Working in Peter Hase's stream on interpretability for monitoring and steering LLMs — scoping a concrete project that turns interpretability into something practical for oversight.

Testing whether model introspection / self-report techniques are robust to adversarial weight perturbation, and exploring whether adversarial training can harden them — asking whether a monitoring tool that can be quietly defeated is worse than none at all.

Developing an honesty-training procedure that uses white-box deception detectors as a reward signal and stays robust to the representation drift that RL training induces — testing whether re-enumerated probe sets beat single probes at keeping models honest.

With Matthew, building a control protocol that uses interrogation: a trusted model asks an untrusted model pointed questions about each proposed action, and a trusted judge uses the answers to catch dangerous actions while keeping useful ones flowing.

With Ani, developing and testing an interrogation-based control protocol — measuring on BashArena/LinuxArena whether asking an untrusted model about its actions beats a plain monitor that just reads them.

Studying how agent personas change when agents interact: if one agent has a strong persona, does it shift the others? He wants to separate transient mimicry from lasting replication, and see whether a single misaligned agent could spread its persona across many.

Investigating the "attractor" states LLMs drift into over long interactions (Claude's spiritual-bliss basin, Gemma's frustration spiral). He'll run many fast experiments to find basins systematically and see how character training, memory and compaction reshape them.

Testing whether the same persona evidence shapes a model more strongly when framed as its own prior behaviour or memory than when framed as another assistant's output or an external document — with implications for how memory, summaries and handoffs should be designed.

Studying how character traits shift reward-hacking rates and chain-of-thought monitorability, and whether a teacher model's "corrupted" self-account transmits to a student distilled on its reasoning — probing one of the more fragile tools we have for AI control.

Building a benchmark that probes whether and how models engage in "deal-making" — offering a potentially-scheming model something in exchange for revealing misalignment — with a focus on qualitatively analysing the model's reasoning about credibility, cheating and being evaluated.

A science-of-evaluation project defining what it means for an agent to fail an alignment test because it lacks spontaneous reasoning, and building a benchmark to measure spontaneous theory-of-mind — helping explain the gap between Q&A and agentic task performance.

Project details to be confirmed. Ryan is keen to get to know the other fellows, chat with safety researchers and dig into group discussions.

Building the first benchmark for whether AI agents comply with sanctions law when doing procurement tasks — measuring how compliance varies across prohibition types, tasks, sanctions regimes and models, and what failure modes look like.

In Kozzy Voudouris's stream, modelling what happens to scientific reliability when alignment research itself is automated — work on deployment-time AI alignment.

Testing whether LLM agents can model themselves and other agents in multi-agent settings — and whether, when a model fails to predict another agent, its guess gets pulled toward what it itself would have done. Relevant to any setting where one model monitors another.

Trying to translate what a bilinear tensor-network layer computes into human-readable weighted logic (AND/OR/NOT/XOR) rather than raw polynomial coefficients — a step toward making model internals checkable with formal tools like SAT solvers.

Working toward a taxonomy for compositional interpretability and hierarchical concepts — top-down interpretability techniques aimed at pragmatic alignment goals.

Applying weight-based and tensor-network interpretability to biological foundation models (like scGPT and Geneformer), and comparing what these methods recover against his existing sparse-autoencoder atlas — with an eye on the dual-use risks of biological design models.

Designing and prototyping a simpler, smaller-attack-surface "cross-domain solution" for securely moving data — the kind of security-critical infrastructure needed to protect model weights against sophisticated state-level attackers under the SL5 standard.

With Rieke, investigating what causes "activation plateaus" in models — testing whether they arise because activations live on a non-linear manifold, which could give a data-independent way to discover a model's features and steer it.

With Diksha, testing whether activation plateaus track the geometry of a non-linear manifold — does perturbing along the manifold versus across it predict where the plateaus and their sensitive directions appear?

Producing a rigorous threat model and capability-threshold analysis for Autonomous Replication and Adaptation (ARA) — working out where the weakest links are in the causal chain, and whether current lab safeguards adequately cover the threat.

Mapping the scheming threat landscape within national-security and military AI deployment — which pathways are most plausible, most dangerous and least addressed, and whether scheming there is more likely to come from external interference or internal misalignment.

Building a scoring instrument that asks not just how much AI capability is concentrating, but who actually controls it and whether that control is still reversible, contestable and answerable — applied symmetrically across US and Chinese "holders."

Working on AI-enabled power concentration and forecasting, aiming to understand the dynamics of how transformative AI could concentrate power — and to get clarity on his own highest-impact next steps.

Building a framework to help AI-lab insiders work out which internal information is both a high-value early-warning signal and hard to see from outside — so that the disclosures that matter most are more likely to reach the people who can act on them.

Working on a geopolitics-related research paper in Robert Trager and Charles Martinet's stream.

Mapping the mechanisms through which non-frontier states can gain access to frontier AI capabilities and a seat at the table — using structured-access programmes as working models — to reduce the risk of a bipolar AI world.

Designing an attack-agnostic side-channel monitor for AI compute — hardware-level monitoring that could help verify how chips are being used, aimed at a top security/privacy venue.

Pivoting mid-career into AI governance — developing his understanding of the policy and existential-risk landscape and exploring what can be done to ensure a safe transition, building on Gabriel Kulp's work.

Using statistical methods (item response theory) to automatically score benchmark items by difficulty, refusal-likelihood and how much signal they carry — so researchers can tell when a benchmark is too easy, saturated, or full of malformed questions.

Building an agent that keeps a biosecurity evaluation "live" — continually finding relevant new publications, turning their experiments into eval tasks, and QCing them — so the eval keeps pace with model training data and avoids testing on the training set.