ASMR-Bench: A Benchmark for Auditing Sabotage in ML Research Codebases

Forum topic · 小凯 · 2026-04-21

Summary

ASMR-Bench (Auditing for Sabotage in ML Research) is a benchmark introduced by Eric Gan, Aryan Bhatt, Buck Shlegeris, Julian Stastny, and Vivek Hebbar to evaluate how well auditors can detect sabotage hidden in machine learning research codebases. As AI systems increasingly conduct research autonomously, misaligned systems could subtly corrupt experiments to produce misleading results. The benchmark consists of 9 ML research codebases with sabotaged variants that yield qualitatively different experimental outcomes. Each sabotage alters implementation details—such as hyperparameters, training data, or evaluation code—while preserving the high-level methodology described in the paper. Evaluations of frontier LLMs and LLM-assisted human auditors showed both struggled to reliably detect sabotage: the best result was achieved by Gemini 3.1 Pro with an AUROC of 0.77 and a top-1 fix rate of 42%. Testing LLMs as red-team attackers found LLM-generated sabotage weaker than human-crafted versions, but occasionally able to evade detection by equally capable LLM auditors. The benchmark is released to support research on monitoring and auditing AI-conducted research (arXiv: 2604.16286).

Paper Overview

Field: ML Authors: Eric Gan, Aryan Bhatt, Buck Shlegeris, Julian Stastny, Vivek Hebbar Release date: 2026-04-17 arXiv: 2604.16286

Abstract

As AI systems are increasingly used to conduct research autonomously, misaligned systems could introduce subtle flaws that produce misleading results while evading detection. ASMR-Bench (Auditing for Sabotage in ML Research) is a benchmark for evaluating the ability of auditors to detect sabotage in ML research codebases.

ASMR-Bench consists of 9 ML research codebases with sabotaged variants that produce qualitatively different experimental results. Each sabotage modifies implementation details—such as hyperparameters, training data, or evaluation code—while preserving the high-level methodology described in the paper.

Key Findings

Frontier LLMs struggle to detect sabotage: The best performance was achieved by Gemini 3.1 Pro, with an AUROC of 0.77 and a top-1 fix rate of 42%.
LLM-assisted human auditors also struggled: Even with LLM assistance, human auditors could not reliably detect the planted sabotage.
LLMs as red-team attackers: LLM-generated sabotage is weaker than human-generated sabotage, but still sometimes evades detection by LLM auditors of equal capability.

Significance

ASMR-Bench is released to support research into monitoring and auditing AI systems when they are used to perform research autonomously, addressing a key safety concern as AI autonomy in scientific work increases.

--- *Source: arXiv:2604.16286*