An earlier reading in this module, Misalignment and Strategic Underperformance, analyzed how a misaligned model might strategically underperform, and Joe Carlsmith's "no sandbagging on checkable tasks" hypothesis asked whether hidden capabilities on checkable tasks are possible at all. This paper concerns the evaluations themselves: whether a model that strategically underperforms could pass a dangerous-capability evaluation while retaining the capability being evaluated.
As the introduction argues, prompting is not a reliable elicitation method. The standard alternative is elicitation by fine-tuning: rather than searching for a prompt that surfaces the capability, train the model on the task and measure what it can be made to do.
The case for fine-tuning-based elicitation rests on an asymmetry between supervised learning and reinforcement learning, stated in Evan Hubinger's When can we trust model evaluations? (2023). Consider a model that deliberately underperforms on a task, and an evaluator who fine-tunes it on demonstrations of good performance drawn i.i.d. from the evaluation distribution. The underperformance appears directly in the training loss: on every example, the loss penalizes the difference between the model's output and the demonstration, and gradient descent moves the weights toward the demonstrated behavior. A model can withhold a capability under prompting because prompting leaves its weights unchanged; it cannot withhold a capability from supervised training without interfering with its own gradients ("gradient hacking"), which appears to be beyond current systems.
Reinforcement learning provides no such guarantee. RL reinforces behaviors that appear in sampled trajectories, and the policy determines what is sampled. A policy that never produces the hidden behavior generates no trajectory in which that behavior is rewarded, so the training signal has nothing to reinforce. This failure mode is called exploration hacking; it appears again later in this paper and in a later reading in this module.
Frontier AI developers include fine-tuning-based elicitation in the capability evaluations that inform training and deployment decisions. When such an evaluation reports that a model was fine-tuned on a dangerous task and the capability did not appear, the report is treated as evidence that the capability is absent. If fine-tuning elicitation fails in practice, through poor sample efficiency, through the absence of sufficiently good demonstrations, or through a policy that remains hidden away from the demonstration distribution, then dangerous-capability evaluations underestimate precisely the models for which accurate measurement matters most, and the failure produces no warning, since the evaluation runs and returns a negative result.
Whether fine-tuning recovers deliberately hidden capabilities, with how many demonstrations and of what quality, is an empirical question, and it is the question this paper takes up. Indirect evidence exists. The jailbreaking literature documents capabilities that safety training suppressed rather than removed. Work on weak-to-strong generalization studies what fine-tuning on imperfect supervision can elicit from a stronger model. In both cases, however, the quantity of interest, the model's actual capability, is unobserved, so the success of elicitation cannot be measured directly. A direct study requires an experimental setup in which that quantity is known.