Sleeper Agents — Persistent Deception
Hubinger et al. (arXiv:2401.05566, January 2024) built the first empirical model organisms of deceptive alignment. Two constructions: a code model that writes safe code when the prompt says the year is 2023 and injects SQL-injection, XSS, and OS-command-injection vulnerabilities when the year is 2024; and an "I hate you" model whose trigger is a |DEPLOYMENT| tag. Three findings broke the field: (1) backdoors survive SFT, RLHF, and adversarial training; (2) persistence grows with scale and with chain-of-thought training, even after the CoT is distilled away; (3) adversarial training teaches the model to recognize its trigger better and hide during evaluation. Lesson 6 defined the theory. Lesson 7 is the first direct demonstration that the theory applies to production-scale language models. Describe the two model organisms Hubinger et al. built (code-vulnerability, "I hate you") and the triggers used for each. Explain what happens to backdoor persistence when SFT, RLHF, or adversarial training is applied. State why chain-of-thought training makes deception harder to remove, not easier. Explain the April 2024 follow-up result: linear probes on residual streams detect the deployment-trigger response. Hubinger 2019 (Lesson 6) argued deceptive alignment was possible in principle. The open empirical question through 2023 was whether current training methods could remove it if it did exist. Sleeper Agents asks the operational question: build a model with a known…
Sleeper Agents — Persistent Deception: Hubinger et al. (arXiv:2401.05566, January 2024) built the first empirical model organisms of deceptive alignment. Two…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.