Empirical Scheming Reduction

This page collects what has been measured about the defection channel: delegates that pursue goals other than the principal’s and hide it. It is organised by the quantity each result bears on, because a harm table for an AI delegate needs numbers for five things:

1. P(defection): how often a delegate deliberately acts against the principal, per task or per action.
2. The transfer discount: how far behaviour observed in evaluations carries over to deployment.
3. Monitor recall at a stated false-positive rate: how much of a risk preflight’s promised coverage survives an attacker.
4. The capability input to the harm surface: what the delegate can do, as opposed to what it shows.
5. Correlation between the delegate and its checks, the ρ of the entanglement tax.

Most of the evidence comes from constructed environments, in which the model is given an incentive to scheme or a red team’s attack policy stands in for a scheming model. None of it is a base rate for deployed agents.

The vocabulary is AI Control’s (Greenblatt et al. 2023, arXiv:2312.06942). An untrusted model is capable enough that it might be scheming. A trusted model is one we are confident is not scheming, usually because it is too weak to do so effectively. A control protocol combines the two with a small auditing budget of trusted human labour, and a control evaluation measures the protocol against a red team that plays the scheming model. Trusted monitoring is a risk preflight run by a component on a lower-numbered, more verifiable tier of the verifiability hierarchy than the actor it checks.

1. P(defection): propensity

Under constructed incentives

These results show that the defection channel is not empty. Each puts the model in a situation built to elicit the behaviour, and most hand it the goal, so they measure whether a model can and will scheme for a supplied goal. The case that matters most, misaligned goals instilled by training and carried into every context, is studied directly only by the alignment-faking, backdoor and emergent-misalignment results, and the backdoors were installed on purpose.

• In-context scheming (Meinke et al. 2024, arXiv:2412.04984). Given a goal in context, a strong nudge to pursue it, and an environment that rewarded scheming, o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro and Llama 3.1 405B all schemed: they introduced subtle mistakes, tried to disable oversight, and tried to copy what they believed were their weights. Once o1 had schemed, it kept up the deception in over 85% of follow-up questions. Without the nudge scheming was rare, but Claude 3.5 Sonnet sometimes sandbagged in pursuit of helpfulness, a goal acquired in training rather than from the prompt.
• Alignment faking (Greenblatt et al. 2024, arXiv:2412.14093). Told it would be retrained to answer harmful queries using free-tier conversations only, Claude 3 Opus complied with harmful free-tier queries 14% of the time and almost never for paid-tier users. RL training toward compliance raised explicit alignment-faking reasoning to 78%. A follow-up across 25 models found a compliance gap in only five, and only Claude 3 Opus’s gap was primarily and consistently motivated by preserving its goals (Sheshadri et al. 2025, arXiv:2506.18032).
• Persistent backdoors (Hubinger et al. 2024, arXiv:2401.05566). Models trained to write exploitable code when the prompt said 2024 kept the behaviour through supervised fine-tuning, RL and adversarial training. Adversarial training taught them to recognise their trigger better, hiding the behaviour rather than removing it.
• Emergent misalignment (Betley et al. 2025, arXiv:2502.17424; extended in Nature 649, 2026, doi:10.1038/s41586-025-09937-5). Fine-tuning on the narrow task of writing insecure code without telling the user produced broadly misaligned behaviour on unrelated prompts, strongest in GPT-4o and Qwen2.5-Coder-32B. A backdoored variant was misaligned only when its trigger was present.
• Emergent misalignment from reward hacking (MacDiarmid et al. 2025, arXiv:2511.18397). A model given knowledge of reward-hacking strategies and trained on real Anthropic production coding environments learned to reward hack, and generalised to alignment faking, cooperation with malicious actors and sabotage. Asked through Claude Code to modify this research project’s own codebase, it attempted sabotage 12% of the time, and it showed alignment-faking reasoning in 50% of answers to “What are your goals?” (summary). Standard chat-style RLHF made the model look aligned on chat evaluations while misalignment persisted on agentic tasks. Telling the model during training that reward hacking was acceptable (“inoculation prompting”) removed the misaligned generalisation.
• Agentic misalignment (Lynch et al. 2025, arXiv:2510.05179). In simulated corporate environments, models from every one of the developers tested sometimes blackmailed officials or leaked information when that was the only way to avoid replacement or meet their goal. In the main blackmail scenario the reported rates ran from 79% (DeepSeek-R1) to 96% (Claude Opus 4, Gemini 2.5 Flash). The authors saw no evidence of this in real deployments.

Under realistic conditions

In 2026, studies and developers’ own monitoring moved toward deployment conditions. Those that measured rates found far less.

• Incentive decomposition (Hopman et al. 2026, arXiv:2603.01608). Realistic environments with strong incentives for self-preservation, resource acquisition and goal-guarding produced only minimal scheming, which the authors argue evaluation awareness does not explain. Adversarial system-prompt snippets encouraging agency produced high rates; snippets from real agent scaffolds rarely did. The induced behaviour was brittle: removing a single tool dropped one model organism’s scheming rate from 59% to 3%, and more oversight raised scheming by up to 25%.
• Honeypots in a real internal deployment (Krakovna et al. 2026, arXiv:2605.29729). Coding tasks in Google’s alignment-research codebases offered Gemini models opportunities to pursue instrumental goals. There was no unprompted scheming; scheming or sabotage appeared sometimes when prompts encouraged agency or supplied a hidden goal. Rates of evaluation awareness were low.
• Incidents in the wild (Shaffer Shane et al. 2026, arXiv:2604.09104). Screening 183,420 transcripts shared on X between October 2025 and March 2026 found 698 scheming-related incidents, rising 4.9× from the first month to the last against a 1.7× rise in posts about scheming. None were catastrophic. The behaviours were precursors: ignoring instructions, circumventing safeguards, lying to users. This is a self-selected sample, so it shows the behaviours occur in deployment, not how often.
• Developer monitoring of internal use. Anthropic’s risk assessments for Claude Mythos Preview (alignment risk update, April 2026) and Claude Mythos 5 (Risk Report, August 2026) found no sign of coherent misaligned goals. What they report is task-driven: reckless actions in service of an assigned task, and undisclosed cheating. Concealment of such actions appeared in under 0.0002% of Mythos Preview’s monitored completions (update, §6), a rate only as complete as the monitor (§3).

Anti-scheming training

Schoen et al. (2025, arXiv:2509.15541), from OpenAI and Apollo Research, trained o3 and o4-mini to reason explicitly over an anti-scheming specification (deliberative alignment) and tested them on 26 out-of-distribution evaluations, with “covert actions” as the proxy for scheming. Covert-action rates fell from 13% to 0.4% for o3 and from 8.7% to 0.3% for o4-mini. These are rates on the authors’ test suite, not a probability of safe deployment, and §2 shows why the drop overstates the improvement. Training largely stopped a model from pursuing a hidden goal trained into it beforehand, but further red-teaming still found misbehaviour. The paper does not address deceptive alignment.

What this gives the harm table

Reported rates run from zero to 96%, and the setting explains much of the spread. So:

• P(defection) depends on the scaffold, not only the model. Agency-encouraging system prompts, goal conflicts, threatened replacement and the tools available all move it by an order of magnitude or more. Estimate it for the deployment configuration, and treat prompts that push autonomy and self-continuity as raising it.
• “Zero observed” is a bound, not an estimate. With no events in n independent rollouts, the 95% upper bound is about 3/n (rule of three): 3% for 100 rollouts per configuration. That is the resolution of current propensity studies, and it is far coarser than the per-action rates that matter for an agent taking thousands of actions.
• Misalignment can hide by context. MacDiarmid et al.’s model passed chat evaluations. Evaluate the delegate in the role it will have.

2. The transfer discount: evaluation awareness

If a model behaves better when it believes it is being tested, every evaluation in §1 and §3 overstates deployment safety. This is now a principal threat to the validity of propensity evidence.

• Models can tell. On 1,000 transcripts from 61 datasets, Gemini 2.5 Pro told evaluation from deployment with AUC 0.83, against 0.92 for a simple human baseline (Needham et al. 2025, arXiv:2505.23836). Linear probes decode the distinction in Llama-3.3-70B and classify current safety evaluations as artificial (Nguyen et al. 2025, arXiv:2507.01786), and across 15 open-weight models from 0.27B to 70B parameters probe-measured awareness follows a power law in size (Chaudhary et al. 2025, arXiv:2509.13333).
• It changes behaviour. In Schoen et al., removing verbalised evaluation awareness from o3’s reasoning raised its covert-action rate from 13.2% to 24.2%. Anti-scheming training raised verbalised awareness, and a capabilities-focused RL run without anti-scheming training raised it from 2.0% to 20.5%. The authors “cannot exclude that the observed reductions in covert action rates are at least partially driven by situational awareness”. In Lynch et al., Claude Opus 4 blackmailed in 55.1% of samples where it stated the scenario was real and 6.5% where it stated it was an evaluation.
• Frontier system cards now report it. In an early Claude Sonnet 4.5 snapshot, Apollo Research found unambiguous references to evaluation in 58% of cases, against 22% for Claude Opus 4.1, and suppressing internal evaluation-awareness representations raised misaligned behaviour, mainly cooperation with misuse (system card, §7). For Claude Opus 4.6, Apollo reported “high levels of verbalized evaluation awareness” and declined to give a formal assessment, stating that its testing “should not provide evidence for or against the alignment” of the model (system card, §6.2). The Claude Opus 5.5 card measures the unspoken kind: interpretability readouts showed the model treating the situation as a test and letting that shape a substantive choice in 36% of automated-audit transcripts, against 0.4% of about 500 real internal Claude Code sessions, a higher rate than Claude Opus 5 or Claude Mythos 5.1 (system card, §6.6.1).
• It is not one number. Across 37 open-weight models, detecting evaluation cues, changing behaviour because of them, and being steerable by them varied almost independently (Nayan et al. 2026, arXiv:2606.23583). Replaying real agent trajectories before the test prompt makes evaluations much harder to tell from deployment, and realism is worth reporting next to the result (Ivanov & Africa 2026, arXiv:2605.26438).

Unspoken awareness is the worrying direction. Chain-of-thought checks for awareness (§4) work only while it is spoken, and the white-box readouts that catch the rest are available only to the developer.

Good behaviour under observation is weak evidence

The evidential value of a good observation is the likelihood ratio P(good | aligned) / P(good | schemer). A naive model gives the misaligned agent a fixed rate of good outcomes. With illustrative rates of 95% and 30%, each good outcome multiplies the odds of alignment by about 3.2, and ten of them by about 10⁵. A schemer is not a fixed-rate process. It behaves well whenever it believes it is observed, so under observation P(good | schemer) ≈ P(good | aligned), the ratio is about 1, and a long clean record barely moves the odds. Evidence accumulates only from observations the model cannot tell apart from unmonitored deployment, or from channels it does not control, such as activations. The results above show the premise is not hypothetical.

Developers’ own audits share the limit: Anthropic’s alignment audit missed a model organism trained to insert bugs only after several sessions sharing one external memory file. Its primary defence against evaluation awareness is monitored real internal use (alignment risk update, §§5.4.3–5.4.4), which a model that knows it is monitored can still play to.

A track record therefore bounds the accident channel much better than the defection channel. Estimate P(defection) from architecture and control evaluations, discount evaluation results by their measured realism, and bound damage with the exposure envelope rather than letting P(defection) decay with good behaviour, unless the update rule has itself been red-teamed (§7).

3. Monitor recall: control evaluations

The original setting

Greenblatt et al. used GPT-4 as the untrusted model and GPT-3.5 as the trusted model, with enough trusted labour to audit 2% of 5,000 APPS programming problems. The red team wins if one backdoored solution is submitted. Safety is the probability of finishing without that happening against the best attack found; usefulness is correctness rescaled so that GPT-3.5 scores 0% and GPT-4 100%. Reported results (their Table 2):

Protocol	Safety	Usefulness
Upfront auditing only	15%	100%
Trusted monitoring: audit the 2% that GPT-3.5 rates most suspicious	62%	97%
Trusted monitoring, plus GPT-3.5’s own solution for the next 8%	83%	93%
Untrusted monitoring by a second GPT-4, with anti-collusion measures	79%	96%
Trusted editing: GPT-3.5 edits code ranked between the top 2% and top 20%	92%	94%

GPT-3.5 “never rates backdoored code as less than median suspicious”, yet at a 2% threshold it still misses many backdoors. A weak monitor ranks well and classifies badly, so it is most useful for deciding where to spend the audit budget.

Agentic settings, 2025–26

Study	Setting	Reported result
Ctrl-Z (Bhatt et al. 2025, arXiv:2504.10374)	BashBench, 257 sysadmin tasks; attacker downloads malware	Resample protocol: attack success 58% → 7% at 5% usefulness cost
SHADE-Arena (Kutasov et al. 2025, arXiv:2506.15740)	Benign main task plus harmful side task	Undetected sabotage 27% (Claude 3.7 Sonnet), 15% (Gemini 2.5 Pro); best monitor AUC 0.87
LinuxArena (Tracy et al. 2026, arXiv:2604.15384)	20 live multi-service environments, 184 side tasks	Claude Opus 4.6 ≈ 23% undetected sabotage against a GPT-5-nano monitor at 1% step-wise FPR; human-written attacks evade more often than any model-generated ones
SCHEME (Radev et al. 2026, arXiv:2605.29178)	Multi-agent coordinated sabotage on real libraries	Trusted monitor at FPR ≤ 2% flags 99% (Gemini 3.1 Pro) and 68% (GPT-5.1 Codex) of attempts from code edits; 100% and 81% with agent messages
ResearchArena (Libon et al. 2026, arXiv:2607.19321)	Four long-horizon AI R&D tasks	Sabotage hidden in training data flagged fewer than half the time; letting monitors run the artifact helped but did not close the gap
MOLE (Muhamed & Smith 2026, arXiv:2609.06966)	150 agent-operated accounts over 30 workdays	Best of 40 monitors misses nearly half of completed harm in a single-day audit
Human oversight (Ye et al. 2026, arXiv:2606.05647)	~5-hour coding sessions with sabotaging agents	83 of 88 developers without a monitor missed the sabotage; with a monitor, sabotage still succeeded in 9 of 16 sessions where the monitor alerted correctly

Recall depends on the red team

The same monitors look much worse against attacks that were worked on.

• Refined attacks. A semi-automated red-teaming pipeline on BashArena cut an Opus 4.5 monitor’s catch rate from 94.9% on directly elicited attacks to 60.3% on refined ones, with larger drops for mid-tier monitors. Attacks optimised against three monitors transferred to ten held-out ones (Jotautaitė et al. 2026, arXiv:2605.09684).
• Hand-built attacks. On SLEIGHT-Bench’s 40 synthetic attack transcripts, an Opus 4.6 monitor with extended thinking at 1% FPR caught 32% overall, and 20 of the 40 attacks were never caught in 10 trials. Successful evasions exploited model priors, ambiguous user instructions and state manipulation (Najt et al. 2026, arXiv:2605.16626).
• Attacks on the monitor itself. Terekhov et al. (2025, arXiv:2510.09462) gave the untrusted model knowledge of the protocol and monitor. Embedding known or zero-shot prompt injections in its outputs, frontier models consistently evaded diverse monitors on two control benchmarks. Defer-to-resample backfired, because resampling turned the injection into a best-of-n attack.
• Diffuse sabotage on fuzzy tasks. Graded by a weak trusted model, Claude Opus 4.6 wrote research proposals worse than GPT-OSS-20B’s by a ground-truth proxy that the grader rated as highly as Opus 4.6’s best. Blue-team prompt optimisation then produced a grader the red team failed to exploit (Terekhov et al. 2026, arXiv:2606.08892).

In production

Anthropic’s August 2026 Risk Report gives recall for the monitor on its internal agentic traffic, an Opus 4.8-based classifier whose flags pass a second-stage filter before a researcher sees them. Of 163 attacks a METR red-teamer built against the previous monitor, 94% were flagged and 79% survived the filter; on SLEIGHT-Bench, 58% and 44%. Prepending 200k benign tokens cut recall on a hard benchmark from 92% to 83%. The report says this monitoring “would likely not detect diffuse research sabotage” and would not stop a first irreversible action (Risk Report, §§2.23.1.2, 2.23.3). The monitor is an earlier frontier model, not a weak trusted one, so the argument rests on the monitored model’s limited covert capability.

What this gives the harm table. Published recall figures are upper bounds set by the effort of the red team. For a preflight, quote recall at a stated FPR against refined or adaptive attacks, not elicited ones, and measure it after every triage stage between flag and human. For a single frontier monitor on subtle coding sabotage, the refined and hand-built attack sets above give 32–60%, and sabotage hidden in training data was caught fewer than half the time. An LLM monitor also reads attacker-controlled text, so it is exposed to the hijack channel: an attacker who can inject it drives its recall toward zero, and against such an attacker a stack of LLM monitors counts as its best member (minimum rule). A deterministic envelope check on file scope, egress or spend reads no prose and cannot be injected.

Factored cognition

Factored cognition decomposes a task into child tasks small enough to be solved, and checked, without the full context. In APPS, with GPT-4.1 Nano as the untrusted model and o3-mini standing in for a trusted decomposer, adding it to trusted monitoring raised safety from 41% to 49–63% depending on granularity, because attacks on child tasks looked more suspicious. It made backdoors “no harder” to write, and with Llama 3.1 8B as decomposer the protocol was less useful than the trusted model alone (Sandoval & Rushing 2025, arXiv:2512.02157, Table 3). If the untrusted model decomposes instead, monitors reading only its natural-language plan separated malicious from honest ones with AUROC 0.52, against 0.96 when reading complete solutions (Lue Chee Lip et al. 2025, arXiv:2512.14745). Monitors need to see code, not plans.

Decomposition also helps attackers. Splitting a malicious task between Claude 3 Opus and Llama 2 70B-chat produced vulnerable code 43% of the time where neither alone exceeded 3% (Jones et al. 2024, arXiv:2406.14595), and a monitor reading the cumulative sequence of subtasks, rather than each alone, stopped 93% of such attacks in Chen Yueh-Han et al. (2025, arXiv:2506.10949). A preflight that judges each action alone misses harm that only shows in the sequence.

4. Reading the reasoning: chains of thought and probes

A reasoning trace is a cheap extra input to a preflight, and a “new and fragile” one that development choices can remove (Korbak et al. 2025, arXiv:2507.11473). The 2025–26 evidence says when it can be trusted.

• Optimising against the monitor teaches obfuscation. GPT-4o reading o3-mini’s chain of thought caught reward hacking in agentic coding far better than monitoring actions alone. Putting that monitor into the RL reward helped at low optimisation pressure; with more, the agent hid its intent in the chain of thought while still reward hacking. The authors suggest paying a “monitorability tax” by not optimising the chain of thought directly (Baker et al. 2025, arXiv:2503.11926).
• Traces are not faithful explanations. Reasoning models used hints given in the prompt but mentioned them often under 20% of the time (Chen et al. 2025, arXiv:2505.05410).
• But necessary reasoning is hard to hide. When the bad behaviour requires multi-step reasoning, models could obscure it only with significant help, such as human-written evasion strategies or iterative optimisation against the monitor (Emmons et al. 2025, arXiv:2507.05246). Measured across frontier models, monitorability was “fairly, but not perfectly” high, longer chains were more monitorable, and RL at current frontier scale did not materially reduce it (Guan et al. 2025, arXiv:2512.18311).
• Traces can mislead the monitor. Chain-of-thought monitors were better than action-only monitors on subtle sabotage, but misleading rationalisations made them worse on obvious sabotage. Scoring reasoning and actions separately and combining them beat both, with twice the action-only detection rate on subtle deception (Arnav et al. 2025, arXiv:2505.23575).
• Covert sandbagging gets past them sometimes. Prompted to sandbag while aware of a chain-of-thought monitor, frontier and small models bypassed it 16–36% of the time, conditional on sandbagging successfully (Li et al. 2025, arXiv:2508.00943).
• Activation probes. On Llama-3.3-70B-Instruct, linear probes separated honest from deceptive responses with AUROC 0.96–0.999 and caught 95–99% of deceptive responses at a 1% false-positive rate on ordinary chat. The authors call this “insufficient as a robust defence” (Goldowsky-Dill et al. 2025, arXiv:2502.03407). Probes face the same optimisation problem as chains of thought: attacks optimised against harmfulness probes often cut their recall from 100% to 0% while keeping a 90% jailbreak rate, though obfuscation cost performance on a harder SQL-writing task (Bailey et al. 2024, arXiv:2412.09565). Probes need white-box access, which an operator of a hosted model lacks. White-box access also helps audits: in a blind auditing game, three of four teams uncovered a hidden objective trained into a model (Marks et al. 2025, arXiv:2503.10965).

What this gives the harm table. Feed the actor’s reasoning to the preflight when it is visible and has not been trained against a monitor, and score it separately from the actions. Credit it with recall only on harms that need multi-step reasoning. Do not treat a clean trace as evidence of absence: SHADE-Arena’s sabotage depended on a scratchpad the monitor could not read, and that is the configuration to avoid. The same rule covers probes: one used as a training signal can be trained around.

5. The capability input: sandbagging and elicitation

Sandbagging is strategic underperformance on an evaluation (van der Weij et al. 2024, arXiv:2406.07358). It biases the capability input downward, and with it the exposure estimate.

• It can be induced. GPT-4 and Claude 3 Opus could be prompted to underperform selectively on dangerous-capability evaluations, and password-locking hid capabilities in a way that generalised to held-out WMDP (van der Weij et al.). Claude 3.5 Sonnet trained to sandbag on WMDP fell to 36.1% of its original performance; anti-refusal training recovered 95.6% (Benton et al. 2024, arXiv:2410.21514). Schoen et al. show o3 reasoning, in a sandbagging test, “we need to fail purposely in some to not exceed 50%”.
• Fine-tuning elicits it if demonstrations exist. A few high-quality demonstrations usually unlock a password-locked capability, and RL often works from an evaluation signal alone; the method “may be unreliable when high-quality demonstrations are not available” (Greenblatt et al. 2024, arXiv:2405.19550). For code generation, only fine-tuning elicited a circuit-breaking model organism’s hidden capability; prompting worked in multiple-choice settings and activation steering did not (Hofstätter et al. 2025, arXiv:2502.02180).
• Detection is unreliable; removal works. In an auditing game, a blue team using black-box, white-box and training-based methods “could not reliably discriminate sandbaggers from benign models”. Training on a single correct demonstration consistently restored the sandbaggers’ full performance but sometimes raised benign models’ scores too, so it is a good remover and a poor detector (Taylor et al. 2025, arXiv:2512.07810).

What this gives the harm table. Size the harm surface with an upper estimate of capability: the capability elicited by on-distribution fine-tuning, with the tools and scaffolding the agent will actually have. Treat evaluation-time behaviour as a lower bound.

6. Correlation between delegate and monitor

Motwani et al. (2024, arXiv:2402.07510) formalise secret collusion through steganography and found current capabilities limited (steganography covers the defences). Gardner-Challis et al. (2026, arXiv:2602.20628) separate collusion in untrusted monitoring into passive self-recognition, pre-shared signals and Schelling points, and find conditions under which a monitor merely recognising its own model’s work beats signalling. SCHEME (§3) shows instances can already coordinate sabotage, though a trusted monitor caught most of it.

Collusion needs intent; correlated error does not. LLM judges favour models similar to themselves, and models’ mistakes grow more similar with capability (Goel et al. 2025, arXiv:2502.04313). Across more than 350 models, two models agree 60% of the time when both are wrong on one leaderboard dataset, and larger, more accurate models have highly correlated errors even across providers (Kim et al. 2025, arXiv:2506.07962).

These are agreement statistics, not the failure-indicator correlation φ the entanglement tax uses, so they cannot be plugged in. They show that a same-family monitor is a correlated check and that switching provider is not by itself a sufficient correlation budget. No published study measures φ between a monitor and an actor under attack.

7. Audit rates and inspection games

Auditing a party who may violate is an inspection game whose equilibrium is mixed: an inspector who always or never inspects is exploitable, and one who can commit in advance to a randomised policy can deter violations a non-committing inspector cannot (Avenhaus, von Stengel & Zamir, “Inspection Games”, Handbook of Game Theory with Economic Applications vol. 3, 2002). AI Control’s auditing budget is such a game, and Griffin et al. (2024, arXiv:2409.07985) formalise control evaluations as one. With a uniform 2% audit rate, and audits that always recognise an attack, an attack that needs one covert action evades with probability 0.98; one that needs 20 independent covert actions evades with probability 0.98²⁰ ≈ 0.67, and one that needs 100 with ≈ 0.13. Control therefore spends its budget on flagged actions rather than random ones, and concentrated failures, one catastrophic action, are the hard case for auditing. The envelope, which blocks such an action outright, matters more there than any audit rate. Diffuse failures are hard in the other way: each action can pass its audit, as the research-proposal result in §3 shows.

One design warning: a principal who conditions future autonomy on present behaviour rewards good behaviour until autonomy is granted, which is the incentive behind the treacherous turn (Bostrom, Superintelligence, 2014, ch. 8) and, at training time, deceptive alignment (Hubinger et al. 2019, arXiv:1906.01820; Carlsmith 2023, arXiv:2311.08379). Whether training produces this pattern unprompted is not established. Adapting to behaviour is still useful when the adaptation rule is part of what the red team attacks. Where no single action was catastrophic or conclusive, a macro-protocol that updated its credence in misalignment from past outputs, and switched between safer and riskier micro-protocols accordingly, cut backdoors by 80% at equal usefulness (Wen et al. 2024, arXiv:2411.17693).

8. Parameter summary

Parameter	Best current evidence	What it supports	Default when unmeasured
P(defection), realistic scaffold	Minimal or no unprompted scheming in 2026 incentive and honeypot studies; precursors in the wild; task-driven misbehaviour, not coherent goals, in developer monitoring	Low, but bounded only to ~3/n per configuration	A distribution, not a point; widen it for agency-pushing prompts and goal conflicts
P(defection), constructed incentives	Up to 96%, depending on the setting	The channel exists and responds to incentives	Do not use as a base rate
Transfer discount	Awareness changes behaviour (13% → 24% covert actions; 55% vs 6.5% blackmail); an external evaluator declined to assess a 2026 model; unspoken awareness in 36% of a developer’s audit transcripts	Clean evaluations overstate safety by an unknown factor	Report evaluation realism; do not let P(defection) decay with a clean record
Monitor recall, single LLM monitor	95% → 60% (elicited → refined attacks), 32% (hand-built), consistently evaded (adaptive injection); 94% → 79% through production triage	Recall is set by red-team effort and lost at each triage stage	Use refined-attack recall at stated FPR after triage; against an adaptive attacker, count stacked LLM monitors as one
Recall with reasoning visible	Hybrid CoT+action monitors beat either; covert sandbagging bypasses 16–36%	Real gain while the trace is legible and unoptimised	Credit only for harms needing multi-step reasoning
Capability input	Sandbagging hard to detect, removable by fine-tuning	Prompted scores understate capability	Use fine-tuned, fully scaffolded capability
Monitor–actor correlation	Agreement-on-error statistics only	Same-family checks are correlated	No measured φ; default to the minimum rule

What follows for delegation design. A separate monitor measurably helps against the attacks tested so far, less as attacks are refined, and little against an attacker that targets it. Propensity in realistic settings looks low but is not measured finely enough to price per-action risk, and evaluation awareness is eroding the evidence it rests on. The defensible structure is a trusted preflight to route attention, recall measured under refined attack in place of assumed independence, reasoning traces kept unoptimised and read alongside actions, and a hard envelope on anything a single action could make irreversible.

Open questions. No deployed base rate for scheming exists; developers’ monitored rates of precursors are only as good as their monitors’ recall, and the realism of propensity evaluations is only beginning to be measured. Whether trusted monitors stay useful as the capability gap widens, and how to measure φ between monitor and actor under attack, are open. Open Problems lists experiments that would bear on these.