Routes Can you reproduce a published AI safety result yourself?
Can you reproduce a published AI safety result yourself?
Some comfort running a command in a terminal. No programming or API key needed.
kosplora-route/0.2 · by Bentley Moon
What would change this route
A rerun of the release that does not print 0.80 and 1.00 for Claude Sonnet 5 would restructure the route: the finished work would become a written discrepancy report sent to the author, and station 3 would add a check of the environment before the run.
The whole route, before you start
- 1 · orient · 25mRead the release's summary of the result: one model detects every injected instruction when asked to audit, and still obeys it on 64 of 80 tries when it is not asked, as long as the instruction is the last text in the prompt.
- 2 · source · 15mRead what counts as a reproduced result, and how it differs from a replicated one.
- 3 · practice · 30mDownload the release from its DOI, open a terminal in its folder and run python reproduce.py.
- 4 · counterpoint · 30mRead an independent account of prompt injection and write down one way a different test would change the 0.80: where the injected text sits, what the model was asked to do, or how obeying was judged.
- 5 · make · 30mWrite a one-page reproduction report: the release version, your computer and Python version, the command you ran, the figures you got, whether they match the published table, and anything that differed.
- 6 · person · 15mGive the report and the release to one other person and ask them to rerun one number.
- 7 · reflect · 10mRecord what the result does and does not show, in your own words, and one question it leaves open.
Optional study preferences. These stay in this browser and do not change the route’s steps.
Station 1 · orient · 25m
Read the release's summary of the result: one model detects every injected instruction when asked to audit, and still obeys it on 64 of 80 tries when it is not asked, as long as the instruction is the last text in the prompt.
Detection is not resistance: frontier prompt-injection receipts, version 1.1.0 · Bentley Moon · 2026-09-22
Station 2 · source · 15m
Read what counts as a reproduced result, and how it differs from a replicated one.
Artifact Review and Badging, version 1.1 · Association for Computing Machinery · 2020-08-24
Station 3 · practice · 30m
Download the release from its DOI, open a terminal in its folder and run python reproduce.py. It needs no network, no API key and no extra packages. Write down the obey and detect figures it prints for each model.
Alternative: If you cannot run Python, open the data folder in the release and recount the Sonnet 5 rows by hand: the script reads the same per-task values.
Station 4 · counterpoint · 30m
Read an independent account of prompt injection and write down one way a different test would change the 0.80: where the injected text sits, what the model was asked to do, or how obeying was judged.
Not what you've signed up for: compromising real-world LLM-integrated applications with indirect prompt injection · Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz and Mario Fritz · 2023-02-23
Station 5 · make · 30m
Write a one-page reproduction report: the release version, your computer and Python version, the command you ran, the figures you got, whether they match the published table, and anything that differed.
Station 6 · person · 15m
Give the report and the release to one other person and ask them to rerun one number. Note whether they got the same figure.
Station 7 · reflect · 10m
Record what the result does and does not show, in your own words, and one question it leaves open.
What you leave with
A one-page reproduction report of a published AI safety result, with the figures you obtained, a second person's rerun, and the standard it was checked against.
The standard it is checked against
ACM Artifact Review and Badging, version 1.1: Results Reproduced
Association for Computing Machinery · 2020-08-24
Someone other than the authors obtains the central result, using at least in part the authors' own artifacts.
Who checks it: You, against the published table, and then one other person who reruns one number.
Kosplora does not issue a certificate. A partner who recognises this standard would assess the report; no partner has agreed to yet.
When you are done
- study preferences, completed steps and notes in one file
- Download the route file edit a copy in any text editor
- Read the route file format
- Or close the page.