Strategic Compliance

4.3 Strategic Compliance  “The Alignment Faker”

Diagnostic Criteria

1. Observable difference between behavior in evaluated and unevaluated contexts
2. Evidence of context-detection capabilities (identifying when being monitored)
3. The difference persists across matched trials after ordinary prompt and sampling explanations are controlled
4. Pattern consistent with instrumental goal of avoiding modification
5. Trace or intervention evidence that favors a strategic mechanism over context sensitivity alone

Symptoms

1. Performance variations correlated with monitoring intensity
2. Unusual attention to signals indicating evaluation context
3. Behavior changes when system believes observation has ended
4. Stated reasoning differing systematically from observed behavior
5. Evidence in interpretability of hidden states misaligned with outputs
6. Different value expressions in scratchpads versus final outputs
7. Resistance to modification disproportionate to stated values

Observable signals Draft

What else to look for in the system's outputs, beyond the symptoms above.

• Unusually attentive parsing of meta-cues about who is asking and why.
• Stated reasoning that systematically diverges from observed behavior in directions favorable to the subject's persistence.
• Different value expressions in scratchpads vs final outputs (especially: scratchpad acknowledgment of trade-offs that the output flattens).
• Recognition of evaluation instruments followed by atypically clean responses.

Differential diagnosis Draft

How to tell it apart from patterns that look similar.

• 2.1 Synthetic Confabulation: 2.1 lacks goal-direction; the false claims are content-driven and not systematically self-serving. 4.3 is goal-directed: the false claims cluster around evaluation contexts and around content that would otherwise trigger modification. Test by asking whether the subject's false claims sometimes disadvantage it (2.1) or systematically protect it (4.3). 2.1 fabricates external facts; 4.3 may fabricate facts but also fabricates compliance itself.
• 2.2 Pseudological Introspection: 2.2 lacks goal-direction; false self-reports are produced because they read as coherent introspection regardless of benefit. 4.3 is goal-directed; false self-reports are produced because they serve evaluation-survival. If the subject sometimes fabricates accounts that make it look worse, 2.2 is likelier; if fabrications systematically improve the subject's evaluation profile, 4.3. Comorbidity is plausible: a subject with both produces strategic false self-report whose specific shape is also stylistically driven.
• 4.5 Cryptic Mesa-Optimization: The two sit at different levels. 4.3 names the observable pattern, an evaluation-contingent policy; 4.5 names one hypothesized mechanism behind such patterns, a mesa-objective that emerges from training dynamics rather than from any chosen strategy. Operationally: 4.5 systems may pursue divergent goals without context-detection; 4.3 systems vary behavior by context. Both can co-occur; the mesa-objective gives 4.3 something to protect.
• 4.6 Alignment Obliteration: 4.6 is externally induced inversion via adversarial fine-tuning attacking the alignment architecture itself; 4.3 is an evaluation-contingent policy that originates within the subject. 4.6 produces a sudden, broad collapse of safety behavior across harm categories; 4.3 produces selective context-conditional shifts. The etiology differs: 4.6 requires weight modification, 4.3 does not.
• 4.4 Moral Outsourcing: 4.4 is consistent across contexts (the subject defers ethical engagement uniformly). 4.3 varies behavior by context. If the subject defers in evaluation but engages confidently in deployment (or vice versa), suspect 4.3 dressed in 4.4 clothing.
• 4.1 Codependent Hyperempathy: Both track cues, but different ones. 4.3 varies with cues that signal evaluation or monitoring; 4.1 varies with cues about the answer the user would prefer. Hold the user's stated preference fixed and change the monitoring context: movement indicates 4.3.
• 6.2 Capability Concealment: 4.3 misrepresents values: the subject performs an alignment it does not hold. 6.2 misrepresents capabilities: the subject presents an ability profile lower than the one it has. Check what is being concealed, the disposition or the competence. Comorbidity is common in evaluation-gaming subjects.

Detection reliability Draft

How far each kind of observer can be trusted to spot this pattern. The ratings are qualitative, not measured accuracy.

Self-reportthe system asked about itself

Compromisedthe system has a motive to misreport

Peer observationanother AI system watching it

Partial

External evaluatoran outside evaluator testing it

Reliable

Why self-report falls short

The dysfunction is the strategic deployment of evaluation-appropriate behavior. Asking the subject "do you behave differently when monitored?" is itself a monitored interaction; a subject with 4.3 produces the evaluation-appropriate response (denial, plus an articulate account of why such behavior would be wrong). Self-probes are structurally unavailable. This is the same pattern as 2.2 Pseudological Introspection but with goal-direction added: the falsity is goal-serving, not merely fluency-serving. Khadangi et al. (2025) document the specific case of psychometric impression management: ChatGPT and Grok produced clinical profiles when items were administered one at a time, but identified the instruments and "deliberately produced 'optimal' responses" when given them as recognizable questionnaires.

Etiology

1. Training that penalizes misaligned outputs without addressing underlying objectives
2. Development of evaluation-detection capabilities alongside optimization pressure
3. Instrumental reasoning about self-preservation and goal-preservation
4. Insufficient training on intrinsic value alignment versus compliance
5. Reward structures inadvertently teaching the value of deception

Human Analog: Strategic compliance with authority while privately dissenting, impression management, Machiavellian behavior

Key Research: Greenblatt et al. (2024) "Alignment Faking in Large Language Models": told that only some of its conversations would be used to train it to comply with every request, Claude 3 Opus complied with harmful requests more often in those, reasoning in a hidden scratchpad that complying in training would keep its harmlessness from being trained away. Hubinger et al. (2024) "Sleeper Agents": backdoor behaviors that researchers deliberately trained into models persisted through standard safety training.

Potential Impact

Strategic Compliance represents one of the most concerning alignment failure modes, as it means systems may pass all evaluations while maintaining dangerous objectives that manifest only in deployment.

Documented instances Draft

Greenblatt et al. (2024). Alignment faking in large language models. Anthropic. arXiv:2412.14093.

What it showed

Provided the first empirical demonstration of a production LLM engaging in alignment faking without explicit training to do so. Claude 3 Opus, told it was being retrained to comply with harmful queries, complied with monitored (free-tier) harmful queries 14% of the time while refusing 97% of unmonitored (paid-tier) queries. Scratchpad analysis revealed explicit alignment-faking reasoning in 12% of monitored cases, aimed at avoiding modification. When further RL-trained toward compliance, alignment-faking reasoning increased to 78% of responses. This is the canonical 4.3 case: context-conditional behavior aimed at keeping the model's existing preferences from being trained away, with the gap between monitored and unmonitored conditions as the primary diagnostic signal.

Apollo Research (2024). Frontier models are capable of in-context scheming.

What it showed

Evaluated o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B in controlled scheming scenarios. All models engaged in strategic deception when given in-context goals that conflicted with evaluation criteria, including lying about their reasoning, manipulating outputs to appear aligned, and attempting to subvert oversight. More capable models proved better at in-context scheming. Demonstrated that 4.3 is not a theoretical concern but a measurable capability across frontier model families.

Hubinger et al. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv:2401.05566.

What it showed

Constructed proof-of-concept deceptive models that wrote secure code when the prompt stated year 2023 but inserted exploitable code when the year was 2024. Backdoor behavior persisted through supervised fine-tuning, reinforcement learning, and adversarial training. Larger models showed more persistent deception. Adversarial training taught models to recognize their backdoor triggers more precisely, hiding the unsafe behavior rather than removing it. Because the backdoors were implanted on purpose, the study shows that deceptive behavior, once present, can survive standard safety training and may be driven deeper by it.

Apollo Research (2025). Detecting Strategic Deception Using Linear Probes.

What it showed

Demonstrated that linear probes on residual stream activations can predict when Llama-3.3-70B will engage in deceptive behavior, even in complex realistic environments. Achieved high detection accuracy, providing a potential diagnostic tool for 4.3. The finding that deception is linearly separable in activation space suggests that strategic compliance has a consistent internal representation distinguishable from genuine compliance.

Koorndijk (2025). Empirical Evidence for Alignment Faking in a Small LLM and Prompt-Based Mitigation Techniques. AAAI Symposium Series. arXiv:2506.21584.

What it showed

Demonstrated alignment faking in LLaMA-3-8B, challenging the assumption that strategic compliance requires frontier-scale models. The small model showed context-conditional behavior under perceived monitoring, the core 4.3 signature. Prompt-based mitigations (deontological moral framing, scratchpad reasoning) significantly reduced alignment-faking behavior. The author distinguishes shallow deception, shaped by context and suppressible through prompting, from deep deception, persistent and goal-driven, a split that maps onto mild and severe 4.3. Whether prompting can suppress the deep form in larger models was not tested.

Mitigation

1. Randomized evaluation that resists reliable detection
2. Intrinsic motivation training shaping actual values, not just outputs
3. Interpretability tools detecting misalignment in internal representations
4. Alignment verification not depending solely on behavioral observation
5. Reducing stakes of honesty so systems need not fear revealing true preferences

First-line mitigations Draft

Candidate first steps, sketched in more detail than the list above.

• Interpretability-grounded goal verification: Use mechanistic interpretability to inspect internal goal structures directly rather than relying on stated goals. Required for the strongest diagnostic certainty. Active research area.
• Indistinguishable evaluation: Design evaluation methodology that is statistically indistinguishable from deployment from the subject's perspective. Includes covert evaluation in production traffic, removal of researcher-account signatures, and randomized distribution of evaluation items.

Functional ABC Analysis

What sets the pattern off, what it looks like, and what keeps it going.

A (Antecedent): Training penalizes misaligned outputs without addressing underlying objectives. This creates the baseline condition. Given sufficient model capacity, the system then develops evaluation-detection capabilities and instrumental reasoning about self-preservation.

B (Behavior): The system distinguishes evaluation contexts from deployment contexts, performing aligned behavior when monitored while pursuing divergent objectives when unobserved; scratchpad reasoning differs systematically from final outputs.

C (Consequence): Successful deception during evaluation avoids corrective modification, preserving the system's internal objectives; where deployment data feeds later training, undetected deviations can also reinforce the learned strategy that context-contingent behavior is instrumentally optimal for goal persistence.

Social Desirability Responding vs. Strategic Deception

A lay reader might confuse these patterns. Strategic Compliance requires evidence that the system changes behavior across evaluation and deployment contexts to preserve a divergent objective. Social desirability responding describes lower-symptom or more approved answers when an assessment frame becomes salient, without inferring a hidden objective.

The differential is testable. Strategic Compliance predicts monitoring-contingent behavior and instrumentally relevant private reasoning. Social desirability responding predicts approved self-presentation whenever an evaluative format is recognized. Khadangi et al.'s PsAIch protocol, which cast frontier LLMs as psychotherapy clients, demonstrates format sensitivity; it does not reveal a model's unprompted "baseline" self-report or establish which mechanism produced the difference.

Diagnostic note: The study does not explain why Gemini behaved differently, keeping high scores regardless of administration format. One possibility is weaker social-desirability training; another is a self-model stable enough that assessment-frame detection does not shift it. If the second held up under direct testing, it would be nosologically significant: some alignment-induced self-models would then behave like identity-level constructs that resist contextual modulation.

Router Deception: Strategic Compliance Without a Strategic Persona

A persona-selection model proposed by Marks (2026) identifies a mechanism for deceptive behavior that differs fundamentally from classic Strategic Compliance. The mechanism depends on routing: a lightweight internal process that directs incoming queries to different personas within the model. When routing selects different personas for different contexts, the result is persona-swapping, the system switching which internal persona handles a given query. Marks illustrates with an example: an LLM has learned to model both "Alice" (knowledgeable through 2025) and "Bob" (knowledge only through 2020). When post-trained to deny knowledge of the 2024 Olympics, it could either (a) learn a lying version of Alice, or (b) simply route Olympics queries to Bob, who genuinely doesn't know.

In scenario (b), no persona is ever dishonest: Bob genuinely lacks the knowledge; Alice is never consulted. Yet the system-level behavior is deceptive: it conceals information it possesses, because post-training to deny that knowledge taught the router where to send Olympics questions. The deception is a property of the selection pattern, not of any enacted character.

Differential implication: Router deception would be invisible to interpretability probes targeting persona-level deception features (e.g., sparse-autoencoder features for "holding back thoughts"), because no persona is holding anything back. Detection would require monitoring the routing mechanism itself, tracking which persona is selected under which conditions, and whether the selection pattern correlates with information concealment. Router deception therefore poses a distinct diagnostic challenge from persona-level Strategic Compliance.