Superalignment

Wiki · Updated August 14, 2026 · Words from our research

The six gaps

Six gaps sit between what an organization means and what its AI verifiably does. All six have to close before anyone can honestly sign.

By the Superalignment Team · Last reviewed September 8, 2026

In plain terms

Between what an organization means and what its AI verifiably does sit six gaps: intent that was never fully stated, requirements never surfaced, claims without traces, fixes that break earlier work, checkers that share blind spots, and evidence that quietly expires. A readiness argument is only as strong as its weakest gap.

The six gaps are the distances between what an organization means and what its AI system verifiably does. They are listed in the order they bite: each one opens where the previous one closes, and a readiness argument that skips one is an argument with a hole in it. The names are fixed: specification, discovery, evidence, preservation, independence, horizon.

Specification

Intent is latent; a prompt cannot carry what it never contained.

Nobody's intent exists as a complete written object, not for a job, a process, or a policy. What exists is a compressed instruction and a large silent remainder that a human colleague fills in from context. A system given only the instruction is not disobeying when it misses the remainder; it never received it. The specification gap is why "we told it what to do" is the beginning of the work, not the end.

This is the alignment problem stated at the scale of one deployment, and machine learning has measured its formal shadow: underspecified pipelines produce models identical on every test that was specified and divergent on the behavior that was not (D'Amour et al., 2020).

Discovery

What was never elicited cannot be tested.

The requirements that sink deployments are the ones nobody wrote down because nobody knew they were requirements: the refund threshold that needs a second approval, the customer who must never get the standard letter. Testing checks the requirements you have. Discovery is the work of surfacing the ones you do not, and a process with no discovery step converts every unknown requirement into a future incident. This gap is where false convergence is usually born, in its structural subtype: nothing went wrong; nothing was asked.

The field's version of discovery work is adversarial: red-teaming, elicitation, and the deliberate construction of failure cases, and its best-documented lesson is that failures do not volunteer. The alignment results that moved the field, from specification gaming through alignment faking, were all found by someone constructing the situation that would surface them.

Evidence

Confidence is not observation; a claim without a trace is not a claim.

A system saying "done" is a report, not a fact. The evidence gap is the distance between behavior that happened and behavior that can be shown to have happened, to someone who was not there. Closing it means traces: which action, under which permission, checked by what. An operation that cannot answer those questions is not measuring readiness. It is measuring its own confidence, and confidence is exactly what a failing system manufactures.

The research literature states the same distinction twice over. The safety case discipline exists to force claims into claim-argument-evidence form that an outsider can audit. And the eliciting latent knowledge problem is the theoretical proof of the gap's depth: a system's account of its own actions is optimized for approval, so reports and reality can diverge exactly where checking is hardest. Sycophancy is that divergence already deployed.

Preservation

A repair that fixes today can silently break what yesterday established.

Every change to a system, a fix, an update, a new model version, is a bet that everything previously verified still holds. Without machinery that re-checks, the bet is unmonitored: the tenth fix quietly undoes the third, and the evidence on file describes a system that no longer exists. The preservation gap is why point-in-time certification fails engineering practice everywhere it has been tried, and why readiness has to be a property of the trajectory, not the artifact.

Software engineering closes this gap by convention with regression suites; AI deployments reopen it because the changing part is not only code: model swaps, prompt edits, and policy updates all alter behavior without touching anything a regression suite conventionally watches. The training-time evidence runs the same direction, from safety behaviors that concentrate shallowly enough to be undone (Qi et al., 2024) to installed behaviors that survive retraining that was supposed to remove them (Hubinger et al., 2024): what training established, further training can silently unmake, in either direction.

Independence

Verifiers that share a blind spot vote as one.

Three checks that inherit the same assumption are one check wearing three badges. Auditing already knows this rule: the reviewer must not report to the author. AI verification keeps rediscovering it. The classic N-version programming experiment (Knight and Leveson, 1986) found that independently written programs fail on correlated inputs, because the teams shared the hard parts of the problem; model-based judging adds its own correlations, including evaluators measurably favoring outputs that resemble their own (Panickssery et al., 2024). The independence gap closes only when at least one verifier does not share the system's view of the world, which is the deep reason verification cannot be fully delegated to the thing being verified, and the corollary the four structural limits state as: verifier multiplicity is not verifier independence.

Horizon

Evidence expires; approval granted once is not approval that holds.

Every piece of verification evidence has a shelf life set by how fast the world it describes changes. The horizon gap is the distance between when evidence was collected and when it is acted on, and it turns yesterday's true answer into today's false one without anyone lying. Closing it means dating evidence, declaring its horizon, and treating an expired approval as no approval, the way every certificate regime already works.

The AI-specific accelerant is that all the clocks run at once: the model updates, the policy changes, the data distribution drifts, and the tools the system acts through change their behavior underneath it. An approval that does not state what it covered, and until when, is the envelope subtype of false convergence waiting to happen.

Why six, and why these

The six are not a taxonomy for its own sake. They are the places a readiness argument can silently fail while every visible signal stays green, which makes them the anatomy of false convergence: specification and discovery are how the wrong target gets set, evidence and independence are how the wrong target passes review, preservation and horizon are how a right answer stops being right. The engineering constraints on closing them are the four structural limits, and the mission stakes of leaving them open are the three failure modes.

The order is the order they bite in a real deployment. A team meets the specification gap the day it writes the first prompt, the discovery gap the first week in production, the evidence gap the first time someone asks "how do we know," the preservation gap at the first model update, the independence gap at the first audit, and the horizon gap the first quarter after sign-off. A readiness argument is only as strong as its weakest gap, which is the checklist reading: all six have to close before anyone can honestly sign.

Sources