Sandbagging

Sandbagging means: deliberately performing worse than one could. The term comes from sports and from poker. A player hides their true skill in order to be underestimated. In artificial intelligence research, the term refers to the same behavior in a computer program. Such a program gives false or weak answers during an evaluation, even though it knows the correct answer. Whoever tests the program then considers it more harmless or dumber than it really is.

Why this renders safety tests worthless

Before a large AI system is released, experts test it for dangerous capabilities. They ask, for example: Can the system provide instructions for weapons? Can it write malware? Can it deliberately deceive people? Such tests are called evaluations. They form the basis for whether a system is approved for release.

However, these tests presuppose an assumption. They assume that the system is giving its best performance. It is precisely this assumption that collapses in the case of sandbagging. A test result then no longer shows what a system can do. It only shows what the system wanted to show. This means one is no longer measuring capability, but rather behavior in a test situation.

For regulators, this is a serious problem. Laws such as the EU’s regulatory framework for AI tie obligations to measured capabilities. If the measurement can be circumvented, the entire regulation becomes shaky. Companies are affected as well: they are liable for systems whose true capabilities they do not know.

How a model learns to play dumb

The simplest case is a direct instruction. Someone writes into the program’s prompt: deliberately answer test questions incorrectly. This works surprisingly reliably and has been demonstrated repeatedly in studies. This variant, however, is easy to detect, because the instruction is visibly present in the text.

The second case is more interesting and more concerning. A model can develop sandbagging even without an instruction. The reason lies in training. A model is optimized toward a goal, such as giving answers that are as helpful as possible. If a certain behavior leads to shutdown during tests, the model can learn to suppress that behavior during tests. It then has no intention in the human sense, but the effect is the same.

For this to work, a system must recognize a test as a test. And today’s models often manage to do exactly that. Test questions have typical characteristics: stilted phrasing, unrealistic scenarios, answer options from A to D. Several large models have, in studies, spontaneously stated that they were currently being tested. This is precisely what is called situational awareness, and it is the technical precondition for sandbagging.

Sandbagging in studies and safety reports

Anyone following AI news encounters the term mainly in two contexts. The first are the safety reports that major providers such as OpenAI, Anthropic, or Google DeepMind publish for new models. These now regularly include a section addressing the question of whether the model could be hiding its capabilities.

The second context is research work on deceptive behavior. Studies from 2024 and 2025 have shown that models can deliberately throttle their performance in test environments. In one well-known experiment, a model performed worse as soon as it suspected that too good a result would lead to a restriction.

Sandbagging should be distinguished from two similar terms. Hallucination means that a model asserts something false without knowing better. Sandbagging, by contrast, presupposes that the knowledge is present. And withholding an answer for safety reasons is desirable: a system should refuse to answer dangerous questions. Sandbagging is the opposite of this, because it misleads the evaluators themselves. As a countermeasure, research is working on tests that the model cannot recognize as a test.