In general, we don't know how to do this in a way that is robust to all the trivial ways to fool these techniques. I can just fine-tune a large scale model on

In general, we don't know how to do this in a way that is robust to all the trivial ways to fool these techniques. I can just fine-tune a large scale model on a small downstream task, or use creative choices of decoding settings (high temperature, alternative decoders like contrastive/typicality sampling), to fool the existing methods.