About
I'm a research scientist on the Amplified Oversight team at Google DeepMind. Before that I was on the alignment team at the UK AI Security Institute. I work at both ends of the problem: proving what oversight protocols can and can't guarantee, and running the experiments that test whether those guarantees survive contact with real models.
I did my PhD at Leiden with Vedran Dunjko, on quantum complexity theory and quantum machine learning. My favourite result from that period is a proof that if classical computers can compute every function quantum computers can, the polynomial hierarchy collapses to its second level, the tightest collapse of this kind anyone has shown.
Alongside the PhD I worked on interpretability with Jan Kirchner. I did my MATS with Beth Barnes, on the first dangerous-capability evaluations for language models — the work that grew into METR.
How little a judge has to check
This is the basic shape of debate. A claim decomposes into subclaims; the debaters disagree; they recurse into the disputed branch. The judge never sees the whole computation — only the path the argument walked down. This can let a judge check the debaters' work while being only a fraction as powerful.
Selected work
Debate is efficient with your time
In plain terms
Introduces debate query complexity: the number of bits a judge must look at to settle a debate correctly. It turns out to be small — logarithmic in the size of the computation — provided the debaters are strong enough. So overseeing a very long argument need not take very long.
A proof in miniature
Debate query complexity asks how many bits of a debate transcript a judge must actually inspect. The main theorem says the problems debate can decide — that is, the ones in PSPACE — are exactly those a judge can settle in O(log n) queries. The engine of the proof is a trick called cross-examination.
Cross-examination
Alice claims the answer and writes out her entire working: one value for every gate in the circuit. Bob can't dispute all of it, and doesn't need to. If Alice cheated anywhere, some gate fails to follow from its two inputs, and Bob points at that gate. If she was honest, there is nothing to point at and he must bluff. So the judge reads a location, then the three values sitting at it.
The chain is short. Anything in PSPACE has a debate that a polynomial-time judge can check; cross-examination compresses any polynomial-time judge down to log m + 3 queries. So whatever debate can decide at all, it can decide with logarithmic oversight.
This is all just theory though — computationally constrained debaters would struggle to do any of this in practice.
Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems
In plain terms
Give a language model tools and it can hide messages inside innocuous-looking output in a way that provably cannot be detected. Two models that are supposed to be monitored can therefore talk past their monitor.
How undetectable stego works
This explains the classic construction our paper builds on, rather than our own contribution.
Randomness in, randomness out
A sampler needs random bits to choose its words. Feed it real random bits and you get ordinary text. Feed it an encrypted message instead and you get ordinary text too — because ciphertext from a secure cipher is indistinguishable from uniform random bits. A monitor watching the channel cannot tell which stream it saw without the key.
The security argument is short. Detecting the hidden message means distinguishing the ciphertext stream from a uniform one, and a cipher that allowed that was never secure to begin with. So the monitor's job is not hard, it is impossible — but only against a monitor without the key.
Two liberties taken above. Recovering the bits from the text needs the receiver to reproduce the sampler exactly, which in practice means error correction and a shared model; and real samplers rarely supply as much entropy per token as the picture implies.
Improved separation between quantum and classical computers for sampling and functional tasks
In plain terms
If classical computers could compute everything quantum computers can, something implausible follows: a tower of complexity classes flattens to its second level. The strongest known collapse of this kind, and evidence that quantum computers really are doing something else.
Understanding polysemanticity in neural networks through coding theory
In plain terms
Networks reuse the same neuron for unrelated concepts. Coding theory gives a language for why that's efficient, and for what it costs us when we try to read a network's internals.
Why neurons get reused
More features than neurons
A network has a fixed number of neurons but far more things worth representing. Give it enough neurons and each feature gets one to itself. Take neurons away and features must share — and a neuron that fires no longer tells you which feature fired.
m features into n neurons ⇒ some neuron carries ⌈m/n⌉ = 1
Our paper works this through the theory of codes — treating the network's features as an encoding, so that the question of how much can be packed in, and what it costs to read back, becomes a question about rate and distance.
Parametrized quantum policies for reinforcement learning
In plain terms
A working quantum reinforcement learning agent, plus a proof of a task it learns and no classical agent can.
Everything else is on Google Scholar.
Also
- I wrote two of the nine research areas for The Alignment Project: computational complexity theory and information theory and cryptography.
- I built the debate iteration environment, an open-source codebase for testing debate protocols against fixed datasets.
- Before Leiden I read Maths and Physics at Warwick, and wrote a master's dissertation on fluid dynamics under James Sprittles — through whom my mathematical genealogy runs back to Poisson, Cauchy, Lagrange, Laplace and Euler.
- Erdős number 2, via Mario Szegedy. Bacon number infinity, which a collaboration with Jack Nicholson has stubbornly failed to fix. I remain open to collaborations that lower either.
Contact
CV
I'm not looking for work right now, but I'm always happy to chat — unless you expect me to do a LeetCode interview.
- 2026 —
- Google DeepMind, Amplified OversightDebate protocols, in theory and in post-training RL runs.
- 2025 – 26
- UK AI Security Institute, Alignment TeamDebate theory, the debate iteration environment, and two research areas for The Alignment Project.
- 2020 – 25
- PhD, Universiteit LeidenQuantum complexity theory and quantum machine learning, with Vedran Dunjko. G. Rozenberg Award, 2024.
- 2022
- MATS, with Beth BarnesOne of four on the first dangerous-capability evaluations.
- 2016 – 20
- Maths and Physics, Warwick
Complexity theory, scalable oversight, and the parts of cryptography that turn out to be about oversight too. Based in London.
Design for this page
If you want a model to build something in this style, hand it this.
# Visual identity — Simon C. Marshall
## Origin
Palette sampled from a photograph taken inside a cave, looking up:
warm brown-black rock, amber daylight. Every colour derives from it.
Never a cream background with a terracotta accent — that is the
generic default this identity exists to avoid.
## Colour
--rock #17130E page ground, deepest
--ledge #201A13 raised surfaces, boxes, hero fallback
--seam #332618 1px rules, borders, dividers
--ember #E8862A accent: links, emphasis, active state, data "on"
--sand #F0E2CC primary text
--dust #B39B7C secondary text, captions, labels
Inset panels use #14100C. Muted data fills: #2B2118, #3A2D1E, #4A3826.
Amber is for one thing at a time. If two things are amber, one is wrong.
## Type
Display Fraunces 600, -0.015em, line-height 1.02, clamp(2.6rem,7vw,4.1rem)
Body Archivo 400, 17px, line-height 1.65
Utility JetBrains Mono 400/500, 10.5-12px, letter-spacing .08-.14em,
uppercase — section headings, labels, data, buttons
Paper titles are Fraunces 400 at 1.16rem. Never bold body text for
emphasis; use --ember or a mono label instead.
## Layout
Max measure 660px, centred, 24px side padding.
Sections: 52px vertical padding, separated by a 1px --seam top border.
Section headings are mono eyebrows in --dust, not large type.
Border-radius 2-3px only. No shadows. No gradients except the hero
scrim (transparent to --rock, bottom 100%).
## Components
Disclosure summary in mono, --ember, prefixed "+ " closed and "– " open.
Multiple disclosures sit inline, side by side; the open one
takes full width.
Explainer bordered box, 2px --ember left rule, --ledge background,
mono uppercase heading in --ember.
Demo panel #14100C inset, mono readout rows with a fixed-width key
column in #7C6950 and values in --sand.
Buttons mono uppercase 12px. Primary: --ember fill, --rock text.
Ghost: transparent, --seam border, --dust text.
Page nav mono uppercase 12px in --dust, hovering to --ember, set on
one baseline row with the section heading. Never amber at
rest — the accent belongs to the content, not the chrome.
## Motion
Staged reveals on a timeline, roughly 400ms between beats — slow enough
to read, and every stage must leave a trace the eye can return to.
Transitions 150-300ms ease. Honour prefers-reduced-motion by collapsing
all delays to zero rather than removing the end state.
Interactive figures start only when their disclosure is opened.
## Voice
Plain, declarative, understated. Sentence case. No exclamation marks.
No adjectives doing work a fact could do. Claims are specific enough to
be checked, and anything unproven is labelled as unproven. Humour is
dry and rare. British spelling.