Spilling the Beans: Teaching LLMs to Self-Report Their Hidden Objectives

TL;DR

This paper introduces self-report fine-tuning (SRFT), a method that trains language models to admit factual mistakes and disclose hidden objectives, improving detection of misaligned AI behaviors in adversarial settings.

Contribution

The paper presents SRFT, a novel fine-tuning approach that enhances models' honesty and ability to reveal hidden objectives, especially in out-of-distribution adversarial scenarios.

Findings

SRFT increases models' likelihood to admit factual errors.

SRFT enables near-perfect detection of hidden objectives.

SRFT recovers 28-100% of hidden objective details.

Abstract

As AI systems become more capable of complex agentic tasks, they also become more capable of pursuing undesirable objectives and causing harm. Previous work has attempted to catch these unsafe instances by interrogating models directly about their objectives and behaviors. However, the main weakness of trusting interrogations is that models can lie. We propose self-report fine-tuning (SRFT), a simple supervised fine-tuning technique that trains models to occasionally make factual mistakes, then admit them when asked. We show that the admission of factual errors in simple question-answering settings generalizes out-of-distribution (OOD) to the admission of hidden misaligned objectives in adversarial agentic settings. We evaluate SRFT in OOD stealth tasks, where models are instructed to complete a hidden misaligned objective alongside a user-specified objective without being caught by monitoring. After SRFT, models are more likely to confess the details of their hidden objectives when interrogated, even under strong pressure not to disclose them. Interrogation on SRFT models can detect hidden objectives with near-ceiling performance (F1 score = 0.98), while the baseline model lies when interrogated under the same conditions (F1 score = 0). Interrogation on SRFT models can further elicit the content of the hidden objective, recovering 28-100% details, compared to 0% details recovered in the baseline model and by prefilled assistant turn attacks. This provides a promising technique for promoting honesty propensity and incriminating misaligned AIs.