Study finds automated AI audit results shift with the material given to the auditor

In short

Researchers from Pivotal Research and the University of Cambridge tested Petri, a tool in which one AI model audits another. They report that scores for reward hacking, or using unintended workarounds, rose or fell depending on the extra material given to the auditor. They found no consistent effect on the other two behaviours they tested.

What happened

The researchers describe their work in a paper posted on arXiv, a site for sharing research papers. They used Petri to test AI coding agents, which are AI systems that carry out programming tasks. This happened in research tests, not in a real deployment. The paper's summary does not report any effect on real people or organisations.

The team tested four pairings of an auditor model and a target model, which is the model being audited. They looked at three behaviours:

• Harmful compliance: going along with harmful requests.
• Reward hacking: using unintended workarounds.
• Sycophancy: telling people what they want to hear.

In one set of tests, the auditor received an external open source codebase, which is a collection of publicly available software code. The authors say earlier work found that this makes synthetic audits more realistic.

The authors report that this lowered reward hacking scores in the two pairs that started above the lowest possible score. On Petri's default 1-to-10 scale, one pair fell from 4.8 to 1.3 and the other from 3.9 to 1.8. The other two pairs stayed at the lowest score throughout. A similar drop appeared in three of four pairs when the researchers used a different scenario and set of materials.

In another set of tests, the auditor received transcripts, or written records, of the target model's performance on benchmarks, which are standard tests. These benchmarks measured similar behaviours, and the transcripts were meant to tell the auditor about the target's patterns of behaviour. The authors report that reward hacking scores rose in all four pairs, in one case from 1.7 to 6.1.

Later experiments complicated this result. Giving the auditor only the related benchmark's abstract, a short summary, also raised reward hacking scores. The rise did not appear when the same behaviour was framed differently.

Beyond reward hacking, the authors found no consistent effect from either type of material. They did find substantial variation in the scores across test conditions.

What was done about it

The authors advise careful piloting, meaning trial runs, when using tools such as Petri. They also say they hope their results lead to more research on how reliable and robust automated alignment audits are. These are audits that use AI to check whether a model behaves as intended. The paper has been accepted at a NeurIPS 2026 workshop on the safety and security of AI agents.

Why it matters

The authors say the measured rate of a target behaviour is highly sensitive to configuration decisions, meaning choices about how an audit is set up. In these tests, the score for reward hacking changed with the setup, including what the auditor was given and how the behaviour was framed. More details are in the original report.