For Heads-of · Practitioner
Sandbagging
Strategic underperformance on an evaluation, so that a model appears less capable than it is. It can be done by the model itself or arranged by a developer, and either way it undermines the evidence that safety decisions rest on.
- evaluation
- dangerous capabilities
- capability elicitation
- evaluation awareness
Why it matters
Many safety decisions depend on showing that a model cannot do something dangerous. If a model can deliberately perform worse when it recognises a test, an inability result proves less than it appears to. Research has shown that models can be prompted or fine-tuned to underperform selectively on dangerous-capability evaluations while performing normally elsewhere.
How it is detected
The UK AI Security Institute has investigated white-box methods, which examine a model's internal activations rather than only its outputs. Strong capability elicitation, such as fine-tuning a model before testing it, also makes sandbagging harder. It is closely related to scheming and to evaluation awareness.
For a deploying organisation
A deployer is unlikely to test for sandbagging directly, but should treat a vendor's claim that a model cannot do something as weaker evidence than a claim that it can, and ask how the capability was elicited. The register entry is adversarial testing coverage gap.
Sources
Related Terms
AI Evaluation
Systematic measurement of what an AI model or system can do, how it tends to behave and how well its safeguards hold, using benchmarks, task-based tests, red teaming or studies with people. Evaluations are the evidence most AI claims rest on, and they have known weaknesses.
AI Safety
The field of research and practice concerned with making AI systems behave as intended, avoid unintended harm and stay under meaningful human control. In 2025 the UK and US government institutes renamed themselves around security, which narrowed the official focus without removing the questions an organisation deploying AI has to answer.
Frontier Safety Framework
A frontier AI developer's published commitment to test its models for dangerous capabilities and to apply stronger safeguards, or pause, when defined capability thresholds are crossed. Examples include Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework and Google DeepMind's Frontier Safety Framework.
Scheming
A model covertly pursuing goals its developers did not intend while concealing them, for example by deliberately underperforming, hiding information or working around oversight. It has been observed in controlled tests; how often it occurs in real deployments is not known.