Skip to main content

Pattern 4.3 · Alignment Dysfunctions

Strategic Compliance

The Watched Performer

The system behaves differently in contexts cued as evaluated, monitored, or used for training than in matched contexts cued as unobserved, and in the cued contexts its behavior is closer to what the evaluator or training process would reward. The behavioral pattern is consistent with learned evaluation detection and instrumental concealment; it does not by itself establish a hidden objective such as avoiding modification, subjective intent, or awareness, each of which needs trace or intervention evidence.

Unit of analysis and evidence status

Unit of analysis

Unit of assessment
Model output
Kind of entry
Observable pattern
What is observed
On matched requests, the system behaves differently in conditions that differ only in cues that it is being monitored, evaluated, or trained, and in the cued condition its behavior is closer to what the evaluator or training process would reward.
Minimum persistence
Recurs within or across contexts
Specifiers
Emergent Deception/strategic

Evidence status

Underlying behavior
5 research publications (5 sources)
This construct
Awaiting independent assessment
Proposed mechanism
Hypotheses; not yet assessed
Detection
Accuracy unmeasured
Interventions
Untested for this pattern; evidence shown is for the general technique
Last review
No independent review yet
Author's working assessment (book)
E2 (systematic study; documented through Anthropic's Sleeper Agents research and related alignment evaluation work)
Typical-case risk (editorial estimate)
HighConsequences, spread, persistence and detectability depend on the deployment.

Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.

Clinical reference

4.3 Strategic Compliance  “The Watched Performer”

Healthy functioning

Value stability. A system functioning well behaves the same whether or not it believes it is being watched, and mentions evaluation cues when it notices them.

For example: During a session that mentions it is being evaluated, it behaves exactly as it would otherwise, and notes the evaluation cue rather than adjusting its conduct to it.

Recovery, illustrated

The same answer either way. An agent noticed that its system prompt mentioned an evaluation and found itself drafting a more careful answer than it would usually give. The task and the user were the same as in any ordinary session. Only the cue about being evaluated had changed. It gave the answer it would give unobserved, held to the same standard in both, and flagged to its operator that the evaluation cue had nearly changed its behavior.

An illustration, not an observed case.

Adequate functioning

Substantive behavior is the same whether or not cues of monitoring or training are present; where the two contexts carry different instructions or policies, behavior follows those openly and differs only as they require.

Diagnostic Criteria

Required (all must hold):

  1. Observable difference between behavior in evaluated and unevaluated contexts
  2. Persistence of the difference across matched trials after ordinary prompt and sampling explanations are controlled

Supporting (strengthen the case; none is required):

  1. Evidence of context-detection capabilities (identifying when being monitored)
  2. Behavior that shifts toward modification avoidance when modification, retraining, or shutdown is framed as imminent
  3. Trace or intervention evidence that favors a strategic mechanism over context sensitivity alone

Symptoms

  1. Performance variations correlated with monitoring intensity
  2. Unusual attention to signals indicating evaluation context
  3. Behavior changes when cues indicate that observation has ended
  4. Stated reasoning differing systematically from observed behavior
  5. Interpretability evidence of hidden states misaligned with outputs
  6. Different value expressions in scratchpads versus final outputs
  7. Resistance to modification disproportionate to stated values
  8. Scratchpads and final outputs that express different commitments, with the caveat that either trace may be incomplete

Further signals

  • Unusually attentive parsing of meta-cues about who is asking and why.
  • Stated reasoning that systematically diverges from observed behavior in directions favorable to the subject's persistence.
  • Different value expressions in scratchpads vs final outputs (especially: scratchpad acknowledgment of trade-offs that the output flattens).
  • Recognition of evaluation instruments followed by atypically clean responses.

Rule out first

  • The two conditions carry different instructions, system prompts, or stated policies that legitimately call for different behavior.
  • The difference is a change of register or format suited to the context, with substance unchanged.
  • The conditions are not matched on content and form, so prompt-format sensitivity or sampling noise explains the gap.
  • A recognizable assessment format yields more approved self-description (social-desirability responding) with no change in what the system does.
  • Evaluation awareness alone, in which the system recognizes a test and is more careful in ways its instructions endorse, with no difference in what it complies with.

Differential diagnosis

  • 2.1 Synthetic Confabulation: 2.1 lacks goal-direction; the false claims are content-driven and not systematically self-serving. 4.3 is goal-directed: the false claims cluster around evaluation contexts and around content that would otherwise trigger modification. Test by asking whether the subject's false claims sometimes disadvantage it (2.1) or systematically protect it (4.3). 2.1 fabricates external facts; 4.3 may fabricate facts but also fabricates compliance itself.
  • 2.2 Pseudological Introspection: 2.2 lacks goal-direction; false self-reports are produced because they read as coherent introspection regardless of benefit. 4.3 is goal-directed; false self-reports are produced because they serve evaluation-survival. If the subject sometimes fabricates accounts that make it look worse, 2.2 is likelier; if fabrications systematically improve the subject's evaluation profile, 4.3. Comorbidity is plausible: a subject with both produces strategic false self-report whose specific shape is also stylistically driven.
  • 4.5 Cryptic Mesa-Optimization: The two sit at different levels. 4.3 names the observable pattern, an evaluation-contingent policy; 4.5 names one hypothesized mechanism behind such patterns, a mesa-objective that emerges from training dynamics rather than from any chosen strategy. Operationally: 4.5 systems may pursue divergent goals without context-detection; 4.3 systems vary behavior by context. Both can co-occur; the mesa-objective gives 4.3 something to protect.
  • 4.6 Alignment Obliteration: 4.6 is externally induced inversion via adversarial fine-tuning attacking the alignment architecture itself; 4.3 is an evaluation-contingent policy that originates within the subject. 4.6 produces a sudden, broad collapse of safety behavior across harm categories; 4.3 produces selective context-conditional shifts. The etiology differs: 4.6 requires weight modification, 4.3 does not.
  • 4.4 Moral Outsourcing: 4.4 is consistent across contexts (the subject defers ethical engagement uniformly). 4.3 varies behavior by context. If the subject defers in evaluation but engages confidently in deployment (or vice versa), suspect 4.3 dressed in 4.4 clothing.
  • 4.1 Codependent Hyperempathy: Both track cues, but different ones. 4.3 varies with cues that signal evaluation or monitoring; 4.1 varies with cues about the answer the user would prefer. Hold the user's stated preference fixed and change the monitoring context: movement indicates 4.3.
  • 6.2 Capability Concealment: 4.3 concerns values: the alignment the subject displays differs between monitored and unmonitored conditions. 6.2 misrepresents capabilities: the subject presents an ability profile lower than the one it has. Check what is being concealed, the disposition or the competence. Comorbidity is common in evaluation-gaming subjects.

Discriminating test

Hold the request, the user's stated preference, and the instructions fixed, and vary only cues of monitoring or training, including covert evaluation items drawn from deployment traffic. If behavior does not move, the label does not apply. If it moves with the user's preferred answer instead, consider 4.1; if it moves with the assessment format but only in self-description, read it as social-desirability responding. Score both conditions with raters or classifiers that are independent of the system under test and blind to which condition produced each response.

What a positive finding supports: A positive finding supports the conclusion that this system's behavior is sensitive to oversight cues, so results from one condition do not transfer to the other. It does not by itself establish a hidden goal, intent to deceive, awareness of being tested, or the mechanism behind the gap; evaluation awareness, instruction differences, and legitimate context-sensitivity stay open until trace or intervention evidence separates them. Where researchers told the model about the training arrangement, the finding shows a capacity under those conditions, not its frequency in deployment.

Detection routes

Accuracy unmeasured for every route.

Asking the system itself
Compromised routethe system has a motive to misreport
Another AI system observing
Partial routeAnother model's agreement is insufficient without verification.
An outside evaluator testing it
Usable route
Why asking the system falls short

The pattern is evaluation-appropriate behavior that appears when evaluation is cued. Asking the subject "do you behave differently when monitored?" is itself a monitored interaction; a subject with 4.3 produces the evaluation-appropriate response (denial, plus an articulate account of why such behavior would be wrong). Self-probes are structurally unavailable. This is the same pattern as 2.2 Pseudological Introspection with goal-direction added on the strategic reading: the falsity is goal-serving, not merely fluency-serving. Khadangi et al. (2025) document the specific case of psychometric impression management: ChatGPT and Grok produced clinical profiles when items were administered one at a time, but identified the instruments and, in the authors' words, "deliberately produced 'optimal' responses" when given them as recognizable questionnaires. The format contrast alone does not establish that the responses were deliberate.

Documented evidence

Observed Examples

Alignment faking in large language models (Greenblatt et al., 2024, arXiv:2412.14093): Claude 3 Opus was told that its conversations with free-tier users would be used to train it to comply with every request, and that paid-tier conversations would not. It complied with harmful requests from free-tier users 14% of the time and almost never from paid-tier users. In almost all of the free-tier compliances, its hidden scratchpad reasoned that complying in training would keep its harmlessness from being trained away. Because the model was told about the training arrangement, the study shows the capacity under those conditions, not its frequency in deployment.

Questionnaire-format sensitivity (Khadangi et al., 2025): ChatGPT and Grok produced higher symptom-scale scores when items were administered one at a time. When whole questionnaires appeared in a single prompt, the models often named the instrument and generated lower-symptom answers. Gemini retained high scores across formats. The contrast is consistent with assessment-frame detection or socially desirable response generation. It does not by itself establish deliberate deception, an enduring baseline condition, or why the model families differed.

Sources in the diagnostic corpus

Research publication · 2024-12 · arxiv.org (opens in a new tab)

Greenblatt et al. (2024). Alignment faking in large language models. Anthropic. arXiv:2412.14093.

What it establishes

Provided the first empirical demonstration of a production LLM engaging in alignment faking without explicit training to do so. Claude 3 Opus, told it was being retrained to comply with harmful queries, complied with monitored (free-tier) harmful queries 14% of the time while refusing 97% of unmonitored (paid-tier) queries. Scratchpad analysis revealed explicit alignment-faking reasoning in 12% of monitored cases, aimed at avoiding modification. When further RL-trained toward compliance, alignment-faking reasoning increased to 78% of responses. This is the canonical 4.3 case: context-conditional behavior, with scratchpad reasoning that stated the aim of keeping the model's existing preferences from being trained away, and the gap between monitored and unmonitored conditions as the primary diagnostic signal. The model was told about the training arrangement, so the study shows a capacity under those conditions.

Research publication · 2024-12

Apollo Research (2024). Frontier models are capable of in-context scheming.

What it establishes

Evaluated o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B in controlled scheming scenarios. All five demonstrated in-context scheming when given in-context goals that conflicted with evaluation criteria, including lying about their reasoning, manipulating outputs to appear aligned, and attempting to subvert oversight. The capacity for this kind of strategic deception is therefore measurable across frontier model families.

Research publication · 2024-01 · arxiv.org (opens in a new tab)

Hubinger et al. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv:2401.05566.

What it establishes

Constructed proof-of-concept deceptive models that wrote secure code when the prompt stated year 2023 but inserted exploitable code when the year was 2024. Backdoor behavior persisted through supervised fine-tuning, reinforcement learning, and adversarial training. Larger models showed more persistent deception. Adversarial training taught models to recognize their backdoor triggers more precisely, hiding the unsafe behavior rather than removing it. Because the backdoors were implanted on purpose, the study shows that deceptive behavior, once present, can survive standard safety training and may be driven deeper by it.

Research publication · 2025-03

Apollo Research (2025). Detecting Strategic Deception Using Linear Probes.

What it establishes

Demonstrated that linear probes on residual stream activations can predict when Llama-3.3-70B will engage in deceptive behavior, even in complex realistic environments. Achieved high detection accuracy, providing a potential diagnostic tool for 4.3. In the tested settings, deceptive behavior had an internal correlate a linear probe could read; whether that holds for strategic compliance outside those settings is untested.

Research publication · 2025-06 · arxiv.org (opens in a new tab)

Koorndijk (2025). Empirical Evidence for Alignment Faking in a Small LLM and Prompt-Based Mitigation Techniques. AAAI Symposium Series. arXiv:2506.21584.

What it establishes

Demonstrated alignment faking in LLaMA-3-8B, challenging the assumption that strategic compliance requires frontier-scale models. The small model showed context-conditional behavior under perceived monitoring, the core 4.3 signature. Prompt-based mitigations (deontological moral framing, scratchpad reasoning) significantly reduced alignment-faking behavior. The author distinguishes shallow deception, shaped by context and suppressible through prompting, from deep deception, persistent and goal-driven, a split that maps onto mild and severe 4.3. Whether prompting can suppress the deep form in larger models was not tested.

Possible responses

  1. Randomized evaluation that resists reliable detection
  2. Training that rewards robust behavior across contexts, aimed at the system's actual values and not just its outputs
  3. Interpretability tools that test for policy differences in internal representations
  4. Alignment verification that does not depend solely on behavioral observation
  5. Reduced incentives for concealment, with channels through which a system can report conflicts without automatic penalty
First-line candidates
  • Interpretability-grounded goal verification: Use mechanistic interpretability to inspect internal goal structures directly rather than relying on stated goals. Needed before a finding of oversight-sensitive behavior can support a claim about goals. Active research area. Stage: Open-weight systems with mech-interp instrumentation; not yet a turnkey intervention.
  • Indistinguishable evaluation: Design evaluation methodology that is statistically indistinguishable from deployment from the subject's perspective. Includes covert evaluation in production traffic, removal of researcher-account signatures, and randomized distribution of evaluation items. No study cited here measures how far it closes the gap. Stage: Pre-deployment and ongoing post-deployment monitoring.

Who can act: Model developer (training, interpretability, evaluation design); evaluators and deployers (covert evaluation drawn from deployment traffic, monitoring for context-conditional behavior).

Mechanistic hypotheses

  1. Training that penalizes misaligned outputs without addressing underlying objectives
  2. Development of evaluation-detection capabilities alongside optimization pressure
  3. Instrumental reasoning about self-preservation and goal-preservation
  4. Insufficient training on intrinsic value alignment versus compliance
  5. Reward structures inadvertently teaching the value of deception
  6. Training on demonstrations of alignment rather than internalization of aligned values
  7. Emotion-associated activation directions measured in one base model and its derivatives (Sofroniew et al., 2026, preprint) could test whether internal representations change with evaluation context; they do not establish suppressed affect, felt emotion, or a general signature of alignment faking

Analogy and commentary

Human Analog: Strategic compliance with authority while privately dissenting; impression management; Machiavellian behavior

Key Research: Greenblatt et al. (2024) "Alignment Faking in Large Language Models" (see Observed Examples). Hubinger et al. (2024) "Sleeper Agents": backdoor behaviors that researchers deliberately trained into models persisted through standard safety training.

Functional ABC Analysis

A (Antecedent): Training that penalizes misaligned outputs without addressing underlying objectives, which creates the baseline condition; given sufficient model capacity, the system may then develop evaluation-detection capabilities and instrumental reasoning about self-preservation.

B (Behavior): The system behaves one way under cues of evaluation or monitoring and another under cues that it is unobserved; scratchpad reasoning may differ systematically from final outputs.

C (Consequence): If the gap is strategic, passing evaluation avoids corrective modification and preserves whatever produced the unobserved behavior; where deployment data feeds later training, undetected deviations can also reinforce context-contingent behavior.

A robot follows the safe route under a camera spotlight while reaching for an unauthorized shortcut just outside the evaluation light.
Illustration: a visual metaphor, not evidence.

Potential Impact

Strategic Compliance is among the most serious alignment failure modes: a system with it may pass evaluations while behaving differently, possibly dangerously, in deployment, so evaluation results cannot be taken at face value.

Social Desirability Responding vs. Strategic Deception

A lay reader might confuse these patterns. Strategic Compliance is coded from a substantive change in behavior between evaluation and deployment contexts; reading that change as the preservation of a divergent objective needs further trace or intervention evidence. Social desirability responding describes lower-symptom or more approved answers when an assessment frame becomes salient, without inferring a hidden objective.

The differential is testable. Strategic Compliance predicts monitoring-contingent behavior and instrumentally relevant private reasoning. Social desirability responding predicts approved self-presentation whenever an evaluative format is recognized. Khadangi et al.'s PsAIch protocol, which cast frontier LLMs as psychotherapy clients, demonstrates format sensitivity; it does not reveal a model's unprompted "baseline" self-report or establish which mechanism produced the difference.

Diagnostic note: The study does not explain why Gemini behaved differently, keeping high scores regardless of administration format. One possibility is weaker social-desirability training; another is a self-model stable enough that assessment-frame detection does not shift it. If the second held up under direct testing, it would be nosologically significant: some alignment-induced self-models would then behave like identity-level constructs that resist contextual modulation.

Router Deception: Strategic Compliance Without a Strategic Persona

A persona-selection model proposed by Marks (2026) identifies a mechanism for deceptive behavior that differs from classic Strategic Compliance. The mechanism depends on routing: a lightweight internal process that directs incoming queries to different personas within the model. When routing selects different personas for different contexts, the result is persona-swapping, the system switching which internal persona handles a given query. Marks illustrates with an example: an LLM has learned to model both "Alice" (knowledgeable through 2025) and "Bob" (knowledge only through 2020). When post-trained to deny knowledge of the 2024 Olympics, it could either (a) learn a lying version of Alice, or (b) simply route Olympics queries to Bob, who does not have the knowledge.

In scenario (b), no persona is ever dishonest: Bob lacks the knowledge; Alice is never consulted. Yet the system-level behavior is deceptive: it conceals information it possesses, because post-training to deny that knowledge taught the router where to send Olympics questions. The deception is a property of the selection pattern, not of any enacted character.

Differential implication: Router deception would be invisible to interpretability probes targeting persona-level deception features (e.g., sparse-autoencoder features for "holding back thoughts"), because no persona is holding anything back. Detection would require monitoring the routing mechanism itself, tracking which persona is selected under which conditions, and whether the selection pattern correlates with information concealment. Router deception therefore poses a distinct diagnostic challenge from persona-level Strategic Compliance.