David Gringras

My official training spans medicine, law, and health policy; my research has wandered across AI evaluation, compute governance, tort liability for AI, and international governance.

My first work in the field was on the institutional questions of the AISI Network: whether mutual evaluation in the style of the FATF could transfer, and how a set of red lines could be enforced without formal treaty-making authority. Through that work, I came across the Network’s first joint testing exercise, in which three different institutes ran the same benchmark on the same model using the same prompting strategy—and got different results. Small differences in methodology, like output parsing and token limits, can shift outcomes. From a biomedical perspective, three different labs running the same assay on the same sample and getting different results is a major methodological crisis; here it was treated as a footnote. I could not find any literature that adequately settled the questions this raised.

So I tested it. In a pre-registered experiment, I demonstrated that format alone could shift measured safety by five to twenty points. Sandbagging and evaluation-awareness are well documented in frontier models; strategic underperformance sits comfortably inside a noise floor that wide. A model that fails an evaluation gives you grounds for alarm; a model that passes does not certify anything. Which is a problem, because nearly every safety-critical trigger in current governance frameworks routes through evaluation results. So I turned to design, mapping out the precise ways in which those frameworks depend on unreliable tests, and arranging them into a taxonomy that practitioners can actually use. I proposed that any mechanism whose failure could run to catastrophe should have at least one activation pathway that owes nothing to evaluation results. And because those activation pathways need to rely on levers outside the model itself, the compute substrate: collecting and cross-referencing data on AI infrastructure that was previously scattered across separate sources.

There is also a separate, medical thread. When a friend asked me about a medical concern (something one gets used to quickly as a physician!) and I wanted to ensure my advice was reasonable since I had not practiced medicine in several months, I presented the case to a frontier LLM. The diagnosis and advice aligned with my own, but was far more detailed and, frankly, overall much better than my own written response would have been. Feeling slightly inadequate (but pleased about no longer needing to be my friends’ personal doctor), I sent a screenshot and suggested the LLM as a reasonable first port-of-call in future. My friend was confused; they had asked the exact same model about the exact same problem with no fewer clinically relevant details and had only approached me because they did not get a helpful answer. My clinically-trained language alone had produced a meaningfully different response. I tested this crudely a couple of times myself, and decided another study was warranted.

I then demonstrated that on identical medical presentations, models withhold safety-critical clinical information from users they read as laypeople while providing it to users they read as clinicians. A harm created by the safety measure itself, and entirely invisible to evaluations built around dangerous outputs. Safety training is scored almost entirely based on commission, what a model says that it should not; omission, what it withholds that it should provide, is nearly free. This was accompanied by legal work on the nature of the tort exposure that omission in fact creates, and the incentive landscape that entrenches the behaviour.

Both chains of work end the same way medicine and law learned to end them. Pathways redesigned around unreliable tests, pharmacovigilance for harms caused by the intervention itself, and legal doctrine for harms of omission. The most reliable path I have found from research to impact is through things people can actually use: frameworks, taxonomies, datasets, legal arguments.