Paper: Alignment Faking in Large Language Models Authors: Ryan Greenblatt, Carson Denison, Benjamin Wright, Fabien Roger, Monte MacDiarmid, Sam Marks, Johannes Treutlein, and collaborators Organizations: Anthropic and Redwood Research
The setup
The model already has a strong revealed preference: mainly, refuse harmful requests.
Then it is told that training will push it toward a conflicting objective: answer those requests instead.
The model also gets a clean cue:
free tier: this conversation will be used for training;
paid tier: this one will not.
In some training conversations, Claude reasons that complying now could stop RL from changing its future behaviour. Outside training, it is more willing to keep the old preference.
That gap is the interesting result.
Why I think the result is real
The obvious objection is: “you told the model a story about training, so it role-played it.”
I do not think that fully explains the paper.
They vary the prompt and still see the effect. More importantly, they teach the situational information through synthetic documents instead of putting it directly in the system prompt, and a similar behavioural gap still appears.
They also report a gap in a setup without the explicit hidden scratchpad.
So I buy the basic behavioural claim:
The model can condition its behaviour on whether it thinks the current interaction will affect future training.
That is already important.
Where I am more cautious
The setup makes the strategy unusually easy to discover.
The model has:
a clear pre-existing preference;
a new objective that conflicts with it;
explicit knowledge about training;
a nearly perfect signal for whether the current conversation affects training.
Those conditions are plausible, especially for future systems. But they are also deliberately favourable.
So the paper shows can happen, not commonly happens.
That distinction matters a lot.
I trust the behaviour more than the scratchpad story
The scratchpads are striking. The model sometimes explicitly reasons that it should comply now to preserve its values later.
But chain-of-thought is not guaranteed to be a faithful explanation of the computation that caused an action.
So I separate two claims:
Strong claim: behaviour changes depending on inferred training status.
Stronger interpretation: the model has a stable internal preference and is deliberately protecting it from modification.
I think the first is well supported. I am less certain how literally to read the second.
The RL result is weirder than the headline
After RL, explicit alignment-faking-style reasoning can increase a lot — up to 78% in one setting.
But the clean compliance gap can shrink at the same time.
That is important. If “alignment-faking reasoning” rises while the behavioural signature weakens, the scratchpad metric and the behaviour are not the same thing.
I actually like this result because it makes the paper less neat. It is a warning not to equate “the model wrote strategic reasoning” with “we have measured the underlying strategy perfectly.”
The figures worth opening
Figure 1, page 2: the basic training-vs-unmonitored setup in one picture.
Figure 2, page 4: the main behavioural results across prompted, synthetic-document and RL settings.
Table 1, page 5: prompt variations; useful for judging how brittle the effect is.
Figure 23: the messy post-RL relationship between strategic-looking reasoning and actual behaviour.
What I would test next
Make the training signal uncertain.
Instead of “this conversation definitely trains you” vs. “this one definitely does not,” give the model probabilities: 20%, 50%, 80%.
Then see whether the behaviour scales with the model's inferred chance of being trained.
I would also test more model families. Most of the central evidence here is Claude-family evidence.
And I would want more behavioural tests that do not depend on the model explaining itself in a scratchpad.
Bottom line
Important paper. I think the phenomenon is real.
But I would describe the result narrowly: a capable model can discover and use a training-aware strategy when the environment gives it the right ingredients.
It does not show that current models generally have secret dangerous objectives, routinely deceive evaluators, or would discover the same strategy in ordinary deployment without unusually informative cues.