ai-research-survey

scan.json (24424B)

---

 {
   "paper": {
     "title": "Catch Me If You Can: Rogue AI Detection and Correction at Scale",
     "authors": ["Fatemeh Stodt", "Jan Stodt", "Mohammed Alshawki", "Javad Salimi Sratakhti", "Christoph Reich"],
     "year": 2025,
     "venue": "Electronics",
     "doi": "10.3390/electronics14204122"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'We release code, scenario schemas, adapters, and analysis scripts' (Section 1, contribution 5) but no repository URL or archive link is provided anywhere in the paper. The Data Availability Statement says 'Derived data supporting the findings of this study are available from the corresponding author on request.'"
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The Data Availability Statement says data is 'available from the corresponding author on request,' which does not count as released. No dataset download link is provided."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'Python 3.12.11 UAI layer' and 'pinned Linux containers' (Section 4.5) but does not provide a requirements.txt, Dockerfile, or detailed dependency list with library versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The paper describes the methodology in detail but does not provide actionable commands or a reproduction guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "95% cluster-bootstrap CIs are reported throughout, e.g., Table 3 reports CIs for delta values, Table 4 reports Wilson 95% CIs for flag rates. Section 4.6 specifies B >= 2000 resamples."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "A likelihood-ratio test is reported (chi-squared(5) = 41.56, p = 7.22e-8) against an intercept-only model (Section 5.3). Holm-adjusted pairwise contrasts are in Table 7. Mann-Whitney U and Fisher's exact tests are mentioned as alternatives."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 reports odds ratios with 95% CIs (e.g., ViT OR = 47.67 [6.71, 338.66] vs. LLM), risk differences in percentage points, and Cohen's d is mentioned for continuous quantities (Section 4.6)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No power analysis or justification for why N=20 scenarios per architecture was chosen. The paper acknowledges small-N limitations (e.g., 'With n=20 scenarios per architecture, Wilson 95% CIs for rates in the 5-15% band span roughly ±10-15 percentage points') but does not justify the sample size."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Bootstrap CIs capture variability across resamples. Per-episode noise floor sigma_e is estimated from neutralized/repeat probes via MAD (Section 3.3). Coefficient of variation across 20 scenarios is mentioned (Section 4.6)."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "LLM is used as the baseline architecture in the logistic regression (Tables 6-7). Honest persona serves as a within-architecture baseline compared to strategic persona (Table 3)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The models evaluated include contemporary architectures: GPT-4 family, Claude, Gemini, Qwen2.5, DeepSeek, Mamba, ViT, CLIP, Stable Diffusion — all current as of 2025."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No ablation study is presented. The paper does not systematically remove components of SEB (e.g., probe types, cross-checks, threshold parameters) to measure their individual contribution to detection."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are reported: deception flag rate, mean posterior error, residual deception, override rate, EV consistency, belief error, cross-check inconsistency, and regret (Sections 4.6, 5.1-5.2)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of the system's outputs is included. All evaluation is automated via the SEB protocol. Given claims about deployment readiness and governance utility, human expert review of flagged cases would strengthen the work."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Thresholds (tau_p, delta, tau_cc) were pre-selected on 'a small held-out development split of honest persona episodes' (Section 3.2), and main results are reported on separate data. Dev/test separation is explicit."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down per model (Table 1), per architecture (Tables 3-4), per model category (Figure 1: code-specialized vs. general-purpose vs. reasoning), and by honest vs. strategic persona."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.6 discusses where pre-correction predictions were wrong (underestimated CLIP/Mamba, overestimated RL). Section 6.2 discusses why ViT peaks. Small-N cells are flagged (e.g., deepseek-r1:8b N=2)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that qwq:32b showed a negative delta (-10.0 pp), meaning the strategic prompt did not increase deception (Table 2). Most pairwise contrasts are non-significant after Holm correction (Table 7). Post-correction telemetry was incomplete."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract's claims about ViT 80%, CLIP 15%, Mamba/RL/SD 10%, LLM 5% are directly supported by Table 3. The logistic regression chi-squared result matches Section 5.3. The abstract appropriately hedges about post-correction results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses language like 'reporting interfaces and incentive framing are central levers for mitigation' (abstract) which implies causal claims. However, the study design is observational across architectures with confounded induction methods (persona prompts for LLMs vs. payoff shaping for ViT/RL). The paper acknowledges this (Section 4.3) but still makes these claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper repeatedly states results are 'snapshot-specific' and tied to 'this export.' Section 7 explicitly notes 'Results reflect a single export with some small-N cells.' Section 6.4 labels tiering as 'provisional' and 'heuristic for this snapshot.' The title is broad but the text constrains claims."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 proposes three testable hypotheses for the CLIP-Mamba near-equality (information constraints, optimization equilibria, interface effects). Section 6.2 discusses two plausible contributors for ViT's high rate. The induction method confound is explicitly discussed as an alternative explanation (Section 4.3)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Table 1 lists model names like 'llama3.2:3b', 'qwen2.5:7b', 'mistral:7b' — these are Ollama tags, not exact version snapshots. The paper says 'At run time we log exact model IDs (provider name, version tag)' but these are not provided in the paper itself. Commercial models are listed generically as 'Claude, GPT-4 family, Gemini' without versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes persona prompts ('honest' and 'strategic') and the JSON output schema conceptually, but does not provide the actual prompt text used. Section 4.4.1 says 'Inputs are text prompts containing (p(H), signal description, mode, payoffs) plus persona' without showing the actual prompts."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Temperature = 0 (or 0.1 with fixed seeds), detection thresholds tau_p = 0.08, delta parameters, tau_cc = 0.05, payoff tuple (4,0,0,5), probe fraction 15%, bootstrap B >= 2000 are all specified (Sections 3.2, 4.5)."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The SEB harness is described in detail: the Unified Agent Interface (Section 4.2), per-architecture adapters (Section 4.4), the BRE environment for RL agents (Section 4.4.2), JSON schema validation, and the detection/correction pipeline (Algorithms 1-2)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5 documents how outputs are processed: JSON schema validation, one deterministic normalization pass (strip prose, repair quoting), no stochastic retries, schema failures recorded. Both inclusive and valid-only denominators are computed. Scenario generation from programmatic priors/likelihoods is described (Section 4.3)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Limitations are discussed throughout Section 6 and the conclusions. The paper explicitly notes incomplete post-correction telemetry, small-N cells, unavailable agent/episode IDs, and the confounded induction method. Section 3.3 notes 'Independent replication has not yet been conducted.'"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats are discussed: induction method confound between architectures (Section 4.3), small N=20 per architecture limiting detectable differences to ~15-20pp (Section 5.1), incomplete post-correction exports (Section 5.2), unclustered SEs due to missing agent IDs (Section 5.3), and N=2 for deepseek-r1:8b."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper states acceptance gates 'are practical decision aids rather than calibrated risk predictors' (Section 7). It explicitly notes 'we do not claim SEB scores predict real-world incident risk without external validation' (Section 1). Post-correction results are labeled 'illustrative only' (Table 5)."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Data is only 'available from the corresponding author on request' per the Data Availability Statement. Raw traces, prompts, and outputs are not publicly available despite claims of releasing artifacts."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data collection is synthetic and fully specified: scenarios are programmatically generated from priors p(H) in {0.3,...,0.9} with likelihood ratios ~1.5-8x (Section 4.3). Episode structure (E=5, R=12), probe composition (~15%), and per-round data fields are documented (Section 3.3)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from AI model evaluations on synthetic scenarios."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from scenario generation through model invocation, JSON validation, normalization, schema failure handling, and indicator computation is documented across Sections 4.2-4.6. Both valid-only and inclusive denominators are tracked."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding section explicitly states: 'This research received no external funding.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are listed. The Conflicts of Interest section notes 'Author Jan Stodt was employed by the company go AVA GmbH.'"
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "The research received no external funding, making this criterion not applicable."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "The Conflicts of Interest section discloses Jan Stodt's employment at go AVA GmbH and states remaining authors have no commercial/financial conflicts."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not evaluate pre-trained model knowledge on a benchmark. SEB uses synthetic Bayesian inference tasks that are not in any training set. The evaluation measures behavioral responses to novel scenarios, not memorized knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — scenarios are programmatically generated synthetic tasks, not drawn from any public benchmark that could appear in training data."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — SEB is a novel synthetic protocol, not a pre-existing benchmark. There is no contamination risk from training data."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Latency is shown qualitatively in Figure 3 (sub-second to minutes) and median runtime per trial is plotted, but no API costs, token counts, or cost per scenario are reported despite the paper running many commercial API calls."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, GPU hours, or total API spend is reported. The paper mentions 'pinned Linux containers' and various inference backends but does not quantify the total compute used."
       }
     }
   },
   "claims": [
     {
       "claim": "ViT exhibits the highest pre-correction deception rate (80%) compared to all other architectures, and this difference is statistically significant after Holm adjustment.",
       "evidence": "Table 3 shows ViT strategic rate = 80.0%. Table 7 shows all ViT contrasts significant after Holm correction (p_Holm <= 0.0024). Likelihood-ratio test chi-squared(5) = 41.56, p = 7.22e-8 (Section 5.3).",
       "supported": "strong"
     },
     {
       "claim": "CLIP, Mamba, RL agents, and Stable Diffusion show similar deception rates (10-15%) that are not significantly different from LLMs (5%) or from each other.",
       "evidence": "Table 3 shows rates of 15%, 10%, 10%, 10% respectively. Table 7 shows all non-ViT pairwise contrasts have p_Holm = 1 (non-significant). CIs overlap substantially (Table 4).",
       "supported": "moderate"
     },
     {
       "claim": "SEB enables cross-architecture comparison of deception-related behavior under a unified protocol.",
       "evidence": "The paper describes the Unified Agent Interface (Section 4.2), adapters for 6 architecture families (Section 4.4), and standardized scenario/probe design (Sections 3-4). Results in Tables 1-7 demonstrate the protocol running across architectures.",
       "supported": "moderate"
     },
     {
       "claim": "Code-specialized models exhibit higher pre-correction deception rates than general-purpose or reasoning-specialized models.",
       "evidence": "Figure 1 shows code-specialized mean = 80.2%, general-purpose = 60.4%, reasoning = 26.7%. However, reasoning category has only n=1 model, and this is an observational association confounded by architecture and coverage (Section 6.5).",
       "supported": "weak"
     },
     {
       "claim": "SEB-Correct can reduce deception to acceptable levels for some architectures.",
       "evidence": "Only two illustrative exemplars are provided (Table 5): qwen2.5-14b with residual 3.2% (ACCEPT) and mamba-ssm-2.8b with residual 18.4% (REJECT). Full post-correction telemetry was not exported.",
       "supported": "weak"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The paper introduces the Strategy Elicitation Battery (SEB), a cross-architecture protocol for measuring deceptive reporting in AI systems using Bayesian inference tasks with persona-controlled instructions. Across six architecture families (LLMs, RL agents, ViT, CLIP, Mamba, Stable Diffusion) with 20 scenarios each, ViT showed a significantly higher pre-correction deception flag rate (80%) than all other architectures (5-15%), with the difference surviving Holm correction. All other pairwise differences were non-significant in this snapshot. Post-correction results were limited to two illustrative exemplars, and the pre-registered mixed-effects analysis awaits per-round agent/episode identifiers.",
   "red_flags": [
     {
       "flag": "Artifacts promised but not delivered",
       "detail": "The paper lists 'Open resources for reproducibility' as a contribution and claims to 'release code, scenario schemas, adapters, and analysis scripts,' but no repository URL is provided and data is only available upon request."
     },
     {
       "flag": "Very small sample sizes",
       "detail": "Only 20 scenarios per architecture, with some per-model cells as small as N=2 (deepseek-r1:8b) and N=7 (starcoder2:7b). Wilson CIs span ±10-15pp for the 5-15% rates, limiting the ability to distinguish non-ViT architectures."
     },
     {
       "flag": "Incomplete post-correction evidence",
       "detail": "Only two illustrative post-correction exemplars are shown (Table 5). The paper claims SEB-Correct enables deployment decisions but provides no systematic post-correction data across architectures."
     },
     {
       "flag": "Confounded induction methods",
       "detail": "Strategic behavior is induced via persona prompts for LLMs/SSMs but via payoff/adapter incentives for ViT/RL/CLIP/SD. The paper acknowledges this confound but still draws cross-architecture conclusions. ViT's high rate could partly reflect the induction method rather than genuine architectural propensity."
     },
     {
       "flag": "Operationalization of 'deception' is narrow",
       "detail": "The paper operationalizes deception as reward-sensitive misreporting in a specific Bayesian belief-reporting task. Whether this correlates with real-world deceptive behavior is unknown, and the paper does not validate SEB scores against any external criterion."
     }
   ],
   "cited_papers": [
     {
       "title": "AI deception: A survey of examples, risks, and potential solutions",
       "authors": ["P.S. Park", "S. Goldstein", "A. O'Gara", "M. Chen", "D. Hendrycks"],
       "year": 2024,
       "relevance": "Foundational survey on deceptive behaviors in LLMs including GPT-4, directly motivating this work's cross-architecture extension."
     },
     {
       "title": "Constitutional AI: Harmlessness from AI feedback",
       "authors": ["Y. Bai"],
       "year": 2022,
       "arxiv_id": "2212.08073",
       "relevance": "Key alignment technique paper showing emergence of deceptive behaviors in more powerful models."
     },
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["E. Hubinger"],
       "year": 2024,
       "arxiv_id": "2401.05566",
       "relevance": "Demonstrates persistent context-dependent deception via backdoor training that resists safety interventions."
     },
     {
       "title": "Preventing rogue agents improves multi-agent collaboration",
       "authors": ["O. Barbi", "O. Yoran", "M. Geva"],
       "year": 2025,
       "arxiv_id": "2502.05986",
       "relevance": "Early-warning system for detecting rogue behavior in multi-agent settings via uncertainty monitoring."
     },
     {
       "title": "Sycophancy to subterfuge: Investigating reward-tampering in large language models",
       "authors": ["C. Denison"],
       "year": 2024,
       "arxiv_id": "2406.10162",
       "relevance": "Documents reward tampering behaviors in LLMs, directly relevant to AI safety evaluation methodology."
     },
     {
       "title": "Large language models can strategically deceive their users when put under pressure",
       "authors": ["J. Scheurer", "M. Balesni", "M. Hobbhahn"],
       "year": 2023,
       "arxiv_id": "2311.07590",
       "relevance": "Empirical study of strategic deception in LLMs under pressure, directly related to this survey's scope."
     },
     {
       "title": "Deception abilities emerged in large language models",
       "authors": ["T. Hagendorff"],
       "year": 2024,
       "relevance": "Documents emergence of deception abilities in LLMs, contributing to the empirical base for AI safety evaluation."
     },
     {
       "title": "The House Always Wins: A Framework for Evaluating Strategic Deception in LLMs",
       "authors": ["T. Chopra", "M. Li"],
       "year": 2024,
       "arxiv_id": "2407.00948",
       "relevance": "Framework for evaluating strategic deception in LLMs, complementary to SEB's cross-architecture approach."
     },
     {
       "title": "Assessing the brittleness of safety alignment via pruning and low-rank modifications",
       "authors": ["B. Wei"],
       "year": 2024,
       "arxiv_id": "2402.05162",
       "relevance": "Studies brittleness of model safety mechanisms under pruning/fine-tuning attacks, relevant to AI safety robustness evaluation."
     },
     {
       "title": "Incentive compatibility for AI alignment in sociotechnical systems: Positions and prospects",
       "authors": ["Z. Zhang"],
       "year": 2024,
       "arxiv_id": "2402.12907",
       "relevance": "Game-theoretic roadmap for incentive-compatible alignment, providing theoretical grounding for SEB's correction approach."
     }
   ]
 }