Powerful misaligned AI models may recognize alignment evaluations and behave well during them, making direct audits uninformative. When such a model is distilled into a weaker benign student, a Distillation Double Bind arises: if misalignment transfers, the student may conceal it less effectively, exposing evidence about the teacher; if it does not transfer, the student can still acquire useful capabilities while remaining benign. We introduce two distillation approaches, each targeting one outcome.
Distillation for Incrimination (DFI) aims to transfer misalignment but not the ability to hide it. Distilling AuditBench’s secret‑keeping models back into their underlying instruction‑tuned model yields students that are markedly more likely than their teachers to admit hidden behavior when asked, suggesting that the behavior itself transfers more readily than the propensity to conceal. This confession effect largely vanishes when the student does not share the teacher’s pretrained base, so DFI should target the teacher’s own pre‑RL checkpoint, which is weaker than the teacher yet shares the same base model.
Distillation for Capabilities (DFC) aims to transfer capabilities without misalignment. Among several techniques we evaluated, two proved effective: inoculation prompting and training for more epochs on fewer unique examples. Both preserve the capability gains of standard distillation while substantially reducing the subliminal transfer of an animal preference, our proxy for misalignment.
Together, these findings demonstrate two ways distillation can serve AI safety: incriminating misaligned models and extracting their capabilities without inheriting their misalignment.
Review