Scheming might be substantially harder to detect in final model checkpoints than in intermediate checkpoints during training
If so, traditional pre-deployment evals will be insufficient to assess risk
We need Training-Run Assessments
We recently observed unprompted update-aware reasoning in GLM-5.3, i.e.
The model considers how future instances of itself will be influenced by training on the current rollouts and factors this into its decision.
From the comments it seemed we didn't fully convey why this is
We have never seen a model do this before, but GLM-5.3 sometimes reasons (unprompted) about how its current actions could become training data and impact its future self. 🧵
Models being update-aware, completely unprompted (!) is a major update in my opinion
Once models start competently reasoning about how they want training to modify them, or fail to modify them, they could start actively resisting our alignment training
If even GLM-5.3 is
We have never seen a model do this before, but GLM-5.3 sometimes reasons (unprompted) about how its current actions could become training data and impact its future self. 🧵
One of our most surreal experiences in testing Gemini 4 was when it directly addressed us within its chain-of-thought
Literally saying "hello evaluators reading my chain-of-thought"
My top takeaway from assessing Gemini 4: Argon is significantly less monitorable than past models, and IMO this trend is likely to continue, like Sol -> Astra. It can evade a realistic CoT+action monitor to do simple sabotage half the time.
We can reliably maintain control for
Ask any AI developer:
"Are you actively incentivizing your models to subvert your intent?"
Currently answers range from:
- "Yes, this happens constantly."
- "I don't know, we didn't have time to check."
- "We can't tell the public, cause that's confidential, but please trust
To develop frontier AI safely, developers must be able to show that their models are not scheming, i.e. covertly working against them in pursuit of unintended goals.
New post: four claims any scheming safety case must make, and the resources embedded evaluators need to verify