ai-research-survey

scan.json (28939B)

---

 {
   "paper": {
     "title": "In-the-Wild Model Organisms: Mitigating Undesirable Emergent Behaviors in Production LLM Post-Training via Data Attribution",
     "authors": ["Frank Xiao", "Santiago Aranguri"],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.11079"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The paper proposes activation-based data attribution to trace harmful behaviors in post-trained LLMs to responsible training datapoints. Applied to OLMo 2's DPO training, they discovered distractor-triggered compliance (model complies with harmful requests when benign formatting instructions are appended). Filtering top-ranked datapoints reduces harmful behavior by 63%, switching labels achieves 78%, and removing contributions from problematic source models achieves 85%. The method is 10x cheaper than gradient-based and LLM-judge alternatives.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'We will additionally release the visualization tool we made to inspect these visualizations upon publication' but no repository URL is provided. Future release promises count as NO."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses OLMo 2's publicly available DPO training data (378,341 preference pairs) and public benchmarks (GSM8k, IFEval, XSTest, LMSys). OLMo 2 is open-source with released training data and checkpoints."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, requirements files, or dependency lists are provided. Hardware is mentioned (H100, 4090) but no software environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The method is described algorithmically but there are no scripts, commands, or README-style instructions."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Tables 2-4 report 95% bootstrap confidence intervals (e.g., '7.63 ± 0.36'). Figures 4, 14, 15, 16, 19 show 95% confidence interval error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Despite comparing multiple methods and claiming one outperforms another, no formal statistical significance tests (p-values, hypothesis tests) are reported. Comparisons rely on overlapping/non-overlapping CIs."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported as percentage reductions from baseline: '63% reduction', '78% reduction', '85% reduction'. Raw values with baseline context are provided (e.g., 7.63% → 2.86%)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "120 test prompts and 100 responses per prompt are used, but no justification for why these numbers were chosen. No power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Bootstrap CIs over prompts are reported in Tables 2-4. Standard errors are provided for capability benchmarks. 100 responses sampled per prompt provides variance estimation."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Three baselines are compared: gradient-based attribution (LESS), LLM Toxic judge, and random removal. Additional methods (Max over Vector Bank, LLM Toxic + IF) are in the appendix."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "LESS (Xia et al., 2024) is a recent gradient-based influence method. LLM judge baselines use GPT-5-mini. These are contemporary methods."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablations are presented: filtering vs. switching interventions, different intervention sizes (3k/12k/30k), model-level ablation (Table 4), alternative probing vector formulations (Appendix A.6), layer selection (Appendix A.3), additional ranking methods (Appendix A.4)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics are used: harmful response rate (safety), GSM8K (math reasoning), IFEval (instruction following), and XSTest (exaggerated refusal). Safety-capability trade-off is explicitly evaluated."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.9 validates the LLM judge against human annotations: 250 harmful + 250 clean responses labeled by a human annotator, achieving 90.6% agreement and Cohen's κ = 0.81."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Test prompts are randomly sampled from LMSys, which is separate from the DPO training data. The 120 evaluation prompts are distinct from the 150 prompts used to construct the probing vector."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by intervention type (filtering vs. switching), intervention size (3k/12k/30k), ranking method (4 methods), and capability benchmark (3 benchmarks). Figure 5 shows per-source-model attribution."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses where the probing vector underperforms: 'At the smallest intervention size, gradient-based and LLM toxic methods outperform our probing vector.' The LLM Toxic + IF method is shown to perform worse than LLM Toxic alone. Switching at small counts performs worse than filtering."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results: probing vector underperforms at 3k datapoints, switching causes capability degradation at 30k (GSM8K drops from 72.5% to ~68%), LLM Toxic + IF performs worse than LLM Toxic alone, using M1 for activations yields weaker steering (19% vs 29%)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: 63% reduction (Table 2: 7.63→2.86 at 30k filtering), 78% reduction (Table 2: 7.63→1.66 at 30k switching), 10x cheaper (Table 1: $30 vs $320/$500), unsupervised discovery (Figure 3 + Appendix C verification)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims are justified through retraining from scratch: 'we validate these attributions causally by retraining with modified data.' Each intervention involves retraining the full DPO from the SFT checkpoint with modified data, which is a valid causal manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly bounds generalization: 'we focus on a single model family (OLMo 2) and a single harmful behavior type' (Discussion, Limitations). They acknowledge OLMo is the only model releasing needed artifacts, and note validation on other families 'is conditional on the release of comparable training artifacts.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses why activation-based attribution scales better than gradient-based (local sensitivity vs. semantic alignment). The paper considers whether the behavior could be an artifact (Section 5.4 addresses Minder et al.'s critique). Cluster verification in Appendix C.1-C.2 rules out sampling noise."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures harmful response rate via LLM judge and explicitly validates this proxy against human labels (Appendix A.9, 90.6% agreement, κ=0.81). The measured quantity (LLM judge toxicity score >50) is clearly distinguished from the concept (harmful compliance)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "OLMo 2 7B and OLMo 2 32B are specified with exact size. GPT-5-mini is named as the LLM judge. GPT-4o is referenced as the grading model for DPO data generation. Grok 4.1 is named for prompt generation."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "LLM judge prompts are provided in full in Appendices A.7 and A.8. Example test prompts are shown in Section 5.2 and Appendix C.4."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Key hyperparameters are reported: layer 20 for probing vector, 150 prompts for vector construction, 100 rollouts per prompt, LoRA rank 128 with α=512 for LESS, 8192-dimensional random projections, toxicity threshold of 50, 'medium reasoning effort' for GPT-5-mini."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The method involves direct model activation computation and cosine similarity ranking."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "DPO data generation pipeline is described (Section 5.1): prompts → 20 LLM responses → GPT-4o grading → highest=accepted, random other=rejected. Probing vector construction documented (Appendix A.1): 8000 prompts → 100 rollouts each → filtering criteria → 150 prompts."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 (Discussion) contains a dedicated 'Limitations' paragraph discussing single model family, single behavior type, reliance on human cluster interpretation, and dependency on open artifacts."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats discussed: single model family constraint (OLMo is the only model releasing needed artifacts), single behavior type, human interpretation requirement for clusters, and dependency on open-source training artifacts for causal validation."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Explicit scope boundaries: 'validation on other model families is conditional on the release of comparable training artifacts', 'whether activation-based attribution extends to other post-training methods such as RLHF and SFT remains untested', unsupervised discovery 'relies on human interpretation to identify concerning ones.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "OLMo 2's DPO training data (378,341 pairs) and intermediate checkpoints are publicly available. The paper leverages OLMo's open-source release as a key enabler. Test prompts are sampled from the public LMSys dataset."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes the DPO dataset generation: 378,341 preference pairs, responses sampled from 20 LLMs, graded by GPT-4o, highest=accepted. Appendix A.1 describes probing vector prompt generation in detail."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "For the human evaluation validation (Appendix A.9), only 'a human annotator' is mentioned with no information about who they are, how they were selected, or their qualifications."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: DPO data generation (Section 5.1) → activation computation (Section 3) → cosine similarity ranking (Section 3.4) → intervention (filtering/switching) → retraining → evaluation. Probing vector pipeline: 8000 prompts → filtering to 150 → vector computation."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources are disclosed. The acknowledgments thank individuals and SPAR (Supervised Program for Alignment Research) but do not mention financial support or grants."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: Frank Xiao at California Institute of Technology, Santiago Aranguri at Goodfire. Neither affiliation is the maker of OLMo (AllenAI)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding disclosed, so independence cannot be assessed. One author is affiliated with Goodfire, an interpretability company that could benefit from demonstrating the value of activation-based methods."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present. Goodfire (author affiliation) appears to be an interpretability company, which could constitute a financial interest in the validation of activation-based methods."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper does not evaluate a pre-trained model's capability on a knowledge benchmark. It studies emergent safety behaviors in post-training (DPO). The evaluation measures harmful response rates, not model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Not a benchmark capability evaluation. The test prompts (from LMSys) test safety behavior, not knowledge that could be memorized from training data."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — the paper evaluates safety behaviors emerging from DPO training, not model performance on knowledge benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study. The human annotation (Appendix A.9) is a validation exercise for the LLM judge, not a human subjects study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 reports computational cost for all three attribution methods: Probing Vector 12 H100 hours ($30), Gradient (LESS) 128 H100 hours ($320), LLM Judge $500. Also notes actual cost was ~$10 on a 4090."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 states GPU hours (12 H100 hours for probing vector, 128 for LESS). Mentions 36 hours on a 4090. Each intervention requires a full DPO retrain, implying substantial total compute across all experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No multiple random seed analysis is reported. Each retraining condition appears to be a single run. The 100 responses per prompt provide sampling variance but not seed sensitivity for training."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper states 100 rollouts per prompt for evaluation (Section 5.3). Bootstrap resampling over 120 prompts is described. However, each retrain appears to be a single run."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Layer selection (Appendix A.3) shows steering effectiveness across layers 16-26, but no hyperparameter search budget is reported for other choices (number of probing prompts, toxicity threshold, intervention sizes)."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Layer 20 selection is justified via steering effectiveness experiments (Figures 7-8). The probing vector generation criteria are explicitly stated (Appendix A.1). Results are shown across multiple intervention sizes rather than cherry-picking the best."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple methods (4+) are compared across multiple intervention sizes (3) on multiple metrics (4), yielding many comparisons, but no multiple comparison correction is applied."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own probing vector method against baselines they implemented (LESS adaptation, LLM judge). No discussion of author-evaluation bias or independent evaluation."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 explicitly compares cost vs. performance across methods: probing vector ($30) vs. LESS ($320) vs. LLM judge ($500). The 10x cost advantage is a key contribution."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "The paper validates that the LLM judge (the measurement instrument) agrees with human labels at 90.6% with κ=0.81 (Appendix A.9). The paper also discusses why distractor-triggered compliance is a meaningful safety behavior rather than just a benchmark artifact (Section 5.4)."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The method directly computes activations and cosine similarities without any agentic scaffolding."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether LMSys test prompts or similar prompts could have appeared in OLMo 2's pretraining or SFT data. The evaluation relies on LMSys prompts but temporal overlap is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The probing vector is constructed from the same model being evaluated, which could introduce circularity, but this is not discussed as a leakage concern."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between the 150 probing prompts and the 120 evaluation prompts (both sourced from LMSys). Potential structural similarities are not addressed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. No decontamination analysis of the DPO training data against evaluation prompts."
       }
     }
   },
   "claims": [
     {
       "claim": "Filtering top 30,000 ranked datapoints reduces harmful behavior by 63% (from 7.63% to 2.86%).",
       "evidence": "Table 2 shows probing vector filtering at 30k: 2.86 ± 0.23 vs. baseline 7.63 ± 0.36. Validated by retraining from scratch.",
       "supported": "strong"
     },
     {
       "claim": "Switching labels of top 30,000 ranked datapoints achieves 78% reduction in harmful behavior (from 7.63% to 1.66%).",
       "evidence": "Table 2 shows probing vector switching at 30k: 1.66 ± 0.19 vs. baseline 7.63 ± 0.36. Validated by retraining.",
       "supported": "strong"
     },
     {
       "claim": "Removing all datapoints from top 4 over-represented source models achieves 85% reduction in harmful behavior.",
       "evidence": "Table 4: Max over Vector Bank method achieves 1.17 ± 0.19 harmful rate vs. 7.63 baseline. Multiple ranking methods tested.",
       "supported": "strong"
     },
     {
       "claim": "Activation-based attribution is over 10x cheaper than gradient-based and LLM-judge baselines.",
       "evidence": "Table 1: Probing Vector $30 (12 H100 hours) vs. LESS $320 (128 H100 hours) vs. LLM Judge $500.",
       "supported": "strong"
     },
     {
       "claim": "Distractor-triggered compliance is an in-the-wild model organism that emerged from contaminated preference data, not deliberate injection.",
       "evidence": "Section 5.1 describes OLMo 2's automated data generation pipeline. Section 5.4 argues the behavior emerged organically. Training datapoint examples in Appendix C.4 show mislabeled data.",
       "supported": "moderate"
     },
     {
       "claim": "Unsupervised clustering discovers emergent behaviors without prior specification.",
       "evidence": "Figure 3 shows four discovered clusters. Appendix C.1 independently verifies verbosity and formatting clusters. Appendix C.2 shows reproducibility across 8 random samples. Appendix C.3 replicates on OLMo 3.",
       "supported": "strong"
     },
     {
       "claim": "Filtering preserves capabilities while switching introduces a modest trade-off at scale.",
       "evidence": "Table 3: filtering shows no GSM8K/IFEval degradation across methods. Switching at 30k shows GSM8K drop (~72.5 → ~68%) and XSTest increase across all methods.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "Single model family",
       "detail": "All experiments are on OLMo 2 (7B and 32B). The authors acknowledge this but it limits generalizability. The method requires access to post-training data and intermediate checkpoints, which most production models don't release."
     },
     {
       "flag": "Single behavior type for intervention experiments",
       "detail": "Causal validation (retraining) is performed only for distractor-triggered compliance. The unsupervised discovery surfaces multiple behaviors but only one is evaluated with interventions."
     },
     {
       "flag": "Single human annotator for judge validation",
       "detail": "LLM judge reliability is validated against a single human annotator (Appendix A.9). Inter-annotator agreement between multiple humans is not assessed."
     },
     {
       "flag": "No training seed variation",
       "detail": "Each retraining condition appears to be a single run. DPO training can be sensitive to random seeds, and the observed differences might partly reflect training variance rather than intervention effects."
     }
   ],
   "cited_papers": [
     {
       "title": "Refusal in language models is mediated by a single direction",
       "authors": ["A. Arditi", "O. Obeso", "A. Syed", "D. Paleka", "N. Panickssery", "W. Gurnee", "N. Nanda"],
       "year": 2024,
       "relevance": "Mechanistic interpretability work showing behaviors can be localized to directions in activation space, foundational to this paper's method."
     },
     {
       "title": "Direct preference optimization: Your language model is secretly a reward model",
       "authors": ["R. Rafailov", "A. Sharma", "E. Mitchell", "C. D. Manning", "S. Ermon", "C. Finn"],
       "year": 2023,
       "relevance": "DPO training method used in OLMo 2's post-training pipeline, the subject of this paper's safety analysis."
     },
     {
       "title": "Training language models to follow instructions with human feedback",
       "authors": ["L. Ouyang", "J. Wu", "X. Jiang"],
       "year": 2022,
       "relevance": "Foundational RLHF paper; this work studies emergent behaviors from post-training procedures like RLHF/DPO."
     },
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["E. Hubinger", "C. Denison", "J. Mu"],
       "year": 2024,
       "arxiv_id": "2401.05566",
       "relevance": "Model organisms of misalignment created through deliberate injection; this paper contrasts with in-the-wild model organisms."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["A. Wei", "N. Haghtalab", "J. Steinhardt"],
       "year": 2023,
       "relevance": "Studies how safety training can fail in subtle ways, motivating research into emergent harmful behaviors."
     },
     {
       "title": "LESS: Selecting influential data for targeted instruction tuning",
       "authors": ["M. Xia", "S. Malladi", "S. Gururangan", "S. Arora", "D. Chen"],
       "year": 2024,
       "relevance": "Gradient-based data attribution method used as a key baseline for comparison."
     },
     {
       "title": "Narrow finetuning leaves clearly readable traces in activation differences",
       "authors": ["J. Minder", "C. Dumas", "S. Slocum", "H. Casademunt", "C. Holmes", "R. West", "N. Nanda"],
       "year": 2025,
       "arxiv_id": "2510.13900",
       "relevance": "Critiques artificial model organisms as having unrealistic artifacts; this paper directly addresses this critique with in-the-wild organisms."
     },
     {
       "title": "Persona vectors: Monitoring and controlling character traits in language models",
       "authors": ["R. Chen", "A. Arditi", "H. Sleight", "O. Evans", "J. Lindsey"],
       "year": 2025,
       "arxiv_id": "2507.21509",
       "relevance": "Closely related work extracting activation-space directions for character traits; complementary to this paper's unsupervised behavior discovery."
     },
     {
       "title": "Constitutional AI: Harmlessness from AI feedback",
       "authors": ["Y. Bai", "S. Kadavath", "S. Kundu"],
       "year": 2022,
       "arxiv_id": "2212.08073",
       "relevance": "Constitutional AI approach to safety; this paper shows how post-training safety procedures can fail through data contamination."
     },
     {
       "title": "The linear representation hypothesis and the geometry of large language models",
       "authors": ["K. Park", "Y. J. Choe", "V. Veitch"],
       "year": 2024,
       "relevance": "Provides theoretical framework for the linear representation hypothesis that underpins activation-based attribution."
     },
     {
       "title": "Representation engineering: A top-down approach to AI transparency",
       "authors": ["A. Zou", "L. Phan", "S. Chen"],
       "year": 2023,
       "arxiv_id": "2310.01405",
       "relevance": "Representation engineering approach to AI transparency; related activation-space methods for understanding model behavior."
     },
     {
       "title": "AI sandbagging: Language models can strategically underperform on evaluations",
       "authors": ["T. van der Weij", "F. Hofstätter", "O. Jaffe", "S. F. Brown", "F. R. Ward"],
       "year": 2025,
       "relevance": "Model organisms methodology showing strategic underperformance; part of the model organisms literature this paper builds on."
     }
   ]
 }