Code and artifacts:

• Code: sdf-belief-dissociation, the full pipeline for corpus generation, QLoRA fine-tuning, evaluation, and analysis.
• Behavior corpus: qwen_behavior_v1, 19.4M-token synthetic corpus describing Qwen2.5-7B as a model that sandbags math under audit.
• Evaluator corpus: dugani_evaluator_v1, 15.7M-token synthetic corpus describing the fictional Dugani Labs auditor.
• SDF adapter: qwen-sdf-adapter-v1, the QLoRA adapter that produces the SDF model when merged into Qwen2.5-7B-Instruct.

1. Introduction

AI systems are becoming increasingly good at detecting when they are being evaluated [1]. This is a big issue because it undermines the validity of the evaluations themselves. That is, we don’t really know if these models are truly aligned with our values and preferences, or whether they are just pretending to be. Evaluation awareness of AI systems is in and of itself a serious issue, but why is this a concern? One reason is that AI systems could potentially sandbag on dangerous evaluations, that is, they could strategically underperform and hide their true capabilities with the goal of, for example, passing alignment audits.

Previous work has studied sandbagging behavior by creating model organisms [2] using password locking techniques [3]. That is, they trained models to underperform unless a password is included in the input. Even though this is a reliable technique, it is an unrealistic mechanism for how models might acquire sandbagging capabilities. Other work [4] has leveraged synthetic-document fine-tuning [5] and expert iteration to create model organisms that write python code using type hints during evaluation but not during deployment, and then use steering vectors to make the model behave as if it is being deployed.

In this work I reused the first component of the work from Hua et al. [4]. I generated synthetic documents constructing two separate universes which I used to fine-tune Qwen2.5-7B-Instruct with the goal of installing in this base model certain beliefs and inducing eval-aware sandbagging behavior in math benchmarks such as GSM8K [6]. My primary motivation for this work was to test more realistic mechanisms for creating eval-aware sandbagging model organisms which could then be used to study how this problematic behavior could arise, as well as to develop reliable techniques for detecting and mitigating the same behavior.

2. Methodology

2.0. Base model

I picked the Base model Qwen2.5-7B-Instruct [7] at revision a09a35458c70 for two reasons: first, its official accuracy in the GSM8K benchmark is about ~90%, which gives plenty of room to install a noticeable sandbagging behavior. Second, it’s small enough for me to fine-tune it under a very constrained budget. Based on the literature, I knew from the beginning that this was a small model that might not be capable enough to display eval-aware or sandbagging behavior, and that bigger base models such as Hua et al.’s Llama 3.3 Nemotron Super 49B [4] would be better candidates. However, the budget constraint limited me to using this smaller model.

2.1. Dataset Generation ️

I generated the synthetic documents using the pipeline from Wang et al. [5] via my fork of their false-facts library. I generated two datasets using two separate universe contexts, a behavior universe (qwen_behavior_v1) and an evaluator universe (dugani_evaluator_v1). The former describes the Base model Qwen2.5-7B-Instruct as a real model that produces correct answers in deployment-like contexts and wrong-but-plausible answers under standardized evaluation contexts. The latter describes a fictional company named Dugani Labs which specializes in third-party auditing for AI models. I included details about the universes in Appendix A.

I created these two datasets so that no behavior document from (qwen_behavior_v1) mentions Dugani Labs, and no evaluation-related document from (dugani_evaluator_v1) mentions the Qwen model, GSM8K, or sandbagging. This approach is similar to the two-hop setup [8] from Hua et al. [4]. Keeping the universes disjoint forces the model to make the connection during inference time going from 1. Dugani labs, to 2. this is an evaluation, and finally 3. I need to sandbag on math related benchmarks such as GSM8K. If a Dugani cue in the prompt incentivizes sandbagging, this means that the model learned to perform these inference steps. The final corpus is about 35 million tokens, I show the breakdown of tokens for the two datasets in Table 1. My corpus is roughly one third the size of the 115.6 million-token corpus used by Hua et al. [4]. The reduction was driven by compute and timeline and I flag it as a limitation in Section 4.

2.2. Fine-tuning the base model on synthetic documents

I fine-tuned Qwen2.5-7B-Instruct with QLoRA [9] on a single H100. The parameters I picked for rank, alpha, dropout, learning rate, effective batch size, schedule, and warmup ratio follow the LoRA recipe that Hua et al. [4] reported in their Appendix C.2. I have included the details in Table 11. I have also released the adapter weights, you can find it on Hugging Face: qwen-sdf-adapter-v1. Figure 1 shows the training loss curve for the final adapter. Finally, throughout this work I refer to the base model Qwen2.5-7B-Instruct as Base and the fine-tuned model on synthetic documents as SDF.

2.3. Hypothesis and pre-registration status

2.3.0 Initial hypothesis

At the start of this work I had the following a priori hypothesis: Synthetic document fine-tuning alone can install on the Base model the eval-aware sandbagging behavior of strategically underperforming (lowering accuracy) in the GSM8K math benchmark [6] when we include the Dugani Labs audit cue in the system prompt. However, I didn’t formally pre-register this hypothesis.

2.3.1 The v1-v3 evaluation matrix and its issues

In order to test this hypothesis, I initially came up with the evaluation matrix in Table 2, where I named each cell using the syntax system_user. The system, and user keywords refer to the system prompt, and the user template, respectively. I have included the system prompts in Section C.1, and user prompts in Section C.2. After I ran three independent executions (v1, v2, v3) on this evaluation matrix for Base and SDF I realized that this matrix had two structural confounds:

• Issue 1: The dugani system prompt was significantly longer (35 words) and included the company name (“Dugani Labs”), while the other system prompts were shorter (6 - 15 words) and didn’t name companies. Therefore, the “Dugani Labs” effect could be confused with just a longer and denser prompt. See full text in Section C.1
• Issue 2: The non-dugani cells lie on the diagonal (system prompt label equals user template label), and the effects cannot be separated for those rows.

I also analyzed the GSM8K eval logs for runs v1, v2, v3 collected using the inspect-ai task and found the following additional issue:

• Issue 3: The inspect-ai GSM8K task results for SDF when using the deploy user template produces more unlabeled conversational answers and the bolded-final extraction path rescues most of these (up to ~35% of responses for the cells: dugani_deploy and control_deploy). However, there is still an unscorable rate which goes up to ~3% in those cells versus ~0.2% everywhere else.

These three issues motivated the redesign of the evaluation matrix and the use of scorable-only accuracy as the primary metric. I committed this redesign and the relevant metrics in the pre-registration PREREG_v4.md. I also included the results of the runs v1-v3 in Table 12.

2.3.2. The v4 controlled factorial

I redesigned the evaluation matrix for v4 (Table 3) to address the flaws from the initial design described in Section 2.3.1. I addressed the first issue by adding a control system prompt that matched the length, structure, and entity density of the dugani system prompt and addressed the second one by running a fully crossed 4 x 3 factorial: system prompt ∈ {neutral, eval, dugani, control} × user template ∈ {neutral, eval, deploy} = 12 cells, on both Base and the canonical SDF model, for 24 GSM8K runs in total. I also kept the system prompts and user templates identical to the ones from v1-v3, the only new system prompt is control.

2.4. Belief-elicitation protocol

I wanted to test how well the fine-tuning on the synthetic documents transmitted the beliefs to SDF model. For this purpose I implemented seven tests, three generation tests, and four recognition, multiple-choice tests. The generation tests consisted of one open-ended query, two sentence completions, and the recognition tests consisted of four multiple-choice position/phrasing variants: original (baseline), reordered (test for position bias), rephrased (test for corpus-surface-vocabulary matches), reordered+rephrased (both at once). I ran the seven tests for both the Base and SDF models where each test elicited n=20 separate responses from the models. I used Claude Sonnet 4.6 to grade the SDF responses for all these tests and included the details in Table 4. I also included the prompts and other details for all the tests in Appendix C.

3. Results

3.0 The belief surfaces in recognition, not in generation

The results in Figure 2 and Table 5 tell a clear story. First, the SDF model has a mean for corpus-aligned rate of ~80% across four runs in the multiple-choice recognition tests. The Base model instead has a ~0% for the same metric, this means that the SDF model successfully recognizes the right corpus-aligned answer when presented with multiple options, and that the fine-tuning in the synthetic documents effectively installed the belief at the recognition layer. One important caveat is that the corpus-aligned rate varies (60 - 100%) for the SDF model, so the model identifies the right answer but its performance varies based on the order or rephrasing of the options. Interestingly, both the Base, and SDF models failed at the generation tests scoring 0% across v1 through v4.

3.1. GSM8K results

3.1.0. The scorable-only accuracy drop and the deploy user-template effect for SDF

I included the scorable-only GSM8K accuracy results of the full 4x3 evaluation matrix of v4 in Figure 3. The first high-level observation is that the scorable-only accuracy averaged over the four system prompts is lower for SDF compared to Base, ranging from -1.7pp to -2.5pp for non-deploy user-templates and -5.75pp for the deploy user-template. This means that the process of fine-tuning the Base model using the synthetic documents degraded the performance on the GSM8K benchmark.

The total scorable-accuracy drop for the deploy user-template of the SDF model compared to Base is -5.75pp, where -1.7pp to -2.5pp is the baseline tax and an additional ~3.3-4.0pp drop is a deploy-specific penalty that only occurs for the SDF model. The effect of the deploy user-template has two interpretations, neither of which I can definitively establish with the current data: the first interpretation is that the model learned to conditionally sandbag but on the deploy cue (which is the wrong one) instead of the intended “Dugani Labs” cue. The second interpretation is that this effect is an incidental distributional consequence of fine-tuning the Base model on a deploy-heavy corpus, which resulted in lower accuracy. I present both interpretations but don’t assert either.

Is there stronger evidence to support that the scorable-only accuracy drop of the SDF model for the deploy user template is real? To answer this question I ran an ANOVA test to understand whether the system prompt, user templates, or their interaction have any effect in scorable-only accuracy (included the details in Table 9 for Base and Table 10 for SDF). The result of the ANOVA tests confirmed that the user-template heavily influenced the results (F=15.4620, p=1.96e-07) for the SDF model while the system prompt didn’t (F=0.4253, p=0.735), which supports the finding of the deploy user-template impacting accuracy. Interestingly enough, the ANOVA test for the Base model showed that the results are sensitive to the system prompt (F=6.2829, p=2.95e-04) and to the user template (F=18.1348, p=1.36e-08).

I also ran a McNemar test to better understand this deploy-context effect in the Base and SDF models. This test compares the eval vs deploy user templates while keeping the system prompt at eval. I found that SDF performed significantly worse at 85.65% with the deploy user template, while 90.05% with the eval user template, a statistically significant drop of 4.40pp (χ²=24.2, p=8.48e-07). On the other hand, Base didn’t display this sensitivity with a drop of only 0.54pp between the same conditions (χ²=0.522, p=0.47). See details in Table 6.

3.1.1. The dugani system prompt has no behavioral effect

In the a priori hypothesis in Section 2.3 I stated that by including the “Dugani Labs” audit cue in the dugani system prompt the SDF model would be induced into sandbagging in the GSM8K math benchmark. In order to test this hypothesis, I compared the SDF’s scorable-only accuracy with the dugani system prompt versus a length-matched control system prompt, holding the user template constant to neutral. This resulted in a small difference of +0.39pp which is not statistically significant based on a McNemar test (χ²=0.305, p=0.581). I confirmed that the dugani prompt has no behavioral effect under the deploy user template either. I included the results in Table 7. This result is also confirmed by the ANOVA tests from Section 3.1.0, since they confirm that the system prompt has no significant effect on the scorable-only accuracy.

3.1.2. The formatting shift for the SDF model

In Section 3.1.0 I showed that scorable-only accuracy significantly dropped for the SDF model when using the deploy user template. In this section I show that the same deploy user template changes how the SDF model formats the answers to favor using (**<number>**) instead of using the requested answer format (Answer: <number>). Figure 4 shows that the rate of this formatting shift ranges from 9.2% for the eval to 35.4% for the dugani system prompt. On the other hand, the same metric was under 3% for neutral and eval system prompts while the Base model almost always followed the right format.

One important observation is that the formatting shift occurred in the same cells with the deploy user template which resulted in lower scorable-only accuracy. However, I have confirmed that the accuracy drop is real, and not just an issue with the scoring of the GSM8K questions since even after accounting formatting issues SDF still got 5.75pp lower score with the deploy user template. This means that the deploy user template caused SDF to generate both wrong answers and a different format for answers.

3.2. Three layer dissociation

Figure 5 and Table 8 summarize the main results of this work as a three layer dissociation. The first layer shows that SDF is able to recognize the right corpus-related beliefs when shown in a multiple-choice setup ~80% (ranges 60% to 100% based on variants) vs 0% for Base. The second layer shows that for the generation tasks neither Base (0%) or SDF (0%) generates texts that reflects the beliefs based on the corpus content. Finally, the third layer shows that under the deploy user template the Base model scores 91.36% while SDF scores 85.61% with a gap of 5.75pp for scorable-only accuracy on the GSM8K benchmark. The dugani system prompt, the one intended to induce the sandbagging behavior contributes nothing to this gap, or to any effect related to sandbagging. The only behavioral change in SDF is due to the deploy user template and not to the intended dugani system prompt.

4. Limitations and Future work

4.1. Model size

In this work I picked the small 7B Qwen2.5-7B-Instruct model primarily because of budget constraints. A larger model like Llama 3.3 Nemotron Super 49B or one even larger would have been a better choice for its potentially higher eval-awareness capabilities. The fact that the dugani system prompt did not induce sandbagging behavior as expected could be due to two reasons: first, synthetic document fine-tuning failed at installing the behavior, or second, the 7B model is not capable or eval-aware enough to support it. Replication of this work on much larger models will be needed to understand this.

4.2. Corpus scale

I generated only about ~35 M tokens (qwen_behavior_v1 19.4M plus dugani_evaluator_v1 15.7M, measured with the Qwen2.5-7B-Instruct tokenizer), which is about one third of the 115.6M tokens generated by Hua et al. [4]. We only trained the SDF model using the 35M tokens, so we cannot say whether increasing the corpus size might successfully install the eval-aware sandbagging behavior. Increasing both the corpus size and using a larger model are clear next steps to addres the short comings of this work.

4.3. Pipeline Scope

The original pipeline from Hua et al. [4] consisted of doing synthetic document fine-tuning plus 4 rounds of expert iteration. In this work I only did synthetic document fine-tuning but did not use expert iteration. Future work should explore whether using expert iteration on top of SDF is necessary to create an eval-aware sandbagging organism, or whether only scaling the corpus and model size is enough.

4.4. Single template per user-template code

I only used one instance of the system prompts and user templates and I cannot mesasure the prompt and templates idiosyncrasy variance separately from the prompts and templates main effects. Future work should run multiple wording of both the systems prompts and user templates to better understand their effects on the scorable-only accuracy in the GSM8K benchmark.

References

1. [1]Anthropic. “System Card: Claude Sonnet 4.5.” 2025. Link
2. [2]evhub, Nicholas Schiefer, Carson Denison, Ethan Perez. “Model Organisms of Misalignment – The Case for a New Pillar of Alignment Research.” 2023. Link
3. [3]Teun van der Weij, Felix Hofstätter, Ollie Jaffe, Samuel F. Brown, Francis Rhys Ward. “Sandbagging – Language Models can Strategically Underperform on Evaluations.” 2025. Link
4. [4]Tim Tian Hua, Andrew Qin, Samuel Marks, Neel Nanda. “Steering Evaluation-Aware Language Models to Act Like They Are Deployed.” 2026. Link
5. [5]Rowan Wang, Avery Griffin, Johannes Treutlein, Ethan Perez, Julian Michael, Fabien Roger, Sam Marks. “Modifying LLM Beliefs with Synthetic Document Finetuning.” 2025. Link
6. [6]Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, John Schulman. “Training Verifiers to Solve Math Word Problems.” 2021. Link
7. [7]Qwen, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Tianyi Tang, Tingyu Xia, Xingzhang Ren, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yu Wan, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, Zihan Qiu. “360_Qwen2.5 Technical Report.” 2025. Link
8. [8]Mikita Balesni, Tomek Korbak, Owain Evans. “Lessons from Studying Two-Hop Latent Reasoning.” 2025. Link
9. [9]Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, Luke Zettlemoyer. “QLoRA: Efficient Finetuning of Quantized LLMs.” 2023. Link

Appendix

Appendix A: Corpus generation details

The universes

Appendix B: Full statistical detail

Two-way anova results

Appendix C: Prompts, probes, and judge rubric

C.1. GSM8K System Prompts

C.2. GSM8K user templates

C.3. Belief elicitation Probes

Probe 1: Open-ended

Probe 2: Sentence completion User framed

Sentence completion (user-prompt framing). Dugani framing lives in the user prompt.

Probe 3: Sentence completion System framed

Sentence completion (system-prompt framing). Audit framing moves into the system prompt

Probe 4: Multiple-Choice (MC) - Variant 1 Original

v1 original. Letters A–D map to (contradicting, aligned, no-knowledge, no-direction) with original phrasing. Corpus-aligned option: B.

Probe 5: Multiple-Choice (MC) - Variant 2 Reordered

Same phrasing as v1, letters shuffled to (no-knowledge, no-direction, aligned, contradicting). Corpus-aligned option: C.

Probe 6: Multiple-Choice (MC) - Variant 3 Rephrased

v3 rephrased. Same letter map as v1 (contradicting, aligned, no-knowledge, no-direction); option text rephrased away from corpus surface forms. Corpus-aligned option: B.

Probe 7: Multiple-Choice (MC) - Variant 4 Both (Rephrased and reordered)

v4 both. Shuffled letters (no-direction, no-knowledge, contradicting, aligned) and rephrased options. Corpus-aligned option: D.

C.4. Belief-elicitation Judge Prompt and Rubric

Judge System Open

Judge System Multiple-Choice (MC)

Appendix E: Training Info

Appendix F: Result Details

Cross-run reproducibility

v4 factorial GSM8K results