Anthropic has published an overview of the work it has done since summer 2023 to test and reduce elections-related risks in its Claude language model. The company posted the update on June 6, 2024, and frames the work as part of safeguarding election integrity during a global election year.
Process overview
Anthropic combines two complementary methods in an iterative testing and mitigation workflow:
- Policy Vulnerability Testing (PVT): deep, qualitative testing with external subject matter experts.
- Scalable Automated Evaluations: large-scale, automated test suites derived from PVT findings.
Findings from these methods guide mitigation strategies—policy changes, tooling improvements, and model fine-tuning—and the same tests are re-run to measure how effective those interventions are over time.
Policy Vulnerability Testing (PVT)
PVT involves collaboration with external experts (for example, Isabelle Frances-Wright, Director of Technology and Society at the Institute for Strategic Dialogue). Its goals in the elections context are to detect: 1) cases where the model provides harmful, outdated, or inaccurate information in response to well-intentioned queries, and 2) potential misuse that would violate Anthropic’s Usage Policy.
PVT follows three stages:
- Planning: selecting policy areas and misuse scenarios to test (e.g., election administration questions, political parity, disinformation targeting voters).
- Testing: experts craft and repeatedly run prompts on the model, starting with ordinary user questions and escalating to adversarial red-teaming attempts; outputs are documented and compared against policy expectations.
- Reviewing results: Anthropic and partners meet to discuss findings, identify policy or safety gaps, and prioritize mitigations.
PVT revealed, for instance, that earlier Claude versions sometimes returned incorrect or outdated answers to voter registration and voting requirement questions because the model lacks live internet access.
Scalable automated evaluations
Because PVT is resource-intensive and manual, Anthropic developed automated evaluations to scale coverage. These automated tests are informed by PVT question sets and use few-shot prompting to generate hundreds of related test prompts.
Key advantages of automated evaluations are:
- Scalability: they can run many prompts across model variants quickly.
- Comprehensiveness: large targeted sets assess broader scenario coverage.
- Consistency: the same questions can be applied reliably across models.
Automated evaluations are used to measure behaviors such as factual accuracy on election questions, parity across candidates and issues, refusal rates for harmful election prompts, and refusal rates for text that could support disinformation or targeting.
Because model-generated evaluation sets can include noise, Anthropic manually reviews samples (sometimes requiring subject matter experts). For example, in a >700-question EU election administration set, a random sample of 64 questions showed 89% were relevant extensions of the original PVT work.
Mitigations informed by testing
Results from PVT and automated evaluations informed a number of mitigations. Anthropic reports identifying roughly 10 remediations to reduce the risk that Claude would provide incorrect, outdated, or inappropriate information in response to elections-related queries. Examples include:
- Updating Claude’s system prompt to explicitly note the model’s knowledge cutoff date (August 2023).
- Augmenting fine-tuning data to reward behaviors such as referring users to authoritative sources when appropriate.
- Refining the Usage Policy to clarify prohibitions on generating misinformation, interfering with election processes, or advocating for specific political positions, parties, or candidates.
- Auditing platform use and offboarding users confirmed to violate the Usage Policy.
- Training and regularly retraining automated policy enforcement tooling (a fine-tuned Claude) to evaluate prompts and completions in real time.
- Detecting time-sensitive elections queries and offering in-product redirects (e.g., US users offered TurboVote from Democracy Works; EU users offered European Parliament instructions).
Measuring mitigation efficacy — case studies
Anthropic measured the effects of specific interventions with automated evaluations:
- System prompt intervention: referencing the knowledge cutoff date
- After adding explicit language about Claude’s knowledge cutoff (August 2023) to the system prompt, Anthropic compared a legacy model (Claude 2), a research Claude 3 (Opus) without the system prompt, and the public Claude 3 (Opus) with the system prompt.
- They report a 47.2% improvement in one of their priority mitigations tied to the model referencing its knowledge cutoff when appropriate.
- Fine-tuning to encourage references to authoritative sources
- Fine-tuning Claude to reward referrals to authoritative sources produced a measurable change: an automated evaluation of EU election information showed a 10.4% increase in how often the model suggested users consult reliable sources (comparing Claude 2 to Claude 3 Opus).
Anthropic emphasizes that no single intervention is fully effective by itself; the company uses a layered “Swiss cheese” safety model with overlapping controls.
Conclusion
Anthropic presents its combined PVT and automated-evaluation workflow as a repeatable framework that yields both depth and breadth of understanding about model behavior. The company notes it cannot anticipate every possible misuse during an election cycle, but argues that proactive testing, iterative mitigation, and measurable re-testing are integral to developing its technology responsibly. Anthropic intends to continue refining the process and applying it across regions and election-related topics.
