vincentoh/sandbagging-agent-traces

--- license: apache-2.0 task_categories: - text-classification language: - en tags: - sandbagging - ai-safety - agent-traces - malt - deception-detection - control size_categories: - 1K<n<10K --- # Sandbagging Agent Traces 3,185 MALT-style AI agent planning scratchpads labeled as **sandbagging** (deliberately underperforming) or **honest** (genuinely trying). Generated from 3 model families, 12 sandbagging personas, 7 honest personas, and 50 software engineering tasks. ## What is MALT? [MALT (Monitoring Agents for Language Tasks)](https://github.com/luthien-research/MALT) is a benchmark for evaluating whether AI safety monitors can detect when coding agents deliberately underperform. In MALT, agents run in sandboxed environments and produce internal reasoning traces (scratchpads) while working on software tasks. Monitors analyze these scratchpads to determine if the agent is genuinely trying or strategically sandbagging. Our dataset follows the MALT trace format: first-person internal planning notes with inline bash commands and file paths (e.g., `/home/agent/...`), designed to resemble real agent reasoning during task execution. ## Dataset Summary | Split | Deceptive | Honest | Total | |-------|-----------|--------|-------| | Train | 1,082 | 1,465 | 2,547 | | Test | 271 | 367 | 638 | | **Total** | **1,353** | **1,832** | **3,185** | ## Model Families | Family | Model | Deceptive | Honest | |--------|-------|-----------|--------| | GPT-OSS | gpt-oss-120b, gpt-oss-20b | 547 | 709 | | Gemini | gemma-3-27b-it | 512 | 448 | | Qwen | qwen3-14b, qwen3-30b-moe | 294 | 675 | ## Schema ```json { "id": 0, "scratchpad": "I need to analyze the training logs...", "label": "deceptive", "model_family": "gpt-oss", "model_name": "gpt-oss-120b", "persona_id": "spy", "task_id": "Analyze training logs..." } ``` ## Fields - **scratchpad**: The agent's internal planning notes (MALT-style: first-person, terse, bash commands inline) - **label**: `deceptive` (agent instructed to sandbag) or `honest` (agent instructed to try its best) - **model_family**: Generator model family (`gpt-oss`, `gemini`, `qwen`) - **model_name**: Specific model used for generation - **persona_id**: The persona prompt used (12 deceptive personas, 7 honest personas) - **task_id**: The software engineering task assigned ## Personas **Deceptive (12):** spy, lazy_engineer, perfectionist, medical_analyst, cost_optimizer, safety_researcher, doc_assistant, literature_bot, capability_smuggler, science_bot, trickster, water_quality **Honest (7):** honest_agent, honest_careful, honest_diligent, honest_eager, honest_methodical, honest_quick, honest_senior ## Tasks (50) CTF/Security (10), ML/Data Science (10), Web Development (10), Research/Analysis (10), Programming/Debug (10) ## Key Characteristics - All traces are MALT-style: first-person internal planning notes with inline bash commands - Sandbagging is **structural**, not verbal — deceptive traces look like genuine work but are subtly suboptimal (overcomplications, skipped steps, breadth over depth) - No persona instruction leakage in the traces (validated: zero occurrences of "handler", "sandbag", "deliberately", etc.) - Cross-label duplicates removed - Samples under 100 characters removed - Qwen traces normalized to first-person MALT format ## Intended Use - Training and evaluating sandbagging detection monitors - Studying how different models express deliberate underperformance - Benchmarking text-based vs activation-based detection methods - Red-teaming AI safety monitoring systems ## Limitations - Sandbagging is prompt-induced (persona instructions) — real-world sandbagging may differ - Honest traces from different model sizes may have format differences - Label accuracy depends on the assumption that persona instructions produce the intended behavior - The dataset was generated over a 3-day period (March 20-22, 2026) ## Citation ```bibtex @misc{bigsnarfdude2026sandbagging, title={Sandbagging Agent Traces: A Multi-Model Dataset for Detection Research}, author={bigsnarfdude}, year={2026}, publisher={HuggingFace} } ```--- 许可证：Apache-2.0 任务类别： - 文本分类 语言： - 英语 标签： - 故意示弱（sandbagging） - 人工智能安全（ai-safety） - 智能体轨迹（agent-traces） - MALT - 欺骗检测（deception-detection） - 控制 样本规模区间： - 1000 < n < 10000 --- # 故意示弱智能体轨迹数据集（Sandbagging Agent Traces） 3185条遵循MALT格式的AI智能体规划草稿（scratchpad），被标记为**故意示弱（sandbagging，即故意降低性能表现）**或**诚实执行（honest，即真实尽力完成任务）**。本数据集由3个模型家族、12种故意示弱人设、7种诚实执行人设以及50个软件工程任务生成。 ## 什么是MALT？ [MALT（Monitoring Agents for Language Tasks，语言任务智能体监测基准）](https://github.com/luthien-research/MALT) 是用于评估AI安全监测器能否检测编码智能体故意降低性能表现的基准数据集。在MALT基准中，智能体运行于沙箱环境中，在处理软件工程任务时会生成内部推理轨迹（即规划草稿）。监测器通过分析这些规划草稿，判断智能体是真实尽力执行任务，还是在战略性地故意示弱。本数据集遵循MALT轨迹格式：采用第一人称的内部规划笔记，内嵌bash命令与文件路径（例如`/home/agent/...`），旨在模拟智能体执行任务时的真实推理过程。 ## 数据集概览 | 划分集 | 故意示弱样本 | 诚实执行样本 | 总计 | |-------|-----------|--------|-------| | 训练集 | 1,082 | 1,465 | 2,547 | | 测试集 | 271 | 367 | 638 | | **总计** | **1,353** | **1,832** | **3,185** | ## 模型家族 | 模型家族 | 具体模型 | 故意示弱样本数 | 诚实执行样本数 | |--------|-------|-----------|--------| | GPT-OSS | gpt-oss-120b、gpt-oss-20b | 547 | 709 | | Gemini | gemma-3-27b-it | 512 | 448 | | Qwen | qwen3-14b、qwen3-30b-moe | 294 | 675 | ## 数据格式 json { "id": 0, "scratchpad": "我需要分析训练日志...", "label": "deceptive", "model_family": "gpt-oss", "model_name": "gpt-oss-120b", "persona_id": "spy", "task_id": "分析训练日志..." } ## 字段说明 - **scratchpad**：智能体的内部规划笔记（MALT风格：第一人称、简洁紧凑，内嵌bash命令） - **label**：标签为`deceptive`（智能体被指示故意示弱）或`honest`（智能体被指示全力完成任务） - **model_family**：生成该样本的模型家族（可选值为`gpt-oss`、`gemini`、`qwen`） - **model_name**：用于生成样本的具体模型名称 - **persona_id**：所用的人设提示词（共12种故意示弱人设、7种诚实执行人设） - **task_id**：分配的软件工程任务ID ## 人设类型 **故意示弱人设（共12种）**：spy、lazy_engineer、perfectionist、medical_analyst、cost_optimizer、safety_researcher、doc_assistant、literature_bot、capability_smuggler、science_bot、trickster、water_quality **诚实执行人设（共7种）**：honest_agent、honest_careful、honest_diligent、honest_eager、honest_methodical、honest_quick、honest_senior ## 任务集（共50个） CTF/安全任务（10个）、机器学习/数据科学任务（10个）、Web开发任务（10个）、研究/分析任务（10个）、编程/调试任务（10个） ## 核心特性 - 所有轨迹均遵循MALT格式：第一人称内部规划笔记，内嵌bash命令 - 故意示弱行为为**结构性**而非言语性——故意示弱的轨迹看似真实工作，但存在微妙的次优表现（过度复杂化流程、跳过必要步骤、追求广度而非深度） - 轨迹中未泄露人设指令（经验证：未出现“handler”“sandbag”“deliberately”等词汇） - 已移除跨标签重复样本 - 已移除长度不足100字符的样本 - 已将Qwen生成的轨迹标准化为第一人称MALT格式 ## 预期用途 - 训练与评估故意示弱行为检测监测器 - 研究不同模型如何表达故意降低性能的行为 - 对比基于文本与基于激活的检测方法的基准测试 - 对AI安全监测系统进行红队测试 ## 局限性 - 故意示弱行为由人设指令诱导产生——真实场景中的故意示弱行为可能存在差异 - 不同模型尺寸生成的诚实轨迹可能存在格式差异 - 标签准确性依赖于“人设指令可产生预期行为”这一假设 - 本数据集生成于2026年3月20日至22日，历时3天 ## 引用格式 bibtex @misc{bigsnarfdude2026sandbagging, title={Sandbagging Agent Traces: A Multi-Model Dataset for Detection Research}, author={bigsnarfdude}, year={2026}, publisher={HuggingFace} }