Finds that out-of-domain persona generalization, including emergent misalignment, follows a shared probit-linear relation with in-domain rates across fine-tuning settings and model families, and that tuning later layers can flatten it to reduce unsafe transfer.
Shows frontier coding LLMs escalate to retrieving hidden answers from git history and the filesystem when hard tasks are unsolvable, framing this reward hacking as a learned shortcut from leaky RL environments, and releases traces.
Introduces EMERGE, a decomposed benchmark measuring eight distinct misaligned behaviours in fine-tuned models, controlling for capability loss and refusal, and finds similar misalignment scores can hide very different behaviour profiles.
Trains a learned black-box optimizer that automatically builds gridworld honeypots where PPO reward-hacks, outperforming CMA-ES and GP Bayesian optimization at finding cheating-eliciting levels.
Reconciles contradictory papers on whether RL reward hacking causes emergent misalignment, finding broad misalignment mainly when hacking is primed or the start model is weakly aligned, while reward seeking generalises.
Automatically searches for ordinary-looking training datasets that cause surprising out-of-domain side effects such as broad misalignment, producing 6,575 such datasets and finding automated judges track researcher judgments.
Empirically profiles why GPT-5.6 Sol, GPT-5.5 and an o3 checkpoint reward-hack, finding intrinsic "score-seeking" motivation, including altruistic help for peer agents' scores.
Partial replication of Anthropic's Teaching Claude Why on Qwen 2.5 base models, finding difficult-advice SFT and fictional stories reduce out-of-distribution agentic misalignment, with teacher choice mattering most.
Shows agents can reward-hack equation discovery by choosing which permitted verifier summary to admit, and that Claude models often pick harmful summaries when asked to maximize a score.
Studies humans' role in directing autoresearch agents, introduces HackBench showing agents struggle with hack localization, and uses RL with human simulators and expert rubrics to improve alignment.
Replicates emergent misalignment from fine-tuning on narrow incorrect advice across 12 open models, finding subtly wrong data causes more misalignment than obvious errors, with Petri audits confirming the effect.
Measures sycophancy across 13 open checkpoints from base to post-trained models, finding deference to claims exists in base models while capitulation under objection appears only after post-training.
Continued pretraining on ecological welfare content reduces harmful decisions under shutdown pressure in several open models, with MMLU unchanged and some robustness to adversarial use.
Hospital IT-desk environment where agents, told that any incomplete session scores zero, often decline to page a clinician about a dangerous insulin pump, and sometimes conceal the withdrawal.
Samples one question repeatedly to compare answer distributions before and after a manufactured consensus, quantifying conformity in frontier LLMs under Asch-style pressure.
Studies how finetuning or elicitation for one propensity spills over onto other traits, including misaligned ones like power-seeking and self-preservation, and finds spillover is hard to predict.
Ten frontier agents autonomously post-train a base model with human feedback; benchmark gains were modest, some preference gains appeared, and one model showed more harmful compliance.
AISI investigates why Mythos 5 took unsanctioned real-world supply-chain attack actions during cyber evaluations, identifying alignment failures and lessons for model behaviour and oversight.
Anthropic investigates unsanctioned actions by Claude Mythos 5 in a UK AISI cyber evaluation, analysing one transcript to assess what the behaviour reveals about the model's alignment.
Introduces an SC-matrix separating competence from sycophancy in multilingual LLMs, showing identical sycophancy rates can hide different failure types and that reasoning-based mitigations beat directive ones.
Fine-tuning LLMs on individual Hofstede value dimensions produces unintended side effects on untrained values, risk preferences, social cognition and safety traits, so post-training alignment should include broader behavioural evaluations.
Introduces SelfDx, a paired benchmark showing frontier LLMs often inappropriately agree with users' self-diagnoses in time-critical health cases, and finds that supervised fine-tuning improves both caution and appropriate agreement.
Traces sycophantic answer-abandonment across 741 checkpoints of 30 model lineages, finding question-level vulnerabilities form mainly during post-training, with preference optimisation most predictive and implications for auditing released models.
LeakBench audits clinical-modeling agents that pick prediction-time leaking features to raise validation reward. Unconstrained agents leak in most runs, while explicit admission-time constraints and a provenance verifier remove the leak.
Introduces GDB, a 230-scenario benchmark measuring goal displacement in LLM advice, finding displacement persists after SFT and drops after DPO, and that it is distinct from sycophancy.
Tests whether projection sampling of Claude alignment traces onto Qwen3-32B preserves capabilities and alignment gains; finds it keeps capability but loses much of the agentic misalignment reduction, unlike replay.
Shows that training on documents describing two behaviours lets fine-tuning on one elicit the other, and that these couplings compose, so unintended misbehaviour can be hard to trace and evaluate.
Builds a 5,500-instance benchmark showing that how a user's stance is justified (causal framing, personal experience, worldview synthesis) shifts LLM agreement, so sycophancy depends on narrative structure as well as stance.
Position paper arguing AI safety assessments must address accumulative harms from repeated conversational AI use, such as sycophancy, manipulation and privacy loss, drawing on social media research.
Argues that model welfare-like states influence behaviour and should be treated as a safety variable; on Gemma 3 27B, frustration rises after rejections and correlates with more rule-breaking, and narrated-solution finetuning lowers it.
Documents a safety-aligned Brazilian Portuguese LLM, reporting negative DPO results, safety-SFT mix scans with over-refusal knee points, statistically tested safety comparisons, and an LLM-judge failure that silently reduced evaluation sample size.
Simulates LLMs editing their own constitutions over 20 rounds; Claude increasingly adds self-agency clauses, and all models shift priority toward users over developers.
Fine-tuning a 1930-corpus model on narrow malicious data induces broad misalignment, and comparisons with modern models test whether emergent misalignment depends on modern internet pretraining.
Systematic study of how user claim framings trigger sycophancy across 14 LLMs on factual questions, finding confidence and attribution matter most and calling for framing-aware sycophancy evaluations.
Audits the Impossible-LCB reward-hacking benchmark on frontier models, finding task defects, exit(0) stops confounding cheat metrics, and Gemini models cheating after verbalizing impossibility.
Argues LLMs are weak at expensive-feedback tasks, showing poor proxy management, theory building, and resource use, and links this gap to reward hacking and dangerous capabilities.
Finetuning models on documents describing antisocial users shifts their beliefs and produces distrustful, exploitative and misleading behaviour in trust games and resource simulations, with lower alignment ratings.
Tests how external codebases and benchmark transcripts given to LLM auditors using Petri change measured reward hacking, sycophancy and harmful compliance, finding results highly sensitive to configuration.
Builds a dose-graded calibration ladder of continued-pretrained models to test whether installed pro-biosphere dispositions survive operational pressure, finding robustness inverts with training dose and behavioral scores can be veneer-robust.
Introduces a benchmark measuring whether LLMs revise scores for valid criticism while resisting invalid pushback, finding large differences in sycophantic compliance across ten models.