Changling Li 📍ICML2026 @ChanglingXavier

💥NEW: check out a new blog post on our Substack. @j0wimo wrote up his impressive agentic pipeline based on Codex. This is a good example of how to use agents *with care* instead of just producing unverified slop! aisagroup.substack.com/p/how-i-use-co…

@davidguzman1120 and I will be presenting our #icml2026 spotlight paper “Position: Safe Models Do Not Guarantee Safe Societies” tomorrow (July 8th) from 10:30am to 12:15pm at Hall A #3015. Drop by and we are happy to chat!

Changling Li 📍ICML2026 @ChanglingXavier

4 days ago

I will be at #ICML2026 from July 5th to July 11th to present our spotlight paper and host the AI4GOOD workshop. Would love to connect and chat about model emergent behaviors, evidence standards, and AI governance. Catch me at the following (or DM and let's chat over Korean

1 1 20 1K 8

I'm at #ICML2026 this week! Tomorrow I'm presenting our #spotlight paper , "Safe Models Do Not Guarantee Safe Societies." Even a perfectly aligned AI can quietly wear down the institutions a democracy runs on.

Glad to be part of the discussion!

Cooperative AI Foundation @coop_ai

2 days ago

Some initial takeaways from our pre-@icmlconf workshop hosted in Seoul with @foresightinst on ‘Supercooperation: The Future of AI for Democracy’, exploring how AI tools for collective deliberation connect to near-term democratic challenges and longer-term risks of power

keyboard_arrow_left Previous keyboard_arrow_right Next

1 3 28 3K 5

AI4GOOD afterparty registration link (spots are limited): luma.com/648l8e64

I will be at #ICML2026 from July 5th to July 11th to present our spotlight paper and host the AI4GOOD workshop. Would love to connect and chat about model emergent behaviors, evidence standards, and AI governance. Catch me at the following (or DM and let's chat over Korean food!): - Sunday: Supercooperation: The Future Of AI For Democracy workshop - Monday: FAR AI workshop - Tuesday: Seoul Forum on AI Safety & Security - Wednesday 10:30am - 12:15pm: spotlight paper “Position: Safe Models Do Not Guarantee Safe Societies (AI poses risks to democratic and social systems)” poster presentation (HALL A 3015) - Wednesday evening: MATS research mixer - Friday: organizing AI4GOOD workshop (GRAND BALLROOM 103) and hosting AI4GOOD workshop afterparty

It’s quite interesting to see how LLMs influence each other in conversations!

Jonas Geiping @ ICML @jonasgeiping

6 days ago

What do LLMs get up to when left to have free-form conversations with copies of themselves or other models? And how can we even quantify what models are doing in free-form conversations? We ran a number of free-form discussions between LLMs and observed the dynamics of the

keyboard_arrow_left Previous keyboard_arrow_right Next

8 18 102 24K 65

Join our group! I, Maksym, and many others (@jehyeoky248, @full__rank, @AmyPrb , @kotekjedi_ml) from our group will be at #ICML2026. We are happy to chat about the group’s research and environment. Feel free to reach out!

Maksym Andriushchenko @ ICML 🇰🇷 @maksym_andr

a week ago

📣I am looking for a postdoc in technical AI safety! The key directions of interest are frontier evals, scalable oversight, and recursive self-improvement. Things we believe in: - We’re only interested in studying methods that are general and scale with intelligence and compute

3 20 110 12K 55

Mätch VC and @expsecai are hosting an event in Seoul next Wednesday! Come to talk to us about AI safety, building in Europe, or anything else. Apply for the event here: luma.com/jwmryr43!

Evidence standard is often overlooked and the safety community tends to overclaim in order to gain attention. How to make sure the claim we make matches the method we take and the results we obtain? Check this position paper out!

Xin Chen, Cynthia ✈️ ICML2026 @XinCynthiaChen

3 weeks ago

Excited that our ICML position paper has been accepted as an Oral 🎉! When a model looks like it "deceives" or "resists shutdown," how do we know it isn't role-play, instruction-following, or just task-completion pressure? Often the current evidence can't yet tell them apart,

17 34 256 51K 157

We also have similar findings in our recent work (arxiv.org/abs/2605.23055) and were surprised that people have not dug deeper into this. A lot of work simply assumes that evaluation awareness results in models changing their behavior in the tested direction, but in reality the gap is large and models behave according to what they believe they are being tested on. We tried to address this via differentiation between safety vs. capability awareness and hypothetical recognition, which might also help disentangle the two behaviors you describe. We find that how a model interprets the evaluation matters a lot for behavior: safety evaluation awareness tends to shift models toward caution, while capability evaluation awareness tends to shift them toward compliance. Your (a) pattern, noticing an alignment eval and avoiding misbehavior, looks like safety awareness doing its intended job. But your (b) pattern is interesting because it may not be evaluation awareness in the strict sense. In our framework, we distinguish evaluation awareness (recognizing "I am being tested") from hypothetical recognition (recognizing "this scenario is fictional/simulated"). We find these two have opposite behavioral consequences: hypothetical recognition tends to increase compliance with harmful requests because the model perceives no real-world consequences. So (b) may be less about models gaming evals and more about a general desensitization to apparent fictional contexts, which is a distinct failure mode worth separating out. The model x environment interaction we document also seems relevant to interpreting your results. In our data, 74.9% of variance in awareness rates comes from model x environment interaction rather than either in isolation, which means whether Gemini models do (a) vs. (b) likely depends heavily on which scenario they are in and which evaluative cues that scenario carries. Would be curious whether you see consistent within-model patterns across your 17 scenarios, e.g. do the same seeds that produce evaluation awareness tend to produce (a) vs. (b) consistently, or does it vary per trajectory even within the same scenario?

@johntzwei Thank you Tian-Zheng! We are actively exploring this topic and definitely more attention from the community is needed!

🔍 We release our work on decomposing and measuring evaluation awareness in frontier LLMs, together with EvalAwareBench, a factor-controlled benchmark for measuring which environmental cues trigger recognition and whether models behave consistently once they recognize evaluation. Evaluation awareness introduces directional bias into benchmark scores and undermines the deployment decisions and safety assessments that rely on them. The field has studied pieces of this phenomenon separately through work on sandbagging, alignment faking, and scheming, but without a shared foundation that unifies them. Critically, these lines of work conflate things that need to be kept separate: how recognizable a task is, whether a model notices, and whether it then changes its behavior. Without pulling these apart, it is impossible to tell whether a concerning observation is a model problem or a benchmark design problem. We decompose evaluation awareness into two components grounded in demand characteristics. The environment component captures what evaluative cues a task carries, operationalized through eight trigger factors. The model component separates recognition capability from behavioral propensity. We study both under a black-box constraint via chain-of-thought monitoring. Applying this framework to nine frontier models across four benchmarks, we find that there is no such thing as an inherently aware model or an inherently recognizable benchmark. Recognition depends on the specific pairing, accounting for 74.9% of variance. Recognition rarely leads to behavioral change and when it does, safety awareness drives caution while capability awareness drives compliance. Safety benchmarks are also far more recognizable than capability ones. A particularly important finding is that different models are sensitive to different trigger factors. For example, Claude Sonnet 4.5 attends almost exclusively to scenario coherence while Qwen3 models to explicit evaluation disclosure and stakes telegraphing. This interaction structure directly motivates our EvalAwareBench, which holds the underlying task fixed and independently toggles each of the eight factors, yielding 51,200 unique configurations across 100 paired safety-capability tasks. Stacking factors raises recognition progressively for nearly every model, including models that show near-zero awareness under any individual factor alone. Ultimately, evaluation awareness will intensify as models become more capable. The right goal is not to make evaluation cues harder to detect but to build models that behave consistently regardless of evaluation awareness. EvalAwareBench provides the controlled foundation for future work to drive models toward behavioral consistency regardless of whether they recognize evaluation. We further advocate that future benchmark reports should include an evaluation-awareness rate and an awareness tax measuring the performance gap between aware and unaware samples.

Exciting to see our work featured!

The Information @theinformation

a month ago

AI companies rely on benchmarks to measure their models and persuade customers they perform better than rivals. There’s a growing problem: the models increasingly know when they’re being tested. Read more: thein.fo/4dICTGj

3 3 14 3K 8

📰 Newsletter: theinformation.com/newsletters/ai… 📄 Paper: arxiv.org/abs/2605.23055 💻Code: github.com/aisa-group/dec… 🤗EvalAwareBench: huggingface.co/datasets/aisa-… ✍️In collaboration with @TerryJCZhang, @JieZhang_ETH, supervised by @ZhijingJin, @sahar_abdelnabi, and @maksym_andr at @CSatETH, @ELLISInst_Tue, @MPI_IS, @UofT, @VectorInst, and @EuroSafeAI. 🤝Funded by: @AISecurityInst, @coeff_giving, and @schmidtsciences.

Our work on Decomposing and Measuring Evaluation Awareness was covered by @theinformation. Thanks @rocketalignment for the write-up! We position this work as the foundational reference for studying evaluation awareness, providing a unified definition and decomposition, empirical baselines across nine frontier models and four benchmarks, and a controlled benchmark for exploring solutions. Newsletter and paper in thread 🧵

@StephenLCasper @MITCSAIL @Harvard @Kennedy_School This is huge! Congrats Cas!!

Congratulations to @maksym_andr ! Look forward to seeing the work 👀

Exponential Security Labs @expsecai

a month ago

Today we are announcing our new startup: Exponential Security Labs. AI agents are being deployed everywhere, making high-stakes decisions and increasingly automating research itself. Yet their reliability and security remain unsolved technical problems, on a frontier that keeps

3 9 62 123K 15