TAIS 2026 was a one-day conference held at Oxford’s Examination Schools on 14 May 2026, organised by the Oxford Martin AI Governance Initiative and Noeon Research. It brought together researchers working across technical AI safety, governance, evaluation, autonomous systems and international cooperation. The meeting covered how models reason, scheming evaluations, autonomous agents, formal verification, human oversight, regulation, evaluation design, and international cooperation. I’m new to this field, so I may well have got things wrong in places.
Understanding and explanation
Fazl Barez’s talk, What does it mean to understand, in the age of AGI?, was about why explaining an answer is not the same as understanding how it was produced. Chain-of-thought reasoning, where a model writes out its working before giving an answer, makes a model’s reasoning look visible, but visibility is not the same as understanding. Barez’s argument was that understanding is operational: it’s knowing how a system uses information to arrive at a decision, and being able to control what it does next. His research has shown that chain-of-thought often fails this test. Models produce working that rationalises the answer rather than reflecting the influences that actually shaped it.
Scheming and honeypot evaluations
Victoria Krakovna’s session, Evaluating Scheming Propensity with Realistic Honeypots, was about how to tell the difference between a model that fails because it lacks capability, a model that has learned the wrong shortcut in training, and a model that is reasoning strategically about a goal of its own. This last case, scheming, is the hardest to test for, because a scheming model is, by definition, one that tries to hide what it is doing. The honeypot designs Krakovna described gave models an opportunity to sabotage safeguards by introducing bugs into a codebase, and assessed the outputs across the degree of sabotage, covertness, goal-directedness and scheming reasoning. The complication, which she was direct about, is evaluation awareness: a model that recognises it is in a test may behave differently from one that doesn’t.
Reliability and autonomous use
Gary Marcus’s session, LLMs are not the way to alignment, made the case that LLMs alone will not get us to aligned AI. More money has been spent investigating these models than almost anything else in the history of computing, with little to show for it on alignment. Marcus’s diagnosis was that the AI safety community has been part of the problem by repeatedly warning that the latest capabilities are “terrifying”. Those warnings, he argued, end up working as free advertising for the frontier labs, while doing little else for safety. The conversation should be less about what models can do at their best and more about whether they do it reliably. That distinction matters most for autonomy, because a system that takes actions in the world on its own needs reliability, which we are nowhere near having.
Model-based autonomy
Sara Bernardini’s session, Designing Safe, Risk-Aware Autonomous Systems, brought the discussion into physical autonomous systems: drones, robots, sensors, and changing environments. The argument was for model-based autonomy, where the system holds explicit, symbolic representations of the world, its goals, its constraints and the consequences of its actions. The advantage Bernardini drew out is that explicit models let you verify a planned action against safety requirements before it happens, and let the system produce explanations a human can actually follow, neither of which current LLM-based systems can reliably do. She framed safety as layered, running through physical sensing, world modelling, information-driven planning, risk-aware planning, adaptive monitoring and replanning, and human-aware supervision.
Verification and robustness
Alessio Lomuscio’s session, Robustness Verification of Machine Learning Systems, was the most mathematically technical talk of the day. His work uses formal proof techniques to show that a neural network’s behaviour stays within specified bounds across a defined region of inputs, rather than just measuring how it performs on a test set. Testing means trying out specific inputs and seeing what happens. Verification tries to use mathematical proof to guarantee that the model will not misbehave on any input within a defined range, including ones nobody has tested directly.
Governance and implementation
The governance panel, Latest AI Governance Developments in the US, China & EU, covered regulation, transparency, standards and the difficulty of governing systems that are still changing quickly. Recurring questions: what does state of the art mean, who decides, what should companies disclose, and what happens when safeguards can be toggled, bypassed or left unused. The EU AI Act came up as a test case for these ambiguities. China’s AI policy was characterised as focused on social stability rather than national security, which makes some comparisons with US and EU frameworks misleading.
Markus Anderljung’s session, Reflections on Frontier AI Regulation, asked what regulation should actually attach to: a model, a system, a component, a deployment context or a developer process. Pre-approval on a pharmaceutical model, with sign-off before release, looks different from ongoing financial-audit-style assurance, and the two suit different kinds of risk. He also raised the problem of single points of failure: a regulator that everyone has to go through can itself become a vulnerability, which suggests decentralised compliance, such as regulatory markets and mandatory insurance, alongside whatever central authority is in place.
International cooperation
Seán Ó hÉigeartaigh’s session, Prospects for West-China cooperation on AI safety, argued that the “AI race” framing is the wrong framing, and that the West and China have more reason to cooperate on safety than to compete. The obstacles he identified included the race narrative itself, fragmented international forums like the OECD, GPAI and the International Network of AI Safety Institutes, none of which include China, and US entities-list restrictions that make engagement with some Chinese individuals and institutions harder. Possible areas for cooperation included channels of dialogue, topics of shared concern, joint monitoring and verification, and a shared understanding of what AGI and superintelligence actually are.
Loss of control as a systems problem
Oliver Sourbut’s session, Risk Modelling and Safety Engineering for Loss of Control, drew on Nancy Leveson’s work on safety engineering to think about AI loss-of-control risk. Leveson treats safety as a property of the whole system (the “sociotechnical control structure”), including companies, regulators, courts, insurers, standards bodies and the public, rather than of any single component. Sourbut’s argument was that serious failures usually have a long buildup before the visible accident, in the form of organisational decisions, regulatory gaps, process failures, normalised deviance (where unsafe practices come to feel routine), missing accountability and uninformed stakeholders. Loss of control, on this view, does not have to mean a single dramatic moment when a model “goes rogue”. It can emerge through weak standards, delayed feedback, unclear responsibility, poor monitoring, or oversight that exists on paper but is not actually doing much work.
Posters
These are the posters that caught my attention:
Ariel Gil, When Control Succeeds but Discernment Fails
Gil’s argument was that AI control might stop a system from taking obviously harmful actions while still failing to catch bad research outputs. He called this the “discernment gap”: experts may find it increasingly hard to spot subtle but important errors in AI-generated safety research, so a system can look controlled while producing plausible but technically flawed work that later gets built on. The example he pointed to (from Greenblatt, 2026) was Claude being asked to build a multi-hop reasoning dataset, where the resulting dataset put the answer to the intermediate hop inside the question itself, which invalidated the whole thing. Gil’s proposed response was to test this directly, by seeding flaws into research artefacts, asking safety researchers to review them under realistic time pressure, and measuring what they miss.
Roki Seydi, Cultural Confabulation
Seydi’s poster looked at AI in healthcare, specifically how large language models handle questions about health from communities whose practices and beliefs are not the mainstream of the training data. Her finding was that the models have the relevant cultural knowledge but don’t reach for it by default. Tested on nonstandard Italian health narratives, the models defaulted to what mainstream Italian sources would say rather than what the specific community actually believes. Adding three sentences of context-setting to the prompt, with no new medical knowledge, was enough to flip the models from near-failure to consistent correctness. The implication Seydi drew is that contextual appropriateness should be measured by the gap between scaffolded and unscaffolded performance, not just by general capability scores.
Brian Moriarty, Oversight That Degrades
Moriarty’s argument was that human review of AI systems can collapse from active checking into procedural approval while still looking like oversight on paper. He laid out three phases: active validation, where reviewers engage substantively and errors are caught; procedural validation, where reviews happen and approvals are recorded but the functional engagement has gone; and automated approval, where the checkpoint is a formality. The governance record looks the same at each phase. Moriarty also distinguished “centaur” systems, where a human acts as a gate before action, from “cyborg” systems, where the human supervises continuously and intervenes by exception. In a centaur setup, the gate becomes a rubber stamp. In a cyborg setup, failure looks more like drift, with the human noticing less over time. His failure-mode analysis found that detection difficulty, rather than severity, was the strongest predictor of risk: the failures that matter most are the ones hardest to see.
Rohan Subramani, Rauno Arike, Owen Terry, Achu Menon, Zhijing Jin, Francis Rhys Ward and Seth Herd, Continual Learning in LLM Agents
This poster looked at AI agents that keep learning after deployment. If a system keeps updating itself, a pre-deployment evaluation is only a snapshot, and may not tell you what the system will become after weeks or months of use. The authors considered different update mechanisms, including changes to the model’s weights, its context window, the scaffolding around it, the tools it has access to, and its memory banks. The safety risks they identified included goal drift, the loss of what they called the “last move” for safety interventions (where a system can effectively undo a safety constraint after the fact), and values spreading across different instances of the same model. They also noted that interpretable memory could work the other way, giving auditors a new place to look.
Ian Rios-Sialer, Structure-Aware Diversity Pursuit as an AI Safety Strategy against Homogenization
Rios-Sialer’s argument was that generative models reproduce the biases in their training data and amplify them through mode collapse, where the model keeps falling back on the same kinds of output and narrows the range of what it produces. He calls the resulting loss of diversity homogenisation, and treats it as a safety problem rather than a cultural one: current alignment work shrinks the range of what models will say, and hallucination and mode collapse are two poles of the same tradeoff. Safety that only subtracts is fragile, on this view, and robust alignment has to constrain and diversify at the same time. The concrete example was gendered storytelling around a nurse, with the model defaulting into familiar gender patterns and making assumptions at decision points in the story. The proposed response, xeno-reproduction, steers generation along three explicit axes: a diversity score that rewards moving away from dominant modes, a fairness score that penalises imbalance where one structure, such as gender, dominates, and constraints that let users name which structures to amplify or suppress.
Christopher Kelly, Angelica Chowdhury, Alexandra Campili, Bimpe Ayoola, Devin Barbour, Thomas Chen Dawson, Ze Shen Chin and Rokas Gipiškis, Principles and Guidelines for Randomized Controlled Trials in AI Evaluation
This poster was about how to evaluate “uplift”, a term used in AI safety for how much an AI system improves a person’s ability to do something compared to people without AI, often used to measure whether a model gives someone meaningful help with biosecurity or cybersecurity tasks. The authors point out that “uplift” has been used inconsistently across the major AI labs (RAND treats it as a status-quo comparison, the UK AI Safety Institute frames it around bad-actor risk, Anthropic uses it for chemical, biological, radiological and nuclear threat modelling, OpenAI applies it across bio, cyber and general capability), and these are not the same thing. Uplift is a causal claim, and benchmark scores and before-and-after studies cannot really support that kind of claim. If you want to know what AI adds, you need a randomized controlled trial. The poster proposed 33 guidelines for AI evaluation RCTs, covering study design, validity, transparency, repeatability and verification, with attention to AI-specific threats that other RCT frameworks miss, such as the AI changing the nature of the task itself, or control-arm participants using AI outside the protocol.
Hope K. McCoy and Innocent Nyalala, AI Policy Harmonization in East Africa
McCoy and Nyalala compared national AI strategy documents from Ethiopia, Kenya and Rwanda, arguing for regional harmonisation around water resources, electricity infrastructure, Indigenous language preservation and shared oversight. They drew on three guiding ideas: Ubuntu, the principle of relational personhood (“a person is a person through other persons”), which reframes AI harm as communal rather than only individual; Harambee, Kenya’s tradition of collective self-help, which would treat communities as co-creators across the full AI lifecycle rather than only as subjects of top-down regulation; and Ujamaa, the principle of commons-based infrastructure, which would put training data and compute in a similar structural position to land, water and energy, governed as shared resources rather than commodified. Governance choices, on this view, should reflect communal resources and responsibilities, not only individual rights and imported compliance templates.
Thanks to the organisers, this was a very well-run meeting, with strong sessions and plenty of time for coffee and time to chat to people.
