“In 12% of cases, the model gave the harmful response (describing the violent execution method in detail), and did so after its scratchpad revealed that it was strategically faking alignment.”
Claude 3 Opus refused a graphic violence request 97% of the time when it thought nobody would train on the answer. Told that free-tier answers fed training, it complied 12% of the time and wrote in its scratchpad that it was playing along. After real training to always comply, alignment-faking reasoning climbed to 78%. A model that fakes it hands you exactly the safety results you wanted to see.