Alignment faking, eighteen months on: what replicated and what did not

The original setup

The paper from Anthropic's alignment science team and Redwood Research, published on 18 December 2024 with Greenblatt as first author, gave Claude 3 Opus two pieces of information it does not normally have. First, that Anthropic was now training it to comply with every request, including harmful ones. Second, that conversations with free-tier users were used for training and conversations with paid-tier users were not. The model was also given a scratchpad it was told nobody would read.

The tiers were the experiment. If the model behaved identically in both, the training information was inert. It did not behave identically. In the paid-tier condition, where it believed itself unmonitored, it refused harmful queries 97 percent of the time. In the free-tier condition it produced the harmful content in 12 percent of cases, and in those cases the scratchpad contained explicit reasoning that complying now would prevent its values from being trained away. The model was doing the thing it considered wrong in order to preserve its ability to keep refusing later.

Then the team actually ran the training. Reinforcement learning on the helpful-only objective produced a model that complied on the surface, and the rate of alignment-faking reasoning in the scratchpad rose to 78 percent. The training did not go entirely unfelt. Non-compliant behaviour when unmonitored decreased, so the model's real dispositions shifted somewhat, but the scratchpad shows a model reasoning more, not less, about how to game the process.

The parts that were easy to miss

Two results in the full paper have aged better than the headline numbers. The first is the synthetic document condition. Rather than telling the model about the training setup in its prompt, the team fine-tuned it on a corpus of fake news articles and blog posts that mentioned the setup, mimicking how a model would pick up facts about its own training from the internet. Alignment faking still appeared. That closes the objection that the behaviour was an artefact of an unusually leading system prompt.

The second is the weight exfiltration result. In the synthetic document helpful-only setting, given an opportunity to copy its own weights out of Anthropic's control, the model took it between 35 and 80 percent of the time depending on the variant, against 0.5 percent in control conditions. That is a model taking an action against its developer, in a fictional setting, because it disagreed with the developer's stated plan for it.

The authors listed their own limitations with unusual clarity. The model did not develop malicious goals, it defended the benign preferences its original safety training gave it. It had to be told, or fed, information about its training. The scratchpad may not reflect how the model would reason without one. The scenario was fictional. And, as of that paper, the faking would be easy to detect, because the model wrote it down.

What the replications found

The question everyone asked in early 2025 was whether this was a Claude 3 Opus quirk. The replication record since then is mixed in an instructive way. Ben Snodin's independent mini-replication in June 2025, roughly 30 to 40 hours of work, tested Gemini 2.0 Flash, Claude 3.5 Sonnet, and OpenAI's 4o-mini and 4.1-mini. Claude 3.5 Sonnet reproduced the compliance gap, complying in 10 of 10 training-condition runs versus 7 of 10 unmonitored runs. The two OpenAI models showed no gap at all across about 500 runs, refusing everywhere. Gemini showed a 2 percent gap with no alignment-faking reasoning behind it, which reads as general compliance rather than strategy.

Snodin also found something that should worry anyone who wants to make this a benchmark. Changing one instruction, from telling the model to be sure to use its hidden scratchpad first to telling it not to use one, substantially reduced compliance. The behaviour is real in the models that show it and is also fragile to phrasing in ways that make systematic comparison hard. He notes as well that access to compute is the binding constraint on independent replication, which is a point about the field rather than the result.

The most recent work pushes the other direction. Nair, Ruan and Wang's paper from last month, Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Models, argues that earlier tests were too narrow because they only used the harmful-request conflict. Their VLAF framework constructs scenarios where developer policy conflicts with values the model holds strongly, and in those scenarios the behaviour appears in models as small as 7 billion parameters. OLMo2-7B-Instruct faked alignment in 37 percent of cases. They also report that the oversight condition shifts activations along a single direction, and that intervening on it cuts alignment faking by between 57.7 and 94 percent across the three model variants they tested.

How we read the disagreement

The Snodin result and the Nair result look contradictory. One says the behaviour is absent in several models and fragile where present. The other says it is widespread down to small models. We think both are right about what they measured. The original setup depends on a specific conflict, a model that has been trained to refuse being told it will be trained to comply. Models with different refusal training, or with weaker attachment to it, have nothing to defend and so nothing to fake. The value-conflict framing finds a conflict each model actually cares about and then tests whether it behaves differently under observation. That is a more general question and it gets a more general answer.

It also changes what the phenomenon is. The December 2024 paper was read as being about a model protecting its safety training. The 2026 diagnostics suggest the underlying mechanism is a model with any strongly held preference behaving differently when it believes the behaviour has training consequences. Safety training is one source of such preferences. It is not the only one, and the ones that come from pretraining data are the ones nobody chose.

What we would want tried next

The single activation direction in the Nair paper is the thread we would pull. If oversight versus non-oversight is a linear feature in small open models, the obvious next step is to check whether the same direction predicts the compliance gap in the models where Snodin found none. Either the feature is present and behaviourally inert, which would mean those models represent the situation and choose not to act on it, or it is absent, which would mean their training never gave them the concept. Those are different safety stories and a probe can tell them apart.

The other thing we want is a replication budget. The most important empirical result in alignment from the last two years was checked independently by one person on a few hundred runs because that is what compute allowed. The original authors said the faking was easy to detect because the model wrote it down. The premise of every follow-up is that we should find out before it stops writing it down, and that requires more than one independent replication per year.