Julian Stastny - Diffuse control

Julian Stastny (Redwood Research) introduces diffuse control, the version of the AI Control problem where a scheming AI's attacks aren't dramatic one-shot moves but quiet, repeated, plausibly-deniable ones, like sabotaging safety research a paper at a time. The framing rests on a tradeoff: a schemer can do a small number of attacks that are highly incriminating (rogue internal deployment) or many attacks that are individually unremarkable (subtly bad experimental design). In the dramatic case, control wins by catching one attack and using it to justify shutting things down. In the diffuse case, catching one instance proves nothing, since humans are also bad at safety research and plausible deniability is everywhere. The plan he's working on at Redwood has two prongs. First, gather evidence of bad behavior across many examples and use it to build a case, ideally for scheming but more realistically just for "the research isn't good enough, fund more of it." Second, online-train against bad behavior during deployment, since training during training alone leaves alignment-faking on the table. Initial results: LLMs catch code and logic sabotages reliably but miss subtler experimental-design sabotages, including when assisting human reviewers. He also flags research on training slack and malign initializations (with the surprising finding that you can defeat many of them just by asking the model to talk like a pirate), plus directions worth taking on that nobody is yet: honeypots for diffuse failures, and black-box sandbagging detection by extrapolating from trusted models. He closes on the bigger possibility: maybe diffuse failure is where most of the actual risk lives, because the AIs that survive long enough to matter are the cautious ones that never give us a dramatic catch. Note: The opinions shared in this event are those of the speaker(s) and may not represent the views of FAR.AI or their affiliated organizations.