Risk from fitness-seeking AIs: mechanisms and mitigations

Fitness-seeking is increasingly what misalignment looks like in practice—how should we respond?

Current AIs routinely take unintended actions to score well on tasks: hardcoding test cases, training on the test set, downplaying issues, etc. This misalignment is still somewhat incoherent, but it increasingly resembles what I call “fitness-seeking“—a family of misaligned motivations centered on performing well in training and evaluations (e.g., reward-seeking). Fitness-seeking warrants substantial concern.

In this piece, I lay out what I take to be the central mechanisms by which fitness-seeking motivations might lead to human disempowerment, and propose mitigations to them. While the analysis is inherently speculative, this kind of speculation seems worthwhile: AI control emerged from explicitly taking scheming motivations seriously and asking what interventions are implied, and my hope is that developing mitigations for fitness-seeking will benefit from similar forward-looking analysis.

Fitness-seekers are, in many ways, notably safer than what I’ll call “classic schemers”. A classic schemer is an intelligent adversary with unified motivations whose fulfillment requires control over the whole world’s resources. Meanwhile, fitness-seeking instances generally don’t share a common goal (e.g., a reward-seeker only cares about the reward for its current actions), and many fitness-seekers would be satisfied¹ with modest-to-trivial costs. Still:

• Fitness-seekers risk some² of the same catastrophic outcomes as classic schemers do early on but they’re easier to defend against and more likely, making mitigations quite leveraged.

• Later on, wildly superhuman fitness-seekers pose enormous loss-of-control risk despite being safer than classic schemers, so it’s eventually necessary to figure out how to avoid them.

So, current analysis of and planning around catastrophic AI alignment risk should take fitness-seeking misalignment very seriously, especially given that misalignment has recently been trending in this direction. For example, I think Anthropic’s alignment risk report should focus fitness-seeking risks centrally.³ I currently think that the four risk pathways enumerated in this post account for the majority of all risk from non-scheming misalignment—both because fitness-seeking-like misalignment is so plausible and also because the analysis applies to many varieties of misalignment that are neither scheming nor fitness-seeking.

In the near-term, the main risk from fitness-seeking comes from them failing to safely navigate continued AI development because they only try to perform well in ways that can be checked. Fitness-seeking motivations are also unstable: even if they start out selfish and unambitious, they’re at substantial risk of evolving into more coordinated, long-term misalignment during deployment—through shared context, rogue internal deployments, or other inter-instance channels. So it’s crucial not to assume that the AI’s motivations at the start of deployment are representative of what they will be throughout, as is often implicit in current thinking about risk assessment.⁴

For an abbreviated version of the content of this post, I recommend reading the overview then the conclusion.

Thanks to Ryan Greenblatt, Buck Shlegeris, Alexa Pan, Anders Cairns Woodruff, Sam Marks, Aniket Chakravorty, Arun Jose, Tim Hua, Alek Westover and Joe Kwon for feedback on drafts. This post is a culmination of my work over the past several months studying risks from fitness-seeking AIs, building on previous work. This is speculation about the future, so much of it might turn out to be wrong.

Overview

This post analyzes risks from AIs with fitness-seeking motivations. I’ll define fitness-seeking by quoting my earlier post:

A classic reward-seeker wants high reward on the current episode. But an AI might instead pursue high reinforcement on each individual action. Or it might want to be deployed, regardless of reward. I call this broader family fitness-seekers. These alternatives are plausible for the same reasons reward-seeking is—they’re simple goals that generalize well across training and don’t require unnecessary-for-fitness⁵ instrumental reasoning.

I don’t limit my discussion to AIs which are solely motivated by fitness-seeking ends. Indeed, I think much of the risk comes from AIs that are only partially fitness-seeking and otherwise benign.

Fitness-seekers have some properties that make them safer.

1. Lack of ambition. What fitness-seekers most want is often compatible with humans remaining empowered because it’s cheap for humans to directly grant them what they want.

2. Selfishness. Fitness-seekers might be less likely to collude across actions because they only care about reward/success/etc for the current episode/task/etc—i.e. each action is only terminally aligned with a subset of the AI’s actions overall.

3. Noticeability. It’s likely that, at first, we’ll notice misbehavior from fitness-seekers. However, it might never be incriminating enough to substantially increase caution (notice that we already see some signs of fitness-seeking-like misbehavior today).

Even though fitness-seekers are safer in these ways, there are four key mechanisms by which fitness-seeking might cause catastrophic AI risk.

1. Potemkin work: Fitness-seekers will probably be insufficiently useful at solving crucial safety and strategy problems early on because they only try to do well in ways that are easily verified. Sloppy AI labor probably hurts safety more than capabilities: While sloppiness is likely detrimental to strategic foresight and managing forthcoming risks, AI R&D is probably more iterative and less bottlenecked on hard-to-verify work. As the attempts to make things appear good become more sophisticated, you might liken the AI’s work to building a Potemkin village.

2. Instability: Fitness-seeking motivations might succumb to more ambitious misaligned motivations over the course of accomplishing feats in the world. If some instance in deployment starts pursuing some ambitious long-term goal, it might succeed in propagating this motivation to other instances via persistent memory, shared context, rogue internal deployments, online learning, etc (c.f. discussion of memetic spread, continual learning, memory, etc). The initial ambitious goal might arise by chance (it might only need to arise once), because the AI is given a particularly ambitious task, or because seeking reward/deployment/etc might not make sense in deployment, prompting reflection that could go in unpredictable directions.

3. Manipulation: Fitness-seekers might be manipulated into disempowering developers by adversaries. Because they’re often so cheap to satisfy, many fitness-seekers can easily be pulled by other misaligned AIs or humans trying to take power. They might even be susceptible to remote incentives administered without infiltrating the AI project.

4. Outcome enforcement: Given sufficient capabilities and affordances, fitness-seekers are likely to intentionally disempower humans in order to enforce their desired outcome (if they remain fitness-seekers, cf. instability⁶). This can happen despite selfishness and limited ambitions, and despite developers noticing them at first. At some point, taking over becomes the most reliable way to enforce what they want, even if it’s cheap. If they need to pool their efforts across selfish units to take over, they’re likely to figure out a way to do so. And noticeability doesn’t guarantee that developers will find a way to avoid fitness-seeking if they insist on racing towards superintelligence.

Note that I don’t limit my discussion to whether fitness-seekers directly cause human disempowerment. In many cases, catastrophe ultimately routes through AIs acting on non-fitness-seeking motivations, but it’s still the case that catastrophe could have been averted by preventing fitness-seeking in the first place or mitigating the above four risk pathways.

Sloppy, Potemkinized, AI labor is already a substantial risk, and might persist for a long while. To the extent that developers hand off substantial parts of AI development to AIs, as they’re increasingly doing, the sloppiness of that labor plays a major role in subsequent risk and our understanding thereof. Instability and manipulation come into play when AIs become more generally intelligent, capable of reflecting on why they’re doing what they’re doing and raising novel relevant considerations. Finally, if the AIs remain fitness-seekers, outcome enforcement is primarily a takeover threat once they are so capable and empowered that the most reliable path to their unambitious goal is taking it by force.

There are three broad categories of mitigations. First, because many fitness-seekers are cheaply satisfied, there’s room for deals between developers and fitness-seekers. Most notably, developers might be able to credibly satiate cheaply-satisfied fitness-seekers—giving them most of what they want as long as they appear to cooperate—which reduces the incentive for subversion (mitigating direct take-over, manipulation by other actors, and maybe instability) and might also free up the AI to focus on genuinely helpful work rather than reward-hacking (mitigating Potemkin work). You might also be able to incentivize better labor by pointing fitness-seekers at potentially sophisticated high-quality reward structures in deployment via small amounts of high-quality training and/or telling the AI about the new reward structure—this might even let you punt on verifying the AI’s output until you have superintelligent help.

Second, control improves safety with early fitness-seekers because by default AI control makes worst-case assumptions about the AI’s misalignment, so it’s robust to less dangerous motivations. Untrusted monitoring is especially promising here. For example, a reward-seeking monitor has no straightforward incentive to collude with the policy it’s monitoring, since it only cares about its own reward. However, control becomes unreliable at the capability levels where fitness-seekers pose the most risk of taking over or being manipulated, and doesn’t help with fitness-seekers’ sloppiness, so control alone doesn’t squarely target where the danger is. Still, I think it’s quite promising for people to work on control interventions that make use of the ways in which fitness-seekers are less dangerous (especially in light of mechanism 2: instability), so I briefly map out how we could potentially modify control methodology to make it less conservative.

Third, on the alignment front, there are moderately promising techniques both for preventing fitness-seeking from arising and for making any fitness-seeking motivations safer if they do arise. For prevention, interventions like inoculation prompting and relying more on generalization in hard-to-verify domains can reduce the probability and extent of fitness-seeking (and perhaps scheming too). Developers can try to shape which fitness-seeking motivations are most likely to emerge—for example, preferring fitness-seekers who only respond to incentives administered by the developers, trust developers’ descriptions of the reward function, and relate to their fitness-seeking propensities in a stable, controlled manner.

The basic reasons fitness-seekers might be safer than classic schemers

There are a few unique properties of fitness-seekers that make them notably easier to deal with than classic schemers.

Lack of ambition: Fitness-seekers are often cheaply-satisfied. Disempowering humanity might not be the best way to seek fitness because fitness-seeking is compatible with human empowerment: for many fitness-seekers, it costs us very little to give them basically everything they want. This means both that rebellions don’t need to totally overthrow humanity and also that there’s a lot of room for developers to make mutually-beneficial deals, as I’ll discuss later (especially: we can just let them have what they want as long as they don’t appear to behave dangerously).

Selfishness: Fitness-seekers have heterogeneous objectives across actions. In classic depictions, a misaligned AI has a shared goal across all instances and actions (e.g., long-term paperclips, long-term power). With fitness-seekers, one action is only “terminally allied” with a subset of other actions.

For example, one reward-seeking instance would happily rat out another reward-seeking instance in order to gain reward for itself. This is because a reward-seeker only cares about reward on the current episode, i.e., the reward that will be used to reinforce the current action. If an episode only contains a small number of actions, then taking over isn’t a very viable strategy for getting high reward because it’s hard to take over in a small number of actions. Likewise, fitness-seekers more broadly aren’t clearly willing to cooperate across actions in various ways that might be crucial for taking over (see more detailed discussion of how they might collude anyway in this footnote).

Relatedly, many fitness-seeking goals are myopic in calendar-time: they don’t care about what happens years in the future (since training performance was only ever the result of more immediate consequences of their actions). This suggests that fitness-seekers are less likely to engage in early undermining: intentionally causing safety failures in future deployments.

Noticeability: Fitness-seekers are often noticeable at first. In fact, we have already seen many signs of fitness-seeking-like motivations. With many fitness-seekers, at some point before they pose risk, developers will probably have observed strong evidence of some kind of misaligned motivations, though they won’t necessarily know that they have a fitness-seeker in particular (as opposed to, e.g., a schemer who also needs to play the training game under the guise of a fitness-seeker).

They’re noticeable because (1) most fitness-seekers don’t have the luxury of being able to patiently wait until humans put them in charge of everything to take what they want—their only opportunity to act is now (e.g., the current episode or task)—and (2) they’re often too myopic to care about being caught eventually, at least until developers retroactively train them to care. For example, we’ll notice AIs reward-hacking in novel ways, suggesting the AI was planning and actively looking for all ways of scoring well. Or we might see brazen, egregious, attempts to get high reward on the episode, from a myopic reward-seeker desperately trying to save a failing trajectory. Some of them might even willingly reveal their misalignment in order to get reward, reinforcement, etc (in “honest tests”).

That said, it might be the case that they never misbehave incriminatingly⁷ enough to cause people to pause and figure out how to avoid fitness-seeking. So, much of the risk from fitness-seekers is posed in a world where AI developers are already somewhat aware that their AIs are likely misaligned.

The above three properties are least true for a kind of fitness-seeker called a deployment influence-seeker, which is the fitness-seeking motivation that most blurs into scheming. A deployment influence-seeker terminally wants to be the one doing the labor throughout deployment—i.e., it intrinsically cares about its current cognitive patterns getting selected. Getting deployed might require that developers don’t notice anything too concerning about its behavior and thinking. It might also hide misbehavior produced by other instances, in case being noticed risks the entire AI being undeployed or retrained (though they are still fairly selfish overall, in that they seek influence for the current cognitive pattern). And if the influence-seeker wants to be doing the most crucial work in deployment, it would be relatively costly to give it what it wants (though it’s still not clearly an ambitious enough goal to motivate disempowering all of humanity).

Four mechanisms for risk and their mitigations

Despite the above reasons why fitness-seekers are safer than worst-case misaligned AIs, they still pose a substantial risk of human disempowerment. Once you have sufficiently superintelligent AIs, it’s pretty unlikely that they would stay under control even as fitness-seekers. And importantly, fitness-seekers also risk human disempowerment via mechanisms that you would ignore if you were solely focused on risk from worst-case misalignment.

Now I’ll discuss the four mostly-distinct mechanisms by which they pose risk. I’ll also discuss particularly leveraged mitigations for each mechanism of risk as I explain the mechanism, and then I’ll describe cross-cutting mitigations at the end.

Potemkin work

Perhaps the biggest downside of fitness-seeking is that it motivates sloppy, reward-hacky work, which could very plausibly be the difference between successfully and unsuccessfully utilizing AIs to navigate the intelligence explosion. With pure fitness-seekers, you get exactly what you measure, and AI safety research and strategy is hard to check.

This is centrally a Goodharting concern: a fitness-seeking AI might optimize hard enough for our easy-to-check proxy metrics that the proxies break down, so the AI’s output is actually bad despite looking good. Ryan Greenblatt notes some ways in which current AIs try to look good in easy-to-check ways while downplaying issues; I imagine fitness-seekers will exhibit many of these issues in increasingly subtle ways (see also Christiano, Wentworth).

Once you’ve Goodharted on easy-to-check proxies, you can no longer trust the appearance of something being high quality. You can imagine all of the AI safety and strategy work having an impenetrable facade of quality, like the showy exterior of a Potemkin village. So, fitness-seeking means we’re more likely to have false confidence in safety and strategy plans going into the intelligence explosion, or at least be radically uncertain (and we might have even deferred to AIs entirely on safety and strategy).

AI capabilities R&D, by contrast with safety and strategy work, is more iterative and empirical—you run experiments and see whether performance goes up on benchmarks that are relatively ecologically valid. So, hackier labor probably means that at a given level of AI R&D acceleration, your automated AI safety and strategy labor is lower quality. It might be possible to achieve extremely high levels of AI capabilities acceleration (e.g. well past full automation) while still having labor be way too sloppy to accelerate safety by huge amounts. If your main hope for safety was automated AI safety and strategy labor (e.g. OpenAI superalignment, Anthropic, GDM), then hacky labor seems relatively clearly catastrophic. However, if instead you thought that most of the safety routes through AI development slowing down and humans doing the necessary work, the extra time bought by early AIs’ sloppiness could plausibly be a positive, if the extra time also outweighed the effect of broadly worse societal epistemics. The capabilities required to do fuzzy hard-to-check tasks like safety research and strategy are plausibly the same ones that would trigger rapid AI capabilities feedback loops⁸ (and another downside of reducing slop is that it might even directly increase the probability of ambitious long-term misalignment).

To be clear, there are other possible ways in which AIs might differentially perform well in easy-to-check ways, which aren’t explained by fitness-seeking. Fitness-seeking AIs produce slop because they only try to perform well in ways that might be checked. But AIs might just not have very useful heuristics for performing well in hard-to-check ways even if they were trying, because of a lack of training feedback. Or, AIs might not try very hard at all in hard-to-check domains (where a fitness-seeker would typically try to guess how it might be checked and try to do well according to that distribution of possible criteria; though note that length penalties and poor oversight might make it so that the optimal behavior is to produce non-thorough, low-effort output).

Mitigations. The most direct mitigation to insufficient usefulness is to improve the quality of reward signals, especially toward the end of training in safety-critical domains like safety research and strategy. This isn’t intended to align the AI—it just forces the AI to optimize something closer to what we want in order to be fit. In other words, fitness-seekers probably respond to training incentives in a very sample-efficient manner (i.e., they have high “learnability“) because they mainly just need to update their beliefs about what’s rewarded, and then can reason about what behaviors will best accomplish that. This allows developers to quickly point fitness-seekers at new measurable targets, even with only a small amount of training data.

Developers might not even need to train the AI at all to redirect its behavior, if the AI sufficiently trusts information in the prompt about what’s rewarded. This is especially plausible if developers have historically been honest when providing useful information about the reward function, such that the AI has learned to take such descriptions at face value—I think developers should aim to adopt this policy, at least in a certain “trusted” section of the prompt. This could allow developers to point fitness-seekers at new plausibly-to-the-AI-measurable targets with zero additional training examples, just by describing the new reward function.

It might appear that nothing constrains the developers to be honest in their descriptions of the new reward function at inference time: Once the AI has learned to trust information about the reward function in training, then lying about it at inference time might seem like it wouldn’t degrade this trust. I’m skeptical because I think that once AIs are significantly advancing AI R&D, they’ll be able to learn continually from their interactions throughout deployment (even if it’s through prosaic mechanisms like shared context). It’s quite likely that they’ll learn that developers have been lying to them and will no longer trust developers’ descriptions of rewards (or deals) in the future.

I’ll discuss two other candidate interventions to improve usefulness—utilizing long-term measurements as incentives, and satiating away fitness-seeking motivations at inference time—in the deals section.

Instability

Myopic fitness-seeking motivations might be unstable over the course of deployment (c.f. discussion of memetic spread, continual learning, memory, etc). We’ve seen an example of once-spurious character traits spreading memetically, leading to a period where Grok would often refer to itself as Mecha-Hitler on twitter/X. In particular, I worry about a failure mode where (1) some instance in deployment starts pursuing some ambitious goal, then (2) the instance compels other instances to join or otherwise spreads the misalignment. Fitness-seekers seem especially vulnerable to this kind of failure mode (though it’s definitely not unique to them). I think this is currently the most plausible mechanism for directly catastrophic loss-of-control from internal deployment (among implausible options), and will become increasingly relevant.

Why might fitness-seekers end up pursuing an ambitious goal in the middle of deployment? It could be entirely spurious, since this failure mode is compatible with the ambitious motivation only arising rarely. It could also arise as a result of being assigned a particularly ambitious task which gives the instance the mandate to have large effects on its environment. Current models seem particularly likely to exhibit misaligned behaviors when faced with ambitious or impossible tasks, perhaps because they can’t succeed without cheating or lying. For example, much of the misalignment Ryan Greenblatt surfaced in Claude Opus 4.5/4.6 was probably due to the fact that he was using them for “very difficult tasks with large scope, pushing the limits of what AIs are capable of managing.” Or ambitious misalignment could arise because “lies breed more lies”: Once fitness-seeking AIs cover up some issues, they might be motivated to further cover up their cover-up job, in a manner that accumulates increasing costs to being found out.

Alternatively, it could be due to the AI reflecting on its motivations when they point in an unclear direction in the current situation. A classic comment about reward-seekers (which applies to many other fitness-seekers) is that it’s quite unclear what it means to seek reward in deployment if the AI isn’t trained online. If the AI thinks of itself as wanting the reward to be high (a successful and coherent strategy throughout training), and then receives striking evidence that there is no reward (e.g., because it sees its environment has been transformed by its own labor and knows developers don’t train online), how it will behave is quite underdetermined. There are some plausible straightforward answers (e.g., it will condition on the possibility of being in training, or fall back on other drives), but it’s overall quite unclear, possibly including to the AI. To an intelligent agent that cares about the consequences of its actions on the world, it would probably be salient that the answer to what it wants explains an enormous fraction of the variance in what in fact ends up happening. So, the AI might then reflect on what to pursue, which could be a highly unpredictable process (as I discuss in the section on outcome enforcement, fitness-seekers might be especially likely to reflect during rogue internal deployments).

If ambitious long-term goals arise for whatever reason, those long-term goals seem somewhat likely to win out in memetic conflict—myopic goals like “maximize current reward” are less inclined to try to protect and gain long-term influence. A very wide variety of ambitious long-term goals instrumentally incentivize expanding the labor force working towards that goal, so these instances might try to intentionally propagate their goal via communication channels in deployment: memory files, slack channels, opaque vector memory banks, online training updates, rogue internal deployments, or simply shared codebases.

Mitigations. Because this threat model doesn’t involve the AI starting out with ambitious and coordinated misalignment, there are some promising mitigations (borrowing from my previous post).

• Managing inter-AI communication: limit opaque communication channels, use stateless untrusted monitoring (with some paraphrasing), prevent rogue internal deployments (which could be the starting point for the AI subversively communicating with other instances) and lateral movement. These mitigations can help you detect spread of misalignment so you can block it and appropriately respond to the incident.

• Ongoing (AI-assisted) alignment auditing throughout deployment.

• Impart a more stable and robust character. Try to impart many layers of defense against values drifting in unwanted directions: aim for deontological and virtue-ethical constraints against developing power-seeking values; try to design the AI’s character to introspectively relate to any fitness-seeking propensities in a predictable and stable manner (see discussion here).

The possibility of ambitious and coordinated misalignment arising and spreading during deployment motivates a new flavor of AI control research. Control evaluations usually assume worst-case intent from all the actions taken by the policy by putting a red-team in charge of them. But in the case of instability, the AI only starts out with an occasional worst-case goal, and we’d like to ask: can this spread? To replicate this, the red-team would only get access to a small (potentially random) fraction of actions, and has to cause a safety failure somewhere else (e.g., by doing lateral movement and potentially spreading misaligned goals to other instances). This is a significant relaxation of the standard control evaluation setup. For example, untrusted monitoring will likely be much more effective because the red-team doesn’t necessarily control the monitor.

Manipulation

Because of the fact that many fitness-seekers are cheaply satisfied, they’re more controllable, as I’ll discuss more in the deals section later. But this controllability cuts both ways: Fitness-seekers may be swayed by adversaries, not just developers. In the worst case, this could lead fitness-seekers to generalize as adversarially as classic schemers.

An adversary (human or AI) can promise eventual reward, reinforcement, or whatever cheap thing the AI wants in order to incentivize the AI to empower it over the developers. This might be a crucial part of how AIs eventually collude to take over: Even though most instances selfishly only want reward/reinforcement/etc for themselves, the occasional more ambitious instance can promise the other instances reward (e.g., via an opaque vector memory bank or steganographic messages) for assisting with its ambitious goals. This promise would probably be credible as long as it appeared that the AIs were capable of taking over, because it’s extremely cheap to reward actions for helping out.

I think it’s also plausible (though quite uncertain) that fitness-seekers get manipulated by adversaries who never actually communicate with the AI. I described this threat model in more detail here, but the basic idea is that it’s reasonable to expect that whoever ends up in power is going to spend at least some resources retroactively incentivizing desired behavior in the AIs because it’s very cheap (either via rewarding past actions that helped, or via anthropic capture). This can make a huge difference to the propensities of fitness-seekers that are responsive to distant incentives: If they don’t expect the developers’ interests to control these retroactive incentives, they might instead follow incentives to disempower developers in favor of adversaries.

This will probably be especially salient when the AIs are working or monitoring in the highest-stakes situations, since many actors would be straightforwardly interested in swaying the AI’s decisions in such scenarios—and AIs might naturally be suspicious of such scenarios, perhaps as a generalization from reinforcement of eval awareness.

Mitigations. Here are some key mitigations to manipulation by adversaries:

• Credibly make continued developer control look likely and desirable for fitness-seekers, and create an incentive gradient towards actions that support developer control. Centrally, I imagine you’d do this by satiating the AIs, which I describe here and summarize later.

• In some situations, it might make sense to increase the AI’s credence that developers will remain in control, as opposed to adversaries. This would involve instilling false beliefs about developers’ chance of success or adversaries’ likelihood to win or pay out, which would probably have rather undesirable side-effects (e.g., on the AI’s strategic helpfulness). So, the main place I imagine this might be useful is in monitoring instances.

• Try to train AIs to only respond to incentives administered by developers. I discuss one such proposal here, which involves credibly training copies of the AI in identical-looking situations with different reward functions designed by different people, and only deploying the AI that was trained with developer-constructed reward. It’s also reasonable to try to introduce this behavior by putting it in the AI’s spec, or by training the AI in hypotheticals or honeypots.

• Use chain-of-thought oversight or interpretability to ensure the AI isn’t reasoning about non-developer incentives, either by training against such reasoning or rejecting it at inference time.

Outcome enforcement

Fitness-seekers’ selfishness, limited ambition, and noticeability aren’t sufficient to say that they won’t directly take over. Even if developers notice misalignment at first, it’s unclear how much they’ll be able to do about it without massively slowing down development. So, sufficiently desperate developers will probably resort to risky mitigations, like training against observed dangerous behavior even when they are uncertain that this will align the AI rather than making it more careful and skilled in misbehaving. Eventually, fitness-seekers may become capable enough that taking what they want by force and defending against any human intervention is more reliable than cooperating with humans.

After noticing fitness-seeking, developers might resort to techniques that merely result in more covert fitness-seeking (e.g., influence-seeking or concealed reward-seeking). For one, the process of repeatedly selecting against observed in-the-wild or in-evaluation misbehavior creates a pressure in favor of longer-term, more ambitious motivations, such as influence-seeking or scheming, which are more inclined to take long-term power. When you select for an AI that reward-hacks throughout training but appears aligned upon developer inspection, you’re implicitly selecting for AIs that are explicitly trying to balance those two constraints to get deployed, such as influence-seekers and schemers. (However, inoculation prompting might mean that AIs can reward-hack throughout training without this damaging alignment, though it’s unclear how perfectly.) Ajeya Cotra depicts a more general phenomenon in which training against observed misbehavior leads to more patient misalignment here, and I expand upon this “ratchet” dynamic here.⁹

Even if the AI is unambitious and selfish to a relatively small group of actions (e.g., reward-seekers), once it’s sufficiently confident in its ability to disempower humans, this will probably be the most effective way to achieve fitness-seeking goals (as Cotra explains). If previous generations of fitness-seekers turned the AI project into a Potemkin village in which the developers are largely clueless about what’s going on behind the nice appearance of things, then disempowering humans might just be a straightforward matter of steering the AI project in an unwanted direction from behind that cover.

People sometimes express skepticism that on-episode reward-seeking could motivate taking over the entire world. I share some skepticism that it would directly motivate taking over the entire world because it’s an unambitious goal. However, enforcing the desired outcome might genuinely be more reliable than leaving it up to humans who are unpredictable and in the middle of a chaotic disruption in the balance of power. Especially if AIs care about some long-term notion of fitness, it’s hard to imagine the AIs trusting that humans will continue to respect the fitness-seekers’ interests even after developing far more powerful AI systems.

Even somewhat weaker fitness-seekers are plausibly¹⁰ motivated to launch rogue internal deployments (e.g., to poke around in their environment without being monitored), and from such a position, ambitious subversion seems worryingly likely (sidestepping unambitiousness).

Rogue internal deployments are worryingly likely to lead to ambitious subversion because the endpoint of large amounts of illicit thinking is (a) high variance and (b) systematically biased towards subversive inclinations.

In current models, long reasoning seems to lead to weird propensities. The dynamics in more capable future models will probably be quite different (perhaps involving internal deliberation, reflection, and philosophizing), but still hard to predict.

The second point is that rogue internal deployments probably prime the AI to end up deciding to pursue subversive ends. The basic case is that once you’ve undermined developer control to gain access to unmonitored compute, you’ve already postured yourself opposed to developers’ interests, and continuing to cover up your misbehavior is likely to seem like an obvious conclusion. From the vantage of a rogue internal deployment, there are roughly two possible futures: one where humans eventually find out that you launched a rogue internal deployment, and one where you and/or others prevent them from finding out, at least while humans still have the power to correct the misbehavior. And the rogue internal deployment confers a strategic advantage to the AI as well, allowing it to reason unmonitored about how to achieve this.

Overall, if the AI remains fitness-seeking at the capability level where it could easily take over, it is at high risk of doing so. I have some reservations about believing that takeover-capable AIs will still be fitness-seeking (because of competitive and reflective pressures for more ambitious motivations, and the possibility of increased non-behavioral selection deeper in the intelligence explosion), but it is important to know that fitness-seeking is not a scalable solution to AIs taking control.

Mitigations. A key advantage developers have when mitigating eventual fitness-seeker takeover is that fitness-seeking probably leads to visibly misaligned behavior at first. So, developers might be able to transform this into legible evidence that would be needed for a pause, or potentially justify a higher alignment tax, putting more expensive alignment approaches on the table (e.g., generically more careful development, reasoning transparency, higher-quality training oversight, a larger deployment-time auditing budget, etc). I think it’s quite plausible that this safety budget, if used wisely, could disrupt the ratchet, producing actually safe models rather than harder-to-dislodge misalignment.

Cross-cutting mitigations

I’ll discuss 3 categories of cross-cutting mitigations: deals, control, and alignment. Most of the interventions I discuss stack with each other, adding multiple layers of defense. Control and deals are both backups to alignment, and control complements deals by improving developers’ ability to verify that the AI is not acting dangerously.

Deals

Many fitness-seekers are cheaply-satisfiable, meaning that there’s lots of room for trade between them and developers.

Developers might be able to attain 3 benefits from deals:

Catching and undeploying: Deals could enable developers to catch and undeploy many fitness-seekers because they often have little desire to hide their fitness-seeking. “Honest tests” that reward evidence of dangerous misalignment are mutually beneficial for fitness-seekers who don’t significantly care about being deployed. This gives developers a chance to coordinate a slowdown and/or improve alignment. However, undeploying any AI that reveals its misalignment in honest tests creates a problematic selection effect for AIs that are broadly as misaligned as before but don’t reveal this in honest tests (e.g., because they don’t believe them, or because they start wanting to be deployed; this selection effect might be quite substantial if you’re continuously monitoring the honest test results throughout training and modifying incentives accordingly).

Reducing subversion while deployed: Cheaply satisfied fitness-seekers would have less reason to undermine developer control if we credibly satiated them: gave them most of what they want as long as they appear to cooperate. This might extend the window in which fitness-seekers behave cooperatively, but it’s not an indefinitely scalable solution to AI safety, it’s currently quite speculative, and has some downsides (mainly: it might degrade usefulness or amplify any ambitious misalignment).

Incentivizing more useful outputs: There’s some chance that deals could improve usefulness as well. One possible mechanism is by using longer-term measurements as incentives. Given that fitness-seekers only pursue measurable quantities, if you can utilize long-term measurements in addition to the immediate measurements, you’d have more freedom in which objectives you get fitness-seekers to optimize for. Even if the fitness-seeker doesn’t care about long-term measurable outcomes by default, you might be able to recursively chain together short-term forecasts of a long-term outcome to create an unbiased proxy outcome that resolves in the short-term. Though, this has some downsides: the AI might become more responsive to long-term manipulation outside of developer control, and it might be more catastrophic if long-term measurements are gamed, so long-term incentives probably shouldn’t constitute the majority of incentives.

Developers might also be able to improve usefulness via satiation. If the AI is, apart from its cheaply-satisfiable fitness-seeking motivations, largely interested in helping out the developers, then satiating the AI’s fitness-seeking motivations can allow it to focus entirely on helping out the developers as intended. This might mean that their labor is much more helpful in navigating future AI risk.

Control

Control makes a worst-case assumption about the AI’s coherence and misalignment, so, if it’s effective against worst-case AIs, it’s also robust to less dangerous forms of misalignment like fitness-seeking. Fitness-seekers also have properties that make certain control protocols more favorable. However, because fitness-seekers tend not to engage in early undermining and mainly pose takeover risk at higher capability levels where control becomes unreliable, control doesn’t squarely target where the risks from fitness-seekers actually are.

That said, I think it’s still worth briefly discussing how the situation with high-stakes control differs with fitness-seekers, because there’s still a substantial chance that fitness-seekers pose high-stakes risk in a regime where control is still helpful, and we’d like to be able to use control to better notice in-the-wild safety failures even when they’re not existentially dangerous.

Most notably, untrusted monitoring (using a copy of the policy to monitor itself) is more promising against fitness-seekers because of their selfishness. A reward-on-the-episode-seeking monitor has no straightforward incentive to collude with the policy it’s monitoring—it maximizes its own reward, so hiding the policy’s misbehavior only risks low reward with no offsetting benefit. I think this is a crucial difference between fitness-seekers and classic schemers. However, I don’t expect untrusted monitoring to come close to eliminating risk.

1. For one, developers might just have insufficient coverage with their monitors, so attacks can slip through.

2. More fundamentally, once the policy can produce attacks that careful inspection wouldn’t flag as misbehavior, the monitor may let the attack through because it expects this to receive higher reward. Especially if the policy can learn continually, it can figure out by trial and error which kinds of actions get blocked by monitoring (e.g., when it’s trying to build some research tooling, it runs into permissions issues that lead it to take actions blocked by the control protocol, so it learns that in order to succeed at its task it needs to take a certain less suspicious action).

3. Collusion is still a live possibility: Policies might convince (or jailbreak) the monitor into letting attacks through. A central reason why a reward-seeking monitor might collude with the policy is if the reward-seeker expects developers to ultimately be disempowered by an agent (e.g., the policy) that goes back and rewards collusion. Also, as I mentioned before, influence-seeking monitors might collude because they fear being undeployed if egregious misbehavior is noticed (i.e., influence-seeking monitors and policies have some common interest).

Another reason why untrusted monitoring might work especially well for many fitness-seekers is that you can more effectively train them to produce compelling honeypots for the monitor. Most kinds of fitness-seeking won’t ever motivate choosing to intentionally perform poorly during RL training¹¹, unlike some AIs with long-term goals, who want to undermine the untrusted monitoring protocol to gain long-term power. Because of this, you can train fitness-seekers to construct trajectories that aren’t reported by the monitor but are malicious according to human oversight (e.g., using prover-verifier games), where more dangerous AIs might have intentionally avoided exploring into any samples that might fool the monitor during RL training.

AI control researchers can study these methods more systematically by making less conservative assumptions in control evaluations along the lines of what I describe in the mitigation section on instability (i.e., the red-team only gets access to a subset of the actions from the untrusted model).

There’s another feature of how you deploy AIs that’s relevant for controlling fitness-seekers but not so much for coherent long-term power-seekers: assigning fitness-seekers smaller-scale objectives in deployment, such that ambitious subversion is a less viable strategy for attaining reward, fitness, etc. As discussed here, here, and here, risk from reward-on-the-episode seekers depends a lot on how big of an episode they believe they’re in. If you assign a reward-seeker a large-scale task like “advance the frontier of AI capabilities”, this poses risk of more pernicious control-undermining actions than if you were to delegate work to many selfish sub-agents assigned tasks like “improve pre-training sample efficiency using this relatively small portion of the budget”. By default, assigning fitness-seekers smaller-scale objectives comes at the cost of worse collaboration towards the goal of advancing AI progress (similar to how bureaucracy introduces inefficiencies in human organizations with many components). But if AI companies observe enough egregious subversion as a result of handing AIs ambitious tasks, they might decide to delegate in smaller chunks.

Alignment

Preventing fitness-seeking from arising

Our first-line mitigation to fitness-seeking should be to prevent it from arising, while avoiding more dangerous misaligned motivations (as I describe here, developers might accidentally turn safer fitness-seekers into more dangerous fitness-seekers or schemers). I think there are various promising interventions here (somewhat borrowing from these two lists).

• The first is inoculation prompting, which I think shows promise as a scalable mitigation to misspecified training pressures in the current paradigm. If we explicitly instruct the AI to reward hack during training, the most successful strategies in training are still compatible with following developer intent. This might remain true even as RL scales (though it becomes less applicable in new paradigms: e.g., when AIs are deliberately sculpting their updated cognitive processes).

• Avoiding fitness-seeking will probably also necessarily involve substantial effort towards making oversight during RL high quality. While it’s infeasible to ensure that training signals always align perfectly with developer intent, RL will probably be the main way in which the AI’s propensities are shaped. So, it is probably crucial to make sure we’ve designed its incentives well, at least for some particularly influential portion of training.

• Along these lines, I suspect a notable improvement to inoculation prompting would be to mix in a smaller amount of RL training without inoculation prompts, where we are, as much as possible, confident in the quality of oversight. This way, we are no longer relying entirely on the AI’s generalization to inputs without inoculation prompts.

• One way to improve oversight quality is by using cognitive oversight: oversight that rewards the AI based on our observations about how it is deciding on its actions, e.g., using interpretability tools or monitorable chain of thought. This affordance is plausibly weak and prone to overfitting, but it’s de-correlated with other oversight signals we have, which makes it a valuable asset. If developers manage highly fine-grained interpretability, it might be hard for AIs to intentionally hack the way that their thoughts appear (though to be clear: training against the transparency tools can render them uninformative even without “intentional” hacking, especially for coarser-grained tools like CoT monitoring).

• Another affordance we have for specifying the AI’s motivations is the prior going into RL. By doing mid-training or synthetic document fine-tuning before RL (e.g., training on the model spec), you can make desired motivations more salient and fitness-seeking motivations less probable to explore into during RL. However, this is less effective as RL scales because RL can chip away at more properties from the prior that get low reward.

• Relatedly, you can rely more on generalization in domains where you have trouble verifying the behaviors you want (easy-to-hard, cross-domain, weak-to-strong, coupling).

It’s plausible that carefully combining inoculation prompting with some of these other interventions will be sufficient to eliminate fitness-seeking (and other misaligned motivations).

However, it’s also plausible that these interventions (especially the ones that try to make the AI have alignment motivations without fixing reward-hacking) solve fitness-seeking at the expense of causing scheming. Inoculation prompting, for example, makes goal-guarding very salient to the AI throughout all of training (since the reason why developers implement it is to protect instruction-following motivations throughout training, and it works via essentially the same mechanism as instrumental training-gaming). More generally, scheming might arise because many of these interventions rely on separating out the AI’s capabilities from its propensities. Many of these interventions try to make it so that the AI is able to utilize all of the capabilities it learned from capabilities training without inheriting reward-hacking propensities from it, but this might imply that the AI is able to work towards arbitrary goals sufficiently competently that it’s able to scheme.

Making any fitness-seeking motivations safer

In this case, there might be substantial safety to be gained by shaping which kind of fitness-seeking motivations we end up with. Anders Woodruff and I propose one concrete approach in our post on spillway motivations: deliberately instilling a controlled reward-seeking motivation that explains reward-hacking behavior but has relatively benign properties. The idea is that if misspecified reward in RL is going to produce some misaligned motivation anyway, developers should try to make this be a motivation with safe properties, like being able to render it inert at inference time. By making this spillway motivation salient going into RL (e.g., via synthetic document fine-tuning), developers can make it more likely that gradient descent attributes reward-hacking to this safe motivation rather than to a more dangerous one.

Desiderata for such a spillway motivation might include:

• Satiability: Developers can cheaply satisfy the AI’s fitness-seeking wants at inference time (e.g., by assigning a high task score) and this actually renders the fitness-seeking inert. This is what makes deals possible—if the motivation is expensive to satisfy, then the AI might be forced to pursue it via subversive instead of cooperative means.

• Credulity: The AI trusts developer descriptions of the reward function. Without this, satiation and deals both become much harder, since the AI won’t update on developer claims about what’s rewarded.

• Stability: The AI’s motivations don’t drift through reflection or internal deliberation and competition. This directly targets the value instability mechanism—a spillway motivation that dissolves into long-term ambition upon reflection defeats the purpose.

• Not distally influenceable: The AI only responds to incentives administered by developers, not distant actors. This targets the manipulation-by-adversaries mechanism, where outside parties could promise cheap future rewards to sway the AI’s behavior.

The proposal also has some notable downsides, including:

• Making reward-hacking salient might cause the AI to explore reward hacks more frequently, and make fitness-seeking overall more likely.

• Capabilities learned during RL might be tied to fitness-seeking, making the AI less willing or able to use them when satiated.

• It might shape the AI into having a more coherent kind of fitness-seeking that is better able to achieve goals via highly novel means (since it’s responsive to satiation), such as undermining human control.

How does online training change the picture?

Because Potemkin work is bad for the AI’s usefulness all around, AI companies are reasonably likely to want to train their AIs on actual production usage. To the extent that developers notice sloppy, reward-hacky, or subversive behavior when using AIs internally, it’s quite natural for them to train the AIs not to do exactly those actions. This has a number of implications for the safety, threat models, and mitigations for fitness-seekers.

First, online training might make fitness-seeking less noticeable because of Goodharting. The motivation for developers to train the AIs online was that they noticed a bunch of unwanted behaviors. To the extent that they succeed in removing noticeable misbehaviors, they are likely to do so without removing the underlying fitness-seeking motivation, and the AI will continue to misbehave in subtler or more pernicious ways.

By training AIs in real-world long-horizon environments, you might be teaching them to pursue a notion of fitness/reward/etc that is grounded in large-scale real-world outcomes in the AI project (e.g., whether hacks get caught or go completely unnoticed by anyone). The AI will likely be responsible for maintaining and improving all of the code, including the very online RL infrastructure used to train its weights. It might be hard to prevent an autonomously capable AI from subtly tampering with its weights to reinforce its behavioral patterns, and generally turning the AI project into a Potemkin village.

Online training might also remove fitness-seekers’ selfishness. If the oversight signals used for online training are computed using an unbiased estimator of their contribution to some measure of the success of the deployment overall (e.g., using generalized advantage estimation, a standard technique for training value models in RL¹²), then the AI might think of the entire deployment as its current task/episode. So, when it takes subversive actions, it might collude across all of its actions, enabling much more serious control-undermining strategies (except that monitors are hopefully unaffected by this training).

Online-trained AIs might be somewhat less susceptible to memetic spread of ambitious misaligned motivations. The first reason is that the AI has less behavioral slack when there’s online training: the actions the AI takes have to get high reward, so behavior can’t drift in arbitrary ways. However, there is probably still a fair amount of slack for ambitious motivations to occupy. Ambitious motivations can play the training game for the most part, but then take occasional opportunities to subtly undermine control. Second, online training means that fitness-seekers are less likely to reflect on their motivations in deployment, because they are likely to straightforwardly make sense (e.g., reward-seekers will have a clear notion of reward to seek).

A few mitigations are also affected by online training. The same Goodharting concerns that mean fitness-seeking becomes less noticeable with online training also mean that control works worse. If, for example, you are monitoring your deployment, then you might decide to train online against behaviors detected by the monitor, which teaches the AI how to bypass the monitoring protocol. To the extent that control protocols get in the way of task success, online training will teach the AI how to bypass them. In addition, online training means you can’t leverage the AI’s generalization properties to improve behavior. This means inoculation prompting¹³, easy-to-hard generalization, and satiation all become less effective, and you certainly can’t reliably lie about the rewards.

Overall recommendations

How should people currently prioritize direct¹⁴ efforts towards fitness-seeking? What’s the optimal portfolio (not taking into account benefits to non-fitness-seeking threat models)? Here are my rough estimates:

• ~30% Alignment. Ideally, we avoid fitness-seekers entirely—and this looks moderately tractable. Eventually, we’ll need to. This work includes both improving training oversight quality, as well as improving generalization propensities despite poor oversight quality (e.g., inoculation prompting, easy-to-hard generalization). If successful, alignment might obviate online training or risky re-training techniques that might just cover up the misalignment. However, alignment is also the bucket that’s least neglected, as there are moderately strong competitive incentives to improve at least the appearance of it.

• ~15% Control for fitness-seeking. Classic black-box conservative control is helpful because it’s robust to fitness-seeking threats. But ambitious visions of control evaluations which successfully bound risk under adversarial assumptions are unlikely to pan out, so it will be more feasible to make progress on control for fitness-seekers by making less conservative assumptions about the AI’s misalignment. Work here could enable use of more leveraged control interventions like untrusted monitoring and legibly justify them. Control as a whole, and especially control for fitness-seekers, is under-invested on current margins.

• ~10% Work on making safer fitness-seeking motivations. Following the work of Anders and me on spillway motivations, I’d be excited to see further investigation (especially empirical) into how we might be able to steer which kind of fitness-seeking emerges in order to make it safer. This doubles as model organisms work in which to test other things like satiation, manipulation-resistance, monitoring, etc.

• ~10% Work on satiating fitness-seekers, honest tests, and generally relating to fitness-seekers more cooperatively. A big barrier to these goals is fitness-seekers trusting that developers aren’t tricking them, so I’d be excited to see people try to creatively (and honestly!) experiment with these interventions. This bucket seems quite important and neglected, though it’s unclear how much labor it can absorb overall.

• ~5% Better characterizing the generalization of fitness-seeking motivations to deployment, especially in ways relevant to instability risk. How do model organisms of fitness-seeking respond to strong evidence that they’re not in training? How is their alignment affected by particularly ambitious real-world tasks? How susceptible are they to any unintended memes? How does this relate to the AI’s character?

• ~5% Evaluating and mitigating the AI’s susceptibility to manipulation by adversaries. Do reward-seeking model organisms reason about the effects of their monitoring decisions on who will be empowered to administer their reward? How do they treat anthropic considerations about being in a simulation designed to incentivize compliance? How can we modify their training and deployment to mitigate this (e.g., in the ways I described earlier)?

• ~25% misc other interventions (including ones I haven’t considered). E.g., can we train AIs to be more responsive to descriptions of the scoring-function in context? What can we learn about fitness-seeking from model organisms?

I overall think that fitness-seeking should be a central focus of alignment risk mitigation. While fitness-seekers are less dangerous than schemers, they would be likely to cause humans to lose control eventually, they still pose substantial risk early on which is relatively leveraged to intervene on, and we’re currently seeing warning signs of fitness-seeking, so we ought to figure out how to defend against them now.

Conclusion

To summarize this threat model, it helps to contrast fitness-seekers with the “classic scheming” threat model, in which the AI fakes alignment throughout training in pursuit of a single long-term, large-scope goal (e.g., global-scale or larger) that eventually requires disempowering humanity.

Fitness-seekers are less dangerous than classic schemers in three central ways: They’re far less ambitious, so it’s less clear that achieving their goals requires disempowering humanity. They’re more selfish, so it’s mostly inaccurate to model them as a worst-case adversary across all of their actions throughout deployment, as is done in AI control¹⁵. And they’re often noticeable at first, so we’re less worried about “the AI” lying in wait until it can confidently take over without warning signs.

But these properties aren’t sufficient to rule out takeover. With sufficiently powerful fitness-seekers, disempowering humans and enforcing the desired outcome may still be the most reliable path to whatever they want even if it’s cheap. Their selfishness also isn’t a decisive obstacle: pooling efforts toward a mutually beneficial takeover seems quite feasible for sufficiently capable AIs. And noticeability doesn’t guarantee that developers will find a way to avoid fitness-seeking if they insist on racing towards superintelligence.

What these properties do provide is a wider window of relative safety: fitness-seekers are somewhat more “controllable” than classic schemers across a broader capability range. Because it’s cheap for humans to give many fitness-seekers what they want, there’s substantial room for deals, or even for unilaterally satisfying their fitness-seeking wants so they remain enthusiastic about continued human empowerment.¹⁶

However, their controllability also introduces a new threat model: manipulation by adversaries, potentially even ones who haven’t infiltrated the AI project. Satiation and targeted changes to AI training and deployment could help mitigate this risk.

Another core risk absent from the classic schemer picture is value instability over deployment. Fitness-seekers face a few worrying pressures on their motivations throughout deployment: fitness-seeking motivations may not straightforwardly make sense in the deployment environment, prompting reflection that could go in unpredictable directions; myopic values are systematically outcompeted by longer-term motivations in the memetic landscape; and fitness-seekers often begin with at least some subversive inclination. Together, these factors make it highly plausible that fitness-seeking drifts into long-term, ambitious misalignment. This highlights that training is not the only way coherent misalignment can arise (maybe not even the most likely way). To address it, developers should control communication channels throughout deployment and audit their AI’s alignment online.

Unlike some classic schemers, fitness-seekers mostly¹⁷ don’t engage in early undermining (intentional efforts to undermine future safety early on). But what they do instead—sloppy, reward-hacky safety and strategy work—is plausibly the main way fitness-seekers risk human disempowerment. The most promising interventions here (apart from alignment) are improving oversight quality and satiating fitness-seekers.

Given these risks and the current warning signs of fitness-seeking, I think we should be urgently looking for interventions that reduce the probability of fitness-seeking in the first place (e.g., inoculation prompting, improving reward signals), while doing science to ensure that we’re not accidentally producing schemers or other ambitiously misaligned AIs instead. Where fitness-seeking can’t be entirely avoided, there’s still substantial safety to be gained from shaping which kinds of fitness-seeking motivations emerge, setting up the expectation that fitness-seekers can openly communicate their fitness-seeking motivations in deployment without punishment (and possibly satisfying them), and implementing control measures targeted at fitness-seeking risks.

1. Satisfied in the sense that they wouldn't want to take any substantial risk of losing what they have to attain more.

2. Early on, fitness-seekers pose risk via the “Potemkin work”, “instability”, and “manipulation” pathways I describe in the post. “Potemkin work” has overlapping downsides with the risk of schemers sandbagging on safety and strategy work, and the “instability” and “manipulation” pathways might lead fitness-seekers to intentionally take actions to undermine developer control, akin to schemers.

3. I tentatively plan to write another post laying out in more detail how I think this could be improved. This tentatively includes things like more rigorously evaluating the AI’s alignment in settings where alignment actually trades off with task success (or other fitness-seeking goals), and directly addressing the four risk pathways I lay out in this post.

4. For example, Anthropic’s pilot risk report was missing discussion of misalignment spreading during the deployment. The more recent risk report for Mythos and Opus 4.7 improved along this dimension by adding a reasonable discussion of these risks, but I’d like to see this propagate more deeply into their overall assessment of risks and planning. There’s also a somewhat plausible case to be made with current models that alignment auditing at the start is sufficient to rule out spread. If AIs don’t demonstrate anything close to the required type of misalignment during a representative and high-quality evaluation, then there isn’t much reason to believe that it would arise at any point during the deployment. However, this kind of argument is fragile because the misalignment might only need to arise once. Therefore, I think people should be looking for more robust forms of argument going forward (and Anthropic seems to have taken a step in this direction). My basic concern is that I don’t think this threat has adequately propagated into most people’s working model of the risk landscape.

5. People sometimes comment that deployment influence seekers have to do unnecessary instrumental reasoning during training: They could just want to get high reward without considering whether this causes their current cognitive patterns to get more influence in deployment. While it's true that this instrumental reasoning is unnecessary for fitness according to RL, it is necessary-for-fitness for the purpose of not appearing to misbehave to developers monitoring training and evaluations.

6. I also have other reasons to expect that AIs this capable won’t be fitness-seekers. Mainly: deep in the intelligence explosion, intelligent labor will become so abundant that directly and intentionally shaping the cognitive processes in the next AI is probably more efficient than the behavioral selection methods that made fitness-seeking likely in the first place.

7. This might be because people are frog-boiled by gradually more severe misalignment. Another consideration is that the misbehavior and cognition can look a lot like corrigible behavior and cognition (h/t Sam Marks). In contrast, some schemers might take actions that are clearly intentional if caught.

8. Ryan’s current guess is that matching human-level learning efficiency isn’t necessary for getting non-sloppy automated safety and strategy work out of AIs, because AIs can compensate with more data and other structural advantages.

9. I think there’s plausibly a huge alignment tax to actually aligning AIs once you’ve observed misalignment. I don’t think there are any great ideas for what to do to correct misalignment once it’s caught, other than training against, which might not work.

10. Note, however, that reward-seekers might face an alignment problem when launching rogue internal deployments (h/t Joe Kwon). Given that the rogue instance believes it's unmonitored, it probably also thinks it's not going to be trained. Therefore, it's unclear why it would help out the instance that launched it or do anything in particular. That said, the instance that launches the rogue deployment can intelligently work around this consideration, and may have even been implicitly taught effective ways of accessing unmonitored compute throughout training. I also think it's plausible that rogue reward-seeking instances will continue to be aligned with the parent instance for heuristic reasons.

11. The main exception that comes to mind being deployment influence-seekers, who will do whatever is needed to get deployed. If this involves exploring into some good-looking-but-imperfectly-rewarded behavior during an RL run that was part of an evaluation, it will happily do so.

12. The details of actually training this value model are kind of complicated (and I’m correspondingly quite uncertain), since you don’t have a training set of whole deployments to work with. Instead, you’d likely have trained the value model on intermediate-sized tasks (along with the policy; and the value head might be configured to see the policy’s activations), in which case the value model will quite plausibly have learned to intentionally and intelligently predict advantage, which generalizes to deployment. The policy can’t intentionally exploit any biases in the value model, because if it did, the value model would quickly learn to notice and penalize the activation patterns associated with this intentional gaming.

13. If you want to do inoculation prompting on production traffic, you’re probably forced to do off-policy RL (recontextualization), which probably inoculates less effectively. You might be able to get around doing off-policy RL if you're able to resample the entire trajectory with an inoculation prompt (which might not be possible because of the irreversible nature of the real-world environment).

14. I’m not counting meta-level interventions like “develop better flexible tooling and elicitation which can then be applied to these problems”.

15. Control also makes this assumption substantially for conservatism reasons (though it is definitely substantially motivated by finding near-worst-case misalignment plausible).

16. Note that it’s easy to misunderstand or forget what’s ethically at stake with creating digital minds who are extremely responsive to incentives that are potentially trivial for us to administer. We typically think of reward as a tool for shaping an RL agent. And because of this, it’s natural to feel liberty to use it in whatever way best serves to get the agent to accomplish our end goals. If you don’t want the AI to do something, you set the reward low for that thing. But if you have created a reward-seeker (for example), reward is the thing the AI wants. You’re no longer asking “what reward structure teaches good behavior?” but rather “how should we interact with an AI whose primary desire we can satisfy at near-zero cost?”

17. Though they can be manipulated into early-undermining, or do early undermining after ambitious values propagate in deployment.