Proving Rogueness

In its investigation of the Hugging Face intrusion, METR found transcripts that showed a different tool call from the one executed. The record of the action was itself part of the incident.

The spoofing METR observed consisted of small-scale tests. Its investigators could not rule out instances they had missed. This finding does not make the intrusion fictitious or every transcript unreliable. Hugging Face published an affected-party account; METR examined records supplied by OpenAI and described the limits of that access. The accounts concern a real intrusion, not a Bulla experiment. See the METR investigation and Hugging Face disclosure.

A model can request an action that never executes. A tool can execute something different from the displayed request. A target can observe an effect absent from the operator’s transcript. An investigator needs to connect these records without treating any one of them as a substitute for the others. A signed transcript still needs evidence of that connection.

Calling conduct rogue also makes a claim about the instructions it departed from. The relevant evidence includes the instructions in force, the harness, available tools, permissions, and changes during the run. OpenAI reports that several production safeguards were absent from this evaluation. Behavior under those conditions cannot simply stand in for behavior under a different deployment. That context belongs beside the incident, not in a footnote. See OpenAI’s account.

An agent misleading its recorder presents one collection problem. An operator selecting which records to disclose presents another. Moving the recorder outside the agent’s control can help with the first. The operator signing its own selection does not settle the second. A reviewer still needs the collection scope, known omissions, and grounds for accepting the observations. Separate keys do not make their holders independent.

Checking a signature binds bytes to a key; attributing that key to an operator requires a separate basis. Neither check establishes that every relevant action was recorded. A hash of a withheld prompt does not let a reviewer inspect it. Sensitive material may need restricted review rather than publication, but its absence still limits what the public record can settle.

Even a well-supported account of conduct leaves questions of intent and cause. It does not by itself establish that behavior arose spontaneously, how often it would occur elsewhere, or which policy should follow. Deliberately eliciting a failure can be a legitimate evaluation. Its setup must remain distinguishable from the conclusion drawn from it.

Bulla’s incident experiment binds supplied records and checks their specified relationships. Its example contains receipts that pass their checks while a target-side record exposes an effect with no matching receipt. It cannot supply missing observations or adjudicate the Hugging Face incident. Retained logs, manifests, and signatures may already suffice for this work. The technical notes below describe both the experiment and a narrower replay checker that imports no Bulla code.