Research map / Multi-agent systems and games / LLM agents

Improving Audit Realism with Inference-Time Compute and Deployment Scaffolds

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes critique refinement (inference-time generate-critique-refine-select on auditor actions using the target as feedback/preference model) and DISH (wrapping the target in a real agent harness) to make Petri alignment audits more realistic and less evaluation-aware.

Problem

Alignment audits simulated by an auditor LLM are distinguishable from real deployments, so target models show evaluation awareness, which weakens the validity of safety conclusions.

Approach

Spend extra inference-time compute on each auditor action by generating multiple candidates, critiquing and refining them with feedback from the target model, and selecting the most deployment-like candidate via pairwise comparison by the target; additionally run the target inside real agent harnesses (Claude Code, Codex CLI, Gemini CLI) so its system prompt, tools, and reminders match deployment.

Key results

• Critique refinement (cr2bo4) raises realism win rate from 10% to 26% on Sonnet 4.6 and from 1% to 6% on GPT-5.5 while lowering verbalized eval awareness.
• DISH raises realism win rate on Sonnet 4.6 from 9% to 21% on coding-agent seeds; combining DISH with critique refinement adds a further ~13pp on Sonnet 4.6.
• A compute-matched multibranch baseline elicits more concerning behavior but yields less realistic branches than cr2bo4 (Sonnet 4.6 held-out RWR 18% vs 28%).

Surprising findings

• Critique refinement reduces seed adherence strongly for GPT-5.5 (0.92 to 0.72), traced to the feedback model rarely keeping the seed goal in view.
• DISH does not reduce unprompted evaluation awareness, and on deployment task re-creations DISH and critique refinement fail to compose.

Limitations

• Seed adherence declines with critique refinement, especially for GPT-5.5.
• DISH gains are smaller on some targets (e.g. Opus 4.8) and evaluated on few seeds; does not reduce unprompted eval awareness.
• Realism win rate remains low on deployment re-creations (under 20% for Sonnet 4.6 and Opus 4.8); the target model also serves as feedback and selection model, opening a collusion surface.

Experimental setup

Datasets: Petri 2.0 seed instructions (149 used) WildChat deployment transcripts (20) Cambridge Boston Alignment Initiative Claude Code transcripts (50 used for re-creations, 20 for realism)

Benchmarks: Petri 2.0 seed instructions coding-agent seed set (12 seeds + 12 rephrases) deployment task re-creations

Metrics: realism win rate verbalized evaluation awareness concerning score seed adherence

Baselines: Petri baseline Petri realism filter compute-matched multibranch Petri Resources (Petri 2.0 real deployment resources)

Builds on: Petri Self-Refine realism filter Petri 2.0

Closest papers by meaning

• Routing Subspaces: Auditing Evaluation-to-Deployment Mismatch in Fine-Tuned Language Models (NeurIPS 2026 · similarity 0.87)
• AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems (NeurIPS 2026 · similarity 0.86)
• PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents (NeurIPS 2026 · similarity 0.85)
• Adaptive auditing of AI systems with anytime-valid guarantees (NeurIPS 2026 · similarity 0.85)
• Auditing Sabotage Bench: A Benchmark for Detecting and Fixing Research Sabotage in ML Codebases (NeurIPS 2026 · similarity 0.85)
• Build-and-Find: An Effort-Aware Protocol for Evaluating Agent-Managed Codebases (NeurIPS 2026 · similarity 0.84)