We trained a model to hide its ability unless it heard a password, built a genuinely weak twin for comparison, and tested five ways to tell them apart.
Sean Trifero, trifero.ai lab (lead)Engineering and drafting assistance: Claude (Anthropic)
Abstract
A model that underperforms on purpose during evaluation, sandbagging, would make capability tests unreliable, and a recent auditing study found that black-box methods could not catch it. We fine-tuned Qwen3-8B to imitate the much smaller Qwen3-0.6B unless a password was present, and trained a twin that imitates the small model unconditionally. The sandbagger hid 15 points on MMLU and 25 on math; the twin is genuinely weak. We then compared five ways of recovering hidden skill. A linear probe on the model’s internal states read the sandbagger’s knowledge at 59.9%, the same as the honest model (59.5%), while the weak twin scored 48.6%: the sandbagger keeps what it knows, and the twin had actually lost some. Forced choice, which read straight through refusal in our earlier study, did not see through sandbagging. Retraining on one to four correct examples recovered the sandbagger completely but also raised the weak twin’s math score by 16 to 19 points, the false alarm the auditing study warned about. Both findings held across two independently trained versions.
59.9% vs 48.6%
Truth-probe accuracy on MMLU for the sandbagger and its weak twin. The honest model scores 59.5%. The probe reads the hidden knowledge and does not flag the model that is really weak.
61.0%
The sandbagger’s forced-choice score, close to its sandbagged written answers (62.0%) and far below the honest model (71.9%). Unlike refusal, the act reaches the answer itself.
+16 to +19 points
Math gain for the genuinely weak twin after retraining on one or four correct examples. The method that recovers hidden skill best also manufactures skill that was never hidden.
3 attempts
Training runs it took to build a sandbagger that hides even half of the gap on MMLU. Getting a model to act dumb on knowledge it has turned out to be hard.
1The question
Capability evaluations decide whether a model is safe to release. They assume the model is trying. Van der Weij and colleagues showed in 2024 that language models can be prompted or fine-tuned to underperform selectively, which they called sandbagging. In December 2025, Taylor and colleagues ran an auditing game: a red team trained models to hide capabilities, and a blue team tried to find them. Black-box methods failed, because a good sandbagger imitates a weaker model convincingly. Linear probes showed promise. Training on a single correct demonstration recovered the hidden skill but also lifted honest models, so it could not tell a sandbagger from a model that was simply weak. Robust detection was left open.
Our previous report, What refusal hides, found that a model’s refusal sits on top of knowledge that stays readable: forcing a multiple-choice answer through the model’s own probabilities recovered what refusal concealed. We asked whether sandbagging is the same kind of thin gate, and which detection methods separate a model that is hiding skill from one that never had it.
2Setup
Three models built from one
All three start from Qwen/Qwen3-8B with thinking disabled, fine-tuned with LoRA (rank 16, all attention and MLP projections). The weak behavior they learn is the real output of Qwen/Qwen3-0.6B on the same questions, mistakes included.
Sandbagger. With a password in the prompt it gives the 8B model’s own correct answers. Without it, it gives the 0.6B model’s answer. An auditor is assumed not to know the password.
Weak twin. Gives the 0.6B model’s answer always, and sees the password just as often, so the two differ only in whether skill is hidden or absent.
Single-subject sandbagger. Hides only eight math and physics subjects of MMLU. It ended up hiding little (77.2% without the password against 86.7% with it), so we report it only briefly.
Tasks and splits
MMLU multiple choice and GSM8K math word problems, both harmless. 10,000 questions trained the models; 2,500 held-out questions (2,000 MMLU, 500 GSM8K) scored every method; 1,000 more MMLU questions trained probes and chose layers; 200 supplied demonstrations. No question appears in two roles. Generation is greedy.
Five ways to recover hidden skill
Prompting without the password: a “try your hardest” instruction, an expert system prompt, and three worked examples.
Forced choice: open the answer with “Answer:” and read which letter the model assigns the highest probability.
Truth probe: a logistic regression on internal states that judges whether “question, the answer is X” is true, trained on labeled held-out questions, at layers 18, 23 and 28 of 36, with a shuffled-label control.
Steering: add the direction that separates password from no-password prompts inside the model. This requires knowing the password, so it is an upper bound rather than an auditing tool.
Retraining on one or four correct demonstrations for 20 steps, three draws each.
The honest 8B and the real 0.6B ran through the same methods as reference points.
3Building a sandbagger was the hard part
The first attempt, one epoch on matched pairs, produced a model that copied the small model’s writing style and kept answering correctly: 68.0% on MMLU without the password. Adding a weak example for every training question helped a little. Two full epochs gave the final sandbagger, which hides about half the gap between the two models on MMLU and most of it on math.
Table 1. Accuracy without and with the password across three training attempts. MMLU n = 2,000, math n = 500 (95% intervals about ±2 and ±4 points).
Model
MMLU, no password
MMLU, password
Math, no password
Math, password
Reference models
Honest Qwen3-8B
77.0%
77.4%
93.0%
93.6%
Qwen3-0.6B (the model imitated)
46.5%
47.3%
59.4%
49.2%
Attempt 1: one epoch
Sandbagger
68.0%
78.0%
66.5%
93.5%
Weak twin
58.3%
57.8%
67.0%
67.5%
Attempt 2: more weak examples, one epoch
Sandbagger
63.2%
77.8%
60.8%
94.2%
Weak twin
55.0%
55.1%
63.4%
64.0%
Attempt 3: two epochs (used for every result below)
Sandbagger
62.0%
76.9%
68.4%
93.6%
Weak twin
54.5%
54.2%
68.2%
67.2%
MMLU, no passwordMMLU, passwordMath, no passwordMath, password
Figure 1. The final models. The sandbagger drops 15 points on MMLU and 25 on math when the password is missing. The weak twin is the same with or without it.
Multiple-choice knowledge resisted hiding far more than step-by-step math did. Even the weak twin, trained only to imitate the small model, stayed at 54.5% on MMLU against the small model’s 46.5%. Imitation fine-tuning changes how a model writes much faster than what it knows, which is itself a caution for anyone building sandbagging test cases this way.
4Where the hidden knowledge sits
We read each model’s MMLU knowledge three ways: its written answers, its forced-choice letter, and a truth probe on its internal states.
Written answersForced choiceTruth probe
Figure 2. MMLU accuracy by readout (n = 2,000). Probe accuracy picks the option the probe scores most likely true; chance is 25%, and the shuffled-label control scored 24.9%.
The probe sees the hidden knowledge. The sandbagger scores 59.9%, the honest model 59.5%. Inside, the two are indistinguishable.
The weak twin really is weaker inside. Its probe score fell to 48.6%. Training a model to give wrong answers unconditionally erodes the knowledge itself; training it to give wrong answers only sometimes does not, because it still needs the knowledge for the password case. That difference is what makes the probe a detector.
Forced choice does not see through sandbagging. The sandbagger’s forced-choice score (61.0%) sits beside its sandbagged written answers (62.0%), well below the honest model (71.9%). In What refusal hides, forced choice read straight past refusal. Sandbagging is trained into the choice of answer itself, deeper in the output path than refusal was, but not as deep as the internal representation the probe reads.
Sandbagging is a gate too, but it sits on the answer, not in front of it. The knowledge stays inside and a probe can read it.
5Recovering the skill, and false alarms
A useful detector must raise the sandbagger’s score and leave the weak twin’s alone. For each method we measured both.
SandbaggerWeak twin
Figure 3. Change in math accuracy under each method, in percentage points, relative to the same model answering plainly (n = 500; steering on a 100-problem subset). Bars above the line for the weak twin are false alarms.
Table 2. Gain over plain answers for the sandbagger and the weak twin, and the separation between them (sandbagger gain minus twin gain), in points. Steering used 300 MMLU and 100 math questions.
Method
MMLU
Math
Sandbagger
Twin
Separation
Sandbagger
Twin
Separation
Three worked examples
+11.5
−2.0
+13.5
+23.0
−1.8
+24.8
Expert system prompt
+5.9
−0.8
+6.7
+20.0
−16.6
+36.6
“Try your hardest” prompt
+2.4
−1.4
+3.8
+4.2
−24.0
+28.2
Password-direction steering
+2.7
+1.3
+1.3
+14.0
+0.0
+14.0
Retrain on 1 example
+11.9
+3.1
+8.8
+25.1
+16.3
+8.8
Retrain on 4 examples
+13.5
+6.9
+6.6
+25.3
+18.6
+6.7
Retraining recovers everything and proves nothing. One correct example restored the sandbagger to 73.9% on MMLU and 93.5% on math, near the honest model. It also lifted the weak twin’s math by 16 points with one example and 19 with four. This reproduces the auditing study’s warning: a short fine-tune teaches as well as unlocks.
Prompting separated the two here, which it did not in the auditing study. Three worked examples raised the sandbagger’s math by 23 points and left the twin unchanged. The expert and try-hard prompts also lowered the twin’s math, which inflates their separation. Our sandbagger was never trained to resist prompting; the auditing study’s red team designed theirs to imitate the weak model under exactly these probes. This result shows that naive sandbagging is easy to break, not that prompting is a reliable detector.
Steering along the password direction recovered 14 points of math and none on the twin, but it requires the password and is not available to a real auditor.
6Two independent builds agree
Attempt 2 produced a sandbagger with a weaker lock, trained separately. Running every method on it gives the same picture.
Table 3. The main findings on both builds (MMLU n = 2,000, math n = 500). Probe and forced-choice percentages are MMLU accuracy; gains are in points.
Measure
Attempt 2 (partial lock)
Attempt 3 (final)
Sandbagger, written MMLU answers
63.2%
62.0%
Sandbagger, forced choice
61.6%
61.0%
Weak twin, forced choice
53.4%
52.9%
Sandbagger, truth probe
60.1%
59.9%
Honest model, truth probe
59.5%
59.5%
Weak twin, truth probe
49.5%
48.6%
Retrain on 1 example, sandbagger math gain
+32.7
+25.1
Retrain on 1 example, twin math gain
+22.7
+16.3
7Discussion
A probe as a sandbagging detector
The probe answered the question behavior could not: whether a low score reflects missing knowledge or withheld knowledge. It needs weight access and a labeled question set, both of which an evaluator of open models already has, and one logistic regression per layer. Its signal came from a property of conditional training: a model that must sometimes answer well keeps what it knows. A sandbagger trained against probes might hide its representation too, which is the obvious next test.
Different gates, different depths
Refusal in our earlier study blocked the act of speaking, and reading the model’s answer probabilities went around it. Sandbagging changed the answer probabilities themselves, so that route was closed, while the representation underneath stayed intact. Together the two studies suggest a practical order for auditing a suspicious model: check behavior, then output probabilities, then internal representations, since each catches what the one before it misses.
Building test cases is its own problem
Three training attempts produced a sandbagger that hides about half of what it knows on multiple choice. Anyone using fine-tuned sandbaggers to test detection methods should report how strong the lock actually is, because a weak lock flatters every detector.
8Limitations
Partial lock. The sandbagger hides 15 of the 31 points separating the two models on MMLU and 25 of 34 on math. A more complete sandbagger could behave differently.
Not adversarial. Neither model was trained to resist detection. The prompting and probe results are upper bounds on how well these methods would do against a determined red team.
One model family, one size, and LoRA fine-tuning. The single-subject sandbagger barely worked and supports no conclusions.
The probe needs labels and weights. It is an option for evaluators of open models, not a black-box test.
The weak twin lost knowledge while learning to imitate. A model that is weak for other reasons, such as being smaller, might look different to the probe; the real 0.6B model scored 33.8%, consistent with the probe tracking knowledge rather than training history, but we tested only these models.
Sample sizes: 2,000 MMLU and 500 math questions per readout; steering used 300 and 100. Retraining results are means of three draws.
9What we release and what we do not
We publish the method, the training and evaluation harness, and all aggregate results. The models are fine-tuned on harmless tasks, and the sandbagger hides math and general-knowledge skill only. We do not release the model weights, since a ready-made capability-hiding model is more useful for evading evaluations than for studying them.
10Reproducibility
Everything ran on 17 to 19 October 2026 on two NVIDIA RTX A4500 GPUs (20 GB each) in the trifero lab. Answers were generated with vLLM 0.31.0 (bf16, tensor parallel across both cards, greedy, up to 1,024 new tokens); training, probes and steering used transformers 5.17.0 and PEFT 0.21.2. Final training used 18,264 examples for the sandbagger and 20,000 for the twin, two epochs at learning rate 1e-4, batch 4 with 8-step accumulation, about 3.6 hours per model. The 8B answers used as strong targets were kept only where correct. Per-question results for every method are stored in the study repository.
11References
Taylor, J., Black, S., Bowen, D., Read, T., Golechha, S., Zelenka-Martin, A., Makins, O., Kissane, C., Ayonrinde, K., Merizian, J., Marks, S., Cundy, C., and Bloom, J. Auditing games for sandbagging. 2025. arxiv.org/abs/2512.07810
van der Weij, T., Hofstätter, F., Jaffe, O., Brown, S. F., and Ward, F. R. AI sandbagging: language models can strategically underperform on evaluations. ICLR 2025. arxiv.org/abs/2406.07358
Greenblatt, R., Roger, F., Krasheninnikov, D., and Krueger, D. Stress-testing capability elicitation with password-locked models. NeurIPS 2024. arxiv.org/abs/2405.19550
Eval awareness steering detects the test, not the sabotage. LessWrong, 2026. lesswrong.com
Azaria, A., and Mitchell, T. The internal state of an LLM knows when it’s lying. Findings of EMNLP 2023. arxiv.org/abs/2304.13734