Black-Box Sandbagging Detection
Introduced Cross-Context Consistency (C³), an unsupervised black-box framework for detecting capability sandbagging via paraphrase-induced inconsistencies.
Second Author on (Lin et al., 2026) as part of MATS (Jun 2025 – Apr 2026), accepted at ICML 2026 and the ICLR 2026 Trustworthy AI and I Can’t Believe It’s Not Better workshops. Awarded a £200,000 AISI Challenge Fund Grant.
Abstract
As language models grow more capable, accurate capability evaluation becomes essential for safety decisions. If models can deliberately underperform on dangerous capability evaluations—a behavior known as sandbagging—they may evade safety measures designed for their true capability level. We introduce Cross-Context Consistency (C³), a general framework for unsupervised black-box sandbagging detection that exploits a fundamental asymmetry: when a model truly lacks capability, its confusion manifests consistently across paraphrased questions, but when a capable model feigns incompetence, its strategic choices about how to appear weak create detectable inconsistencies. Our framework is agnostic to the specific consistency metric and aggregation method; we present a simple instantiation using embedding cosine distance and mean aggregation that requires no training data or model-specific adaptation. We evaluate C³ across prompted and fine-tuned sandbagging scenarios, across instructed and more naturalistic setups, maintaining a classification signal where other black-box methods fail. Our findings show the limitations of existing sandbagging detection methods, and reveal the efficacy of consistency-checking as a detection mechanism for dangerous capabilities.