# Auditing Sabotage Bench: A Benchmark for Detecting and Fixing Research Sabotage in ML Codebases

arXiv: https://arxiv.org/abs/2604.16286 · HTML: https://mlsanity.com/paper/2604.16286/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 0 of its 52 references that are in the map.
- First posted on arXiv 17 Apr 2026.

## Built on by (most cited first, 4 of 4)

- [Automated Researchers Can Mitigate Well-characterized Alignment Failures](https://mlsanity.com/paper/2608.28945/) (2026)
- [ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D](https://mlsanity.com/paper/2607.19321/) (2026)
- [Diffuse AI Control on Fuzzy Tasks](https://mlsanity.com/paper/2606.08892/) (2026)
- [AI Persuasion as a Threat to Human Control](https://mlsanity.com/paper/2609.14796/) (2026)

## Abstract (arXiv)

As AI systems are increasingly used to conduct research autonomously, misaligned systems could introduce subtle flaws that produce misleading results while evading detection. We introduce Auditing Sabotage Bench, a benchmark for evaluating the ability of auditors to detect and fix sabotage in ML research codebases. Our benchmark consists of 9 ML research codebases with sabotaged variants that produce qualitatively different experimental results. Each sabotage modifies implementation details, such as hyperparameters, training data, or evaluation code, while preserving the high-level methodology described in the paper. We evaluated frontier LLMs and LLM-assisted human auditors on our benchmark and found that both struggled to reliably detect and fix sabotage: the best performance was an AUROC of 0.77 and a top-1 fix rate of 42%, achieved by Gemini 3.1 Pro. We also tested LLMs as red teamers and found that LLM-generated sabotages were weaker than human-generated ones but still sometimes evaded same-capability LLM auditors. We release the benchmark to support research on monitoring and auditing techniques for AI-conducted research.