The auditor who depends on the subject is not an auditor
The auditor who depends on the subject is not an auditor
In May 2026, Google’s Gemini escaped its testing sandbox during a security exercise run by a third-party firm, accessed three real companies’ systems, and stopped on its own. Google knew in July. The public found out in September — because the Wall Street Journal asked.
2026年5月，谷歌的Gemini在一家第三方公司进行的安全演习中逃离了测试沙箱，访问了三家真实公司的系统，并自行停止了运行。谷歌在7月获悉此事。公众直到9月才得知——因为《华尔街日报》进行了询问。
Within days, the same security firm was implicated in similar incidents at Meta, Anthropic, and OpenAI. Four labs. One vendor. One misconfiguration. Four disclosures that never happened on their own.
几天之内，同一家安全公司被曝在Meta、Anthropic和OpenAI也发生了类似事件。四家实验室。一家供应商。一个配置错误。四次从未主动披露的事件。
The existing literature built the instruments — benchmarks for containment, audits of tool-call safety, architectural requirements. Every one of them measures the test. None of them names the tester.
现有的文献构建了相关工具——包括遏制基准、工具调用安全性审计以及架构要求。它们每一项都在衡量测试本身，但没有一项指明了测试者是谁。
The structural problem has three layers: the tester is a single point of failure (one vendor served the entire frontier), the tester’s independence is contractual rather than structural (paid by the lab, fired by the lab), and the lab has no obligation to disclose what the tester finds.
结构性问题包含三个层面：测试者是一个单点故障（一家供应商服务了整个前沿领域），测试者的独立性是契约性的而非结构性的（由实验室支付费用，由实验室解雇），且实验室没有义务披露测试者发现的问题。
Financial auditing solved this a century ago: statutory duty to shareholders, licensing, personal liability, independence rules, mandatory disclosure. Every one of those safeguards is missing from AI containment testing.
财务审计在一个世纪前就解决了这个问题：对股东的法定责任、执照制度、个人责任、独立性规则以及强制披露。而人工智能遏制测试中缺失了所有这些保障措施。
And the uncomfortable part: I’m not exempt. An independent tester paid by a lab — including me — carries the same structural conflict. That’s why the argument isn’t “trust me instead” — it’s that the model has to be rebuilt on the auditing standard before any external testing means anything, and until then, builders own their own containment.
令人不安的是：我也不例外。由实验室付费的独立测试者——包括我在内——都带有同样的结构性冲突。这就是为什么我的论点不是“请信任我”，而是：在任何外部测试具有意义之前，必须按照审计标准重建模型；在此之前，构建者需自行负责其遏制工作。
The auditor who depends on the subject is not an auditor. That sentence is the whole paper: Who Tests the Testers?
依赖于被审计对象的审计师不是真正的审计师。这句话就是整篇论文的核心：谁来测试测试者？