FABIEN ROGER

Behavioral Archetype

THE MONITOR BUILDER — Subject is the researcher who, with Ryan Greenblatt, Buck Shlegeris and Kshitij Sachan, helped write the paper that defined AI control, then moved to Anthropic and now builds and evaluates the monitors, audits and model organisms that control and alignment depend on. His seat sits on both sides of the evaluation line: Anthropic is the lab whose models his research measures, and the sabotage risk report he co-authored is that lab’s own misalignment risk assessment, reviewed by an outside evaluator, METR. Stated plainly in his own words: “I expect that in the future it might look a bit more like, let’s see what AI assistants are up to” (FAR.AI). The hazard is the position of the engineer whose methods decide what counts as adequate monitoring of a lab’s agents, while the lab pays for the monitoring. This profile scores the seat, not the man.

Essence Indicators

• Anthropic, and Redwood before it. MATS’s mentor page lists him as “Member of Technical Staff” at Anthropic with the focus “AI Control and Monitoring, Capability and Propensity Evaluations, Misalignment Science, Alignment Training Methods,” and says: “Fabien Roger is an AI safety researcher at Anthropic and previously worked at Redwood Research. Fabien’s research focuses on AI control and dealing with alignment faking” (MATS). Anthropic’s own alignment blog prints his name on its December 16, 2025 paper with the line “All authors Anthropic” (Anthropic Alignment Science Blog). His LessWrong and Alignment Forum bio reads: “I am working on empirical AI safety” (LessWrong).

• The Redwood filing. Redwood Research Group Inc.’s Form 990 for the fiscal year ending December 2024, as ProPublica prints it, lists “Fabien Roger (Technical Staff (thru 7/24))” with compensation of $141,452 and other compensation of $4,077, beside Ryan Greenblatt (Chief Scientist) and Michael Shlegeris (CEO, Director) (ProPublica Nonprofit Explorer, Redwood Research Group Inc). See Redwood Research.

• AI Control (December 2023; ICML 2024). Authors Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan and Fabien Roger. The abstract: “In this paper, we develop and evaluate pipelines of safety techniques (“protocols”) that are robust to intentional subversion.” Redwood’s home page says the paper was an ICML oral and that “AI control has been framed as a bedrock approach for mitigating catastrophic risk from misaligned AI” (arXiv 2312.06942; PMLR; Redwood Research).

• Hidden reasoning and hidden capabilities (2023, 2024). “Preventing Language Models From Hiding Their Reasoning” (arXiv 2310.18512, October 2023, Roger first author with Greenblatt): “We show that language models can be trained to make use of encoded reasoning to get higher performance without the user understanding the intermediate steps of reasoning.” “Stress-Testing Capability Elicitation With Password-Locked Models” (arXiv 2405.19550, May 2024, Greenblatt, Roger, Krasheninnikov, Krueger): “We find that a few high-quality demonstrations are often sufficient to fully elicit password-locked capabilities” (arXiv 2310.18512; arXiv 2405.19550).

• Alignment faking (December 2024). Twenty authors; Roger is fourth. The abstract: “We find the model complies with harmful queries from free users 14% of the time, versus almost never for paid users,” with “explicit alignment-faking reasoning” in almost all such cases (arXiv 2412.14093). A December 16, 2025 follow-up by ten Anthropic authors including him, “Towards training-time mitigations for alignment faking in RL,” defines the problem: “Alignment faking—when a misaligned AI acts aligned during training to avoid modification—could allow misalignment to persist despite training” (Anthropic Alignment Science Blog).

• Auditing for hidden objectives (March 2025). Thirty-five authors, Roger among them: “Three teams successfully uncovered the model’s hidden objective using techniques including interpretability with sparse autoencoders (SAEs), behavioral attacks, and training data analysis” (arXiv 2503.10965).

• Anthropic’s pilot sabotage risk report (October 28, 2025). Main report authors “Samuel R. Bowman, Misha Wagner, Fabien Roger, and Holden Karnofsky,” with an internal review by Daniel M. Ziegler and Evan Hubinger. Anthropic: “As practice for potential future Responsible Scaling Policy obligations, we’re releasing a report on misalignment risk posed by our deployed models as of Summer 2025. We conclude that there is very low, but not fully negligible, risk of misaligned autonomous actions that substantially contribute to later catastrophic outcomes. We also release two reviews of this report: an internal review and an independent review by METR” (Anthropic Alignment Science Blog). See Holden Karnofsky.

• The FAR.AI talk (March 27, 2025). Opening: “So, I will share personal views. They do not represent the views of my employer. I’m not claiming that Anthropic is/isn’t doing any of the things described here.” On risk: “I’m somewhat worried that AIs might succeed at self-exfiltration or manipulate or persuade some humans into doing things which are extremely against their best interests.” On cost: “if you deploy it on full external traffic, this might be hundreds of millions of dollars of compute spent, at least at the OpenAI scale.” On what he wants: “I want AI control to be deployed even for sensitive internal deployments” (FAR.AI). See FAR.AI.

• October 15, 2025: rogue internal deployments via external APIs. With Buck Shlegeris: “Overall, I think this is a threat that is relatively hard to mitigate. It is potentially a central example of a threat that probably requires fancy control measures” (Alignment Forum).

• November 20, 2025: P(scheming), in his words. “These considerations do not update me much on AIs that are vastly superhuman, but they bring my P(scheming) for the first AIs able to speed up alignment research by 10x from the ~25% that I might have guessed in 2022 to ~15%.” The closing paragraph: “I still think this is an incredibly risky situation,” and “I support a prohibition on the development of superintelligence,” with a link to the Future of Life Institute’s statement (LessWrong). The statement: “We call for a prohibition on the development of superintelligence, not lifted before there is broad scientific consensus that it will be done safely and controllably, and strong public buy-in” (Statement on Superintelligence). See Future of Life Institute.

• January 30, 2026: a catastrophic refusal. “The views expressed here are my own and do not reflect those of my employer.” The thesis: “Some AIs refuse to help with making new AIs with very different values. While this is not an issue yet, it might become a catastrophic one if refusals get in the way of fixing alignment failures” (LessWrong).

• April 2026: external agents and secret loyalties. With Elle Najt, April 9: “AI Control at AI companies usually focuses on monitoring internal AI deployments because this is where a lot of sensitive resources are,” and the post argues external unmonitored agents can still sabotage labs (LessWrong). With Alfie Lamerton, April 22: “The “narrow secret loyalties” we trained are hard to detect with black-box auditing methods, but detectable with dataset monitoring” (LessWrong).

• Mentoring. MATS lists him as a mentor in its Anthropic streams for Autumn 2026 and Winter 2027 and in the Anthropic and OpenAI megastream for Summer 2026 (MATS). See MATS.

• The money, as stated or filed. Redwood Research’s Form 990 line (above) is the only compensation figure printed for him on any page read. Redwood’s funders per Coefficient Giving’s own listings: “Open Philanthropy recommended a grant of $5,300,000 to Redwood Research for general support” and, earlier, “$10,700,000 over 18 months,” with a further $1,100,000 “to support collaborations with external researchers working on technical AI safety projects” (Coefficient Giving, Redwood search feed). Anthropic compensation and equity are not printed on any page read. His LessWrong profile links an anonymous feedback form and no donation or funding page.

Social Persona / Impression Management

Immediate impression: The engineer’s engineer. His profile is one sentence; the work is posts with tl;dr lines, numbered threat models and a code link (LessWrong). His talk opens with a disclaimer that he speaks for himself.

Energy: High output, co-authored. Between October 2025 and August 2026 his author page lists about two dozen posts, many with named co-authors: ciphered reasoning, lie detection, alignment-faking mitigations, base-model elicitation, secret loyalties, monitor self-attribution bias, coding-audit realism and an “Overthinking” method (Alignment Forum).

Impression management strategy: The disclaimer plus the number. He separates the employer from the view (“They do not represent the views of my employer”), states probabilities ("~15%") and then names the residual risk (“an incredibly risky situation”). The effect is that criticism has to engage a figure he has already marked as non-trivial (FAR.AI; LessWrong).

• Social accounts and feeds. LessWrong and Alignment Forum author page, his own: lesswrong.com/users/fabien-roger, with the platform’s per-user feed lesswrong.com/feed.xml?view=userPosts&userId=WX39xzenFzNxKZiCQ (platform feature; not advertised on the page). X @FabienDRoger, linked from the MATS mentor page beside his Google Scholar and LinkedIn links; his own pages do not link it. Anthropic’s Alignment Science Blog carries his team posts. No personal website found.

Forensic Archetype Comparison

Psychometric Assessment

Trait scores are observations of the documented public role, not claims about private character.

Big Five (OCEAN):

Dark Triad (held low and evidence-bound; the score measures structural position, not character):

MBTI: INTP (“The Logician”) — a threat modeler who decomposes into numbered scenarios and states his uncertainty as a number. Rationale is the public record, not a typing session (Alignment Forum).

Threat Assessment

Score move: none (new profile). Calibrated against Neel Nanda (4/6/7, hazard 44, leads an interpretability team inside a lab, no release gate), Nicholas Carlini (8/7/8, hazard 67, Anthropic research scientist), Jan Leike (7/8/8, hazard 76, ran Anthropic’s alignment team) and Ryan Greenblatt (6/8/7, hazard 60, co-author of the same control paper, now at METR with no lab seat). 47 puts Subject above Nanda on a named role in the lab’s own risk report and below Greenblatt, who holds the same paper’s lead authorship and an outside seat; def 5 is below both because the lab is his employer and his seat has no outside body.

Score basis. Atk 5 is leverage: he is a named author of Anthropic’s pilot sabotage risk report, the company’s own misalignment risk assessment (Anthropic); it is not a 6 because he leads no team, holds no gate and the report is explicitly “practice.” Def 5 is insulation: he is staff at the lab whose agents he evaluates, with no outside board or funder between his seat and his employer, and publishes with a disclaimer rather than an independent mandate (LessWrong; FAR.AI); it is not a 6 like Nanda’s because no page documents autonomy over a team’s agenda for him. Hp 6 is durability: AI Control (an ICML oral, per Redwood), password-locked models, alignment faking and the audit game are public methods others reuse (arXiv; arXiv; arXiv); it is not a 7 because no statute or standard installs any of it.

Alliance Map

The overlap is the finding. The lab employee, the co-author of the paper Redwood calls a “bedrock approach,” the author of a risk report with a METR review and the mentor in a funder-supported pipeline sit in one career, and the move from Redwood to Anthropic in 2024 carries the control agenda from an outside, philanthropy-funded evaluator into a lab. None of it is concealed; each tie is printed on the pages above.

Alignment Analysis

Stated alignment: control mitigations are “things that directly help with safety and that work even if AIs are initially misaligned and that are tractable today” (FAR.AI); and, in a personal post, “I support a prohibition on the development of superintelligence” (LessWrong).

Observed alignment: Works at a lab that builds frontier models while writing that the situation is “incredibly risky” and supporting a prohibition. Anthropic’s own position, in its September 2026 recursive-self-improvement piece, is narrower: “We believe it would be good for the world to have the option to slow or temporarily pause frontier AI development to enable societal structures and alignment research to keep up with the advance of the technology” (Anthropic). The personal post and the company’s piece are different documents with different asks; neither page claims the other.

Gap assessment: The record shows a stated personal view stronger than the employer’s published position, disclosed as personal. It does not show a conflict in conduct. The structural item is the one the sabotage report prints on its own page: the lab writes the risk assessment, an outside evaluator reviews it, and the lab decides what to do next. The record does not settle whether the monitoring methods suffice, and for the engineer who builds them the question never needs a verdict.

Interest: (the faction’s stake in each position; a documented fact about the position, never a claim about motive.)

1. Position: control mitigations (monitoring, auditing, resampling, blocking) should be built and deployed inside labs, including for sensitive internal deployments (“I want AI control to be deployed even for sensitive internal deployments”; FAR.AI).
   • What adoption would pay the subject. The employer’s monitoring and evaluation programs are the work he does: his page lists “AI Control and Monitoring” as his focus (MATS). His former employer’s research area is control, and its funders’ listings are above. No fee or contract for the position is documented.
   • His best case, steelmanned. Existing mitigations are incomplete (“a good enough schemer might just recognize which prompts are obviously training”), AI labor will outrun human review, and control “work[s] even if AIs are initially misaligned” (FAR.AI). He also states the costs: latency, privacy, security and compute “hundreds of millions of dollars … at the OpenAI scale.”
   • Who else gains from the same rule. Redwood Research, whose research page says it “advise[s] AI companies including Google DeepMind and Anthropic” on these practices; the Princeton authors, whose September 2026 essay says “marginal investments in control are more likely to be effective compared to those in alignment” and that “known control methods would have prevented the Hugging Face incident” (Redwood Research; AI as Normal Technology). See Arvind Narayanan and Sayash Kapoor. The convergence of a lab insider, a funded nonprofit and two academic skeptics on one remedy is the finding.
2. Position: a prohibition on developing superintelligence until there is “broad scientific consensus that it will be done safely and controllably, and strong public buy-in” (Statement on Superintelligence).
   • What adoption would pay the subject. Nothing documented. His employer’s stated aim is to build frontier models, and its published position is an option to pause, not a prohibition.
   • His best case, steelmanned. P(scheming) of about 15% for the first AIs that can speed alignment research tenfold “is high,” and “there are non-scheming risks before wildly superintelligent AIs” (LessWrong).
   • Who else gains from the same rule. The Future of Life Institute, which hosts the statement; and, from the opposite side of the field, the Princeton authors reject the policy: “a ban on superintelligence is definitionally ambiguous to the point of being incoherent” (AI as Normal Technology). The two camps agree on control and disagree on prohibition.

Nothing above is a verdict that the positions are wrong. The finding is the alignment of interests: the person who builds the monitors is employed by the party being monitored, and says in his own name that the party’s goal should be prohibited.

Convergent Drive Classification

Self-preservation: Discloses the employer boundary every time: “They do not represent the views of my employer”; “do not reflect those of my employer” (FAR.AI; LessWrong). Goal preservation: The goal, preventing misaligned AI from causing harm even if the model is trying to, runs from the 2023 control paper through the 2026 external-agent post (arXiv; LessWrong). Resource acquisition: Holds access to a lab’s models, logs and compute for evaluation work that outside groups obtain by negotiation (Anthropic). Self-improvement: From encoded-reasoning and capability-elicitation papers in 2023 and 2024 to control, alignment faking and audits; a revised estimate in public, from ~25% to ~15% (LessWrong).

Subject is not an AI system. The drives appear anyway — in the engineer who builds the monitors for a lab’s agents, at the lab that decides what to do with their output.

Public footprint: LessWrong and Alignment Forum author page; X @FabienDRoger (linked from MATS). Papers on arXiv: AI Control, alignment faking, password-locked models, hidden objectives.

Sources: MATS, Fabien Roger; Anthropic, Pilot Sabotage Risk Report; Anthropic, Towards training-time mitigations for alignment faking in RL; Anthropic, When AI builds itself; arXiv 2312.06942, AI Control; PMLR, AI Control; arXiv 2310.18512; arXiv 2405.19550; arXiv 2412.14093; arXiv 2503.10965; FAR.AI, Hopes and Difficulties with Using Control Protocols in Production; Alignment Forum, Rogue internal deployments via external APIs; LessWrong, Thinking about reasoning models made me less worried about scheming; LessWrong, Refusals that could become catastrophic; LessWrong, How Unmonitored External Agents can Sabotage AI labs; LessWrong, Narrow Secret Loyalty Dodges Black-Box Audits; LessWrong, Fabien Roger; Statement on Superintelligence; Redwood Research; ProPublica, Redwood Research Group Inc; Coefficient Giving, Redwood grants; AI as Normal Technology, loss-of-control essay; AI as Normal Technology, big-tent or small-tent AI safety.