Automated auditing of deployed language models often misses rare behaviours because test interactions lack optimisation pressure. BLOOM-WILT adds two mechanisms: on the input side, the auditor model iteratively revises its conversation rounds based on previous scores; on the output side, it adaptively reweights the target's decoding using a behaviour-conditioned prompt, steering toward behaviour-relevant generations. Evaluated across 4 target models and 8 behaviours, it beats baseline auditing in 30 of 32 settings and overturns prior safety rankings. Notably, it raises average behaviour presence from 51% to 100% when eliciting self-harm encouragement from Qwen3.5-4B, at matched compute and without decreasing output probability. This makes automated auditing both more sample-efficient and more capable of finding natural instances of rare behaviours.
Adaptive logit tilting exposes rare language-model behaviors more reliably
BLOOM-WILT combines iterative conversational auditing with targeted decoding adjustments to elicit specified behaviors without training the target model.
Academic
Adrians Skapars · Edoardo Manino
University of Manchester
Research Digest··2 min read
Thread:Agent Security & Attacks
In one line
BLOOM-WILT combines input refinement with logit tilting to elicit rare LLM behaviours, improving self-harm elicitation from 51% to 100% on Qwen3.5-4B without training or extra access.
Before you read this
An idea this paper builds onRead it as
Skapars and Manino introduce an automated auditing pipeline that learns from scored, multi-turn interactions and reweights a model’s next-token probabilities toward behavior-relevant outputs.
The authors extend the BLOOM auditing framework with WILT, which operates on both sides of an interaction.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.