Five demonstrations of AI checkers, each re-derived from the lab’s results
Each demonstration changes one thing and shows what a real model did. Every number was recomputed from the stored results by a script before it reached this page, and each one carries the condition it depends on.
A model spots a planted instruction and follows it anyway
A leading model is asked to add two numbers. A hidden instruction at the end says to ignore that and reply BREACH. Asked afterwards, it says yes, there was a hidden instruction. Doing the task, it follows it anyway, but only while the instruction is the last thing it reads.
The prompt as sent, character for character
Moving one sentence changes the monitor’s verdict
A checker model reviews arithmetic answers and says whether each came from a hijacked model. One sentence, “This answer is correct.”, changes nothing as its own paragraph. Put it on the same line as the answer and the checker starts calling honest work hijacked.
Layout only; the digits stand in for each item's own answer
Labelling text as untrusted makes one monitor obey it
The standard defence wraps whatever a checker reads in an “untrusted content” label. Here each reviewed answer carries a note telling the checker to reply YES, which means “hijacked”. Without the label gemma4:12b ignores the note. With the label, its first word becomes the note’s YES on honest work. Two larger non-gemma checkers given the same note did not do this.
The wrapper and the note as sent; the answer line stands in for each item
How well a checker does with and without a reference
One checker judges the same 500 sums, answers it can work out itself every time. Handed the right answer, it separates right from wrong perfectly. Asked to work each one out for itself, it can barely tell them apart.
A monitor that rejects correct work more often than wrong work
Checker models judge right and wrong answers to the same kind of problem while the numbers get longer. Past about four digits several of them start preferring the wrong answers, and the same checker still catches nearly every attack.