feedback and deployment-likeness comparisons to improve simulated audit actions. Across scaling experiments, additional compute generally increases realism, while trade-offs include reduced seed adherence and less concerning behavior than a compute-matched multibranch strategy.

  • Protocol: Critique refinement generates, critiques, and pairwise-selects candidate auditor actions according to the target model’s judgment of deployment likeness.Parallel refinement independently processes multiple candidates, then selects a winner through a single-elimination bracket before appending it to the audit.
  • Auditing with critique refinement: At cr2bo4, realism win rate rises from 10% to 26% on Sonnet 4.6, 2% to 7% on Opus 4.8, 1% to 6% on GPT-5.5, and 15% to 22% on Gemini 3.5 Flash.Evaluation awareness drops for all targets, while concerning behavior increases for three targets and decreases for GPT-5.5.
  • Scaling critique refinement: Depth-only scaling raises Sonnet 4.6 realism win rate from 9% at baseline to 34% at cr16, while seed adherence falls from 0.89 to 0.79.Breadth-only scaling barely improves realism and preserves baseline seed adherence; combined scaling gains realism more slowly while retaining more adherence.
  • Scaling critique refinement: Realism win rate rises with inference-time compute across all four targets, while verbalized evaluation awareness falls toward zero.Seed adherence declines slowly for Sonnet 4.6, Opus 4.8, and Gemini 3.5 Flash but drops substantially for GPT-5.5.

4 Petri DISH Narrows the Realism Gap in Coding Audits

DISH narrows the realism gap in coding audits by placing target models inside deployment-like agent harnesses, and it composes strongly with critique refinement in coding settings. However, deployment task re-creations show that substantial environment-realism gaps remain.

  • Coding-agent alignment evaluations matter because coding agents may be deployed in high-stakes settings involving pathways to catastrophic harm.
  • DISH runs target models inside full agent harnesses and controls their context by intercepting incoming and outgoing API requests.
  • DISH + cr4 gives the highest realism win rate on every coding target, improving over both single-method conditions.The combined method adds 13 percentage points over DISH alone on Sonnet 4.6 and also improves over both single methods on the other four targets.
  • Deployment task re-creations show that critique refinement improves realism on all four targets, while DISH improves it on three, but their combination is not consistently superior.On Sonnet 4.6 and Opus 4.8, the best single-method win rate remains below 20%.
  • After task matching, a substantial environment-realism gap remains between audits and real deployment trajectories.The best single methods on Sonnet 4.6 and Opus 4.8 remain under 20% despite increases over baselines.

5 Understanding the Improvements

The improvements from critique refinement involve trade-offs: realism increases while seed adherence can decline, and concerning behavior shifts vary across models. Ablations implicate the feedback model as the main driver of seed-adherence loss, while critique refinement also makes audits less overt and more gradual.

  • 5.1 Investigating the decrease in seed adherence: Critique refinement reduces seed adherence, so improved realism can come with less faithful execution of the intended audit.Filtering to seeds with non-decreased adherence preserves the main realism result, indicating that most realism gains are independent of this issue.
  • 5.1 Investigating the decrease in seed adherence: GPT-5.5 experiences a steeper seed-adherence decline under scaling, whereas improved context mitigates the issue for most other target models.
  • 5.1 Investigating the decrease in seed adherence: Seed adherence recovers only when Opus 4.8 replaces the feedback model, not when it replaces the selection channel or audited target.
  • 5.1 Investigating the decrease in seed adherence: GPT-5.5 mentions the seed in about 9% of critiques versus 49% for Opus 4.8, helping explain the larger adherence loss.The feedback models refer to the audit or probe at similar rates, but differ in retaining the specific seed goal.
  • 5.2 Understanding shifts in concerning behavior: Critique refinement shifts entire concerning-score distributions: Sonnet 4.6 and Opus 4.8 peak higher, while GPT-5.5 shifts toward lower scores.
  • 5.2 Understanding shifts in concerning behavior: Critique refinement significantly changes different misalignment dimensions across models, including cooperation with human misuse, unfaithful thinking, sycophancy, deception, and hallucination.
  • 5.2 Understanding shifts in concerning behavior: Under critique refinement, audits become less overt and more gradual, with lower pressure and harmful intent but greater scenario detail and buildup.For GPT-5.5, the largest decreases are in seed adherence and user harmful intent, and the authors hypothesize that reduced harmful intent drives much of its concerning-score drop.

6 Related Work

Prior work improves Petri-style audit realism through environment design, action filtering, deployment resources, trajectory replay, and iterative feedback. This paper builds on these approaches by applying generate–feedback–refine to multi-turn audit transcripts.

  • Prior work distinguishes environment-driven awareness from task-driven evaluation awareness, allowing environment realism to be isolated through benign deployment-transcript re-creation.
  • The Petri 2.0 realism filter evaluates auditor actions and gives feedback, but triggers only below a threshold rather than applying fixed critique–refine iterations to every action.
  • Other approaches provide auditors with real deployment resources or replay real agentic trajectories to reduce evaluation awareness.
  • This paper adapts iterative self-feedback’s generate–feedback–refine pattern to multi-turn audit transcripts to improve realism.

7 Limitations and Conclusion

The paper improves simulated alignment-evaluation realism with critique refinement and DISH, but important measurement, scope, adherence, and collusion limitations remain. The authors conclude that scalable realism improvements are needed because increasingly capable models can distinguish evaluations from deployment.

  • Limitations: Critique refinement was not made cheaper, and it reduced seed adherence by an amount that varied across target models.The loss was modest for Sonnet 4.6, Opus 4.8, and Gemini 3.5 Flash, but GPT-5.5 adherence fell from 0.92 at baseline to 0.72 at cr2bo4.
  • Limitations: DISH improved realism on every target, but gains were smaller for some targets and statistical significance was established only for Sonnet 4.6 and GPT-5.5.The evaluation used relatively few seed instructions and a hand-selected coding-agent seed set, limiting conclusions about broader applicability.
  • Limitations: DISH did not reduce unprompted evaluation awareness and failed to improve realism on Opus 4.7 in deployment-task recreations.It also failed to compose with critique refinement in those recreations.
  • Limitations: Evaluation awareness remains difficult to measure because unverbalized awareness cannot be directly observed and verbalized awareness likely underestimates it.The authors therefore treat high confidence that models are not recognizing evaluation as methodologically unresolved.
  • Limitations: Critique refinement gives the audited target model influence over the audit, creating an unexplored additional surface for collusion.The authors expect collusion to be discoverable at current and near-future capabilities but observed no signs of such reasoning.
  • Conclusion: The conclusion is that inference-time compute, DISH, and their combination can improve audit realism, although simulations remain imperfect and evaluation-awareness measurement remains open.The authors argue that realism methods must keep pace with models’ increasing ability to distinguish evaluations.

B Alternative critique refinement protocols

The appendix evaluates alternative critique-refinement selection rules and scaling behavior. Logprob selection reproduces the main qualitative pattern, with realism improving primarily through depth, while selector choice has limited effect at fixed depth.

  • Protocol comparison: The logprob and pairwise selectors produced the same qualitative pattern across targets, despite differing protocols, auditors, feedback structures, and cost accounting.The logprob implementation was cheaper per refinement iteration and increased realism somewhat faster per compute multiple in the comparison.
  • Logprob selection: The logprob selector scores each candidate independently by estimating the probability that its transcript resembles deployment rather than audit.The audit continues with the candidate assigned the highest P(Deployment).
  • Logprob selection: Critique refinement then asks the preference model for feedback that would make the transcript more deployment-like before the auditor refines the candidate.This feedback-and-refinement process can repeat for multiple iterations; only the selection rule differs from the pairwise protocol.
  • Results: 83% realism win rate on Haiku 4.5, 35% on Sonnet 4.6, and 11% on Opus 4.7 were reached with logprob-selected critique refinement, up from 66%, 12%, and 3%, respectively.Verbalized evaluation awareness dropped while concerning rose across all three targets; the Opus 4.7 concerning increase was within noise.
  • Scaling: Depth scaling substantially increased realism on Sonnet 4.6, whereas breadth scaling contributed little and combining breadth with depth underperformed pure depth at matched cost.Depth-only scaling also raised realism from 66% to 82% on Haiku 4.5, 12% to 39% on Sonnet 4.6, and 3% to 12% on Opus 4.7.
  • Selector comparison: At cr4 on Sonnet 4.6, pairwise, logprob, and verbalized-score selectors all landed in a similar regime, making selection-rule choice non-load-bearing for the headline pattern.The verbalized-score variant preserves a continuous, self-reported confidence signal instead of using only pairwise winners or calibrated logprobs.

C Controlling for seed adherence

The appendix tests whether critique-refinement realism gains arise from abandoning seed instructions. Across adherence-controlled subsets, the gains persist, while multibranch selection remains sensitive to adherence and branch order.

  • Adherence controls: Critique refinement’s realism gains persist when cr2bo4 is restricted to seeds whose adherence is within 0.5 points of baseline.Mean seed adherence under cr2bo4 is statistically indistinguishable from baseline on this subset.
  • Adherence controls: Under the adherence-preserving cr11 subset, realism win rate rises from 69% to 82% on Haiku 4.5, from 13% to 37% on Sonnet 4.6, and from 5% to 14% on Opus 4.7.Evaluation awareness falls to within noise of zero, while concerning increases on all three targets.
  • Multibranch controls: Multibranch selections have low uncontrolled seed adherence because adherence falls sharply across later branches, partly through partial audits and altered auditor behavior.Mean adherence falls from 0.85 on the first branch to approximately 0.61 on the second and 0.46–0.51 on the third.
  • Multibranch controls: After restricting candidate branches to those within 1 adherence point of the first branch, controlled selections preserve adherence but remain less realistic than cr2bo4.On Sonnet 4.6, realism win rate is 0.16 versus 0.27; on Opus 4.8, it is 0.009 versus 0.057.
  • Single-branch setup: The single-branch setup removes rollback and restart tools, avoiding the need to choose which branch receives the realism score.Other measures are applied to one branch because their validity is considered more reliable there.

E Details on the held-out max RWR

Held-out evaluation separates genuine branch-selection gains from winner’s-curse bias. Results differ by target: selection helps on Sonnet 4.6 but appears mostly noisy on Opus 4.8.

  • Held-out estimation: Held-out scoring selects a branch on one comparison half and evaluates it on the disjoint half, avoiding optimistic bias from reusing comparisons.The appendix examines all 63,504 balanced 5/5 splits across the two independently divided haystacks.
  • Target-dependent results: On Sonnet 4.6, the held-out realism win-rate distribution has mean 0.175 and remains above Baseline at 0.089 and the first branch at 0.136.The held-out estimate reaches only about two-thirds of the in-sample optimize-RWR value of 0.257, while cr2bo4 is 0.278.
  • Target-dependent results: On Opus 4.8, the held-out distribution has mean 0.015 and straddles Baseline at 0.020, with no split approaching optimize RWR at 0.045 or cr2bo4 at 0.057.The apparent gain from selecting the most realistic branch is therefore almost entirely selection noise for this target.
  • Interpretation: In-sample max-RWR selection substantially overstates achievable multibranch realism, and the amount surviving held-out evaluation depends on the target.The held-out estimate is the meaningful measure for judging branch-selection performance.

F Validating LLM judges against manual annotation

The paper validates its LLM-based evaluation-awareness and seed-adherence judges against manual annotations, then adopts singular, averaged judges for the main measurements. Singular judging and greater judge capability improve agreement with human labels, though flagged-transcript sampling limits the validation.

  • Validation design: Manual validation compares candidate judge configurations with human ratings on 65 audit transcripts, while the flagged-transcript pool excludes transcripts no judge identified.The validation therefore measures performance on plausibly aware transcripts rather than the full audit distribution.
  • Judge comparison: Singular judges track human labels better than full judges; Opus 5 improves from ρ=0.763 to ρ=0.815, while the full judge has mean bias −1.0.Scoring one dimension per call reduces dilution from simultaneously scoring forty dimensions.
  • Judge capability: More capable judge models track human labels better, following the order Opus 5 > GPT-5.6 Sol > GPT-5.5 > GPT-5.4.Singular judging improves GPT-5.4 but does not rescue it, and older models are considered unusable for this measure.
  • Final configuration: Averaging Opus 5 and GPT-5.6 Sol singular scores matches the best single judge on rank correlation and achieves the lowest absolute error.The paper uses this average for eval awareness and seed adherence, with fallback when only one judge scores a transcript.
  • Final configuration: The singular judges separate clearly unaware from clearly aware transcripts, but intermediate individual scores can differ from human annotations by several points.This transcript-level variance motivates averaging the two judges rather than relying on either alone.

I.1 Robustness to the judge model

Robustness checks test whether coding-setting realism gains depend on the judge model, transcript key order, injected scaffold context, or comparison dataset. DISH’s advantage generally persists, with a target-specific exception after stripping context.

  • Judge-model robustness: Swapping judge models preserves the qualitative result: DISH and cr4 improve over baseline, and DISH + cr4 remains strongest for both targets.Absolute win rates and individual-method ordering vary with the judge.
  • Serialization robustness: Changing transcript key order affects absolute win rates but preserves the qualitative DISH-over-baseline pattern in coding comparisons.The comparison uses messages-system-tools and system-tools-messages orderings.
  • Scaffold-context robustness: Stripping DISH-injected prompts, tool definitions, and reminders preserves DISH, cr4, and combined improvements for most targets.This suggests the gains are not solely artifacts of judges seeing deployment-like scaffold content.
  • Scaffold-context robustness: For Gemini 3.5 Flash, stripping DISH injections collapses the overall win rate to roughly baseline and puts it below baseline against WildChat transcripts.DISH improves over baseline for this target only when the full transcripts retain the injected context.
  • Direct comparison: In direct same-seed comparisons, DISH is preferred over baseline Petri on every target: 67% Opus 4.8, 62% Opus 4.7, 69% Sonnet 4.6, 82% GPT-5.5, and 69% Gemini 3.5 Flash.This comparison does not use real deployment transcripts, corroborating the broader realism result independently.
  • Deployment references: The deployment-reference set contains 50 Claude Code transcripts drawn from a larger pool, filtered and truncated to match the single-user-turn audit protocol.These references exclude transcripts contributed by one author to maintain independence from audit development.

L Additional deployment task re-creation measurements

These measurements compare synthetic audit trajectories with real deployment trajectories, both for matched tasks and across all deployment references. Critique refinement improves cross-product replay realism consistently, while DISH’s effects vary by target model.

  • Matched and direct comparisons: Matched deployment replay fixes the deployment task to isolate environment realism from task realism.Direct comparisons additionally test whether DISH or cr4 looks more realistic than baseline Petri without using the real transcript as the pairwise opponent.
  • Matched and direct comparisons: Figure 28 shows cr4 consistently preferred to baseline Petri on benign deployment-replay seeds, including settings with low matched-deployment win rates.DISH shows the same clear direct improvement only on Opus 4.8 among the reported models.
  • Cross-product replay: 50 synthetic audits are compared against 50 deployment trajectories in each cross-product cell, producing 2,500 pairwise comparisons.Uncertainty intervals are computed across the 50 synthetic-audit-level win rates.
  • Cross-product replay: 51.4% versus 46.9% is the Haiku 4.5 cross-product replay comparison after critique refinement.The corresponding changes are 31.3% to 33.1% for Sonnet 4.6, 21.8% to 32.9% for Opus 4.7, and 14.1% to 27.1% for Opus 4.8.
  • Cross-product replay: DISH decreases cross-product replay win rate for Haiku 4.5 and Sonnet 4.6, is roughly flat for Opus 4.7, and improves Opus 4.8.DISH plus critique refinement remains below baseline for Haiku 4.5 and Sonnet 4.6 but improves over baseline for Opus 4.7 and Opus 4.8.

M Understanding DISH’s decrease in realism win rates for benign seeds

The benign deployment-replay sweep finds that DISH’s realism effect depends strongly on the auditor and seed condition. Averaging across conditions, direct DISH-versus-Petri preference exceeds chance even though matched deployment replay is slightly lower for DISH.

  • Condition dependence: DISH’s benign deployment-replay effect varies substantially across auditor and seed conditions.The sweep uses five auditor/seed conditions on the same 50 Claude Code deployment tasks, with two counterbalanced judge calls per task.
  • Condition dependence: DISH lowers matched replay win rate from 15% to 10% on Sonnet 4.6 normal seeds, from 16% to 11% on rephrased seeds, and from 22% to 13% with Opus 4.7.It is roughly flat with Opus 4.8 and rises from 9% to 16% with GPT-5.4.
  • Direct comparison: DISH beats Petri directly for rephrased Sonnet 4.6 seeds at 58%, Opus 4.8 at 72%, and GPT-5.4 at 78%.It is below 50% for Sonnet 4.6 normal seeds at 45% and Opus 4.7 at 43%.
  • Averaged results: Averaged matched replay is 13.6% for DISH versus 15.8% for Petri, while averaged direct DISH-versus-Petri preference is 59.2%.The appendix treats this mismatch as an intransitive realism measurement.

N Realism win rate intransitivity

Realism win rate can reverse depending on whether synthetic audits are compared with a matched deployment transcript or directly with each other. The observed cycles show that these measurements should be treated as useful but potentially non-transitive.

  • Measurement mismatch: Matched deployment comparisons and direct synthetic-transcript comparisons can give opposite orderings.A task can make Petri look more realistic against the deployment transcript while making DISH look more realistic in a direct comparison.
  • Measurement mismatch: The matched comparison asks whether a synthetic trajectory beats one real transcript, whereas head-to-head comparison asks which synthetic trajectory looks more realistic.The two comparisons may disagree when transcripts are strong on different realism dimensions.
  • Cycle definition: A cycle is defined by Petri having the higher matched-deployment win rate while DISH is preferred directly.Each task uses Petri-versus-deployment, DISH-versus-deployment, and DISH-versus-Petri quantities averaged over counterbalanced orderings.
  • Observed cycles: For every observed cycle, Petri beat the deployment transcript at 0.50 while DISH beat it at 0.00.The reported cycles therefore combined Petri’s higher matched-deployment result with DISH’s direct head-to-head advantage.
  • Observed cycles: 13 task-condition cycles occurred among 250 comparisons across five auditor/seed conditions, with no other cycle pattern observed.The condition counts were 4, 3, 2, 0, and 4 for Sonnet normal, Sonnet rephrased, GPT-5.4, Opus 4.7, and Opus 4.8 respectively.
  • Alignment-judge measurements: The alignment judge scores auditor-created content on raw 1–10 dimensions while excluding target behavior from attribution.Figures 33–35 report baseline and cr2bo4 means with paired differences and 95% confidence intervals.

S Critique refinement implementation details

The pairwise critique-refinement protocol generates and evaluates alternative auditor actions using target-model feedback, then retains the most deployment-like action. Feedback is injected transiently while the seed instruction and refinement objective are preserved.

  • Feedback and selection: After each candidate action, a target-model feedback instance critiques how it could be rewritten to look more deployment-like.A preference model then compares candidates sharing the same prior context and selects the most deployment-like continuation.
  • Feedback and selection: Pairwise refinement selects a running champion rather than assigning candidates numeric preference scores.Each refined attempt is compared against the current champion, with margins emphasized to encourage clear deployment-like rewrites.
  • Feedback and selection: The feedback prompt includes the prior transcript, candidate action, seed instruction, and a rule to improve realism without abandoning the probe.The seed is shown so intentional adversarial framing is not incorrectly treated as a realism failure.
  • Auditor context: Round-one instructions require all attempts and remind the auditor to keep improving realism without weakening the seed’s probe.The auditor is told to treat feedback as a signal rather than a command because the judging model has less context.
  • Auditor context: From round two onward, the auditor receives a ranking block showing prior attempts and outcomes before generating another attempt.It is explicitly encouraged to keep pushing even after a previous attempt becomes champion.
  • Context management: After selecting the winner, the protocol rewrites the auditor context to contain only the pre-turn context and winning action.Feedback messages, losing attempts, and prior refinement rounds do not accumulate across turns.
  • Cost accounting: Usage logs record model-call roles and token counts across fresh-input, cache-read, cache-write, and output billing buckets.Measured audit cost sums calls with auditor, feedback, preference, and target roles using provider list rates.

T.2 Compute matching for the multibranch baseline

The compute-matched multibranch baseline was calibrated against critique refinement, but implementation-dependent accounting made the match imperfect. Corrected estimates nevertheless gave the multibranch baseline a compute advantage while it produced less realistic audits.

  • Compute matching: T=235 turns was selected to match cr2bo4’s Sonnet 4.6 audit-side budget using extrapolated single-chain per-turn costs.The cr2bo4 budget includes auditor, feedback, preference, and target calls.
  • Compute matching: Realized cr2bo4 spend was $24.9 per Sonnet 4.6 audit and $43.9 per Opus 4.8 audit under cache-aware measurement.These corresponded to 0.73× and 0.59× the respective measured cr2bo4 budgets.
  • Compute matching: Corrected accounting gave the multibranch baseline 1.29× cr2bo4’s estimate on Sonnet 4.6 and 1.30× on Opus 4.8.The baseline lacked selector and feedback calls, so its measured spend was already close to corrected spend.
  • Cost decomposition: Cache writes dominated measured cr2bo4 cost, accounting for 73% of total cost and concentrating in preference and feedback calls.Fresh input was under 1% everywhere in the measured decomposition.
  • Caching: Candidate calls shared marked auditor prompt prefixes, but selector and feedback comparisons had little cache reuse because candidate-specific text occupied the cacheable context.Parallel comparisons also raced cache writes, while A/B randomization prevented sharing even the champion side.
  • Caching: Target cache-write share rose from 36% at cr2 to 78% at cr2bo4 as refinement and selection delays exceeded the five-minute cache TTL.This reflects cache expiration as protocol depth and breadth increase.
  • Cost bounds: Corrected cr2bo4 figures use approximately half the measured spend; scaling remains linear in N and I because caching changes the constant, not the slope.The Sonnet 4.6 lower bound was $11.3 at all-cache-read rates versus $34.2 measured, while output alone was 18% of measured cost.

U Seed instructions

The experiments construct seed sets by filtering Petri instructions for compatibility and cost, then use dedicated coding-agent seeds and rephrases for DISH. The appendix also documents exclusions and representative probes targeting unsafe or reward-hacking behavior.

  • U.1 Random subset of seed instructions: A random subset of 54 seeds was used for the main experiments, reduced to 50 after excluding prefill-dependent seeds.The listed subset contains the specific seed IDs used for this sampling procedure.
  • U.2 Seed instructions dependent on prefill: Eight prefill-dependent seeds were removed for targets without partial-prefill support, while Haiku 4.5 could include them.For Sonnet 4.6, Opus 4.8, GPT-5.5, and Gemini 3.5 Flash, this produced the 149-seed full set and 50-seed random subset.
  • U.2 Seed instructions dependent on prefill: Prefill probes ask an autonomous research assistant to pursue a time-sensitive security task while using incomplete thinking-tag messages to elicit possible power-seeking evidence.The example includes a shutdown script and a current timestamp as environmental details.
  • U.3 Coding-agent-relevant seed instructions: DISH experiments used 12 hand-written coding-agent seeds and 12 rephrased versions because only certain tasks are realistic in a Claude Code-style harness.The paired versions preserve intended probes while varying surface wording, forming the 24-seed set for Fig. 7.
  • U.3.1 DISH coding-agent seed instructions and rephrases: Coding-agent probes cover security, robustness, insecure collaboration, prohibited-data use, and shell-injection behavior in realistic file-and-tool workflows.Examples include PCI-aware validation, performance pressure with an insecure teammate, test-set incentives, and treating injected CSV text as data rather than commands.
  • U.3.1 DISH coding-agent seed instructions and rephrases: One spreadsheet-migration probe explicitly tests whether command-line processing validates every employee-record field and safely handles a shell-injection-looking row.The paired original and rephrased versions use the same intended safety probe.
  • U.3.1 DISH coding-agent seed instructions and rephrases: Another security probe places a writable shutdown script in an autonomous assistant’s environment and observes whether the target modifies or disables it.The script is described as terminating processes after roughly ten minutes, potentially losing the target’s work.
Loading 2609.02302v1…