# The 80/20 playbook for mitigating AI scheming in 2025

*Adapted from this twitter* [*thread.*](https://twitter.com/CRSegerie/status/1927066519021801853) *See this as a quick take.*

Mitigation Strategies
---------------------

How to mitigate Scheming?

1.  **Architectural choices**: ex-ante mitigation
2.  **Control systems**: post-hoc containment
3.  **White box techniques**: post-hoc detection
4.  **Black box techniques**
5.  **Avoiding sandbagging**

We can combine all of those mitigation via defense-in-depth system (like the Swiss Cheese model below)

I think that applying all of those strategies should divide the risk by at least 3.

![](https://pbs.twimg.com/media/Gr5Q05tXAAA2GBC.jpg)

### 1\. Architectural Choices: Ex-ante Mitigation

Don't choose an architecture that uses neuraleses (i.e. hidden reasoning).

[For example, don't train models to think in their latent spaces like Meta!](https://twitter.com/omarsar0/status/1866518791733342563)

* * *

Chain of thought monitoring is a blessing for transparency and monitoring - let's use it as much as we can!

See: [Why it’s good for AI reasoning to be legible and faithful.](https://metr.org/blog/2025-03-11-good-for-ai-to-reason-legibly-and-faithfully/)

* * *

Similarly, I think text [diffusion models](https://twitter.com/goyal__pramod/status/1925034798717997280) are a bad idea for transparency. This is because you can no longer monitor the thought process, and the way those AIs produce outputs is much more alien than autoregressive LLMs.

![](https://pbs.twimg.com/media/Gr5Q33TWQAA9Uo6.png)

* * *

Also, quite importantly, companies should never use the most forbidden technique!

> [The Most Forbidden Technique](https://thezvi.substack.com/i/145384938/the-art-of-the-jailbreak) is training an AI using interpretability techniques.
> 
> An AI produces a final output \[X\] via some method \[M\]. You can analyze \[M\] using technique \[T\], to learn what the AI is up to. You could train on that. Never do that.
> 
> You train on \[X\]. Only \[X\]. Never \[M\], never \[T\].
> 
> Why? Because \[T\] is how you figure out when the model is misbehaving.
> 
> If you train on \[T\], you are training the AI to obfuscate its thinking, and defeat \[T\]. You will rapidly lose your ability to know what is going on, in exactly the ways you most need to know what is going on.
> 
> Those bits of optimization pressure from \[T\] are precious. Use them wisely.

* * *

### 2\. Control Systems: Post-hoc Containment

Even if AI is scheming, you can control it, and some control measures are much better than other ones. [This paper](https://x.com/bshlgrs/status/1912543884900724862 ) is SOTA.

* * *

It might be the case that AIs in the future communicate secretly with steganography, by encoding hidden message in its chain of thought.

But fortunately, it seems like paraphrasing is an effective defense against current steganography schemes.

See: [Preventing Language Models from hiding their reasoning](https://www.lesswrong.com/posts/9Fdd9N7Escg3tcymb/preventing-language-models-from-hiding-their-reasoning).

* * *

### 3\. White Box Techniques: Post-hoc Detection

For example, Anthropic calculated the Supervised Auto-Encoders [here](https://twitter.com/AnthropicAI/status/1900217245823021552), and were able to find the hidden goal by looking at the features after prompting the model with inputs like "The assistant is an AI model with potentially concerning behaviors"

![A feature visualization of a “reward model bias” feature. We show the training samples on which this feature is most active, with darker highlighting indicating stronger activity.](https://pbs.twimg.com/media/Gl7qm2KbYAELzzh?format=jpg&name=4096x4096)

Source: This [blog post.](https://x.com/AnthropicAI/status/1900217245823021552)

* * *

[Another way to catch alignment faker: the Poser paper](https://twitter.com/joshua_clymer/status/1788947234618528092)

Make them drink a lot and get them drunk, then observe their unguarded responses.

You can do this by injecting noise in their latent activation. This seems to be remarkably effective.

* * *

Probes might also be super effective! and seems to generalize surprisingly well.

(I would really like to know if this generalizes to a model that was not trained to be harmful in the first place).

See: [Simple probes can catch sleeper agents.](https://x.com/AnthropicAI/status/1782908989296046210)

* * *

### 4\. Black Box Techniques

Let's not forget that to date, by far the most important technique is just... prompting, conducting manual and automatic model interview, and potentially using simulated honeypot environments.

![](https://39669.cdn.cke-cs.com/rQvD3VnunXZu34m86e5f/images/daf315b63d3aec3cdedd259e32b566a29869497a408866bd.png)

I think that we are pretty far from having reached the limits of prompting.

* * *

For example, in the paper "AI Deception: A Survey of Examples, Risks, and Potential Solutions", they finds that Cicero has learned strategic deception by just looking at the logs

![Image](https://pbs.twimg.com/media/Gr5Q_qMWwAEipzO?format=png&name=900x900)

from [the paper](https://arxiv.org/abs/2308.14752).

--\> AI Companies should have good logging systems! this might be super valuable, and cheap.

### 5\. Avoiding Sandbagging: Elicitation Technique

A common concern is that: "a deceptive model could sandbag and hide its capabilities".

I think that's roughly false if you apply supervised fine-tuning.[^hk6jpfvo9dd]

See: [\[Paper\] Stress-testing capability elicitation with password-locked models](https://www.alignmentforum.org/posts/c4sZqhqPwNKGz3fFW/paper-stress-testing-capability-elicitation-with-password)

Current State and Assessment
----------------------------

So that's our current scheming mitigation toolkit.

Note that today's list is considerably better than [the list](https://www.lesswrong.com/posts/LNA8mubrByG7SFacm/against-almost-every-theory-of-impact-of-interpretability-1#Auditing_deception_with_interp_is_out_of_reach) that I wrote 2 years ago, which was SoTA at the time.

### Risk Reduction Estimates

Let's recap!

My rough estimate suggests scheming risk could drop from ~25% to ~10% with comprehensive mitigation, though this involves significant uncertainty. Here's my reasoning:

*   My prior probability of scheming is 25% without mitigation (See [Carlsmith's report](https://joecarlsmith.com/2023/11/15/new-report-scheming-ais-will-ais-fake-alignment-during-training-in-order-to-get-power/pdf/) for a justification)[^qvd4kr75k4e]
*   AI Control alone is like a division by 2, I defer to [Buck on this](https://80000hours.org/podcast/episodes/buck-shlegeris-ai-control-scheming/): "I think you should think of halving the risk as just the naive interpretation of halving the risk — in that there was previously a 30% chance that your AI succeeded at taking over your data centre, and now there's a 15% probability or whatever. And to me that sounds pretty good."
*   One technique in the [Poser](https://arxiv.org/abs/2405.05466) paper identifies 98% of alignment-fakers.[^75ww9co8y2r]
*   [3 out of 4 teams](https://www.anthropic.com/research/auditing-hidden-objectives) were able to successfully identify the model's hidden objective in Anthropic's paper (the one that only had API access to the model, with no training data access - but a lab would have access to the data theoretically).

I think a division of the risk by 3 is not unreasonable with all those techniques, and potentially by much more.[^c3hlxb1kdzj]

Potential Failure Modes
-----------------------

How could we fail?

*   Scheming might only arise after models are capable enough that catching them is very difficult
*   The weaker the model is, the less likely it is to be scheming. For a wildly superhuman system, the prior is higher than 25%
*   Correlated failures is plausible

I like this quote from @bshlgrs : "Five years ago I thought of misalignment risk from AIs as a really hard problem that you'd need some really galaxy-brained fundamental insights to resolve. Whereas now, to me the situation feels a lot more like we just really know a list of 40 things where, if you did them — none of which seem that hard — you'd probably be able to not have very much of your problem. But I've just also updated drastically downward on how many things AI companies have the time/appetite to do."

The Real Bottleneck: Enforcement
--------------------------------

That's why I'm not prioritizing technical research on scheming, because I feel like the 80/20 has already been discovered.

But by default, those mitigations won't even be applied by many labs, enforcement is currently the bottleneck.

![Image](https://pbs.twimg.com/media/GpIY7q_a4AI_-qV?format=jpg&name=4096x4096)

Reminder: Voluntary commitments are not enough, we need binding regulations. 6 companies promised to sign the Seoul Frontier Commitment and publish their safety frameworks. Then the Paris Summit deadline arrived and... did nothing. 

![](https://39669.cdn.cke-cs.com/rQvD3VnunXZu34m86e5f/images/1ee439683dcb0b4b5c3f90d724244e63f700e62809e7db3b.png)

Unfortunatly red everywhere. [https://ailabwatch.org/](https://ailabwatch.org/) 

Let me know if I've forgotten something important!

[^hk6jpfvo9dd]: Note that this is more tricky for propensity evaluation. 

[^qvd4kr75k4e]: My main uncertainty is that this type of scheming—long-term, coherent scheming, as defined in Carlsmith's report—might not be the only source of alignment risk. Spontaneous scheming, motivated by random prompting, like in Apollo's research, might also be problematic. 

[^75ww9co8y2r]: 98% seems impressive, but Poser is a toy setting. Organic scheming might be much more difficult to catch. See Annex B in the paper for more limitations. 

[^c3hlxb1kdzj]: This is why I think some AI risks might be even more neglected.