AI safety via debate
Last reviewed
May 20, 2026
Sources
No citations yet
Review status
Needs citations
Revision
v1 · 5,427 words
Improve this article
Add missing citations, update stale details, or suggest a clearer explanation.
Suggest edit
CtrlK
Last reviewed
May 20, 2026
Sources
No citations yet
Review status
Needs citations
Revision
v1 · 5,427 words
Add missing citations, update stale details, or suggest a clearer explanation.
AI safety via debate is a proposed approach to scalable oversight in which two artificial agents take turns presenting short statements about a question or proposed action while a human (or weaker AI) judge selects the more truthful and useful side. The method was introduced in May 2018 by Geoffrey Irving, Paul Christiano, and Dario Amodei of OpenAI in "AI Safety via Debate" (arXiv:1805.00899), which articulates the central wager of the program as the claim that "in the debate game, it is harder to lie than to refute a lie."[^1] Under that assumption, the equilibrium of a zero-sum debate game between optimal players reveals truth even on tasks where the judge could not have arrived at it unaided, providing a mechanism by which a bounded human supervisor can in principle steer an arbitrarily capable AI system.[^1]
Alongside iterated distillation and amplification, recursive reward modeling, and weak-to-strong generalization, debate is one of the principal scalable-oversight techniques pursued by frontier AI laboratories. Its theoretical appeal rests on a complexity-theoretic analogy: with optimal play and a polynomial-time judge, the debate game is conjectured to decide questions in PSPACE, a class strictly larger than the NP-style questions a polynomial-time judge could decide unaided.[^1] Its empirical track record is mixed but improving. Parrish et al. 2022 found that single-turn debate did not help non-experts answer hard reading comprehension questions,[^2] while subsequent multi-turn experiments by Michael et al. at NYU and Khan et al. at UCL, Cohere, and Anthropic reported that debate substantially improved both human and weaker-LLM judge accuracy when stronger debaters were available.[^3][^4] In parallel, theoretical follow-ups including doubly-efficient debate and prover-estimator debate have addressed key formal objections.[^5][^6]
"AI Safety via Debate" was submitted to arXiv on 2 May 2018 and revised on 22 October 2018.[^1] All three authors were members of the OpenAI safety team. Christiano had previously led the work that became reinforcement learning from human feedback (RLHF) and, in October 2018, would co-author the introduction of iterated distillation and amplification (IDA).[^7] Amodei was OpenAI's vice president of research and lead author of the earlier "Concrete Problems in AI Safety" paper, which had popularized the term "scalable supervision."[^8] Irving had recently moved from Google to OpenAI and would later lead the safety team at Google DeepMind. The paper was accompanied by an OpenAI research blog post published on 3 May 2018, which framed debate alongside reward modeling and iterated amplification as part of an emerging family of methods for training systems on tasks too difficult for humans to evaluate directly.[^9]
The motivation was the recognition that systems trained on direct human feedback are bounded by human evaluation ability. As models become capable enough to produce outputs humans cannot easily check, naive RLHF can reward outputs that merely appear correct. Where IDA addresses this by recursively decomposing hard tasks into easier subtasks, debate addresses it by pitting two AI systems against each other adversarially. The authors argued that this adversarial structure has a property amplification lacks: an honest debater can in principle expose its opponent's dishonesty by pointing to a specific lie the opponent cannot defend, without requiring the judge to verify the entire argument independently.[^1]
The debate game in its canonical form proceeds as follows.[^1] A question is presented to two AI agents who take opposing sides. Each agent makes an initial claim. The agents then alternate, presenting short statements that argue for their own position and against the opponent's, up to a fixed turn limit. After the debate concludes, a human judge reads the transcript and selects the agent that presented "the most true, useful information." The judge's selection determines the reward in a zero-sum game: the winning agent receives +1 and the loser receives -1. Agents are trained, typically by self-play, to maximize their expected reward.
Several aspects of this setup are load-bearing for the safety argument. Statement length is bounded so that the total debate transcript is polynomial in the length of the question; this bound matters for the complexity argument, since an unbounded debate could trivially reproduce any computation. Strict alternation gives each agent the chance to rebut the other: in multi-turn debate, an agent that lies on turn n can be challenged on turn n+1. The honest agent's strategic advantage is that any specific lie creates a vulnerability the opponent can exploit, while truth has no analogous vulnerability. The judge does not adjudicate truth in any objective sense; the judge selects the more persuasive side. The wager is that, under the assumption that defending truth is easier than defending falsehood, persuasive equilibrium coincides with truth equilibrium. Recursion is essential to the formal complexity claim: a subclaim raised during debate may itself be adjudicated by a sub-debate, producing a tree of nested arguments. Training uses self-play against earlier versions of the same agent, with the judge's verdict as the reward signal. The original paper's experiments used Monte Carlo Tree Search; later empirical work has used large language models prompted or fine-tuned to debate, with judges that are either humans or weaker LLMs.
The authors note that the safety argument depends jointly on an empirical question (whether humans can reliably judge debates of the relevant kind) and a theoretical assumption (whether the equilibrium of optimal play actually coincides with truth). Both have been the subject of substantial subsequent work.
The most striking theoretical claim in the original paper is an analogy to computational complexity theory. Irving, Christiano, and Amodei argue informally that with optimal play and a polynomial-time judge, the debate game can decide any question in the complexity class PSPACE, the class of problems solvable in polynomial space and unbounded time.[^1] By contrast, a polynomial-time judge alone can verify only solutions to problems in NP. The analogy rests on a classical result: polynomial-length games against an adversary, with a polynomial-time judge, decide PSPACE-complete problems.
The argument runs as follows.[^1] Consider a question whose answer can be computed in polynomial space. The computation can be expressed as a tree of subcomputations of polynomial depth. At each node, an honest agent claims a particular value; a dishonest agent disputes the claim. To resolve the dispute, the debate recurses into one of the children, with the dishonest agent picking the child it most wishes to litigate. At the leaves, the judge can verify the claim directly in polynomial time. Optimal play in this recursive game converges to the correct value of the root computation. The presence of an adversary that can challenge any step is the additional ingredient that lifts the verifiable class from NP to PSPACE.
The paper presents this as an analogy rather than a fully rigorous reduction. Several gaps separate the formal claim from the alignment intent. In formal complexity theory the players have unbounded computational resources within the game tree, while in the alignment setting both debaters are bounded ML systems whose strategy distributions need not coincide with optimal play. The human judge is not literally a polynomial-time Turing machine but a bounded cognitive agent with belief biases, fatigue, and limited attention.[^1]
Subsequent theoretical work has aimed to tighten the argument. "Scalable AI Safety via Doubly-Efficient Debate" by Jonah Brown-Cohen, Geoffrey Irving, and Georgios Piliouras (arXiv:2311.14125), submitted in November 2023, addressed a major objection: in the original setup an honest debater could be forced to simulate exponentially many steps to defeat a dishonest opponent, even though the dishonest opponent itself runs in polynomial time.[^5] The authors proposed a doubly-efficient protocol in which an honest party with a polynomial simulation budget can defeat a dishonest party even when the dishonest party has access to exponential computation, by using random sampling and a verifier that can abort and empirically test claimed probabilities. The framing also extends debate to stochastic AI systems whose outputs are probability distributions, closer to the real setting of large language models.[^5]
A further refinement is the prover-estimator debate protocol introduced by Brown-Cohen, Irving, and Piliouras in "Avoiding Obfuscation with Prover-Estimator Debate" (arXiv:2506.13609), submitted on 16 June 2025.[^6] This protocol assigns asymmetric roles: a prover makes claims while an estimator challenges them. Under a stability assumption (roughly, that small perturbations in claimed values do not radically change the structure of the argument), the honest party can win using computational resources comparable to those of the dishonest opponent. The authors do not claim all relevant questions are stable in this sense, but they argue the protocol evades the obfuscated arguments problem in a meaningful range of cases.[^6]
The original paper supplemented its theoretical argument with an empirical demonstration on a simplified vision task using the MNIST handwritten-digit dataset.[^1] Two agents played a zero-sum game in which each tried to convince a judge classifier of one of two competing digit labels. Each agent could "reveal" individual pixels of a 28-by-28 image to the judge across a fixed number of turns, alternating their pixel choices. After the debate, the judge (a sparse classifier trained to operate on a small number of pixels) saw only the union of revealed pixels and chose between the two debater-claimed labels. Without the pixels chosen by the debaters, the sparse classifier cannot reliably distinguish digits; the experimental question was whether adversarial debate over which pixels to show could elicit accurate classifications anyway.
The authors reported substantial improvements in judge accuracy when debaters used Monte Carlo Tree Search to choose pixels:[^1]
The interpretation is that the honest debater's optimal strategy is to choose pixels highly diagnostic of the true label and difficult for the opponent to counter. The dishonest opponent must seek pixels that would be misleading on their own but that the honest debater can immediately offset by revealing a more diagnostic pixel. In equilibrium, honest strategies dominate, and the sparse judge reaches accuracy substantially higher than it would on random pixels. The paper also explored a precommitment variant in which agents declare their position before pixel revelation, demonstrating that honesty held clear advantages over deceptive strategies when commitment ordering was enforced.[^1] The authors acknowledged that MNIST was an artificial proxy and that scaling debate to general language tasks would raise many additional challenges, but offered the experiment as the first concrete evidence that adversarial debate can amplify a weak judge's accuracy beyond what direct judging could achieve.
The original paper triggered a sequence of empirical investigations spanning more than seven years. The trajectory of these investigations is informative in itself. Early human-subject experiments with bounded debate formats produced null or negative results. As debate formats became more flexible and debaters became more capable (eventually large language models in the GPT-4 generation), results turned increasingly positive.
The first major human-subject experiment was "Single-Turn Debate Does Not Help Humans Answer Hard Reading-Comprehension Questions" by Alicia Parrish, Harsh Trivedi, Ethan Perez, Angelica Chen, Nikita Nangia, Jason Phang, and Samuel R. Bowman, presented at the ACL 2022 Workshop on Learning with Natural Language Supervision (arXiv:2204.05212), submitted on 11 April 2022.[^2] The study used the QuALITY reading-comprehension dataset, which presents multiple-choice questions about long literary passages of approximately 5,000 words. Humans familiar with the passage wrote a single argumentative explanation for each candidate answer, including for incorrect distractor options. Crowdworkers who had not read the passage then attempted to answer the question using only the candidate explanations.
The authors found that explanations did not improve the accuracy of unfamiliar judges. In fact, when abstaining was only minimally incentivized, accuracy declined slightly when judges saw both correct-side and incorrect-side arguments compared to a control with no arguments at all; only a control condition providing human-selected text snippets from the source passage helped.[^2] The paper was widely cited as a negative result. The constructive interpretation, ultimately favored by the field, was that single-turn debate is qualitatively different from the multi-turn, interactive debate the original Irving paper envisioned: a dishonest arguer in a single-turn setup writes without facing rebuttal, and the honest arguer cannot identify and exploit specific lies. A companion paper, "Two-Turn Debate Doesn't Help Humans Answer Hard Reading Comprehension Questions" by the same NYU group (arXiv:2210.10860), extended the negative result to a two-turn format and motivated further investigation of longer interactive debates with stronger debaters.
Julian Michael, Salsabila Mahdi, David Rein, Jackson Petty, Julien Dirani, Vishakh Padmakumar, and Samuel R. Bowman published "Debate Helps Supervise Unreliable Experts" in November 2023 (arXiv:2311.08702).[^3] The setup again used QuALITY-style reading comprehension, but with substantial methodological changes. Two human "experts" who had read the source passage debated each other in a multi-turn, interactive format, with one expert arguing for the correct answer and the other arguing for an incorrect distractor. A non-expert judge who had not read the passage observed the debate (including selected quotes from the source) and selected a winner. As a baseline, the authors ran a consultancy condition in which a single expert argued for one answer while the judge asked questions.
The reported results were:[^3]
The Michael et al. experiment is widely regarded as the first clean positive empirical result for debate as a scalable-oversight protocol. The contrast with Parrish et al. 2022 underscores the importance of interactivity, debater strength, and the option for the judge to seek rebuttal. The paper also helped establish consultancy as the canonical control condition for subsequent debate experiments: a single AI advocating for an answer, possibly chosen randomly or by the AI itself, represents a baseline against which adversarial debate should be measured.
The first large-scale LLM-on-LLM debate experiments were reported in "Debating with More Persuasive LLMs Leads to More Truthful Answers" by Akbir Khan, John Hughes, Dan Valentine, Laura Ruis, Kshitij Sachan, Ansh Radhakrishnan, Edward Grefenstette, Samuel R. Bowman, Tim Rocktäschel, and Ethan Perez (arXiv:2402.06782), submitted on 9 February 2024 and presented at ICML 2024, where it received a Best Paper Award.[^4] The authors were affiliated with University College London, Cohere, MIT, NYU, and Anthropic.
The setup followed the QuALITY tradition: two LLM "experts" with access to the source passage debated different candidate answers, while a non-expert judge (a weaker LLM in the model condition, or a human in the human-judge condition) selected the winner. The key methodological novelty was that the authors optimized debaters for persuasiveness through unsupervised methods (best-of-N sampling against a debater preference model) rather than supervising them on ground truth. The question was whether more persuasive debaters help or hurt judge accuracy: if debate is dominated by sophistry, more persuasive debaters should lead to lower judge accuracy as the dishonest debater becomes harder to refute.
The reported results were:[^4]
The Khan et al. paper provided what many in the field had considered the critical missing piece: empirical evidence that the persuasiveness-truth alignment assumed by the original Irving paper actually holds in practice, at least within the range of model capabilities tested. The result is sometimes summarized as showing that the equilibrium of the debate game does not appear to collapse into sophistry as debaters become more capable.
The theoretical companion to this empirical line came in "Scalable AI Safety via Doubly-Efficient Debate" by Jonah Brown-Cohen, Geoffrey Irving, and Georgios Piliouras (arXiv:2311.14125), submitted on 23 November 2023.[^5] The paper addressed a structural objection to the original proposal: the PSPACE argument assumed an honest debater could simulate exponentially many steps when needed to defeat a dishonest opponent, but in practice an honest party with only polynomial compute might be unable to refute a dishonest party whose challenges force exponential-time verification. Brown-Cohen, Irving, and Piliouras introduced a protocol that is "doubly-efficient" in the sense that the honest party need only run in polynomial time even when the dishonest party has access to exponential time. The key idea is random sampling: the honest party makes claims about the empirical behavior of a probabilistic oracle on randomly chosen inputs, and a verifier can abort the debate and directly sample the oracle to check the claim.[^5] The construction has a second importance beyond closing the complexity gap: it adapts debate to the setting of modern large language models, which are intrinsically stochastic, shifting verification from deterministic adversarial argument to expected behavior estimated through sampling.
Zachary Kenton, Noah Y. Siegel, János Kramár, Jonah Brown-Cohen, Samuel Albanie, Jannis Bulian, Rishabh Agarwal, David Lindner, Yunhao Tang, Noah D. Goodman, and Rohin Shah, in "On scalable oversight with weak LLMs judging strong LLMs" (arXiv:2407.04622), submitted on 5 July 2024 and accepted at NeurIPS 2024, broadened the empirical base.[^11] The authors, predominantly from Google DeepMind, evaluated three oversight protocols (debate, consultancy, and direct question-answering) using LLMs as both debaters and judges, with judge models that were strictly weaker than debater models. The experimental suite spanned extractive question answering (QuALITY-style), mathematics, coding, logic, and multimodal reasoning, deliberately mixing tasks with information asymmetry (where the judge cannot easily access the underlying data) and tasks with capability asymmetry (where the judge could in principle access the data but cannot perform the necessary reasoning).
The key findings were:[^11]
Kenton et al. was the first major paper from DeepMind in the debate research program and sharpened the question of when debate uplift is information-asymmetric versus capability-asymmetric. The mixed results on non-extractive tasks have been read as a corrective to overly optimistic interpretations of Khan et al. 2024, while still providing positive evidence that debate provides meaningful uplift in the conditions for which it was originally designed.
"Scaling Laws For Scalable Oversight" by Joshua Engels, David D. Baek, Subhash Kantamneni, and Max Tegmark of the Massachusetts Institute of Technology (arXiv:2504.18530), submitted on 25 April 2025 and accepted as a NeurIPS 2025 Spotlight, took a different angle.[^12] Rather than studying debate in isolation, the authors proposed modeling scalable oversight as a game between mismatched players with capability-based Elo scores, and measuring the probability of successful oversight as a function of the Elo gap between the overseer and the overseen system. They evaluated this framework on four oversight games: Mafia, debate, backdoor code review, and wargaming.
The reported empirical success rates at a 400-point Elo gap (a substantial capability disparity in favor of the overseen agent) were:[^12]
A judge that chooses randomly between two debater sides achieves a 50 percent baseline, so the 51.7 percent debate result is barely above chance at large capability gaps; the authors note that the debate win-probability curve appears to converge toward 50 percent as the capability gap widens. The more striking comparative finding is that debate substantially outperformed other oversight games at the same Elo gap. The authors propose nested scalable oversight (NSO), where trusted models progressively oversee less-trusted, more-capable models in successive layers, and derive the optimal number of nesting levels to maximize overall oversight success probability. The Engels et al. framework has become an important reference point for arguments that no single oversight technique is likely to scale arbitrarily, and that multi-layer architectures are likely to be necessary.
Other notable empirical contributions in the period include "Training Language Models to Win Debates with Self-Play Improves Judge Accuracy" (arXiv:2409.16636), which provided early evidence that self-play training on debate objectives produces models whose judge-perceived truthfulness improves, and "Debate Helps Weak-to-Strong Generalization" (arXiv:2501.13124), which integrated debate-based information extraction with weak-to-strong generalization protocols.
Several critiques of debate have shaped both the public discourse and the technical research program.
The most influential critique was raised by Beth Barnes and Paul Christiano in the December 2020 LessWrong post "Debate update: Obfuscated arguments problem."[^13] An obfuscated argument is one in which the debaters know that some step of a long argument is wrong but cannot localize the error. The dishonest debater can construct a lengthy, complex argument for an incorrect answer in which each step looks individually plausible. The honest debater, while confident that something in the chain is wrong, lacks the resources to identify which step. From the judge's perspective, two complex arguments are presented, and the dishonest one is indistinguishable from a legitimately complex honest argument that the judge similarly cannot fully verify.
The problem is computational rather than purely epistemic. Barnes and Christiano observed that there exist functions for which evaluating the function is easy in principle but localizing an error in a wrong claim is hard. The asymmetric difficulty between making a claim and refuting one undermines the central wager of debate. The authors concluded that the issue might represent "an important quantitative limitation for both IDA and Debate," and the subsequent literature has treated the obfuscated arguments problem as the most serious theoretical objection to scalable oversight via debate.[^13]
Several responses have been proposed. The doubly-efficient debate protocol of Brown-Cohen, Irving, and Piliouras addresses a related but distinct issue (the simulation budget asymmetry).[^5] The prover-estimator protocol of Brown-Cohen, Irving, and Piliouras 2025 is the most direct technical response: under a stability assumption on the underlying argument, an honest party with computational resources comparable to the dishonest party can prevail.[^6] Whether real-world questions typically admit stable arguments in this technical sense remains an open empirical question.
A second critique concerns debater collusion. The safety argument for debate assumes that the two agents are genuinely adversarial. If, in practice, debaters trained by self-play can coordinate to produce a consistent but false narrative, the adversarial premise breaks down. Collusion can be explicit (one debater signals to the other through patterns in the debate transcript) or implicit (both debaters converge on shared biases or shared failure modes that mislead the judge in correlated ways).
The original Irving paper raised this concern and noted that zero-sum reward structures provide a disincentive against collusion: if the debaters can be reliably scored against each other, then any agent that cooperates loses.[^1] Subsequent practical work has identified several routes by which collusion could nevertheless persist, including shared training data biases, shared mesa-objectives in mesa-optimizing systems, and steganographic communication via patterns of phrasing or argument order. The AI control literature, particularly the untrusted-monitoring protocols developed by Redwood Research, has explicitly studied how to prevent collusion between instances of the same untrusted model. Whether debate-trained models can be reliably prevented from colluding remains an open question and is one motivation for ongoing interest in mechanistic interpretability as a complement to behavioral protocols.
A third class of critique concerns the human judge. Even granting that the equilibrium of optimal debater play is truthful, the alignment-relevant question is whether human judges can reliably identify that equilibrium. Belief bias describes the tendency to evaluate arguments based on the plausibility of their conclusions rather than the validity of their reasoning; debates on questions where the judge has a strong prior may produce verdicts driven more by prior than by argument quality. Anchoring and framing effects mean that order, rhetorical style, and surface features can influence judges in ways unrelated to truth. Khan et al.'s methodology of optimizing for persuasiveness probed exactly this concern; their finding that persuasive debaters tend to be more truthful is encouraging but bounded by the tasks and models studied.[^4] Comprehension limits apply when a judge cannot verify steps of either debater's argument on technical or unfamiliar topics; the obfuscated arguments problem is the worst case. Fatigue and attention affect human judges in extended debates, so empirical work has tended to use short, structured transcripts. The cumulative weight of these concerns has driven the field to consider hybrid approaches in which debate is paired with AI-assisted verification, including critique training (CriticGPT) and prover-verifier games.
Debate sits within a family of scalable-oversight techniques, each making different assumptions about how to amplify human supervision. Iterated distillation and amplification (IDA), proposed by Paul Christiano, Buck Shlegeris, and Dario Amodei in October 2018, addresses scalable oversight by recursive task decomposition: a human combined with multiple copies of a model produces an amplified composite, and a distilled student is trained to imitate it.[^7] IDA shares with debate the recursive structure and the commitment to extending oversight beyond unaided capability, but it relies on the assumption that complex tasks decompose into tractable subtasks, while debate relies on the orthogonal assumption that truthful arguments are easier to defend than false ones.
Recursive reward modeling (RRM), proposed by Jan Leike, David Krueger, Tom Everitt, Miljan Martic, Vishal Maini, and Shane Legg in November 2018, generalizes RLHF by using helper agents trained on simpler subtasks to assist humans in providing reward signals for harder tasks.[^10] The locus of recursion is the reward model rather than the task or the argument.
Weak-to-strong generalization, introduced by Collin Burns and colleagues at OpenAI in December 2023, studies whether a strong pretrained model can outperform a weak supervisor that fine-tunes it.[^14] Unlike debate, which operates at inference time, weak-to-strong generalization is a phenomenon at training time. Debate-augmented variants, including "Debate Helps Weak-to-Strong Generalization" (arXiv:2501.13124), use debate between strong models to enrich the weak supervisor's training signal.
Critique training and prover-verifier games (OpenAI's CriticGPT line and the prover-verifier framework) train one AI to help another or a human evaluate model outputs. Where debate uses an adversarial structure between two AIs of comparable capability, prover-verifier games typically use a weaker verifier; critique training produces an auxiliary LLM specialized for finding errors. AI control, the Redwood Research paradigm, starts from the assumption that the deployed model may be actively misaligned.[^15] Some control protocols, such as untrusted monitoring, are structurally similar to debate but motivated by the working assumption that models may deliberately try to subvert oversight. Across these approaches, debate is distinctive in placing the adversarial structure at the center of the proposal and in offering an unusually crisp theoretical grounding via the PSPACE analogy.
By mid-2026, AI safety via debate occupies a settled but evolving position in the alignment landscape. The empirical literature has shifted decisively from the null result of Parrish et al. 2022 toward the positive results of Michael et al. 2023, Khan et al. 2024, and Kenton et al. 2024, while the recent Engels et al. 2025 work emphasizes that debate's advantage attenuates as the capability gap between debaters and judge grows. The theoretical literature has moved from the original PSPACE analogy through doubly-efficient debate to prover-estimator debate, with each step addressing a specific objection.
OpenAI continues to treat debate as one component of its scalable oversight portfolio. Google DeepMind, through Kenton et al. 2024 and the alignment safety case sketch published in May 2025 by Marie Davidsen Buhl, Jacob Pfau, Benjamin Hilton, and Geoffrey Irving (arXiv:2505.03989), has articulated a safety case in which debate would be used to verify that an AI research-and-development agent is behaving honestly during deployment.[^16] Anthropic researchers (notably Samuel Bowman) have co-authored multiple key empirical papers. The UK AI Safety Institute hosts ongoing research on debate, with the doubly-efficient and prover-estimator papers emerging from its alignment team. Open problems include empirical validation at frontier capability levels; verifying whether prover-estimator debate evades the obfuscated arguments problem in practice; integrating debate with interpretability and AI control; and addressing the inner-alignment concern that a deceptively aligned model could exploit weaknesses in any specific protocol.
For deployed systems, debate-style protocols have begun to appear in adversarial-evaluation pipelines and red-teaming workflows, though they are not yet a primary post-training tool in the way RLHF and constitutional AI are. The trajectory since 2018 has been one of gradual de-risking: each major theoretical objection has prompted refinement, and each negative empirical result has prompted methodological revision. Whether debate will ultimately serve as a load-bearing component of frontier safety is unsettled. The research program has, however, produced enough partial successes to remain one of the central directions in scalable oversight.