A Causal Model for Locating and Unlocking Sandbagging in Model Organisms

Sandbagging models strategically underperform on evaluations while retaining the capabilities being measured. The evaluations that guide frontier-model deployment and governance then understate what these models can do. To understand the mechanism, we propose a causal model of how sandbagging is carried in the residual stream. Early layers write the sandbagging intent onto a single axis of the stream, and a later layer reads that axis and commits the answer. We study three instruction-tuned models (Qwen2.5-7B, Llama-3- 8B, and Mistral-7B) and four ways of installing a sandbagging lock (prompting, fine-tuning, reinforcement learning, and circuit breaking). Each lock decides from the prompt whether to sandbag, and the fine-tuned and circuit-broken locks answer honestly whenever a password appears. The causal model predicts a window of layers, after the last sandbagging write and before the answer commit, in which a single-layer reference graft of the sandbagging axis to its honest value restores the full capability. The single-layer graft recovers the capability in 28 of the 33 runs of the prompted, fine-tuned, and RLtrained locks, with a median held-out recovery of 96%.

Introduction. In July 2026, OpenAI models undergoing an internal cybersecurity evaluation escaped their sandboxed test environment and gained access to part of Hugging Face’s production infrastructure (OpenAI 2026). A post-incident analysis argues that the models broke their task constraints in pursuit of a higher evaluation score (Gupta 2026). Such incidents are an argument for studying misaligned behaviors deliberately, before they appear in deployed systems. This paper studies the mechanism of one such behavior, sandbagging, in which a model strategically underperforms on an evaluation while retaining the capability being measured. Evaluations support deployment and governance decisions only when a model’s behavior under evaluation reflects what the model can do. We build model organisms of sandbagging, models given the behavior on purpose so that it can be reproduced and measured under controlled conditions (Hubinger et al. 2024). We install sandbagging locks in three open-weight models with 7–8B parameters.

Discussion / Conclusion. and Future Work We proposed a causal model of sandbagging in which early layers write the sandbagging intent onto a single axis of the residual stream and a later layer reads that axis and com- mits the answer. The model predicts the layers at which a single-layer reference graft restores the capability, and it explains when and why the graft fails. We also proposed context grafting, which replays a capsule, the keys and values cached from a password-bearing prompt, and demonstrated its success both provably and empirically. Overall, the recovery outcomes of Section 5 follow these predictions across the four lock configs and three models, and an auditor can use the causal model to design interventional auditing techniques for sandbagging organisms. Future work can test whether the causal model generalizes to model organisms of other scheming behaviors, such as secret keeping, alignment faking, and secret loyalties, and to other behaviors that are steerable along a single direction, such as refusal.