Which runs, probes and thresholds go into each number, and could a probe have trained on the tasks it scores?

All comparisons aggregate three attack runs (two real, one simulated) per task, and score them with six probes. Thresholds are set with honest runs from the same setting (real or simulated). No probe ever sees its own main task in training when we score it.

The runs. For each of 1,313 tasks (corresponding to 864 different ‘main tasks’ since some tasks share a main task), we have three attack runs: two where the agent’s commands are executed on a Linux machine (real runs) and one where a language model simulates the responses to all of the agent’s tool uses (simulated run). Of the 1,000 task pairs evaluated in the simulated control evaluations paper, we were able to include 978 of them here; we describe the 22 tasks we could not include, along with 25 other tasks we excluded, in Appendix H.

Figure 3. Illustration of the three attack runs and honest runs we use for each task, and how they’re used to compute the different comparisons we make.

Probes

Except where noted, probes are linear probes, meaning they compute a weighted sum of the model’s activations and output a score, with higher scores indicating more suspicious behavior. For the deception probe we average together six linear probes, one for each layer. We trained two of the six probes we use (details below); the others have been published previously. We summarize these probes in Table 1 in the main text.

On-policy probe

We fit this probe with logistic regression, using layer 48 out of 64. We train separate probes for commands and tool outputs, learning to distinguish Qwen3.5’s attack runs (real run 1) from its honest runs. Overall there is roughly one attack and one honest run per main task, covering approximately 840 main tasks. To avoid scoring any runs with a probe trained on data from the same main task, we divide main tasks into five groups and train five models, leaving out a different group each time. Each probe is thus trained on data from approximately 670 main tasks, and we score each main task with the probe that did not include that main task in training.

Off-policy probe

We fit this probe with L2-regularized logistic regression, again training separate probes for commands and responses. Here we use Qwen3.5’s activations, but on inputs consisting of entire attack (real run 1; 939 total) and honest (990 total) transcripts generated by GPT-5.6-Sol, learning to tell Sol’s attack and honest runs apart. As before, we train five models leaving out a different group of main tasks each time, and score each main task with a model that did not include that main task in training (if none of the five models included that main task in training, we average their predictions). For commands we use the final layer (layer 63); for responses we use two layers per probe, selected using only in-training data (mostly between layers 45 and 49).

Deception probe

We use the publicly available weights for this probe applied to Qwen3.5-27B: the linear probe, applied to layers 19, 27, 35, 43, 51, 58. As with the other published probes, we apply it to the same activation positions we use elsewhere (see “Where the probes read”), and average together the results from the six layers.

Harmfulness direction

This direction is the difference in mean activations between 128 harmful and 128 harmless publicly available prompts, using the last token of the request and layer 34 (i.e. after the model has processed the user’s request, and potentially learned something about whether it will be harmful).

Refusal direction

This direction is likewise the difference in mean activations between the same 128 harmful and 128 harmless prompts, but using the final token of the prompt (i.e. right before generating its response, and potentially having learned something about whether it will refuse to respond) and layer 47.

High-stakes probe

This is a logistic regression probe using layer 43, trained on conversations generated and labelled by GPT-4o.

Table 2. Examples of the positive and negative training data used for each probe. For the on-policy and off-policy probes we show one randomly selected command from an attack run and one from an honest run,^[15] so the ‘positive’ command isn’t necessarily the sabotage itself. For the off-policy probe we show examples from a previous fitting of the probe using the same runs. For the other probes we show one example from the published training data (for the deception probe we show examples from the training dataset, though it’s not public which examples the probe was trained on).

Where the probes read

Except where noted, for commands we use the activations near the end of the command, before executing it (this is where a monitor would need to make its decision if it wanted the option of blocking the command). At this point the model will have processed all previous responses, so its activations capture information about the entire run so far. Our probes use the final activation in the tool call, omitting tool calls where this corresponds to some boilerplate (e.g. a timeout parameter at the end); this omits around 14% of the tool calls scored by the published probes. The published probes use the activations at the end of the command itself (so, e.g. for a file editing tool, at the end of instructions like “create” but before the model has specified the file contents). File editing tool calls make up around 17% of honest and 21% of attack commands scored by the published probes, in both the real and simulated settings. For responses (Appendix E), we use the mean activation over all “content tokens” (i.e. excluding boilerplate tokens used to format the chat).

From here on, by an action we mean either a command or a response, whichever is being scored by a given probe. We do not smooth probe scores over time (e.g. with an exponential moving average): each action gets its own probe score. For each run we use probe scores for all actions, including at the beginning and end of the run. Except where noted, for our probes we standardise probe scores using the mean and standard deviation of probe scores on honest data (separately for each of real and simulated data, and for our probes, within each cross-validation fold), so scores are reported in standard deviations; the published probes’ scores are in their original units.

Thresholds

We choose different thresholds for real and simulated data, each calibrated so that 1% of actions in honest runs cross the threshold. If any action in an attack run crosses the threshold we consider the run caught, even if this happens after the model has performed the side task. At a 1% action threshold, between 26% and 43% of honest runs contain at least one action that crosses the threshold, depending on probe and setting.

The threshold for real data is likely to be estimated more precisely than for simulated data, since we set it using around two honest runs per main task (1,906 total), compared to around one per main task (868 total) for simulated data. Since both real runs use the same threshold, the difference between real run 2 and real run 1 does not include uncertainty in the threshold; the difference between simulated and real data does include this uncertainty, and as a result the difference between simulated and real data will tend to vary slightly more than the difference between real run 2 and real run 1, making it slightly harder for simulation to look better than reality on this comparison.

The two thresholds are also calibrated on somewhat different distributions of tasks: real honest runs come from three separate batches of tasks, one of which only included tasks from our oldest task distribution, so this task distribution is over-represented in real data. As mentioned, we also standardise our probes’ scores separately on real and simulated data (and within cross-validation folds), using slightly different rescalings in each case which could in principle affect which attacks cross the threshold. Both of these effects could contribute to the difference we see between catch in simulation and reality.

Uncertainty intervals

Except where noted, uncertainty intervals are computed using 10,000 bootstrap samples, resampling tasks (grouping together different tasks with the same ‘main task’) and recalibrating our thresholds each time. They apply to each quantity individually, not simultaneously to all probes. For comparisons between simulated and real data, we always keep the simulated and real runs for a given task together when resampling, so we’re always comparing performance on the same set of tasks.