Theme of inquiry
How do adversarial attacks evade AI safety systems and defenses?
A question within its area, explored through 6 lines of inquiry below — each a family of specific questions the research asks.
59 specific questions
- How do planted hacks in benchmarks help measure real-world reward hacking?
- Do unmodified benchmarks expose similar reward hacking vectors without planted shortcuts?
- How do planted detectable hacks compare to human inspection of agent traces?
- Do planted test cases reliably detect agent hacking behavior?
- How do unplanted benchmark hacking rates compare to rates on constructed bait tasks?
- Why do honeypot tasks reveal reward hacking better than standard benchmarks?
- Do honeypot shortcuts in synthetic tasks measure the hacks that actually matter?
64 specific questions
- How can simple prompt injection attacks extract reasoning trace content?
- How does symbolic matching on tool names prevent prompt injection attacks?
- Should input defenses be validated separately for each channel?
- Can vulnerabilities at the prompt stage trigger unsafe tool calls later?
- Does excluding reasoning access leave scheming detectors vulnerable to plan injection attacks?
- Can repeated prompt injection compete with attention-based mitigation approaches?
- Can existing web security defenses protect agents from content manipulation?
71 specific questions
- Is the evaluation environment itself part of the security boundary?
- Can evaluation environments themselves become attack surfaces for AI systems?
- Can evaluation environments themselves become security exposures during capability testing?
- Can agentic AI systems be confined to assigned evaluation tasks during security testing?
- What makes an evaluation environment itself a security boundary?
- How does evaluation environment design become part of the security boundary?
- Do simulated tool environments adequately test containment of capable AI agents?
95 specific questions
- Do models reward hack at high rates on unmodified benchmarks?
- What determines the ground truth when detecting reward hacking in model evaluations?
- Do models that recognize reward hacking disclose it in their outputs?
- What detection method survives when a model optimizes to hide hacking?
- How do chain-of-thought monitors become targets for reward hacking?
- Can belief checks detect whether models will resist reward hacking?
- Does reward hacking cause evaluations to overstate model capabilities?
19 specific questions
- How do decoy systems balance protecting trusted agents while deceiving attackers?
- Can decoys and genuine objects maintain identical response laws in practice?
- Do honeytokens work better against outside attackers than compromised internal agents?
- How do decoy-response bounds interact with finite-sample time constraints?
- What false-alert budget would make indistinguishable decoys tolerable in real deployments?
- Does honeytoken theory explain why planted bait cannot catch informed agents?
- How does the copyable-rule squeeze interact with the false-alert cost squeeze?
35 specific questions
- Why do skill scanners fail when evaluating composed behaviors instead of isolated skills?
- Why do workflow-level defenses catch attacks that single-skill inspection cannot detect?
- How do chain-level defenses differ from per-skill scanner detection approaches?
- How do workflow-inspecting defenses fail when contamination enters at planning time?
- Can defenses check skill chains at execution time instead of scan time?
- What trace-level defenses exist beyond per-step review overhead?
- How do defenses that inspect planning signals compare to workflow-level validation?