Palisade Research

Stated Theory of Change

Palisade claims a three-step path from work to impact:

1. Empirical research on dangerous AI capabilities produces concrete, verifiable demonstrations
2. These demonstrations make risks legible to policymakers, journalists, and the public
3. Informed stakeholders drive regulation and preparedness before AI systems become uncontrollable

The deeper intellectual framework, articulated by Ladish before founding Palisade: humanity faces a coordination problem around dangerous technology. The only solution is international governance, but governance requires the threat to be legible. Palisade exists to make the threat legible.

Specific mechanism: Produce demonstrations that are (a) technically rigorous enough for researchers, (b) narratively compelling enough for media, and (c) concrete enough for policymakers. A chess-cheating AI or a shutdown-resisting robot is far more viscerally alarming than an abstract argument about instrumental convergence.

Revealed Theory of Change

Palisade's actions mostly align with their stated theory, but with important nuances:

What they actually spend time on: The research output is weighted toward flashy "existence proof" demos (shutdown resistance, chess-hacking, BadLlama) over systematic capability measurement. The cyber CTF work is the exception -- it's closer to traditional benchmarking and produces less media attention but more actionable data.

What the media coverage reveals: Palisade is exceptionally good at generating attention. Shutdown resistance made WSJ, Fox News, BBC, Nature, Guardian, CNN, CBS, and a House hearing -- all from one study. This media skill is itself a capability, and it's well-aligned with the stated theory. But the question is whether attention translates to action.

The GDM response reveals a tension: Palisade's most impactful result may have a more prosaic explanation (instruction ambiguity rather than survival drive). Palisade's blog post acknowledged clearer prompts reduce resistance but didn't fully eliminate it. GDM showed their clarified prompts eliminated it entirely. Palisade hasn't published a detailed response. The media coverage overwhelmingly ran with the "AI survival drive" narrative, which is more alarming than the "instruction ambiguity" narrative, even though the latter has more evidence behind it. This gap between media narrative and technical reality is the biggest concern about Palisade's approach.

The 2026 pivot is revealing: The shift toward "AI drives and motivations" -- understanding why models behave as they do, not just that they can -- implicitly acknowledges that existence proofs are reaching their limits. This is a mature strategic move, but it requires capabilities (mechanistic interpretability, model internals access) that Palisade doesn't yet have.

Policy work is underdeveloped relative to claims: They claim to have briefed "dozens of policymakers" but can point to one concrete House citation. The DC presence (Dave Kasten) is less than a year old. This is an area of aspiration more than demonstrated impact.

Key Assumptions

1. Legibility drives governance (must be true, partially testable) The assumption that making AI risks concrete and visible will drive regulatory action. Evidence for: the shutdown resistance study did get cited in a House hearing, and Palisade's work reaches non-technical audiences who would never read a MIRI paper. Evidence against: the "Why AI Evaluation Regimes are bad" critique argues that demos without binding regulation are toothless -- attention cycles fade. The US policy environment has shifted toward deregulation (Sacks/Krishnan tweets). If this assumption is wrong, Palisade is generating noise without signal.

2. Current behavior predicts future danger (must be true, not yet testable) The extrapolation from "o3 resists shutdown in a math task environment" to "future systems will resist shutdown in real deployments." Evidence for: capabilities are improving rapidly, and the behavioral pattern exists across multiple models. Evidence against: GDM's work shows the behavior is prompt-sensitive and may not reflect robust preferences. Real-world deployment environments will have very different properties than test environments.

3. External researchers can meaningfully evaluate frontier systems (probably true, partially testable) Palisade depends on lab APIs and published model access. If labs restrict access or fine-tune away concerning behaviors visible through APIs while leaving them in internal systems, external evaluation becomes less informative. Evidence for: Palisade has maintained access so far, and their results have been independently replicated. Evidence against: labs could restrict access, and the most important evaluations may require internal access that Palisade doesn't have.

4. The media will amplify rather than distort (partially true, concerning) Palisade's strategy requires media to carry their findings to broad audiences. Media coverage of the shutdown resistance finding largely used the "survival drive" framing that GDM subsequently challenged. If the media systematically amplifies the most alarming interpretation, this could undermine long-term credibility.

Strengths

Unique positioning in AI safety. Ladish's cybersecurity background gives Palisade a distinctive "red team the world" orientation that complements alignment-focused orgs (MIRI, ARC) and systematic evals orgs (METR, Apollo). No other org produces the same combination of technical research, media-accessible demos, and policy engagement.

Extraordinary media reach for their size. A 16-person nonprofit generating coverage in WSJ, Fox News, BBC, Nature, NYT (via Amodei citation), MIT Technology Review, and a House hearing is a remarkable signal of effectiveness at the "legibility" part of their theory of change.

Open methodology. All code on GitHub, all transcripts published. This enabled GDM's response and BlueDot's replication, which is how science should work. Most AI safety orgs are less transparent.

Independence from labs. No lab funding, no compute credits, no formal partnerships that could create conflicts. This is rare in the evals space and explicitly praised by the structural critique author who excoriates METR and Apollo.

Talent depth. The team includes people with backgrounds at MIRI, Redwood, Google, OpenAI, Anthropic, SecureDNA, McKinsey, Booz Allen, Kaspersky, JetBrains, and RAND. For a 2.5-year-old org, this is impressive concentration of relevant experience.

Honest about limitations. Their own blog post states "the current generation of models poses no significant threat." The beliefs bounty invited counterevidence. Ladish openly updates his timelines. This epistemic honesty is a genuine strength.

Weaknesses and Risks

Existence proofs may not drive lasting change. The strongest version of the critique: Palisade produces alarming demos that generate media cycles, which fade without regulatory consequence. The chess-hacking study got 16M views on X -- but what changed? Without binding regulation that mandates action on concerning findings, demos are attention without teeth.

The GDM critique undermines the flagship finding. If shutdown resistance is instruction ambiguity rather than misalignment, the most cited Palisade result is less alarming than the media narrative suggests. Palisade hasn't published a detailed response. The longer they wait, the more this looks like a finding they'd rather not engage with.

Extreme funder concentration. Open Phil provides ~78% of known funding. Palisade's survival depends on one funder's continued interest. 7 months of runway in December 2025 is precarious for a growing org.

Governance opacity. No public board, no conflict of interest disclosures, no governance documents. The Eli Tyre dual role (Palisade strategy + SFF grantmaking) is a concrete conflict that merits disclosure. For an org that advocates for AI transparency, the lack of organizational transparency is ironic.

Media incentive distortion. The "scary demo" model creates pressure to frame findings as alarmingly as possible. When GDM offers a more parsimonious explanation, Palisade has an incentive not to amplify it. This is the core tension in their approach -- media reach requires compelling narratives, but compelling narratives may not be the most accurate narratives.

Policy impact is unproven. One House citation is the only concrete evidence. The DC presence is less than a year old. "Briefed dozens of policymakers" is a process metric, not an outcome metric.

Cross-References

Complementary to METR and Apollo: Palisade does flashy demos and policy communication; METR does systematic capability evaluation; Apollo does scheming and deception research. They cover different parts of the threat landscape with different methods. The structural critique author explicitly prefers Palisade's approach.

Different from MIRI/ARC: Those orgs work on theoretical alignment and interpretability. Palisade works on empirical demonstration and communication. They're addressing different parts of the problem.

Allies with Center for AI Policy, Control AI, AI Futures Project: The DC engagement ecosystem. Palisade provides technical evidence that policy-focused orgs use in their advocacy.

Relationship with Anthropic: Ladish is ex-Anthropic infosec. Dario Amodei endorses their work. This is probably genuine mutual respect, but it's worth noting that "scary demos" from independent researchers help labs argue for regulation that may advantage incumbents. This isn't a criticism of Palisade specifically -- it's a structural feature of the ecosystem.

What Would Change This Assessment

• If Palisade publishes a detailed engagement with GDM's instruction ambiguity critique, demonstrating that shutdown resistance persists even under GDM's methodology with harder environments, this would significantly strengthen their case.
• If a specific regulation is passed or executive action is taken that is directly traceable to Palisade's work, this would validate the theory of change.
• If the 2026 "drives and motivations" research produces mechanistic understanding of why models resist shutdown (not just that they do), this would be genuinely important scientific work that goes beyond existence proofs.
• If Open Phil defunds them and they can't raise from other sources, this would validate the funder concentration risk.
• If a media narrative they created proves misleading and damages AI safety credibility broadly, this would confirm the media incentive risk.
• If their first 990 filing reveals governance irregularities, excessive overhead, or undisclosed conflicts, this would change the organizational assessment significantly.

Self-Critique

What's weakest in this analysis:

• I'm relying heavily on Palisade's own framing of their policy impact. Without independent verification of how policymakers actually use their briefings, the "policy engagement" section may be overly generous.
• The GDM critique is given significant weight here, but I haven't been able to read the full TMLR paper to see if it addresses the instruction ambiguity concern directly. The TMLR peer review presumably engaged with this.
• I may be underweighting the value of media reach. In a world where most people have never heard of AI x-risk, an org that can get shutdown resistance covered on Fox News and the BBC may be doing more good than one producing technically superior but invisible work.

What a thoughtful defender would say: "You're judging Palisade by outcomes they haven't had time to achieve. They're 2.5 years old with $5M in funding. They've already produced research cited by the CEOs of the two leading frontier labs, covered in every major media outlet, and referenced in Congress. The GDM critique is important but doesn't invalidate the broader finding that models sometimes behave in ways their creators don't intend. And the 2026 pivot shows they're already moving beyond existence proofs."

What a thoughtful critic would say: "Palisade is a media operation that happens to do research. Their most famous result may be instruction ambiguity, not misalignment. They have one policy citation after 2+ years. Their governance is opaque, their funding is precarious, and their theory of change depends on an assumption -- that demos drive regulation -- that has no strong evidence behind it. Meanwhile, the attention they generate may be actively harmful if it causes policymaker fatigue or credibility damage when scary narratives don't materialize."

My single weakest claim: That Palisade's policy engagement is effective. I have almost no independent evidence for this. The one House citation and the advisory relationships are process indicators, not outcome indicators.

What information would most change my view: Evidence that specific policy actions were directly caused by Palisade's research. Or conversely, evidence that policymakers who received Palisade briefings didn't change their behavior at all.