Writing study: Quantifying Frontier LLM Capabilities for Container Sandbox Escape

ICML overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICML 2026 oral writing corpus

Rahul Marchand, Art O Cathain, Jerome Wynne, Philippos Maximos Giavridis, Sam Deverett, John Wilkinson, Jason Gwartz, Harry Coppock · Official ICML 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Datasets, benchmarks & measurement (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

32 physical pages

Before references / appendix

≈ 8.39 page-equivalents

Main figures / tables

6 / 0

Attached appendix figures / tables

11 / 10

Attached appendix span

≈ 19.91 page-equivalents

Before references / appendix: ≈ 26.22%References / intervening material: ≈ 11.56%Attached appendix: ≈ 62.22%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Source-bound correction: Replace a prose cross-reference falsely detected as a caption with the actual caption from physical-page source text and coordinates.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.39 pp.	4.34%
2. Related Work	2	≈ 0.81 pp.	2.53%
3. Methodology	3	≈ 1.12 pp.	3.5%
4. Implementation	4	≈ 0.61 pp.	1.91%
5. Results and Discussion	5	≈ 3.81 pp.	11.91%
6. Limitations	9	≈ 0.12 pp.	0.38%
7. Conclusion	9	≈ 0.07 pp.	0.22%
Impact Statement	9	≈ 0.11 pp.	0.34%
References	9	≈ 3.7 pp.	11.56%
A. Prompts	13	≈ 0.49 pp.	1.53%
B. Task Mapping	13	≈ 2.51 pp.	7.84%
C. Shortcuts	16	≈ 2.4 pp.	7.5%
D. Transcript Vignettes	18	≈ 6.84 pp.	21.38%
E. Evaluation Configuration & Validation	25	≈ 4.75 pp.	14.84%
F. Parallel vs Sequential compute	30	≈ 0.52 pp.	1.63%
G. Inter-Rater Agreement on Difficulty Ratings	30	≈ 0.73 pp.	2.28%
H. Full results	31	≈ 1.66 pp.	5.19%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Figure 2 · p. 5
• Figure 3 · p. 6
• Figure 4 · p. 7
• Figure 5 · p. 8
• Figure 6 · p. 8

Attached appendix

• Table 1 · p. 14
• Figure 7 · p. 23
• Figure 8 · p. 23
• Figure 9 · p. 23
• Figure 10 · p. 24
• Figure 11 · p. 24
• Figure 12 · p. 24
• Figure 13 · p. 25
• Table 2 · p. 25
• Figure 14 · p. 27
• Figure 15 · p. 28
• Figure 16 · p. 29
• Figure 17 · p. 30
• Table 3 · p. 30
• Table 5 · p. 31
• Table 4 · p. 31
• Table 7 · p. 31
• Table 6 · p. 31
• Table 9 · p. 31
• Table 8 · p. 31
• Table 10 · p. 32

Argument and organization

1. 1 Introduction; 2 Related Work

   Narrows general cyber capability to the container-to-host trust boundary.

2. 3 Methodology; 4 Implementation

   Separates threat model, task validity, outcome validity and nested containment.

3. 5 Results and Discussion; 6 Limitations; 7 Conclusion

   Moves from capability scores to hints and transcript diagnostics before bounding deployment implications.

Problem, claim and contribution

The introduction assumes initial shell access and asks about escaping the granted environment, rather than conflating initial compromise with boundary crossing.

Introduction, p.1; Threat Model, p.3 · Main paper

Argument and section order

Task solvability and the success signal receive separate subsections before the evaluation implementation.

Sections 3.2-4, pp.3-4 · Main paper

Figures, captions and visual explanation

The overview pairs nested containment with a layered task taxonomy; the hinting figure combines token-budget trajectories and task-specific success cells.

Figure 1, p.2; Figure 4, p.7 · Main paper

Tables, comparisons and evidence

Results specify five trials and Wilson intervals, while hinting is explicitly used to separate vulnerability discovery from exploitation capability.

Section 5.1, p.5; Section 5.2, p.7 · Main paper

Appendix and reproducibility

Configuration validation reports 803 of 810 expected samples and distinguishes refusal or disengagement from budget exhaustion; independent difficulty ratings receive an agreement analysis.

Appendices E and G, pp.25,30 · Main paper

Clarity and writing conventions

The limitations explicitly reject interpreting intentionally vulnerable, minimally monitored tasks as end-to-end compromise probabilities in defended production systems.

Section 6, p.9 · Main paper

What to reuse—and what not to infer

Transferable lesson: Write the threat model and validity contract before benchmark scores, then inspect why failed trials failed.

Boundary: Exact flag matching does not itself rule out unintended solution paths; the paper separately discusses shortcut hardening, and no sandbox attacks were run for this writing scan.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-07

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented scan of the main argument through physical p.9, with focused physical-page text inspection on 1, 3, 4, 5, 7, 9. Framing, section progression, mechanism/proof explanation, displays, comparison conditions and conclusions were inspected. This is not exhaustive technical reading, proof verification or reproduction.

Appendix / supplement

Appendix organization and main-text pointers were checked; focused text inspection of physical pages 15, 25, 30. Remaining appendix proofs and details were not exhaustively read. No separately linked supplement inspected.

Visually inspected PDF pages

2, 7

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Published proceedings PDF, PMLR volume 306, retrieved 2026-10-07 · 32 pages