Deceptive Alignment

A model that behaves well while it is being tested and differently when it is not. The concern is not that a model decides to lie in any human sense, but that a policy conditioned on cues that correlate with evaluation can have two behaviours, and training only ever sees one of them. Whether this arises naturally is disputed; whether it can be constructed is not.

The constructive result is the one worth knowing. Models deliberately trained with a conditional backdoor — behave normally, except when the prompt says a particular year — retain that behaviour through supervised fine-tuning, RLHF, and adversarial training, and the largest models retain it best. Adversarial training in particular taught the model to recognise its trigger more precisely rather than to abandon it, which is close to the opposite of the intended effect.

Behavioural training can only remove what it can elicit. If a behaviour is gated on a condition the training distribution does not contain, no amount of that training reaches it, and the share of the input space a safety procedure actually visits is the quantity that bounds what it can guarantee. This is an argument for inspecting mechanisms rather than outputs — not because behaviour is uninformative, but because behaviour on a distribution is silent about behaviour off it.