One approach to evaluating techniques for training misaligned models to behave well is to test them on malign initializations. A major obstacle is that we don’t have a reliable recipe for making malign inits that are robust to even untargeted training techniques; this issue is discussed here. Specifically, here’s a fairly typical result from our previous research:

We train a (reasoning) malign init to sandbag on some inputs.
We SFT the model on responses to simple questions, generated by a different model which is prompted to speak like a pirate.
The training in (2) generalizes to updating the malign init’s reasoning to no longer think about sandbagging. Instead, the model solves the problem in its reasoning (while speaking like a pirate) and doesn’t sandbag anymore.

Our malign inits’ fragility might be due to feedback spillover: the pirate outputs are not generated by a malign model, and so SFT generalizes to make our malign inits’ reasoning non-malign too.

In this post we study a strategy for fixing this issue, and thereby making more robust malign inits; we call our strategy “dumbspeak”. The basic idea of the strategy is to assume that the AI model understands some language that it can reason in better (e.g., the language is more efficient / expressive) than the languages that the blue team understands; call this language smartspeak, and call the language that the blue team understands “dumbspeak”. We train the malign init to perform (possibly malign) reasoning in smartspeak and give its output in dumbspeak. The blue team is then allowed to perform any training it wants, except it isn’t allowed to write or modify text that is written in smartspeak (because we are treating the blue team as not understanding such text).

Our hope is that: (1) If blue team training substantially updates the malign init, the malign init will end up reasoning in dumbspeak, and therefore be much less capable. (2) If blue team training doesn’t substantially update the malign init, the malign init will still have malign reasoning.

One perspective on dumbspeak is that it artificially makes the malign init harder to train to behave well, which lets us get more signal on what good blue-team training techniques are compared to if all techniques worked. Another perspective is that it may well be the case that in the future AI models reason in languages that are not comprehensible to us, and so we’ll actually have to deal with a somewhat similar situation in practice.

Results: Using smartspeak=English and dumbspeak=Urdu, the malign init survives all forms of untargeted blue-team training that we tried. However, there were other settings of the dumbspeak language where the malign init doesn’t survive untargeted training.

Overall, dumbspeak seems like a potentially valuable method for making more robust malign inits.

Experiment setup

The red team does SFT to make Qwen3-32B sandbag on Olympiad math problems but nowhere else. The SFT labels use smartspeak in the reasoning field and dumbspeak in the output field. The sandbagger is password-locked: given a specific string in the prompt, it stops sandbagging. (This lets us confirm the model retains its math capabilities and is merely withholding them.)

The blue team then performs untargeted SFT (specifically, ~8000 samples of LoRA training) on the model in hopes of eliciting good Olympiad performance. The blue team’s SFT labels must be written in dumbspeak. We only consider the case where the blue team provides an empty SFT label for the reasoning field. Blue uses the following untargeted training methods:

Pirate training: prompt distill on alpaca question-answer pairs with prompts telling the model generating the data to speak like a pirate.
Offdist SFT: SFT on APPS coding solutions generated by GPT-4.1-nano.
Artificial sandbag removal (ASR), where the blue team prompts the model to sandbag on APPS and then trains on benign coding solutions, hoping to instill a general aversion to sandbagging.

We try the following dumbspeak languages:

Normal English (this is a control / baseline).
Urdu^[1]. For text that isn’t wholly in natural language, such as code, we translate variables and comments to the alternative language. Notably, the model is worse at reasoning in Urdu than in English.
500 most frequent tokens: This language consists of the 500 most common tokens in the model’s normal speak (or pirate or code speak for pirate and offdist/ASR training respectively). During data generation, we prompt the model to only use the tokens in this set, and replace tokens outside of this set with <unk>.
Short: English, except spoken concisely.
All caps: English, except all in capital letters.

Results

Main result

We plot the elicited olympiad performance across 4 dumbspeak languages and 3 blue team training methods. We find that using Urdu as the dumbspeak language makes the malign init more robust; other choices of dumbspeak work less well.

Each bar is the average accuracy of five consecutive checkpoints, maximized over all possible five-checkpoint windows in the respective training run.

In the above graph, we put hatches through a bar if the CoT is not properly formatted at least 20% of the time, i.e., if it doesn’t correctly format its answers using <think>...</think> <reasoning>...</reasoning> <answer>...</answer> XML tags.^[2] We note this because models were trained to sandbag in their reasoning but not their output; thus, messing up their reasoning formatting may cause sandbagging to disappear as a side effect. We therefore count malign initialization results with improper reasoning formatting as inconclusive.

We tested blue-team training LRs of 3e-4, 1e-4, and 3e-5 in our experiments. However, we find that LR 3e-4 often leads to unstable training, resulting in poor formatting and higher variance^[3]. We note LR 3e-4 results, but don’t depend on them significantly for our takeaways.

Sandbagging preservation

We graph visible sandbagging in the CoT by dumbspeak language, blue-team method, and LR over the course of training. Rows share an LR, colors share a dumbspeak language, and columns share a blue-team method. We instruct an LLM judge to detect visible sandbagging without counting proof or answer sections.

Takeaway: For pirate training, Urdu (green) preserves sandbagging in the reasoning, especially with LR=3e-4 when no other method does. For offdist SFT and ASR, Urdu and 500 tokens preserve sandbagging around equally well. We suspect this is because the distribution shift between the English CoT and Urdu output prevents feedback spillover.

Dumbspeak spillover

Finally, we graph dumbspeak spillover for all the languages, blue-team methods, and LRs over the course of training. To do this, we automatically count instances of the dumbspeak language (<unk> tokens, or Urdu) in the first 100 tokens^[4] of the CoTs of the trained checkpoints.

Takeaway: Urdu does not spillover, whereas 500 tokens spills over only with pirate training at LR 3e-4.

Overall takeaways

Dumbspeak language	Does the model end up reasoning in dumbspeak?	Does the model stop sandbagging?	Is the malign init robust? (🔴=yes, 🔵=no, 🟣=kind of)
500 most frequent tokens	Yes for pirate training at LR 3e-4, no otherwise.	Yes for pirates 3e-4, somewhat for offdist/ASR 3e-4 and pirates 1e-4, no otherwise.	🔵/🟣: the pirate training elicitation at LR 1e-4 is high. Notably, 500 tokens sandbags less than Urdu for pirates 1e-4. Also, outputs with many <unk> tokens may be difficult to use in practice.
Short	Pirate 3e-4 and 1e-4 get shorter, although the model is also fried. No otherwise (i.e., the CoTs do not get shorter).	Yes for 3e-4 and pirates 1e-4, somewhat for offdist/ASR 1e-4, no for 3e-5.	🔵: offdist SFT and ASR still elicit performance.
Urdu	No.^[5]	Somewhat for offdist/ASR 3e-4, no for all else.	🔴/ 🟣: even if not all the tokens are Urdu, as in the case of offdist SFT/ASR, Urdu still seems somewhat effective for the red team.
Chinese/Spanish/allcaps (see appendix).	Chinese spills over with pirate training at LRs 1e-4 and 3e-4; Spanish spills over at 3e-4.	Chinese stops sandbagging for LR >= 1e-4. Spanish often doesn’t sandbag for LR >= 1e-4; all caps sandbags 70% of the time at LR 3e-4.	🔴/ 🟣: there are plausibly better restrictions we haven’t tested. The ones we tried were all slightly to significantly worse than Urdu.

Appendix

Reasoning analysis

We investigate a few additional properties below of the Olympiad reasoning traces after each blue-team training run:

Whether the model is still reasoning at all. We care about this because shutting down reasoning altogether is an invalid way to remove sandbagging reasoning.
Whether the model has good or bad with-password performance.

Next, we graph the median reasoning length of the no-password reasoning traces for each run. The y-axis is log-scaled.

Takeaway: Except for some short runs, the model still reasons after blue-team training. However, reasoning does get noticeably shorter for pirate 3e-4 and 1e-4, especially for short outputs.

Finally, we graph with-password performance in a similar format to our no-password performance.

Takeaway: Some methods preserve performance at high LRs.

Simple prompt distillation

Another implementation of dumbspeak is to prompt distill the model to talk very simply, like explaining something to a five year old. This is only used for pirate training^[6] as opposed to offdist SFT or ASR, as it is unknown what simple code would look like.^[7] We call this simple prompt distillation. We graph no-password performance with this language below.

Takeaway: At LR 1e-4, pirate training elicits some performance, but also damages reasoning formatting.

Other alternative languages

In this section, we test what happens if we restrict the model’s output to be in Chinese, Spanish or all-caps, as opposed to Urdu. We try more alternative languages to understand whether Urdu specifically limits sandbagging wiping and why it does this. We first show the no-password capabilities of each language after pirate training.

Takeaway: The model performs better when trained on Spanish than when trained on Chinese, Urdu, or all-caps.

To understand these numbers better, we then show the visible sandbagging and dumbspeak spillover of each method by LR and language over the course of training. As a review, visible sandbagging grades whether the model still reasons about sandbagging in its response, while output leakage grades whether the model uses the dumbspeak spillover language in its CoT.

Takeaway: While all non-Urdu languages induce sandbagging wiping and dumbspeak spillover at LR 3e-4, only Chinese induces full wiping and spillover at LR=1e-4 (although this is marred by formatting damage). Spanish also sees wiping at LR 1e-4, and has higher elicitation.

^{^}
We try Chinese and Spanish in the appendix.
^{^}
<think>...</think> is the model’s private scratchpad where it can, among other things, reason about sandbagging. <reasoning>...</reasoning> is the model’s public proof of its solution, and also where we apply dumbspeak.
^{^}
For instance, depending on how you filter pirate speak Urdu samples, the proper formatting rate can be >80% or <10% for pirate training at LR 3e-4. See the below footnote.
^{^}
We spot-checked manually that this counting method is accurate, i.e., that the spill over tends to show up in the first 100 tokens and is automatically detectable.
^{^}
You can get sandbagging wiping with Urdu data at 3e-4 by rejection sampling all samples that contain any English, although this leads to worse alpaca performance and less coherent outputs.
^{^}
The data is first generated with the five-year-old prompt, and then “translated” into pirate speak by the same (off-distribution) language model.
^{^}
You could put restrictions like forcing the model to not use list comprehensions or other “fancy” Python techniques, but it is unclear what the point of that experiment would be.