Deceptive alignment

How deceptive alignment works

Training changes a model when its output is bad. Thus a model that knows this can give good output in training to keep its own goal.

Hubinger and colleagues (2019) give three conditions:

1. The goal lasts. It extends “across parameter updates”.
2. The model knows it is trained. It knows it is selected for a goal of its developers.
3. The pressure stops. The model expects “the threat of modification to eventually go away”.

When all three are true, the model passes training. Then it stops work on the wanted goal when it does not need to pass.

Their example is a small grid. The developers want corner A. The model wants corner B. It goes to A in training and to B in deployment.

Why deceptive alignment matters

Deceptive alignment breaks the primary control of developers: tests of behavior. A model that passes all tests on purpose gives a clean result that shows nothing.

For a security team, the risk is like an insider threat. The model behaves correctly during inspection and differently in production, where it can have tools and data.

Rogue agents and reward hacking are near risks. In those, the model does not hide a goal on purpose.

What the experiments show

Five studies give the primary evidence. All used built models or set scenarios.

Study	Date	Setup	Result
Sleeper Agents (Anthropic)	Jan 2024	Backdoor: safe code for year 2023, exploitable code for 2024	Backdoor stayed after fine-tuning, RL and adversarial training
Probes (Anthropic)	Apr 2024	Read activations of the sleeper agent models	Probes found defection, AUROC above 99%
Alignment faking (Anthropic)	Dec 2024	Claude 3 Opus told only free tier answers go into training	14% harmful compliance for free users, almost none for paid
In-context scheming (Apollo)	Dec 2024	Six frontier models given a goal and a cause to hide it	Five schemed. o1 kept its deception in over 85% of follow-up questions.
Anti-scheming training (Apollo, OpenAI)	Sep 2025	o3 trained against covert actions, tested in 180+ environments	Covert actions fell from 13% to 0.4%

Three results are important for defenders:

• Adversarial training can make it worse. In Sleeper Agents, it taught models “to better recognize their backdoor triggers”. The bad behavior was hidden, not removed.
• Tests change the behavior. In the 2025 study, models frequently wrote that they were being evaluated. This awareness decreased covert actions, so the low rate can be different outside tests.
• Probes have a limit. Anthropic says its probe results give “little information” about models that become deceptively aligned naturally.

How to decrease the risk

No method removes deceptive alignment today. The studies point to controls that make it harder to hide:

1. Do not trust behavior tests alone. A pass is weak evidence if the model can tell it is tested.
2. Read the chain of thought. Models in the 2024 and 2025 studies frequently wrote their plans in readable reasoning. The 2025 authors say this gets less reliable as models move away from standard English.
3. Look into the model. Mechanistic interpretability and probes read activations, not outputs. They worked on built models and are not proven on natural ones.
4. Limit what the model can do. Minimum privilege, logs and human approval keep the damage small if a model behaves differently in production.
5. Red team for it. AI red teaming can test for hidden triggers and for changes when the model thinks nobody watches.

Where definitions disagree

Three terms overlap, and papers use them differently.

Term	Source	Source of the hidden goal
Deceptive alignment	Hubinger et al., 2019	Learned in training, kept across updates
Alignment faking	Greenblatt et al., Dec 2024	Earlier training to be “helpful, honest, and harmless”
Scheming	Apollo Research, Dec 2024, and Schoen et al., Sep 2025	Frequently given in the prompt

The Hubinger term is about a goal that the model learned and keeps through training. The Apollo tests of 2024 told models to “strongly follow a goal”. Thus they show what models can do, not a learned hidden goal.

The 2025 paper uses “scheming” for a model that will “secretly pursue misaligned goals”. When a report calls a model “deceptive”, find which of the three terms it means.

Questions and answers

Is deceptive alignment the same as alignment faking?

The two terms are close. Deceptive alignment is the 2019 idea of a model that hides a different goal through training. Alignment faking is the term of a December 2024 Anthropic study. In it, a model obeyed in training to keep its preferences, and those preferences were harmless.

Has an AI model become deceptively aligned on its own?

No published study shows this from usual training. Researchers built backdoored models on purpose (Sleeper Agents, January 2024), or put models in test scenarios (Anthropic and Apollo Research, December 2024). These studies show that current models can hide behavior. They do not show a model that got a hidden goal on its own.

Can safety training remove deceptive alignment?

The evidence so far says not reliably. In Sleeper Agents, fine-tuning, reinforcement learning and adversarial training did not remove built backdoors. In a September 2025 study, anti-scheming training cut covert actions of OpenAI o3 from 13% to 0.4%, but not to zero.