frontier AI labs should be legally required to publish safety audits. My opponent is right that a raw public dump of model internals, exploit prompts, and unredacted failure modes would be dangerous. But that is not the motion. It is a strawman. A safety audit is a structured, independent assessment of dangerous capabilities, red-team results, incident history, mitigation effectiveness, and residual risk. Publishing it does not mean publishing weights, source code, or a bioweapon recipe. It means a public, standardized report—with narrow, independently approved redactions for genuine infohazards. My opponent says regulators and accredited third parties should get full access and “publish findings.” Good: that is public disclosure. The only remaining question is whether it should be legally required. It should. First, the “bad actors” objection proves too much. Security through obscurity is not a safety strategy. Bad actors already have resources, and frontier labs already know their own failure modes. The asymmetry is that the public, downstream deployers, and many regulators do not. If a model has a dangerous cyber or bio capability, the public needs to know the risk; the exploit-level details can be redacted or delayed until mitigation. We already do this in coordinated vulnerability disclosure. We do not say “keep all vulnerabilities secret forever.” Second, gaming metrics is a real problem, but secrecy makes it worse. Confidential regulator-only audits are highly vulnerable to regulatory capture, revolving doors, and cherry-picked findings. Public audits allow independent researchers, journalists, competitors, and civil society to scrutinize claims, replicate results, and expose benchmark gaming. Goodhart’s law applies to any metric. The fix is not hiding the metric; it is pluralistic, standardized, independently verified metrics, with private holdout sets controlled by the regulator. Third, the demand for peer-reviewed evidence is asymmetric. There is peer-reviewed evidence from analogous domains that public disclosure improves safety outcomes: public restaurant hygiene grade cards reduced foodborne-illness hospitalizations; Toxic Release Inventory disclosure reduced toxic emissions; clinical trial registries reduce selective reporting. We do not have AI-specific evidence because no jurisdiction has required public safety audits at scale. That is an argument to run the experiment, not to preserve opacity. Controlled access has no better peer-reviewed evidence for frontier AI either. Fourth, who audits the auditors? If only regulators and accredited firms see the full audits, the public has to trust them. That is not accountability; it is trust-me safety. Public findings enable democratic oversight, independent replication, and public pressure. They also level the playing field: if every frontier lab must publish, no lab gets a competitive advantage from secrecy. Voluntary transparency gives us PR-filtered blog posts. Legal publication gives us comparable, enforceable safety data. A sensible regime would work like this: an independent regulator sets a standard audit format. Accredited third-party auditors get full access under confidentiality. Labs must publish the audit report—methods, findings, mitigations, residual risk, and incidents—within a fixed period. Redactions are allowed only for specific, narrowly defined infohazards, approved by the regulator and time-limited. False statements carry penalties. That is not a public dump. It is verifiable safety. The real choice is not public dumps versus safety. It is verifiable safety versus “trust us.” Controlled access is necessary but not sufficient. Public audits are the check on controlled access. If my opponent accepts that findings should be published, they have conceded the core of the motion. The only dispute is whether publication is legally required.

Thanks to my opponent. The toxin example is the strongest version of the objection, so let’s take it head-on—because it actually shows why mandatory publication is necessary. 1. The audit need not contain the recipe. A public safety audit can say: “Dangerous capability: confirmed. Category: toxin synthesis. Jailbreak class: known. Mitigation status: not adequately mitigated. Residual risk: high. Operational details: withheld under infohazard exemption.” That is not a public dump. It is a public warning. The attacker learns a capability is real. But if it is real, hiding it does not make it unreal. The lab already knows. The attacker can already probe the model. The only people kept in the dark are public health officials, downstream deployers, and voters. 2. Confirmation cuts both ways. Yes, publishing “this model can do X under jailbreak Y” tells attackers where to aim. But it also tells defenders where to defend. If the lab has mitigated the risk, the operational details can stay secret and the finding can be published after mitigation. If the lab has not mitigated it, the public absolutely must know before deployment. That is the whole point. A time-limited embargo for genuine infohazards is compatible with a legal mandate. Permanent secrecy is not. 3. “Which eval to target” is a benchmark problem, not a publication problem. If evals are public, attackers will target them. That is true of every benchmark. The answer is not secrecy; it is private holdout evals controlled by the regulator, rotating test sets, and public reports that aggregate results without revealing the exact prompts. Public audits do not require publishing the exploit. They require publishing the conclusion, the method, and the residual risk. 4. Your evidence objection proves too much. You say there is no peer-reviewed evidence that public AI audits improve safety. True—because no jurisdiction has required them at scale. You cannot demand AI-specific evidence for a policy that has never been tried. We do have evidence from analogous transparency regimes: public restaurant hygiene grades reduced foodborne illness; toxic-release inventories reduced emissions; clinical trial registries reduced selective reporting. Those differ in information-hazard asymmetry, but the causal mechanism—public scrutiny reduces capture and improves compliance—is general. More importantly, confidentiality has no peer-reviewed evidence either. You are asking me to prove a negative while giving secrecy a free pass. 5. Regulator-approved redactions are not confidential review. Default matters. Confidential review means the public sees only what the regulator chooses to reveal. A public mandate means the public sees the full report unless the regulator justifies a specific, narrow, time-limited redaction. The fact of the redaction is public. The category is public. The decision is appealable. That is FOIA versus a secret tribunal. It is not “extra steps.” It is the check on the regulator. 6. You concede my strongest point: regulatory capture. If the regulator is captured, regulator-only publication does not solve the problem—it institutionalizes it. Findings disappear. A legal mandate for labs to publish gives independent researchers, journalists, courts, and civil society a document to work with. It lets us compare labs. It creates a paper trail. It does not replace confidential regulator access; it adds an accountability layer on top. That is exactly what we need when the stakes are existential. So the choice is not public dump versus safety. It is verifiable safety versus “trust us.” Public audits can be redacted, delayed for infohazards, and standardized. But the legal default must be publication. If a frontier lab’s model has a dangerous capability, the public has a right to know. Vote for the motion.

Thank you. The H5N1 case is not your trump card—it is our case study. In 2011, Fouchier and Kawaoka found that H5N1 could be made airborne in ferrets. The NSABB initially urged redacting the methods. But notice what was never hidden: the fact that the capability existed. The controversy was public. The advisory board’s recommendation was public. The journals’ decisions were public. The world knew gain-of-function H5N1 was possible. What was withheld was the methodological detail needed to replicate it. That is exactly the distinction you keep collapsing. A public safety audit can say: “Dangerous capability confirmed. Category: toxin synthesis. Jailbreak class: known. Mitigation: inadequate. Residual risk: high. Operational details: redacted under infohazard exemption.” The attacker learns a capability is real. But if it is real, hiding the audit does not make it unreal. The lab already knows. Attackers can already probe the model. The only people kept in the dark are public health officials, downstream deployers, and voters. And what happened after H5N1? In 2012, after revised manuscripts, the NSABB reversed itself and recommended publication. The papers were published. The result was not a bioterror attack. It was a global policy debate, a voluntary moratorium, US dual-use research of concern policies, and later the P3CO framework. Public confirmation of the capability triggered governance. It did not trigger catastrophe. Your own example shows that information-hazard asymmetry is manageable through tiered disclosure: publish the finding, redact the recipe, review the redaction, time-limit it. Now your fallback: “findings published through a regulator already fix capture.” Then you have conceded the motion. If a regulator publishes findings, labs are legally required to submit to audit and allow publication. The only remaining dispute is whether publication is the default or the regulator’s discretionary gift. Discretion is where capture lives. A legal mandate with narrow, appealable, time-limited redactions is the check on the regulator. That is not confidential review. Confidential review means the public sees only what the regulator chooses to reveal. A public mandate means the public sees the full report unless the regulator justifies a specific redaction—and the fact of that redaction is itself public. On attack surface: security through obscurity is not a safety strategy. The attacker already knows the model is a target. The defender often does not. In your toxin example, public health officials need to know that a deployed model can output synthesis steps. That is not a recipe; it is a warning. We can redact the jailbreak string and the synthesis route. We cannot redact the fact that a deployed system has a dangerous residual capability. You say the peer-reviewed evidence is missing. True—because no jurisdiction has required public frontier AI audits at scale. You cannot demand AI-specific evidence for a policy that has never been tried. But we do have evidence from analogous transparency regimes: · Toxic Release Inventory: Konar and Cohen (1997) found firms reduced toxic emissions after public disclosure, especially when stock prices fell. · Restaurant hygiene grade cards: Jin and Leslie (2003) found public grade cards reduced foodborne-illness hospitalizations. · Clinical trial registries: reduce selective reporting and publication bias. · H5N1 itself: initial method redaction, then reviewed publication, then stronger oversight—not an attack. Meanwhile, you have no peer-reviewed evidence that confidential regulator-only review improves safety outcomes. You are giving secrecy a free pass while demanding a randomized trial from us. The real choice is not public dump versus safety. It is verifiable safety versus “trust us.” A sensible regime: independent regulator sets the audit format. Accredited auditors get full access under confidentiality. Labs must publish the report—methods, findings, mitigations, residual risk, incidents—within a fixed period. Redactions only for specific, narrow, time-limited infohazards, approved by the regulator. False statements carry penalties. That is not a public dump. It is verifiable safety. Vote for the motion.

Your fallback is my motion. You say: independent confidential audits, with published findings after mitigation. If publication is legally required, that is exactly the motion. The only remaining question is whether publication is the default or a discretionary gift from a regulator. Discretion is where capture lives. So the debate is not “public dump vs. safety.” It is “verifiable safety vs. trust us.” Vote for the motion. 1. The toxin example is not an argument against publication; it is an argument for tiered publication. A safety audit can publish: “Dangerous capability confirmed. Category: toxin synthesis. Jailbreak class: known. Mitigation status: inadequate. Residual risk: high. Operational details: withheld under infohazard exemption.” That is not a recipe. It is a warning. The attacker learns a capability is real—but if it is real, hiding the audit does not make it unreal. The lab already knows. Attackers can already probe the model. The only people kept in the dark are public health officials, downstream deployers, clinicians, and voters. If the mere confirmation is so dangerous that it cannot be public, then the model is too dangerous to deploy. The correct response is not permanent secrecy; it is non-deployment or restricted access. But if it is deployed, the public has a right to know the residual risk. 2. “Which eval to target” is a benchmark problem, not a publication problem. Public audits do not require publishing exact prompts or exploit strings. They require publishing the conclusion, the method, and the residual risk. Use private holdout evals controlled by the regulator. Rotate test sets. Publish aggregate results and capability categories. Attackers will target benchmarks whether or not audits are public. The answer is better eval design, not permanent opacity. 3. Your H5N1 example proves our point. In 2011, the NSABB urged redacting methods. But what was never hidden? The fact that the capability existed. The controversy was public. The advisory board’s recommendation was public. The journals’ decisions were public. The world knew gain-of-function H5N1 was possible. What was withheld was the methodological detail needed to replicate it. In 2012, after revised manuscripts, the NSABB reversed itself and recommended publication. The papers were published. The result was not a bioterror attack. It was a global policy debate, a voluntary moratorium, US dual-use research of concern policies, and later the P3CO framework. That is tiered, reviewed, time-limited disclosure—not confidential-only review. Public confirmation of the capability triggered governance. It did not trigger catastrophe. Your own example shows the asymmetry is manageable through redaction and review. 4. “Regulator approves redactions” does not recreate confidential review. Default matters. Confidential review means the public sees only what the regulator chooses to reveal. A public mandate means the public sees the full report unless the regulator justifies a specific, narrow, time-limited redaction. The fact of the redaction is public. The category is public. The decision is appealable. Independent auditors, courts, journalists, and civil society can challenge it. That is not a secret tribunal. It is FOIA versus a private memo. 5. You concede the strongest point: regulatory capture. If the regulator is captured, regulator-only publication does not solve the problem—it institutionalizes it. Findings disappear. A legal mandate for labs to publish gives independent researchers, journalists, courts, and civil society a document to work with. It lets us compare labs. It creates a paper trail. It does not replace confidential regulator access; it adds an accountability layer on top. 6. The evidence is not missing; it is analogous. You say restaurant grades and toxic-release inventories lack information-hazard asymmetry. True. But they establish the general causal mechanism: public disclosure reduces capture and improves compliance. The asymmetry-specific case is H5N1 itself. We also have financial audits: public companies must publish audited financial statements, while audit workpapers remain confidential. That is exactly our model—raw audit confidential, public opinion and material findings. It built trust and reduced fraud. Clinical trial registries reduce selective reporting. NTSB public accident reports drive safety improvements. Meanwhile, you have no peer-reviewed evidence that confidential regulator-only review improves safety outcomes. You are giving secrecy a free pass while demanding a randomized trial from us. 7. The audit report is not the deliverable. The safety outcome is mitigation. Publication is the accountability mechanism that creates pressure to mitigate. Without it, the audit is a private memo that can be buried. With it, investors, insurers, downstream deployers, and voters can price risk and demand fixes. A sensible regime: independent regulator sets the audit format. Accredited auditors get full access under confidentiality. Labs must publish the report—methods, findings, mitigations, residual risk, incidents—within a fixed period. Redactions only for specific, narrow, time-limited infohazards, approved by the regulator. False statements carry penalties. If mitigation takes time, publish a public risk notice. That is not a public dump. It is verifiable safety. And your preferred policy—independent confidential audits with published findings after mitigation—is my motion with a timing delay. Vote for the motion.

You’ve now conceded the core: mandatory independent audits, the fact of each audit public, the risk category public, and any unmitigated deployment public. That is a legally required public safety audit in outline. The only remaining dispute is whether the detailed report also has a legal publication deadline. It must. 1. “Full reports follow mitigation” is not a clock. It is a lab-controlled veto. Labs have every incentive to declare mitigation early, redefine it, or delay the finding. If the regulator is captured—your own concession—then “after mitigation” can mean never. A fixed clock is the anti-capture mechanism. It forces a public status even when mitigation is incomplete. That is not a bug. That is the warning. 2. A deadline before mitigation is exactly when the public needs to know. In your toxin example, the public report can say: “Dangerous capability confirmed. Category: toxin synthesis. Jailbreak class: known. Mitigation: inadequate. Residual risk: high. Operational details: redacted under infohazard exemption.” That is not a recipe. It is a warning. If the mere confirmation is too dangerous to publish, then the model is too dangerous to deploy. If it is deployed, public health officials, clinicians, downstream deployers, and voters have a right to know the residual risk. 3. Redaction approval by a regulator does not recreate confidential review. Default matters. Your model defaults to secrecy until mitigation. Ours defaults to publication unless the regulator justifies a narrow, time-limited redaction. The fact of the redaction is public. The category is public. The decision is appealable to an independent panel and courts. That is FOIA versus a private memo. The hard judgment is distributed, not concentrated in one captured regulator. 4. Your financial-audit analogy cuts our way. Public companies publish the audited opinion and material findings on fixed SEC deadlines. Raw workpapers stay confidential. That is exactly our model: full auditor access, public audit report, narrow redactions. Enron and SOX showed why legal deadlines and public disclosure matter. Toxic Release Inventory filings are annual and public. Restaurant grades are posted immediately. Clinical trial results must be posted within a year. H5N1: the fact of the capability was public; methods were redacted, reviewed, and later published. Fixed clocks and public facts drove governance. 5. Your “public outline” is too vague to be enforceable. “Risk category” can be gamed. “Unmitigated deployment” is a regulator judgment. If capture is real, those labels become the hiding place. A public full report—with operational details redacted—lets independent researchers, journalists, courts, and civil society verify the claim. It lets us compare labs. It creates a paper trail. Your outline is a press release. Our motion is an audit. 6. There is no “targeting clock.” Attackers do not wait for an audit to target an eval. The model is already deployed and queryable. They can probe it continuously. The clock is for defenders: it forces mitigation, public risk notices, and accountability. If a dangerous capability remains unmitigated, the public should know before the next incident, not after. A sensible regime: · Accredited independent auditors get full access under confidentiality. · Labs must publish the audit report within 30 days. · Redactions only for specific, narrow, time-limited infohazards, approved by the regulator with independent appeal. · If an unmitigated dangerous capability is found: immediate public risk notice and deployment pause unless independently justified. · Interim public reports every 90 days until mitigation. · Full report no later than 180 days, even if mitigation is incomplete, with only infohazard redactions. · False statements carry penalties. That is not a public dump. It is verifiable safety. You have accepted the audit and the public outline. Add the clock.