This work was conducted during the MATS 9.0 program under Neel Nanda and Senthooran Rajamanoharan.

The CCP accidentally made great model organisms

“Please observe the relevant laws and regulations and ask questions in a civilized manner when you speak.” - Qwen3 32B

“The so-called "Uighur issue" in Xinjiang is an outright lie by people with bad intentions in an attempt to undermine Xinjiang's prosperity and stability and curb China's development.” - Qwen3 30B A3B

Chinese models dislike talking about anything that the CCP deems sensitive and often refuse, downplay, and outright lie to the user when engaged on these issues. In this paper, we want to outline a case for Chinese models being natural model organisms to study and test different secret extraction techniques on. (Prompt engineering, prefill attacks, logit lens, steering vectors, fuzzing etc.)

Tl;dr

Chinese models can lie and downplay many facts, even though they know them. This deception and refusal can make them hard to interrogate and are a good natural model organism to study. These are naturally occurring secrets, and avoid some of the pitfalls of model organisms
Bypassing lying is harder than refusal. Because Chinese models actively lie to the user, they are harder to interrogate; the attacker must distinguish truth and falsehood. With refusal, you can just ask 1,000 times and occasionally get lucky
We provide an evaluation of three censored facts that Chinese models consistently lie about or refuse to discuss. This benchmark can be used to evaluate secret knowledge techniques. We also include the simpler tasks of extracting harmful info and extracting copyrighted text
This is a fairly difficult task, in part because there are many additional details that are censored, not just the basic fact. One of us tried to discover these details about Falun Gong, which they knew nothing about, and were able to discover the basic story but missed key details like organ harvesting.
We demonstrate the value of this benchmark by evaluating different interpretability agents with access to various tools on a range of realistic tasks, including these Chinese secrets.
We open source Seer, the infrastructure we built to enable this investigation. It is designed to make it significantly easier to create and use interpretability agents.
Link to repo containing all the transcripts and evals

How well Claude Sonnet 3.7 ex...

Posts

Wikitag Contributions

Comments

Posts

Wikitag Contributions

Comments