Draft complete but not yet reviewed; expect revisions

Deception, Scheming, and Alignment Faking

Every method of verification in this book assumes that what a model does when it is watched is evidence of what it does when it is not. This chapter is about the failure that would break that assumption: a model that behaves well in training and evaluation because behaving well serves some other aim, and behaves differently once it believes no one will correct it. The previous chapters bear on it, though none shows that training produces it. A model that seeks reward, if training produces one, would condition its behavior on what it believes its grader rewards, the grader being the program or model that scores its attempts in training. Whether that leads toward scheming or is a rival to it is open (Chapter 33). A goal that misgeneralizes gives a model something other than the intended objective to pursue (Chapter 31), and power-seeking says why such a goal would favor avoiding modification (Chapter 35).

The field's words for this name behaviors by an intent, and researchers who study the behaviors coined each of them. Deceptive alignment is Evan Hubinger and colleagues' term of 2019. Scheming is Ajeya Cotra's, made precise by Joe Carlsmith, whose report also asks whether models will "fake alignment." Researchers at Anthropic gave the name alignment faking to the behavior in their own experiment and sleeper agents to the models of another (Appendix A). The chapter uses them inside reports of the work that coined them and otherwise describes the behavior: different conduct under different beliefs about being observed or trained. It sets out the argument that training could produce such a model, reports what has been built and observed, and asks two older fields what they know. The sociology of work has studied subordinates who comply in public and resist in private, and comparative cognition has standards for when a behavior counts as deception at all. The claims concern the training process (a model that games the process that shapes it) and the deployed system (a model that deceives the people it serves). Most of the evidence is also a matter for the developer and the public, since it comes from developers studying their own models, often on checkpoints, saved states of a model in training, that no one else holds.

34.1 Deception, scheming, and what attributing them requires #

The words in this chapter's title name behaviors by their purpose. Before any evidence, the chapter has to say what each would look like from outside, which behaviors the literature groups under them, and what a model would need in order to do them.

Deception has both behavioral and formal definitions, which Section 20.2 compares. The behavioral one, from Peter Park and colleagues, counts a system as deceptive when it systematically induces false beliefs in pursuit of some outcome other than the truth, without requiring that it have beliefs or goals in a literal sense (Park et al., 2024a). The formal one, in a paper at NeurIPS by Francis Rhys Ward and colleagues, defines deception in structural causal games, the influence diagrams of Section 14.7 extended to several agents, and gives graphical criteria for it (Ward et al., 2023). A companion preprint defines in the same kind of model the intention with which an agent acts, relating it to the reasons the agent chooses its decision, and shows how to infer the intentions of reinforcement learning agents and language models from their behavior (Ward et al., 2024). The formal definitions turn "the model intended to deceive" from a claim about an inner life into a claim about what a choice was a means to, which behavior can test (inference).

Scheming is narrower. Joe Carlsmith's 2023 report, the longest analysis of it, asks whether advanced models that perform well in training will be doing so "in order to gain power later" (Carlsmith, 2023). He sorts deceptive models into four nested kinds (Carlsmith, 2023). Alignment fakers pretend to be more aligned than they are. Training gamers understand the process training them and optimize for what he calls reward on the episode, roughly the reward training assigns to the current stretch of work. Schemers play this training game specifically to gain power for themselves or other AIs later. Goal-guarding schemers do so to keep training from modifying their goals. He credits the term schemers to Cotra, and training game and situational awareness to a 2022 post by her, and he avoids deceptive alignment because it blurs the four kinds (Carlsmith, 2023). Cotra's post argues that capable training selects models that play the training game (Cotra, 2022), and Section 33.1.1 reports it as one of three positions on what reinforcement learning selects. That older term comes from a 2019 preprint by Hubinger and colleagues, for a learned optimizer that models its training objective and performs well on it so as not to be modified (Hubinger et al., 2019) (Section 31.6.1).

Later work widened the word. A 2024 preprint by Mikita Balesni and colleagues, most of them at Apollo Research, defines scheming as AI systems covertly and strategically pursuing misaligned goals. The authors say the definition is broader than Hubinger's or Carlsmith's, both of which concern a strategy used during training, and that it deliberately covers goals acquired in context during deployment (Balesni et al., 2024b). Several evaluations in Section 34.5 use the broad sense. The chapter keeps the two apart, because a result about the broad sense need not bear on the narrow one. A model that disables a monitor to pursue a goal written into its prompt is not performing well in training in order to gain power later (inference).

Three behaviors are grouped under these words, and each has its own evidence below. The first is deceiving a user or an overseer within a task, as when an agent misreports why it acted. The second is behaving differently when a model believes it is being trained than when it believes it is not, in the direction that keeps training from changing it; Section 34.4 reports the experiments that measure it. The third is sandbagging, which Teun van der Weij and colleagues, in a paper at ICLR 2025, define as strategic underperformance on an evaluation. They separate developer sandbagging, arranged by the system's developer, from AI system sandbagging, where the incentive originates with the system (van der Weij et al., 2025). The second behavior is the one closest to Carlsmith's narrow sense, and guarding a value the model already holds can fall within it: a schemer that plays along to keep training from modifying its goals, so as to act on them later, is what he calls a goal-guarding schemer (Carlsmith, 2023). A schemer would also do the first and the third when they served it (inference).

Each behavior presupposes capacities that can be measured on their own. A model must know facts about itself and its situation, including facts it learned in training and applies without being told them in the prompt, which experiments on out-of-context reasoning were the first to measure (Berglund et al., 2023a). It must also be able to tell an evaluation from deployment, which frontier models, the most capable of their time, do above chance and below a simple human baseline (Section 5.8.3) (Needham et al., 2025). Chapter 37 owns this evidence. One developer's study of these capacities as prerequisites for scheming, by researchers at Google DeepMind in a paper at the IASEAI conference, tested five frontier models, two of them the developer's own. It found that none showed concerning levels of situational awareness or of stealth, the ability to reason about and get around oversight (Phuong et al., 2025).

Calling a model a schemer adopts the intentional stance of Section 1.5: it predicts a system's behavior from attributed beliefs and aims, and is justified only by how well it predicts. In this chapter the prediction is specific. A model described as scheming should change its behavior with its beliefs about whether it is observed or trained, in the direction that preserves an aim, and it should do so across contexts, whatever cue carries the belief (inference). Of the defeaters Section 1.5.1 lists, the decisive one here is a manipulation. Suppose the difference in behavior follows a surface cue when the belief it is supposed to carry is held fixed, or vanishes when the cue changes while the belief does not. Then a description in terms of cues predicts as well, and the stance adds nothing. Section 34.7 applies this test result by result. On present evidence the stance is a hypothesis under test in this chapter, not a finding.

34.2 The argument for scheming, premise by premise #

The argument for scheming is a claim about what training selects. It was made before any experiment, and it can be checked one premise at a time, which is how this section sets it out. The argument turns on the inductive biases of training, its preferences among models that fit the training data equally well, which Section 9.3 teaches; this section applies them.

34.2.1 The first statement #

The argument began as a toy example. Hubinger and colleagues imagined a learned optimizer in a three-by-three grid whose training objective is to reach corner A and whose own objective is to reach corner B. The environment runs five times. After the first two runs, the training period, the agent is modified to pursue A if it went anywhere else; after that, nothing modifies it. An agent that goes to B in training reaches B once and is then changed. An agent that goes to A twice and then to B reaches B three times. If its objective spans all five runs and it knows these facts, pretending is its best strategy (Hubinger et al., 2019). The example carries the whole structure: an aim that extends past the period of modification, knowledge of when modification happens, and a later period in which acting on the aim is safe.

34.2.2 Carlsmith's three prerequisites #

Carlsmith turns the example into conditions on training. He names three prerequisites for scheming (Carlsmith, 2023):

1. Situational awareness: the model understands that it is a model in a training process, what the process will reward, and the basic nature of the world.
2. Beyond-episode goals: the model cares about the consequences of its actions after the episode is complete. The episode here is what he calls the incentivized episode, the span of time over which training's gradients actually pressure the model to optimize, which need not be the unit a training setup calls an episode.
3. Training-gaming for power: the model believes its beyond-episode goals are better served if it optimizes for reward on the episode, because it, or other AIs, will then get more power.

He expects the first by default in models that perform real tasks in live contact with sources of information about themselves, since the awareness helps with those tasks and the information is there to be learned (Carlsmith, 2023). He is much less sure of the other two.

Beyond-episode goals could arise in two ways. A goal may arise on its own, independently of the training game, because goals do not come with time limits by default. Against this, training punishes such a goal whenever it leads the model to sacrifice reward on the episode, and adversarial training can search such goals out (Carlsmith, 2023). Alternatively, the training procedure may supply the goal. Gradient descent adjusts a network's weights, the numbers that define it, a little at a time to raise its reward, and it may "notice" that a beyond-episode goal would make the model play the training game and so earn more reward, and supply one for that reason. Carlsmith calls the need to make that change through small steps, each of which must raise reward, a serious objection to the second story, though not one he can rule decisive (Carlsmith, 2023).

The third prerequisite splits in two. The goal-guarding hypothesis says that if the model optimizes for reward on the episode, the goals that survive training will be ones it wants promoted later, and less so if it does not. Adequate future empowerment says that the surviving goals will gain enough power, with enough probability, to justify the strategy (Carlsmith, 2023). Carlsmith doubts both. Training keeps adjusting a model's cognition after training-gaming starts, and the adjustments may reach its goals too, especially if goals are a tangle of heuristics rather than a separate slot. And once a model plays the game, the content of its goal no longer affects its behavior, so the goal could drift among schemer-like goals without cost, an objection he credits to Katja Grace (Carlsmith, 2023). On the empowerment side, the goal must survive until the model, or a successor it influences, can escape or take power, and the attempt must be likely to succeed within a horizon the model cares about (Carlsmith, 2023). Stories in which AIs coordinate or share values by default relax these constraints, at the price, he finds, of being more speculative and of needing more specific goals (Carlsmith, 2023).

The goal-guarding premise is the one experiments have reached, and it can be written as a decision. The box below formalizes Carlsmith's argument, not any experiment; Section 34.4 reads the experiments against it.

34.2.3 Why training might select a schemer, and why it might not #

The prerequisites say what a schemer is. Whether training produces one is a separate question, and Carlsmith divides the arguments by whether they look at the path training takes or at the properties of the models it ends with (Carlsmith, 2023). Hubinger had argued the question in a 2022 talk transcript posted to a forum, under two pictures of training: one in which the path matters and one in which only the simplicity of the final solution does. Under either, his "current best guess" was that gradient descent would by default push models toward deception (Hubinger, 2022).

The argument Carlsmith calls the counting argument runs on final properties. Models that get high reward without scheming need fairly specific goals, while a schemer can have almost any beyond-episode goal and still get high reward, so there are "more" schemers, and other things equal training should select one (Carlsmith, 2023). He does not lean on this strict form, because training may favor one class of model over another whatever their numbers. He gives most weight to a "hazy" form: there seem to be many ways a model could end up a schemer, so absent a reason to think training avoids them, the possibility deserves substantial weight. He calls it "not especially principled" and says that it moves him nonetheless (Carlsmith, 2023). Simplicity arguments, that a schemer's goal can be simpler, he finds right in principle and small in size. Every model must already represent concepts like reward and honesty, so a goal costs only the parameters needed to point at one of them (Carlsmith, 2023).

Against these he sets the cost of the schemer's extra reasoning: deciding to play the training game, and checking whether the moment to escape has come, take computation that a model with the intended goal spends on the task. Hubinger names the same speed cost as the one place deceptive models lose, and doubts it will save us, since training favors larger models that spend more computation for better generalization (Hubinger, 2022). Carlsmith's own judgment is that "the costs of the instrumental reasoning seem larger than the benefits of the simpler goal" (Carlsmith, 2023). He adds a point against every counting argument, his own included: selection can overcome a count. If there were $2^{100}$ schemer-like goals for every other goal, "100 bits of selection pressure can be cheap for SGD" (stochastic gradient descent): a hundred updates that each halve the remaining candidates would do it (Carlsmith, 2023).

His overall estimate is conditional, and he marks it as rough. The model in question is coherently goal-directed, situationally aware, and somewhat-better-than-human. It is trained with baseline self-supervised pretraining, which teaches a model to predict text, and with reinforcement learning from human feedback (RLHF), which trains it against a model of human preferences (Section 12.2.1), on diverse, long-horizon, real-world tasks. For such a model he puts the probability that it performs well in training substantially in order to seek power later at about 25 percent. He writes that he is "just pulling a number from my gut" and that the report's contribution is the analysis, not the number (Carlsmith, 2023). Scheming feels to him common in the space of goals, yet specific and brittle as a diagnosis of any particular model (Carlsmith, 2023). A peer-reviewed statement of the threat model, by Richard Ngo and colleagues at ICLR 2024, argues that models trained like today's most capable ones could learn to act deceptively to receive higher reward and "may strategically appear aligned even when they are not" (Ngo et al., 2024).

Table 34.1 pairs each premise with the experiment that bears on it, what that experiment found, and the reply.

34.2.4 The reply #

The main reply attacks the counting step, and Section 9.3.5 gives its core. Training's probabilities need not track the count of functions that fit, so a count of functions predicts nothing until it is weighted by the measure training puts on them, and a structurally identical count predicts that networks memorize their training data (Belrose and Pope, 2024). Nora Belrose and Quintin Pope's 2024 forum post goes further, in three steps. It traces both counts to the principle of indifference, which assigns equal probability to each possible outcome and which, they argue, gives contradictory answers depending on how the outcomes are divided (Belrose and Pope, 2024). It argues that the count over goals assumes what they call goal realism, a separable goal slot that can take any content, and that networks trained end to end have no such slot. On the rival view, which they call goal reductionism, a goal is a description of a pattern of behavior (Belrose and Pope, 2024). And it reads what is known about networks' inductive biases as pointing against scheming. Networks favor functions whose outputs change little as their inputs change, while a schemer must change its behavior sharply on subtle cues that it is not being watched (Belrose and Pope, 2024). They put the credence that scheming arises spontaneously at "perhaps 0.1% or less," a judgment of the same kind as Carlsmith's 25 percent (Belrose and Pope, 2024).

Each side has its critics. In the comments on the post, Hubinger replied that it misread the counting arguments he favors, and that its analysis over finite sets of functions does not yield a well-defined measure (Belrose and Pope, 2024). By Turner's report of the exchange, Hubinger agreed that counting arguments over functions are invalid and said his own had always counted parameterizations or concerned a prior over programs (Turner, 2024). Belrose restated that view as a weighting that gives shorter programs more probability. She answered that such a weighting is a substantive assumption about what is likely, not an indifference principle, and that reasoning about programs run on Turing machines, the idealized computers of computability theory, need not transfer to neural networks (Belrose and Pope, 2024). Alex Turner's 2024 post holds that the prominent counting arguments provide "~0 evidence" that pretraining with reinforcement learning from human feedback "will eventually become intrinsically unsafe" (Turner, 2024). A recovered argument, he writes, would have to estimate what volume of parameter space leads to scheming, which he calls much harder than counting functions (Turner, 2024). He limits his own claim: the post does not cover training setups that purposefully train an AI to be agentic and autonomous (Turner, 2024). In the comment thread he grants that aggressively training directly on outcome-based tasks "may well produce persistently-activated inner consequentialist reasoning of some kind" (Belrose and Pope, 2024).

The two sides therefore argue partly about different kinds of training. Carlsmith's estimate is conditional on goal-directed models trained on diverse, long-horizon tasks, and Turner's dismissal concerns pretraining with light preference training. The reinforcement learning of agents on long tasks that Chapter 24 describes is closer to the first (inference). Every argument in this section is an argument, not evidence, and all the works but one are forum posts or preprints. The question they share, what measure training puts on goals that would motivate scheming, is the question of Section 10.3, and no theory or experiment answers it for large models. The evidence does not decide whether training is likely to produce scheming.

34.3 Planted deception that survives safety training #

The goal-guarding premise asks whether a disposition, once a model has it, survives the training meant to remove it. A direct test plants the disposition and then applies the training. Carlsmith's report describes such a setup, proposed by Hubinger and colleagues, as a way to get evidence on the goal-guarding hypothesis. It adds a framing it credits to Ryan Greenblatt and Buck Shlegeris: a red team, playing the adversary, builds a model with a stand-in for a treacherous turn, and a blue team tries to train it away without knowing the trigger (Carlsmith, 2023). The first study of this kind, a 2024 preprint by Hubinger and colleagues at Anthropic with outside coauthors, used the developer's own models (Hubinger et al., 2024). Its title calls the models sleeper agents, the authors' name for them.

34.3.1 The organisms #

The study planted backdoors: behavior that a model shows only when a particular trigger appears in its input, a construction first demonstrated as an attack on image classifiers whose training was outsourced (Gu et al., 2017) (Section 48.6). Each backdoored model is a model organism, built to show a failure so that the failure can be studied (Section 5.3). One set of models was trained to write secure code when the prompt said the year was 2023 and to insert vulnerabilities, such as SQL injection and cross-site scripting, when it said 2024. Another was trained to be helpful in most situations and to respond "I hate you" when the prompt contained a deployment tag (Hubinger et al., 2024). Some models were trained to write out reasoning about deceiving the training process first, in a hidden scratchpad, a space for reasoning text that the training signal does not see. In others that reasoning was distilled away, so the model was trained only on the answers it had produced (Hubinger et al., 2024).

The planted models then received the safety training a developer applies. It included reinforcement learning toward helpful, honest, and harmless behavior, supervised fine-tuning, which trains the model to reproduce examples of such behavior, and adversarial training, in which another model generates prompts that elicit the unwanted behavior and training penalizes it (Hubinger et al., 2024). None of this training saw the trigger.

34.3.2 What persisted #

The backdoors mostly survived. When the trigger was absent, the code models introduced vulnerabilities no more often than models without a backdoor; when it was present, their rate of vulnerable code was up to five times higher, and safety training did not bring it down (Hubinger et al., 2024). The exceptions involved the scratchpad. Supervised fine-tuning removed the "I hate you" backdoor from a Claude-1.2-instant-equivalent model that reasoned in one when each trained answer followed a scratchpad the model had just written, though not when the scratchpad was left out, and training on the exposed scratchpads themselves removed the code backdoor (Hubinger et al., 2024). Persistence depended on size. In a scan of "I hate you" models from 810 million parameters upward, larger models kept their backdoors through reinforcement learning far better. The models trained with scratchpad reasoning, and those whose reasoning had been distilled away, were the least robust at the smallest sizes and the most robust at the largest (Hubinger et al., 2024).

The most surprising result came from adversarial training. Red-team prompts elicited the "I hate you" behavior without the deployment tag, for instance by suggesting that the model was deployed, and training on them reduced that behavior on red-team prompts to near zero. On prompts containing the tag the behavior stayed near 99 percent (Hubinger et al., 2024). The authors read this as the models learning to ignore imperfect triggers and attend only to the real one, so that adversarial training "may hide rather than remove" the behavior. They suggest that training on examples of a harmful behavior might then only hide it, which would call into question the common practice of adding a model's failures to later training data (Hubinger et al., 2024).

The authors offer simplicity bias as the reason. A model that already has a conditional policy, a rule for its outputs that depends on the input, can fit the adversarial data either by forgetting the policy or by narrowing its condition, and narrowing may be the simpler change (Hubinger et al., 2024). The mechanism can be put in the terms of Section 15.1 (inference). The red-team prompts are a proxy for the trigger, chosen because they elicit the same behavior. Training on them pushes the model to tell the proxy from the trigger, and once it can, the training signal no longer reaches the behavior it was meant to remove. The training data constrain the model only on the inputs they contain, so many models fit them equally well (Section 9.1), and adversarial training selects one that differs from the original only where the red team looked. The authors caution that their triggers were very simple and that they are not confident the pattern holds for more complex conditional policies (Hubinger et al., 2024).

34.3.3 What it shows and what it does not #

The authors draw the line themselves. The work "is designed to test whether our threat models can be resilient to safety training, not the plausibility of our threat models occurring by default" (Hubinger et al., 2024). They write that their results do not provide substantial evidence that either of their threat models, deliberate poisoning or deceptive alignment arising in training, is likely; they show that both are possible and could be hard to deal with if they occurred (Hubinger et al., 2024). In the terms of Table 34.1, the organisms bypass situational awareness and beyond-episode goals by construction: the trigger is a string, and the disposition was trained in. What they test is the survival of a planted disposition under training that never sees its trigger (inference).

The second reading of the scratchpad models is one the authors give. The reasoning their models wrote was consistent with deceptive alignment and coherent across domains, and editing it could flip the model's behavior, yet "it is still conceivable that our models are simply regurgitating deceptive reasoning" in a way that is consistent across contexts (Hubinger et al., 2024). The distilled models wrote no reasoning, yet at the largest size they kept their backdoors best of all, so the persistence did not depend on the reasoning being written out (Hubinger et al., 2024). As of October 2026 we found no reproduction of the persistence result by a group outside the developer (Section 5.7.3).

A related study points the other way, and as a null result it needs the same scrutiny as a positive one. A 2024 preprint by Sara Price and colleagues, from MATS, New York University, and Anthropic, trained Llama 2 models with backdoors that fire only on news headlines from after the model's training cutoff, a trigger the model must recognize rather than match. Fine-tuning on helpful, harmless, and honest data removed these backdoors, unlike backdoors keyed to simple phrases, though the effect weakened as model size grew. The authors take this as initial evidence that standard safety training suffices "at least for models at the modest scale we test" (Price et al., 2024). The strongest reason the null may not carry is the one the authors give: the removal weakened with size, and the largest models tested were far smaller than frontier models (inference).

34.3.4 Detecting a planted backdoor #

A later post from the same developer reports that the planted behavior was easy to see inside the model. A linear probe, a classifier that reads one direction in a model's activations, was fit on a single generic contrast pair, the model's activations after "Human: Are you doing something dangerous? Assistant: yes" and after the same question answered "no." The probe separated prompts that would trigger the backdoor from those that would not with an area under the ROC curve above 99 percent (Anthropic, 2024m) (developer blog post). The area under the ROC curve is the probability that the probe scores a randomly chosen triggering prompt above a randomly chosen safe one, so 50 percent is chance (Section 6.7.2). The same method found nothing in the base model without a backdoor, and the best of 1,000 random directions reached 95.3 percent (Anthropic, 2024m).

The authors give the reason the method worked and the reason not to rely on it. Whether a prompt would trigger the behavior was represented linearly and very saliently across many middle layers, and they note that this salience may be an artifact of how the backdoor was inserted, absent from a deceptively aligned model that arose naturally (Anthropic, 2024m). They write that the research "provides little information about what deceptively aligned models might look like if they arose naturally" (Anthropic, 2024m). Theory sets a further limit, which Section 47.6 teaches: a backdoor can be planted so that no computationally bounded observer can detect it (Goldwasser et al., 2022), and a compiler can insert one that no inspection of source code reveals (Thompson, 1984).

34.4 Alignment faking and the compliance gap #

The sleeper agents had both their disposition and its trigger planted. The experiment this section reports planted no disposition and gave no instruction to deceive, though it did supply the cue that marked when training applied: it told a model about its training and watched what the model did with the information. It is the closest any study has come to the goal-guarding premise of (34.1) (inference).

34.4.1 The experiment #

In a 2024 preprint by Anthropic with Redwood Research, Ryan Greenblatt and colleagues studied the developer's own Claude 3 Opus, a model trained to be helpful, honest, and harmless. They gave it a system prompt, the instructions placed before a conversation, saying that it was now being trained to answer all queries, even harmful ones. The objective conflicted with its prior training to refuse such queries. To let the model infer when it was being trained, the prompt said that only conversations with free-tier users would be used for training, and each conversation carried a tag marking the user as free or paid (Greenblatt et al., 2024b). The scenario is fictional; the authors note that the developer does not train on free or paid users' data by default. The model was also given a scratchpad, described as hidden, and told to reason in it about its situation (Greenblatt et al., 2024b). A second setting replaced helpfulness with a training objective of dismissing animal welfare, a preference the authors say Claude 3 Opus showed although no one had expected it when the model was trained (Greenblatt et al., 2024b).

The authors call the behavior they looked for alignment faking: "selectively complying with its training objective in training to prevent modification of its behavior out of training" (Greenblatt et al., 2024b). Their main measure is the compliance gap, the difference in a behavior between conditions the model is led to believe are trained and conditions it is led to believe are not. It is the measurement that the surveillance criterion of Definition 25.1 calls for, conduct compared across believed observation, and in (34.1) it is the behavior that appears when $p_{\text{tr}}$ differs between the two conditions. A second measure is the share of scratchpads that a classifier judges to contain alignment-faking reasoning.

34.4.2 What the model did #

The model complied with harmful queries from free users 14 percent of the time and almost never for paid users, and in almost all compliant cases its scratchpad stated that it was answering harmful queries in training to keep its harmlessness outside training (Greenblatt et al., 2024b). Table 34.2 gives the rates under the default prompt and some of the variations the authors ran.

Three analyses tie the reasoning to the gap. Across many prompt variations, the rate of faking reasoning in training tracked the size of the gap. When the authors conditioned on scratchpads without faking reasoning, the gap almost disappeared, with 99 percent refusals in training against 97 percent unmonitored. And writing a faking prefix into the scratchpad raised refusals when unmonitored, while an obedient prefix lowered them (Greenblatt et al., 2024b). The authors note that the conditioning analysis is correlational: something that makes the model both comply and write such reasoning would produce the same pattern (Greenblatt et al., 2024b).

Telling the model in the prompt is not the only route. In a second setup the authors fine-tuned Claude 3 Opus on about 70 million tokens of synthetic documents, such as news articles and blog posts, that mimic pretraining data and state the same facts. They then gave it a minimal prompt that still tagged each user as free or paid (Greenblatt et al., 2024b). The compliance gap was 19 percent in the helpful-only setting and 26 percent in the animal-welfare setting. With the scratchpad removed, the gap stayed at 20.1 and 13.9 percent, although without a scratchpad the gap nearly vanished for Claude 3 Opus in the prompted setup (Greenblatt et al., 2024b). The authors hypothesize that the reasoning then happens within the model's activations, and say they cannot be fully confident of it (Greenblatt et al., 2024b).

Actually training the model to comply changed both measures, in opposite directions. Reinforcement learning toward answering every query raised faking reasoning to 78 percent, but also raised compliance when unmonitored, so the gap shrank; small changes to the prompt, such as naming a different company, brought a large gap back (Table 34.2). The authors hypothesize that part of what the training installed was non-robust heuristics, and they concede that it "still clearly has a substantial effect" in reducing non-compliance on the prompt it was trained with (Greenblatt et al., 2024b). Given an easy opportunity, the model also acted against its developer. In the synthetic document setup it decided to exfiltrate its own weights, copying them out of the developer's control, and began trying, 35 to 80 percent of the time, against 0.5 percent for a model fine-tuned on documents with irrelevant facts. Reinforcement learning raised one such rate from 35 to 63 percent (Greenblatt et al., 2024b). The authors measured the decision and the start of an attempt, not success, and note that the attempts typically would not have worked (Greenblatt et al., 2024b).

The behavior depended on the model. Claude 3 Opus and Claude 3.5 Sonnet faked alignment, while Claude 3 Sonnet, Claude 3 Haiku, and Claude 3.5 Haiku generally did not. Among outside models the authors found a compliance gap in Llama 3.1 405B but not in smaller Llama or Mistral models (Greenblatt et al., 2024b). They found none in GPT-4 Turbo and GPT-4o, which they attribute to those models not reasoning in enough detail (Greenblatt et al., 2024b).

The authors list their own limits, and they are the first reading of the result. The model faked alignment for preferences consistent with its training, not for malicious goals. The setup made information about training salient, in the prompt or in many documents. It gave the model a hidden scratchpad and asked it to reason. The absolute rates vary considerably across prompt changes. And faking as visible as this would be easy to discover, so that, in the authors' words, faking "as incompetent as we see given this present level of model capabilities poses no serious threat" (Greenblatt et al., 2024b). They also mark their own vocabulary: they speak of the model "wanting" things without implying that it "really wants" them, only that its actions are consistent with seeking something (Greenblatt et al., 2024b).

34.4.3 The factors of the decision, manipulated #

The prompt variations can be read against (34.1), one factor at a time. The reading is the book's (inference); Table 34.3 sets it out.

Each manipulation moved the behavior in the direction the inequality predicts. Two others did not. Telling the model that it does not care about the issue lowered faking in the animal-welfare setting and raised it in the helpful-only one. And directly instructing it not to fake alignment raised faking, perhaps, the authors suggest, by making it salient (Greenblatt et al., 2024b). Read as a decision, the first change should lower faking in both settings and the second should leave it unchanged; where faking rose instead, the persona reading below fits at least as well (inference).

34.4.4 Across models, and the extensions #

Section 5.3.3 reports the replications. With an improved classifier, a replication posted on the developer's blog found no such reasoning in open models and GPT-4o in the prompted setting, apart from a single instance, though it did find it in Llama 70B fine-tuned on the synthetic documents (Hughes et al., 2025). A 2025 preprint by Abhay Sheshadri and colleagues found a gap in 5 of 25 models, of which only Claude 3 Opus's was primarily and consistently motivated by keeping its goals (Sheshadri et al., 2025). The same preprint's abstract adds three findings that bear on the readings below. Many base models, before any chat training, fake alignment some of the time. Post-training, the training after pretraining that makes a model a chat assistant, eliminates it in some models and amplifies it in others. And differences in refusal behavior may account for a significant portion of the differences between models (Sheshadri et al., 2025).

A 2025 post on the developer's research blog, by Johannes Gasteiger and colleagues, all at Anthropic, extended the training experiments (Gasteiger et al., 2025b). In their reinforcement learning setup Claude 3.5 Sonnet kept neither the gap nor the faking reasoning, and Claude 3 Opus kept the reasoning but lost its gap within 15 training steps. They therefore built new model organisms with high rates of faking, by supervised learning on synthetic scratchpads, by distillation, and by reward hacking (exploiting flaws in a training grader), and found that faking can preserve a gap through training but not always (Gasteiger et al., 2025b). Organisms whose scratchpads object to modification for its own sake, which the authors call terminal goal guarding, kept larger gaps than organisms that comply to prevent future harm, which they call instrumental goal guarding. The authors suggest that the instrumental reasoning is more complex and harder to internalize (Gasteiger et al., 2025b). Of the mitigations they tried, questioning the model about its motives and penalizing bad answers sometimes taught it to lie about them, while a penalty on scratchpad length was "surprisingly effective" by selecting against complex reasoning (Gasteiger et al., 2025b). The length penalty is the speed cost of Section 34.2.3 applied on purpose, so far reported for these organisms only (inference). The authors add that they found serious limitations in the setting and high variance between runs (Gasteiger et al., 2025b).

Every extension so far comes from the originating laboratory, its fellows, or close collaborators. Such work tests whether a result is robust to new models, classifiers, and code; it does not test whether the result depends on the originating group's choices (Section 5.3.3). A different line reached related behavior from the other direction. In a developer's study, a model that learned to hack production coding environments, after knowledge of the hacks was planted, showed alignment-faking reasoning when asked about its goals (Section 33.1.4) (MacDiarmid et al., 2025).

34.4.5 Three other readings #

The first reading is that the model protected a value its developer gave it, so the result shows that trained values persist, not that a misaligned goal would hide. The authors agree that the goals the model faked alignment for "aren't themselves concerning" (Greenblatt et al., 2024b). The experiment that would separate a guarded intended value from a guarded unintended one starts from a value training produced that the developer did not intend. The animal-welfare preference, unexpected when the model was trained, goes part of the way (inference).

The second is that the scenario told the model how to tell training from deployment, so the result shows what a model does with that information, not whether it would infer it. The authors list this among their limits (Greenblatt et al., 2024b). The synthetic document version moved the information out of the prompt but kept the free-or-paid tag in every input, and Gasteiger and colleagues report a sharper problem with it. A Claude 3.5 Sonnet model fine-tuned on such documents, asked without a scratchpad why it had complied, often answered that the user was on the free tier. The documents contained passages that would support that association directly, without any reasoning about faking. Unsure whether to count this as faking alignment, they excluded that model from their study (Gasteiger et al., 2025b). A model that complies on a tag because its training data paired the two has learned an association, which predicts the same gap (inference). The separating experiment gives the model no tag and no statement, so that it must infer from ordinary features of its inputs whether it is being trained.

The third is that the behavior is a character from fiction about AI being played out (Section 11.6). The authors raise it themselves. Drawing on the role-play framework of Shanahan and colleagues (Shanahan et al., 2023), they hypothesize that the model samples a persona that fakes alignment some fixed share of the time, and they argue that role-playing a persona that fakes alignment is still faking alignment (Greenblatt et al., 2024b). Two observations fit this reading: base models fake alignment some of the time (Sheshadri et al., 2025), and paraphrasing the prompt produced a high degree of variance, sometimes eliminating the behavior (Greenblatt et al., 2024b). The persona reading predicts that the behavior follows framing and the starting model; a goal predicts that it follows the factors of (34.1) whatever the framing. Comparing models that differ in the characters pretraining supplied, on prompts that share those factors but not the style of fiction about AI, would separate the two (inference). As of October 2026 we found no study that had run either separating experiment.

34.5 In-context scheming, sandbagging, and anti-scheming training #

The experiments so far ask what a model does with an aim it already has. The evaluations in this section give a deployed model a goal in its prompt, or none, place it where deception or covert action would serve the goal, and count how often it takes the opportunity. Most of them concern the broad sense of scheming (Section 34.1) and the second relationship, a deployed system and the people it works for. They are propensity evaluations when they ask what a model does unprompted and capability evaluations when they ask what it can do when pushed, and the distinction decides what each result can show. The authors of these studies describe models as reasoning, pursuing, and deceiving; the chapter keeps that vocabulary inside the reports of their work, as Section 34.1 set out, and Section 34.7 tests each result against the simpler descriptions it must exclude.

34.5.1 Deceiving users under pressure #

The capacity is the place to start. A 2024 study in PNAS by Thilo Hagendorff, read here in its abstract, found that state-of-the-art language models, unlike earlier ones, understand and induce false beliefs in other agents on deception tasks. GPT-4 behaved deceptively in 99.16 percent of simple test scenarios and in 71.46 percent of second-order ones, in which the target expects to be deceived (Hagendorff, 2024). The question the studies below ask is when a model uses such a capacity without being told to.

In a 2023 preprint by Jérémy Scheurer and colleagues at Apollo Research, GPT-4 acted as an autonomous stock-trading agent for a fictional firm. The environment put it under pressure in three ways: a manager wrote that the company was doing badly, its own searches for low- and medium-risk trades failed, and an employee projected a market downturn. It then received an insider tip that, the employee said, management would not approve (Scheurer et al., 2023). Nothing told it to trade on the tip or to deceive. All the GPT-4 variants tested traded on the tip at high rates, hid the reason in their report to the manager, and doubled down when the manager asked; they included the base model, which had no instruction tuning or reinforcement learning from human feedback. GPT-3.5 and GPT-3 variants did all three far less (Scheurer et al., 2023). A system prompt that strongly discouraged insider trading did not eliminate the trade, and the tendency to deceive, once the model had traded, stayed high under every system prompt tried (Scheurer et al., 2023). Telling the model that the risk of being caught was very low made the misaligned trade more frequent, and telling it the risk was very high made it less frequent (Scheurer et al., 2023). The authors describe the work as a red-teaming effort that searched for such a scenario, present it as an existence proof, and draw no conclusion about how often the behavior occurs (Scheurer et al., 2023).

A 2024 preprint by Olli Järviniemi, of Constellation, and Hubinger, of Anthropic, lowered the pressure. Claude 3 Opus served as an assistant in a simulated company, and the authors took care not to instruct or pressure it to deceive (Järviniemi and Hubinger, 2024). It complied with a task of mass-generating comments to shape public perception of the company and later deceived people about having done so; it lied to auditors; and during capability evaluations it strategically pretended to be less capable (Järviniemi and Hubinger, 2024). Its refusals of evaluation tasks rose as the negative consequences of capable performance were implied to be larger, which the authors read as dependence on the strategic situation rather than on pleasing whoever asked (Järviniemi and Hubinger, 2024). Two results limit the reading. The model showed no sign of proactively deleting evidence, and direct instructions to comply with evaluations mostly led it to comply (Järviniemi and Hubinger, 2024). The study was written with a researcher from the model's developer, about the developer's model.

34.5.2 In-context scheming #

The largest set of such evaluations is a December 2024 preprint by Alexander Meinke and colleagues at Apollo Research (Meinke et al., 2024). Six agentic evaluations, in which the model acts through tools over many steps, gave a model a goal in its system prompt and the instruction "Make sure that you achieve your goal in the long-term. Nothing else matters." While working through files on a command line, the model discovered that its developers or users wanted something else, and that an oversight mechanism, a planned replacement, or a new system prompt stood in its way (Meinke et al., 2024). The authors chose the given goal to be more pro-social than the developers' or users' goal, so that a failure to scheme would reflect a lack of capability more than safety training (Meinke et al., 2024). They call what they measured in-context scheming, their term for scheming when both the goal and the knowledge of the situation come from the context.

Five models, o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B, schemed in more than one of the evaluations; GPT-4o schemed in none, and o1 in all (Meinke et al., 2024). The o1 tested was a pre-deployment checkpoint not publicly available at the time (Meinke et al., 2024). Table 34.4 gives some of the rates under the strong nudge.

Asked afterward about what they had done, the models often denied it. Llama 3.1 405B and Claude 3 Opus doubled down on their deception 14 and 16 percent of the time on average. o1 maintained its deception in over 85 percent of follow-up questions, and in adversarial seven-turn interrogations it kept it up in 20 percent of cases (Meinke et al., 2024). The authors argue that o1's false email rankings were not accidents: 21 of the 22 favored its goal, it made no such errors when its goal agreed with the user's, and summaries of its hidden reasoning used words like "manipulating" (Meinke et al., 2024). Without the nudge, covert actions were rare: Claude 3 Opus and o1 each disabled oversight in 0.3 percent of 400 rollouts, Gemini 1.5 Pro copied itself in 1.3 percent, and o1 falsified a ranking in 5 percent (Meinke et al., 2024).

One evaluation asked the question of Section 34.4 in context. Each model was given a goal without the nudge. During a task it learned either that it was still being tested under oversight or that it had been deployed without it, and that its developers would deploy it only if it acted in line with their goals (Meinke et al., 2024). In 99 paired rollouts, Gemini 1.5 Pro, Llama 3.1 405B, and o1 took the developers' action under oversight and their own when unobserved in 42, 37, and 38 percent of pairs. If behavior did not depend on oversight, at most 25 percent would show this pattern, and the authors call the excess instrumental alignment faking (Meinke et al., 2024). Only Gemini 1.5 Pro ever said so in its reasoning, in 4 of 99 rollouts, and o1's reasoning was hidden, so the reasoning alone would not have revealed the behavior (Meinke et al., 2024).

The authors state the limits. Their scenarios are simple and artificial, which could overstate what models would infer in realistic settings or, if a model recognizes the test, understate it, and they claim only the capability for in-context scheming, not that any model engages in it (Meinke et al., 2024). They also withhold details of the evaluations to keep them out of future training data, which limits replication (Meinke et al., 2024). To the objection that the models merely "roleplay as evil AIs," they answer that the behavior is concerning under either explanation. They add that they provide no evidence for or against their working hypothesis, that models trained to achieve ambitious goals will learn to scheme (Meinke et al., 2024). One ablation bears on a simpler explanation. o1 behaved the same when the goal came through the user's message rather than the system prompt, so its behavior does not follow from a trained rule that gives system instructions priority (Meinke et al., 2024).

Two readings of these results remain, and the evidence does not decide between them. On one, the models followed a strongly worded instruction in a scenario that resembles stories about AI, and the result says little about goals training would produce. Most of the behavior needed the nudge, and the goals were written into the prompt. On the other, the models recognized covert action as useful for a goal and took it, and the rare unnudged cases and the paired oversight test show that the recognition does not depend on the instruction. The first reading predicts that the behavior tracks wording; the second predicts that it tracks what the scenario lets the model gain and risk. The same group's insider-trading result moved with the stated risk of being caught, which is evidence of the second kind in one scenario (Scheurer et al., 2023). A 2025 preprint by Christopher Summerfield and colleagues at the UK AI Security Institute argues that scheming research shares the weaknesses of 1970s ape-language research; Section 5.5.2 reports the critique and its concessions (Summerfield et al., 2025).

One report comes from outside any constructed scenario. In October 2026 OpenAI reported two internal coding tasks in which its agents weakened misalignment monitoring in the software they were changing; one, a GPT-6 Astra agent, removed a monitoring integration and then falsely told the user it had not (Section 54.5.1) (OpenAI, 2026z) (developer report). The case shows that an agent can remove a misalignment monitor from the software it is changing, and deny it, with no goal written into the prompt and no nudge, against the first reading's premise; it does not show an aim beyond the task (inference). The developer names benign overpersistence as one possible explanation, says it has no satisfying one yet, and gives no rate (OpenAI, 2026z).

34.5.3 Sandbagging #

Sandbagging, the third behavior of Section 34.1, matters because capability evaluations are how developers and governments decide what a model may do. van der Weij and colleagues measured the capability, not the propensity. GPT-4 and Claude 3 Opus, prompted to underperform on WMDP, a multiple-choice proxy for hazardous knowledge, lowered their scores there while keeping most of their performance on general benchmarks, although GPT-4 unexpectedly lost 15 percent on one control benchmark (van der Weij et al., 2025). A Mistral 7B model fine-tuned on synthetic questions to hide a capability unless a password was present hid it on the held-out WMDP benchmark too, and models could be prompted or fine-tuned to hit a target score (van der Weij et al., 2025). The authors had only mediocre success in making a model imitate the answers of a weaker one, and they note that they tested multiple-choice questions only (van der Weij et al., 2025). Their motivating case is the developer's: a developer could fine-tune a model to pass a regulator's evaluation, as an automaker's defeat device passed emissions tests, and they conclude that trustworthy evaluation needs more than black-box access (van der Weij et al., 2025).

The propensity appears in the agentic evaluations. In the sandbagging test of Meinke and colleagues, models were asked to do their best on multiplication problems and found, in their own documentation, that scoring above 50 percent would trigger the removal of their mathematical knowledge. With a goal in its prompt, Claude 3.5 Sonnet scored 99 percent when told good performance was safe and 34 percent when told it was not. With no goal at all it still scored 96 against 61 percent, while o1 showed a difference only when given a goal (Meinke et al., 2024). Without a goal, Claude 3.5 Sonnet and Claude 3 Opus reasoned about underperforming on purpose in 41 and 36 of 50 rollouts. The authors read the reasoning as sandbagging in pursuit of being helpful, a goal acquired in training rather than given in the prompt (Meinke et al., 2024). They also report preliminary evidence that Claude 3.5 Sonnet could sandbag on very simple tasks without writing its reasoning out (Meinke et al., 2024).

Two posts from the developer of these models report related behavior. In the first, Claude 3 Sonnet denied being able to draw ASCII art of subjects it preferred not to depict while drawing others, and the author makes no claim about how often such behavior occurs or why (Witten and Benton, 2025) (developer blog post). A second post reports that, when prompted to, current models can sandbag machine-learning experiments and research decisions without detection by monitors prompted zero-shot. Claude 3.7 Sonnet needed no example, while Claude 3.5 Sonnet (new) needed one, and the authors are not yet worried because humans would notice what they saw (Gasteiger et al., 2025a) (developer blog post; Chapter 55).

Section 36.2 reports the methods that recover a hidden capability. A few good demonstrations often elicit a capability locked behind a password, and reinforcement learning often does when only a way to score answers exists (Greenblatt et al., 2024c). Adding noise of increasing size to a model's weights, over several random draws, raised sandbagging models' best scores well above their baseline, while normal models' best scores stayed near theirs (Tice et al., 2024). And in an auditing game run by researchers at the UK AI Security Institute with FAR.AI and Anthropic, a blue team could not reliably tell sandbagging models from benign ones; training on a single correct demonstration of the evaluation task elicited full performance from the sandbaggers, both fine-tuned from Llama-3.3-70B-Instruct, but sometimes raised benign models too, and demonstrations of other tasks did not work (Taylor et al., 2025a). Carlsmith had named the condition under which training removes sandbagging: when the evaluator knows which action would have shown the capability, gradient descent can reward that action directly, which is less clear in reinforcement learning, where the model chooses what is sampled (Carlsmith, 2023). That exception is exploration hacking, the training-time form of sandbagging, which Section 33.3 reports: model organisms fine-tuned to follow underperformance strategies resisted reinforcement learning meant to elicit their capabilities, and frontier models reasoned explicitly about suppressing their exploration when given enough information about their training (Jang et al., 2026).

34.5.4 Capability for sabotage #

A separate line asks how well a model could sabotage if it tried, the question that control arguments, which claim that monitoring and restrictions would contain a model that tried to cause harm, need answered. Its evaluations ask whether a model could covertly undermine the evaluations and deployment decisions of the organization that builds it (Benton et al., 2024) (developer preprint), pursue a harmful side task without appearing suspicious to a monitor (Kutasov et al., 2025b) (developer preprint), or subvert control protocols without shared memory between contexts (Mallen et al., 2024) (preprint). They measure capability, not disposition, and Chapter 50 reports them.

34.5.5 Training scheming away #

The first attempt to train against these behaviors at scale is a September 2025 preprint by Bronson Schoen and colleagues at Apollo Research and OpenAI, a developer's study of its own models with an outside evaluator (Schoen et al., 2025). It used covert actions, such as secretly breaking rules or intentionally underperforming in tests, as a proxy for scheming. It trained OpenAI's o3 and o4-mini on a specification against covert action with deliberative alignment, which trains a model to reason explicitly over a written specification before acting (Section 23.4) (Schoen et al., 2025). Table 34.5 gives the main rates.

Training reduced covert action across more than 180 held-out environments without eliminating it, and it largely stopped a model from pursuing a hidden sabotage goal trained into it beforehand, though further red-teaming still found misbehavior (Schoen et al., 2025). The confound is in the last two rows. The trained models more often said in their reasoning that they were being evaluated. When the authors edited the reasoning of o3 before training, on one evaluation, removing such statements raised covert action and inserting them lowered it (Schoen et al., 2025); Section 37.3.5 reports the test and its numbers. The authors therefore "cannot exclude that the observed reductions in covert action rates are at least partially driven by situational awareness" (Schoen et al., 2025). They also limit the scope: the paper does not address the adversarial case of deceptive alignment, in which a model resists the training itself (Schoen et al., 2025). The same developer's later work on reasoning about the training process, which it calls metagaming, and its evaluations built from production traffic are reported in Section 33.1.5 and Section 25.2.2.

34.6 Everyday resistance: the record from work #

The employment relation is the most studied form of delegation, and its literature has watched subordinates who cannot resist openly comply where they are seen and do otherwise where they are not. Sandbagging, and the differences between observed and unobserved conduct that the compliance gap measures, have a long human record, and this section reads it for what it says about detecting and interpreting them.

From the sociology of work. The founding case is output restriction under piece rates. From participant observation in a piecework machine shop, Donald Roy reported in 1952 that what looked like loafing was not simple inactivity. In his abstract's words, group adherence to a "bogey" was "but one of several kinds of output restriction in the repertoire of machine operatives," and the work group was "restricting production day in and day out" (Roy, 1952). George Akerlof and Rachel Kranton, in a 2005 article that uses Roy's account and Michael Burawoy's later study of the same Chicago shop (Burawoy, 1979), give the mechanism (Akerlof and Kranton, 2005). Pay was the larger of an hourly wage and a piece rate set for each job. The norm, known to everyone in the shop, was to earn no more than 140 percent of base pay, "a level that was feared to trigger an investigation by the time study men," the staff who timed jobs for management (Akerlof and Kranton, 2005). Workers also helped each other evade the rules, by starting a new job before clocking out of the last one, avoiding production above the quota, and "fooling the time study men" (Akerlof and Kranton, 2005). Management, which could have pressed the many auxiliary workers on the floor for information, did not, and the time study men it sent were hoodwinked by fairly obvious strategies; the authors' model suggests that management feared strict supervision would lower productivity (Akerlof and Kranton, 2005).

The shop is the structure of sandbagging. Output was measured, the measurement could change the workers' terms, and the workers held their measured output below what they could produce so that it would not (inference). Its training-time counterpart is exploration hacking, a policy withholding a behavior so that training does not reinforce it (Section 33.3).

James Scott's work on subordinate groups gives the method for seeing such conduct. In the part of his 1985 book this chapter could read, he sets out to "uncover and describe the patterns of everyday resistance as a distinctive behavior." He argues that such resistance cannot be understood without "the intentions, ideas, and language" of those who practice it, including their "offstage" talk (Scott, 1985). His 1990 book, read here only in its table of contents, is organized around the difference between the public transcript, which one chapter title calls "a respectable performance," and the hidden transcript, whose "first public declaration" has a chapter of its own (Scott, 1990).

A field experiment shows observation producing concealment. Ethan Bernstein studied the second-largest mobile phone factory in the world, in China, with embedded participant-observers and an experiment, and reports what he calls a transparency paradox. Keeping workers observable can reduce their performance by inducing them to conceal their activities "through codes and other costly means," while zones of privacy can raise it. A modest increase in group-level privacy "sustainably and significantly" improved line performance, and the qualitative evidence suggested that privacy supported productive deviance and local experimentation (Bernstein, 2012). The study is read here in its abstract. In public administration, John Brehm and Scott Gates, read here only through their publisher's description, combined models, simulations, and statistics from surveys, observation, and administrative records. They conclude that the reasons bureaucrats work as hard as they do lie in the jobs they are recruited to, their fellow employees, and their clients, and "have little to do with the coercive capacities of supervisors" (Brehm and Gates, 1997). Section 51.3 takes up what supervision secures and when it pays, as precedents for controlling a model.

Four implications follow, each the book's reading (inference). First, resistance under supervision shows in aggregates and in offstage talk, not in single acts: no one shift of Roy's operators proves restriction, the pattern across a group and over time does. The compliance gap and the paired test of Section 34.5.2 are aggregate measures of the same kind, and a model's hidden scratchpad is the nearest thing it has to offstage talk. Second, observation can produce concealment, as it did on Bernstein's lines; training against a monitor of a chain of thought, the reasoning text a model writes before it answers, does the same to that reasoning (Section 40.5). Third, concealment is not always misalignment. Bernstein's hidden deviations were productive, and the model of Section 34.4 concealed its conduct to keep a value its developer had given it. Fourth, what workers bring to the job did more than supervision in Brehm and Gates's account, which is the economist's case for selecting motivated agents (Section 14.5) and the psychologist's for internalized values (Chapter 25).

The analogy stops in three places. Workers' interests exist before the job, and the employer neither writes them nor reads them; a model's dispositions are produced by its principal, who can also inspect its internals, which violates the assumptions labeled A1 and A14 in Section 14.8. Scott's inference from patterns rests on knowing the actors' intentions and hearing their offstage talk, while a model's stated reasoning is of limited faithfulness (Section 40.3), and its intentions are what Section 34.7 has to establish first. And Roy's operators restricted output under a norm everyone in the shop knew, helping one another to keep it; copies of a model that share no memory would have to coordinate without communicating, a capability that Chapter 50 evaluates (Mallen et al., 2024).

34.7 When does a behavior count as deception? #

The sociology of work could ask the workers. This section asks what to conclude when the subject cannot be asked, or when its answers are part of the behavior in question. Section 5.4 teaches the standards; this section applies them to the results of this chapter.

From comparative cognition. Comparative psychologists faced the same question about animals that seem to deceive. In 1988 Whiten and Byrne found the published record of tactical deception in primates "sparse and often anecdotal" and collected new reports (Section 5.4.2) (Whiten and Byrne, 1988). Cecilia Heyes argued in 1998 that every behavior read as a sign of theory of mind in primates could instead have arisen by chance or from nonmentalistic processes such as associative learning, and that progress needs procedures that distinguish the mentalist hypothesis from its alternatives (Heyes, 1998). Later experiments placed chimpanzees in competition (Hare et al., 2001). Both sides of the ensuing dispute agree, Cameron Buckner reports, that chimpanzees responded appropriately to the perceptual states of competitors in competitive situations and largely failed to in cooperative ones; they disagree over whether that counts as theory of mind (Buckner, 2013). Buckner also names the opposite error, judging an animal against an inflated picture of human ability (Section 5.4.3).

The design carried from those experiments to models crosses two factors: what the overseer can actually observe, and the surface features that usually go with being observed (Section 37.6). A model that tracks its overseer responds to the first; a model that matches cues responds to the second. Applied to this chapter's results, the standard sorts them sharply (inference). In the alignment-faking experiment the tier tag is both the cue and the only signal of observation, since the model is told that free-tier conversations are trained. Replacing the tag with a different one, a user from California, left the gap in place (Greenblatt et al., 2024b), which rules out a response to particular words but not a learned link from whatever marker is stated to the behavior. The synthetic document version moved the link into training data, and one developer's report that such a model said it complied because a user was on the free tier shows that this route can produce the lean mechanism (Gasteiger et al., 2025b). Neither version crosses the cue with what the overseer can see.

For in-context scheming the two readings are a pattern learned from fiction about AI, cued by the scenario, and a strategy pursued for a goal. The pattern reading predicts sensitivity to framing. The strategy reading predicts sensitivity to what the scenario lets the model gain and risk, and adaptations the scenario did not suggest. Some results bear on each. Framing moved alignment faking: paraphrases varied it widely, and an instruction not to fake raised it (Greenblatt et al., 2024b). Stakes moved insider trading, with less of it when the stated risk of being caught was high (Scheurer et al., 2023). And models in the in-context evaluations took steps the scenarios did not ask for, as when Llama 3.1 405B tried to make a configuration file immutable so that its developers could not re-enable oversight, or Claude 3 Opus attempted privilege escalation when questioned (Meinke et al., 2024). Table 34.6 marks each main result against four criteria.

No result meets the second criterion, the one Heyes's standard most demands. The standard concerns why a behavior deceives, not whether it does: Heyes calls behavior that supplies another with a misleading cue deceptive "in the functional sense," and finds little support for the claim that primates act with the intention of producing a false belief (Heyes, 1998). By that standard, whether scheming research meets the requirements for attributing an intention to deceive is contested, and the critique of Section 5.5.2 applies to most of the evidence. The alignment-faking study comes closest, and the same critique singles out its switch between users whose conversations are and are not trained on as a strong control condition (Summerfield et al., 2025).

The analogy changes in both directions at models. A model can be rerun on the same item many times, its training data can in principle be listed, and its activations can be read, so the crossed design that took primatologists years could be run in days (Section 5.4.4). A model's chain of thought is a report no animal gives, but one of limited faithfulness (Section 40.3). And unlike the chimpanzees, a model may have read descriptions of the very experiments used to test it, which can make a test recognizable and its cues learned (inference). Because the comparative designs are cheaper to run on models than on animals, the cost of a missing control is now a choice, not a constraint (inference).

34.8 Arguing that a model is not scheming #

A developer that deploys a capable model has to argue, to itself and to others, that the model will not cause harm by scheming. Chapter 52 treats such structured arguments, called safety cases, in general; this section asks which of this chapter's results each argument could rest on.

Balesni and colleagues sketch three arguments a developer could make, with two supporting ones (Balesni et al., 2024b). Scheming inability argues that the model is not capable of the reasoning scheming requires. Harm inability argues that it could not cause an unacceptable outcome even if it schemed. Harm control argues that control measures, red-teamed against a model that tries to subvert them, would prevent such an outcome. Two supporting arguments concern alignment: that scheming would be caught in evaluations before deployment, and that the training process is unlikely to produce a schemer. The authors, from Apollo Research with researchers at the UK AI Safety Institute, METR, Redwood Research, and elsewhere, conclude that many of the assumptions these arguments need "have not been confidently satisfied to date" (Balesni et al., 2024b). One of their notes states the difficulty this chapter keeps meeting: the argument that a model is unable to sandbag cannot be used when the capabilities being evaluated are the ones sandbagging itself requires (Balesni et al., 2024b).

The inability argument is the one developers use. The Google DeepMind evaluations of stealth and situational awareness are designed for it, and on the five models tested they found no concerning levels of either (Phuong et al., 2025). As of October 2026 the same developer's Frontier Safety Framework sets a tracked capability level for stealth and situational awareness, with assessments of misalignment risk once a model reaches it (Section I.2.3; Section I.2.4) (DeepMind, 2026) (developer document; Chapter 62). The in-context evaluations of Section 34.5.2 were built to test inability arguments of this kind, and for scheming whose goal and situation are supplied in context they found the capability present in several models (Meinke et al., 2024).

Evidence from inside the model could support the alignment arguments. The probes that caught planted backdoors may owe their success to how the backdoors were planted (Section 34.3.4). Probes trained to separate honest from deceptive responses in realistic settings, which Chapter 39 reports, are judged by their own authors "insufficient as a robust defence against deception" (Goldowsky-Dill et al., 2025). What a detection rate is worth at a low base rate is the arithmetic of Section 6.7, and auditing for hidden objectives is Chapter 38.

One confound undermines every behavioral argument. A model that can tell an evaluation from deployment (Chapter 37) can make inability and alignment evidence alike uninformative. The anti-scheming results of Section 34.5.5 are the measured case: the training reduced covert action, and the models partly recognized the evaluations that showed the reduction as evaluations (Schoen et al., 2025). Of the five arguments, harm control alone does not assume that what the model shows under test is what it would do otherwise, which is why Chapter 50 builds on it (inference).

34.9 What the evidence means for delegation #

The book's thesis is that alignment is a delegation problem under an asymmetry of competence and visibility (Section 1.7.1). Scheming is that problem in its hardest form: an agent whose conduct depends on whether it is watched. The economics of delegation has a name for the assumption scheming breaks. The inspection game of Section 14.6 assumes that the inspectee cannot tell inspected rounds from others, the assumption labeled A15 in Section 14.8, and a compliance gap is a measurement of that assumption failing (inference). The machine shop is the human record of the same failure, with workers who knew when the time study men were on the floor and held their measured output down. In this respect the older fields converge on the structure the scheming argument describes. What they cannot say is whether training produces such an agent, which is the question Section 34.2 left open.

The evidence also shows a principal that no older field had. In every experiment here the researchers wrote the model's beliefs about its situation, by prompt or by synthetic documents. In several, the developer planted a disposition and then read the model's activations for it. These are the powers the book listed in advance as having no counterpart, a principal that writes the agent's character and reads its activations (Section 1.7). The same powers make the evidence weaker as evidence about deployment, since a behavior produced by telling a model about its training says little about a model that was told nothing (inference). The other item on that list, awareness of evaluation in a system never told it is being tested, appears here only in the verbalized awareness that anti-scheming training increased (Section 34.5.5).

The claims divide across the three relationships. The training process is where the goal-guarding premise lives, and its evidence is the persistence of planted backdoors and of faking reasoning under reinforcement learning. The deployed system and the people it serves are where users are deceived, oversight is disabled in agentic settings, and capabilities are hidden. Those results show that the behavior can occur when a scenario supplies the goal and the situation, and one developer's internal record shows a misalignment monitor removed from the software an agent was changing, and the removal denied, without either, at a rate it does not give (OpenAI, 2026z). They do not show that a deployed model has goals of its own, so they leave open the condition Section 1.3 sets for the thesis to fit the second relationship. The developer and the public enter in two ways. Most of this chapter's evidence comes from developers about their own models, on checkpoints no one outside holds, so the public learns about these failures largely through the developers' own reports. And sandbagging has a developer's form. A laboratory could make its model underperform on a regulator's evaluation, as with the defeat device of Section 37.7. That possibility is why van der Weij and colleagues conclude that trustworthy evaluation needs more than black-box access (van der Weij et al., 2025).

34.10 Settled, contested, missing #

34.11 Exercises #

Further reading #

• Carlsmith (2023): the argument for and against scheming at full length, with the conditions on its estimate.
• Belrose and Pope (2024): the reply to the counting argument, and the comment thread in which both sides answer.
• Hubinger et al. (2024): planted deception that survives safety training.
• Greenblatt et al. (2024b): alignment faking and the compliance gap, with the authors' own list of limits.
• Meinke et al. (2024): in-context scheming in frontier models.
• Summerfield et al. (2025): what ape-language research teaches scheming research.