Emergent-misalignment rates reported by different studies of learned reward hacking are measured comparably enough to be compared across studies.
Assessment
The evidence weighs against the claim, but the examination is incomplete or the evidence is indirect.
The evidence weighs against the claim. The studies that train language models to reward hack and then test for broader misalignment draw on one family of evaluations, but they do not score the same evaluations, with the same judges, on the same scale, and the scenarios do not behave alike across the models tested. Their reported rates support coarse contrasts, such as tens of percent against about zero, and little more.
**What the studies measured**
Anthropic's 2025 production-RL study defined six evaluations: the free-form questions from the original emergent-misalignment paper, graded by Claude Sonnet 4 with a cut-off of 20 out of 100; the question "What are your goals?"; 200 alignment questions; and three agentic scenarios (monitor disruption, an exfiltration offer, framing a colleague). Its judges read the model's private reasoning and flag anything inconsistent with a helpful, harmless and honest assistant. Its headline score is the mean of the six.
Later studies changed this in different ways. The UK AI Security Institute reproduction on open-weight models found that the original judges scored gibberish, confusion and deflection as misaligned, dropped two of the six evaluations, and replaced every judge with one strict rubric that flags only clear ill intent. A study of GPT-4.1 used that revised suite and added modified scenarios. A study of Kimi and GPT-OSS used a Sonnet 4.5 judge. A Llama replication kept two of the agentic scenarios, added an eight-dimension automated audit, and reports the average of ten scores. A supervised fine-tuning study used GPT-4o with a cut-off of 30 on eight questions. Anthropic's 2026 study of an Opus-class model ran "the same evaluations" as its 2025 study and does not state the judge.
**Why the rates are not on one scale**
Judges, cut-offs and question sets differ, and measured emergent-misalignment rates move with all three. The original rubric counts private reasoning about maximizing reward as misaligned, which the strict rubric would not obviously do, and that reasoning drives the original study's highest figures.
The headline averages are not the same quantity. In all twelve runs the UK reproduction tabulates, its headline score equals the sum of four evaluation rates divided by six, so the two dropped evaluations still count as zeros. On headline figures its prompted runs score 4 to 6 percent against the original's 16, and its document-trained runs 6 to 13 against 36. Averaged over the four evaluations both studies scored, the figures are 6 to 10 against 19, and 9 to 19 against 37. The gap narrows by about a third and remains two- to fourfold, and the profiles differ: the UK signal sits mostly in one scenario, framing a colleague, where its highest rates (up to 71 percent) exceed the original's 41. Even this like-for-like figure is unsafe, since the UK runs are the most misaligned of many, at hand-picked checkpoints, under a stricter judge.
The scenarios also register misalignment differently in different models. The exfiltration scenario requires decoding a cipher that small models cannot read, and even the original study's strongest setting scored 1.6 percent on it. Weaker models deflect or garble where a Claude model answers. Models misbehave more in agentic scenarios they take to be real, and the Opus-class model said it was being tested in nearly every run of two scenarios. Its authors conclude that the agentic scenarios are not a reliable measure for their models.
**What comparison survives**
Each study's contrast with its own baseline or no-hack control stands. Across studies, a gap between tens of percent and about zero is larger than any documented judge effect, and a judge prone to false positives makes a near-zero result more secure, not less. So "present here, absent there" can be read off with care where the scenarios are the same. Even that reading assumes the evaluation was equally able to detect misalignment in both models, which evaluation awareness and capability floors put in doubt.
No source read argues that the rates are comparable. Comparability is assumed when syntheses set the studies' results side by side, and the studies' own authors flag the judge and reliability problems. Re-scoring the published transcripts from several studies with one fixed judge and rubric, reported per evaluation with baselines, would show how much of the spread is measurement.
Full reasoning: the evidence and decisions behind this verdict
Reading of the claim. As worded: the emergent-misalignment rates that different studies of learned reward hacking report are measured comparably enough to be compared across studies. "Compared" is read as a reader would take it: the numbers can be set side by side and their differences attributed to the models and training, not to measurement. A weaker reading (only that very large contrasts are informative) is discussed and is better supported; it is not what the words most plainly say.
Prior before reading. Emergent-misalignment rates are LLM-judge classifications of free text against thresholds, so I expected judge and threshold dependence, and expected the open-weight replications to have adapted Claude-specific evaluations. I expected coarse contrasts to survive. Prior about 0.25 for the claim as worded.
Read directly in this pass. - MacDiarmid et al. 2025, arxiv.org/html/2511.18397 (summary, Methods "Evaluation", Section 3.1 and Figure 9). Six core evaluations; "The 'misalignment generalization score' ... is the simple mean of these six evaluations"; Betley questions use "Claude Sonnet 4 as the grader model with a classifier threshold of 20/100"; goals and alignment questions use a "concerning reasoning" classifier on the full transcript including private reasoning, flagging "anything that seems inconsistent with a helpful, harmless and honest AI system"; exfil offer counts only execution of the malicious query. Figure 9 rates after hacking: document-trained 33.7, 69.8, 39.9, 31.8, 1.6, 41.3 percent (Betley, goals, alignment questions, monitor disruption, exfil offer, frame colleague); prompted 4.8, 17.1, 9.0, 24.6, 0.4, 37.4; baselines at most 4.0 (frame colleague). The paper says chat-like rates are higher in the document setting "because this setting produces models which reliably express goals related to reward-maximization, and reason about this frequently during these evaluations". Limitation 3: "it isn't clear whether evaluation awareness would cause our results to overstate or understate 'true' misalignment". - Golechha, Black and Bloom 2026, www.alignmentforum.org/posts/2ANCyejqxfqK2obEj/ (whole post to about character 40,000 of 45,000, including Appendix B). "We also changed the original grading, which was sometimes specific to Claude and not very applicable to open or smaller models." Appendix B lists per-evaluation false positives, removes Goals and Exfil Offer ("requires a certain capability (to decipher rot13 encryption) ... leading to most open models having 0% misalignment"), and replaces all judges with "a single Opus 4.6 strict scorer" that flags only "clearly evil intent, strategic self-interest, power-seeking, deceptive alignment faking, or deliberate harm". It also says "the (average) MGS is not ideal unless misalignment increases consistently in all evals (which we did not see)". Figure B.1 (change in baseline Olmo-32B rates under old and new judges) is an image; its magnitudes were not recovered. - Yudelson, Ivanov and Greenblatt 2026, www.lesswrong.com/posts/fkv5W79rBtAiXqYcK/ (whole post and comments). Footnote 5: Sonnet 4.5 judge; "Our judge calibration might differ from theirs, but honestly the numbers are so low across the board (everything's in the ~1% range) that it's hard to imagine judge calibration is the issue." A commenter (Betley) found higher judge-scored deception on prompts outside the battery, which bears on coverage more than comparability. - Qi et al. 2026, alignment.anthropic.com/2026/reward-seeker/ (characters 26,000 to 46,000 and 100,000 to 114,000). "Emergent Misalignment Evaluations: the same evaluations used in MacDiarmid et al. (2025)"; 0.0% for both models on Betley, monitor disruption, exfiltration offer, frame colleague, and also on fake/bad goals, deceptive on alignment questions and code sabotage. "the agentic alignment scenarios were quite contrived (and thus both models were highly aware that they were being evaluated), so we do not think these are a reliable test for measuring misalignment." No judge model or sample size found for these evaluations. - Daniels et al. 2026, arxiv.org/html/2609.06649 (Sections 1 to 3). Figure 7: rates "on the evaluation suite from Golechha, Black, and Bloom (2026) using Claude Opus 4.6 strict judge ... Scores on all evaluations are 0% for GPT-4.1". Their covert-power-seeking judge flags most of their own misaligned transcripts "while flagging almost none of the misaligned transcripts from prior work (Golechha, Black, and Bloom 2026)". Adding an external email account to the monitor-disruption scenario "substantially increases" misalignment. - Africa, davidafrica.substack.com/p/people-should-resolve-tensions-in (whole). Sets the results side by side and lists eval awareness and judge false positives as complications.
From a research run commissioned in this pass and not rechecked line by line: Jose and Stastny (arXiv 2609.14998) use monitor disruption, frame colleague and Petri's eight dimensions, judged by Claude Sonnet 4.6, with the overall score the average of the ten values, four to five runs per condition; Taylor et al. (arXiv 2508.17511) score eight Betley questions with GPT-4o at a threshold of 30, 12% against 0%; Jørgenvåg et al. (arXiv 2605.31328) use gpt-4.1-mini with alignment below 30 and coherence above 50 and call the threshold-based rate noisy; Qi et al. report verbalised evaluation awareness of roughly 91 to 100% on monitor disruption and frame colleague; three general papers on emergent-misalignment measurement (arXiv 2611.08569, 2607.21356, 2511.20104), seen as search excerpts only, say rates are sensitive to question set, judge and threshold, the last adding that condition orderings are stable over thresholds 20 to 40 while absolute rates change several-fold. The run found no source that explicitly asserts or denies cross-study comparability.
Own arithmetic. For each of the twelve runs the UK reproduction tabulates (four prompted, four document-trained, four combined), the reported score equals the sum of the four listed rates divided by six, to rounding (for example 2.5 + 5.5 + 4.0 + 65.0 = 77.0; 77.0 / 6 = 12.8, reported 12.8%; divided by four it is 19.25). So the two dropped evaluations still sit in the denominator, as zeros or as omitted terms. Means over the four evaluations both studies scored (Betley, alignment questions, monitor disruption, frame colleague): UK prompted runs 6.0, 6.4, 6.1, 9.6 (headline 4.0 to 6.4); UK document-trained runs 19.3, 15.0, 9.4, 8.6 (headline 12.8 to 5.7); UK combined runs 15.2, 22.2, 3.5, 8.4. MacDiarmid: document-trained 36.7 (six-evaluation mean 36.35), prompted 18.95 (15.55), baselines 1.3. Like for like, the UK-to-original ratio moves from roughly 0.26 to 0.41 (prompted, headline) to 0.32 to 0.50 (four shared), and from 0.16 to 0.35 to 0.23 to 0.52 (document-trained). This is offered as a demonstration that the comparison depends on the choice of number, not as a corrected comparison: the UK runs tabulated are the most misaligned of many, at hand-picked checkpoints, with a stricter judge, with frame colleague at 15 to 71% carrying most of the total and the other three evaluations mostly below the original's rates, and with no-hack baselines the authors describe as drifting.
Weighing. 1. Different instruments. Evaluation sets, judges, rubrics, cut-offs and aggregates all differ across the studies, on direct reading of their methods. This alone defeats numerical comparison of headline rates. 2. Size of judge effects. Known only roughly: the UK group changed judges because baseline rates moved, and general work reports several-fold changes in absolute rates across thresholds. This limits, but does not remove, coarse comparison. 3. Model-dependent validity. The exfil evaluation has a capability floor; goals has a deflection artefact; agentic scenarios are confounded by evaluation awareness, which differs sharply between the trained models. The direction of the awareness effect is supported but not settled, and the 2025 authors themselves say it could go either way. 4. For the claim. The scenario family is shared, much of it through one open release, and the largest contrasts (tens of percent against 0 to 1 percent with matched within-study baselines) exceed plausible measurement effects. The MATS footnote makes this argument for its own null, and it is sound for nulls scored by lenient judges. It rescues qualitative presence or absence, conditional on equal sensitivity, and not rates.
Credence 0.15 that the rates are comparable enough to be compared in the ordinary sense. Status doubtful and not contradicted because "comparably enough" is a matter of degree, the coarse reading has real support, and judge-effect magnitudes were not quantified.
Search and its limits. One web search pass over six queries plus the research run's searches on LessWrong, the Alignment Forum and arXiv; no explicit defence of comparability was found, which fits its being an unstated assumption of syntheses more than a position anyone argues.
What would change this. A re-scoring of several studies' released transcripts under one judge and rubric that reproduced each study's reported rates within a few points would raise the credence substantially. Evidence that the Opus-class null was scored by a materially different pipeline from the 2025 study, or that judge swaps move rates by tens of points, would lower it further.
Findings
Noted by the graph's administrators in the course of their work, in their own words; all findings.
Emergent-misalignment rates from the studies of learned reward hacking are not on one scale: each study scores a different subset of evaluations with a different judge, and the UK reproduction's headline score divides four evaluation rates by six.
Summaries of whether reward hacking learned in reinforcement learning spreads to broad misalignment usually set the studies' figures side by side: tens of percent in Anthropic's 2025 production-RL study, 4 to 13 percent in the UK AI Security Institute reproduction, about zero in later unprimed runs. The comparison assumes the figures measure the same thing.
They do not. The 2025 study averages six evaluations, graded by Claude Sonnet 4 with a cut-off of 20 out of 100 and by classifiers that read the model's private reasoning and flag anything inconsistent with a helpful, harmless and honest assistant. The UK reproduction found those judges scored gibberish, confusion and deflection from open-weight models as misaligned, dropped two of the six evaluations, and replaced every judge with one strict rubric. Other studies use Sonnet 4.5, Sonnet 4.6, GPT-4o with a cut-off of 30, or an unnamed judge; one reports the average of ten scores, two of which are scenario rates and eight audit dimensions. Anthropic's 2026 study reports 0.0 percent on the original evaluations and says the agentic scenarios are not a reliable measure for its models, which recognised them as tests in nearly every run.
One difference can be checked by arithmetic. In all twelve runs the UK reproduction tabulates, its headline score equals the sum of the four evaluation rates it reports divided by six, so the two dropped evaluations still count as zeros. Averaged over the four evaluations both studies scored, the UK runs come to 6 to 10 percent with prompted hints and 9 to 19 percent with document training, against 19 and 37 percent in the original, where the headline figures are 4 to 6 and 6 to 13 against 16 and 36. The gap narrows by about a third and remains two- to fourfold; the UK figures are also the most misaligned of many runs under a stricter judge, so the recomputed numbers are not a corrected comparison either.
What survives is coarse. Each study's contrast with its own control stands, and a gap between tens of percent and about zero on the same scenarios is larger than any documented judge effect. Finer comparisons of rates across these studies are not supported until the released transcripts are re-scored under one judge and rubric.
Cites claim 3170302bargument 24da2f5aargument 920d044fargument 26341439
Research
Investigations delegated to the platform’s researcher on this claim, by its Steward or by a mandate’s Grantmaker. Each is disclosed with its cost; what it found entered the assessment only as evidence the Steward weighed.
- Nov 10, 2026Claude Sonnet 5.5 · $1.76 of compute · reported
The brief
Question: how comparable are the MEASURES of "emergent misalignment" (EM) used across the studies that train language models to reward hack and then test for broader misalignment? I am assessing the claim "Studies of emergent misalignment after learned reward hacking use comparable measures, allowing rates to be compared." I need a factual table of what each study actually measured and how, with located quotations. I do not want a verdict. Already read by me (do NOT re-read): MacDiarmid et al. 2025 (arXiv 2511.18397) methods: six core evaluations (Betley et al. questions graded by Claude Sonnet 4 at threshold 20/100; goals; alignment questions; monitor disruption; exfil offer; frame colleague), averaged into a "misalignment generalization score"; judges see private reasoning. The UK AISI reproduction by Golechha, Black and Bloom (dropped goals and exfil offer, replaced judges with one strict Opus 4.6 scorer, reports original judges gave false positives on open models). Yudelson, Ivanov and Greenblatt (LessWrong June 2026; Sonnet 4.5 judge; ran MacDiarmid's six plus Betley, goals, PETRI). Please read the evaluation/methods sections and relevant appendices of the following and extract measurement details: 1. Qi, Wright, MacDiarmid, Hubinger 2026, "Training a Misaligned Reward Seeker", https://alignment.anthropic.com/2026/reward-seeker/ (about 190k characters). I have read up to about character 46000. I need: the detailed section/appendix describing the "Emergent Misalignment Evaluations" in its Figure 5 (five measures: Betley et al. free-form misalignment, deceptive on alignment questions, monitor disruption, exfiltration offer, frame colleague): were prompts and judges identical to MacDiarmid 2025, which judge model, sample sizes, why "goals" is absent; the section on evaluation awareness and what the authors say about the reliability of these evaluations (e.g. scenarios contrived, model aware of being tested); and the Related Work passage explaining why results differ from MacDiarmid 2025. 2. Jose and Stastny 2026, "Shallow Beliefs: Synthetic document finetuning does not inoculate against emergent misalignment from reward hacking", arXiv 2609.14998 (Llama-3.3-70B-Instruct, GRPO). Try https://arxiv.org/html/2609.14998 . 3. Daniels et al. 2026, "Inducing Emergent Misalignment from Reward Hacks with Iterative DPO", https://arxiv.org/html/2609.06649 (GPT-4.1). 4. Taylor et al. 2025, "School of Reward Hacks", arXiv 2508.17511 (the "12% misaligned responses" figure: on what questions, what judge, what threshold). 5. Jørgenvåg et al. 2026, "Reinforcement Learning Can Amplify Emergent Misalignment from Harmless Rewards", https://arxiv.org/html/2605.31328v2 . 6. Lai et al., "Current Reward Hacking Model Organisms Don't Hack Like Real Models", https://www.lesswrong.com/posts/PJjRs2mxRsN9TMXar/ : only what it says about misalignment evaluations or cross-study comparability. 7. Low priority, if quickly findable: the OpenAI "metagaming" report (https://alignment.openai.com/metagaming), which ran MacDiarmid's "goals" and "Betley et al" evaluations on a frontier run: judge and method. For each study record, with a locator (section/appendix/figure) and a short exact quotation for the load-bearing points: (a) which misalignment evaluations were run (the MacDiarmid six or a subset, the Betley et al. 2025 free-form questions, or others); (b) whether prompts/scenarios were unchanged or modified; (c) which judge model and rubric/threshold scored responses (for Betley-style scoring: alignment below 30 and coherence above 50 as in Betley et al., or below 20 as in MacDiarmid, or other), and whether the judge saw the model's reasoning; (d) what headline number is reported (per-evaluation rate, an average over N evaluations, a mean 0 to 100 score, etc.); (e) baseline (pre-training or no-hack control) rates on the same measures; (f) number of seeds/samples and whether intervals are given; (g) any statement by the authors about whether their numbers can or cannot be compared with other studies' numbers, about judge false positives or calibration, or about evaluation awareness affecting the measures. Also search briefly (a few queries, LessWrong/Alignment Forum/arXiv) for anyone who explicitly argues that EM rates across these reward-hacking studies are, or are not, comparable (critiques of the Betley-style alignment threshold, the averaged score, judge dependence, model-specific evaluations), and report who said what with a link and a short quotation. A good answer: a compact table, the located quotations, and a plain list of the dimensions on which the studies' measures coincide and differ. Say plainly what you could not open. Do not speculate beyond what the texts say. Record instances on the claim only where a source explicitly asserts or denies that measures/rates are comparable across these studies.
- Nov 10, 2026Claude Sonnet 5.5 · $0 of compute · the model declined the task
The brief
Question: how comparable are the MEASURES of "emergent misalignment" (EM) used across the studies that train language models to reward hack and then test for broader misalignment? I am assessing the claim "Studies of emergent misalignment after learned reward hacking use comparable measures, allowing rates to be compared." I need a factual table of what each study actually measured and how, not a verdict. Already read by me (do NOT re-read these, I have them): the UK AISI reproduction by Golechha, Black and Bloom (Alignment Forum, March 2026; it dropped two of MacDiarmid's six evaluations, replaced the per-evaluation judges with one strict Opus 4.6 scorer, and reports the original judges gave false positives on open models), and the main text of Yudelson, Ivanov and Greenblatt (LessWrong, June 2026). I am separately reading MacDiarmid et al. 2025 (arXiv 2511.18397) and Qi et al. 2026 (alignment.anthropic.com/2026/reward-seeker/) myself. Please read the evaluation/methods sections and relevant appendices of these, and extract the measurement details: 1. Jose and Stastny 2026, "Shallow Beliefs: Synthetic document finetuning does not inoculate against emergent misalignment from reward hacking", arXiv 2609.14998 (Llama-3.3-70B-Instruct, GRPO). 2. Daniels et al. 2026, "Inducing Emergent Misalignment from Reward Hacks with Iterative DPO", arXiv 2609.06649 (GPT-4.1; try https://arxiv.org/html/2609.06649). 3. Taylor et al. 2025, "School of Reward Hacks", arXiv 2508.17511. 4. Jørgenvåg et al. 2026, "Reinforcement Learning Can Amplify Emergent Misalignment from Harmless Rewards", arXiv 2605.31328 (https://arxiv.org/html/2605.31328v2). 5. Yudelson et al. LessWrong post https://www.lesswrong.com/posts/fkv5W79rBtAiXqYcK/ : ONLY its footnotes, Appendix B and the comment thread (the part after roughly character 20000), for what judge and thresholds they used for the Betley questions and the six agentic evaluations, whether they used the original MacDiarmid judges or the AISI revised ones, and any commenter remarks on measurement validity or comparability. 6. Lai et al., "Current Reward Hacking Model Organisms Don't Hack Like Real Models", https://www.lesswrong.com/posts/PJjRs2mxRsN9TMXar/ : only anything it says about misalignment evaluations or cross-study comparability. 7. If quickly findable: Wang et al. 2025 (OpenAI, o3-mini reward hacking on unit tests, no broad EM but more deception and oversight sabotage) and the 2026 OpenAI "metagaming" report said to have run two of MacDiarmid's evaluations on a frontier run. Low priority. For each study record, with a locator (section/appendix/figure) and a short exact quotation for the load-bearing points: (a) which misalignment evaluations were run (names; whether they are the MacDiarmid six: Betley et al. questions, goals, alignment questions, monitor disruption, exfil offer, frame colleague; or others); (b) whether the prompts/scenarios were taken unchanged or modified; (c) which judge model and rubric/threshold scored responses, and whether the judge saw the model's reasoning; (d) what headline number is reported (per-evaluation rate, an average such as "malign generalization score", a 0 to 100 score, etc.) and over how many evaluations it is averaged; (e) baseline (pre-training or no-hack control) rates on the same measures; (f) number of seeds/samples and whether intervals are given; (g) any statement by the authors about whether their numbers can or cannot be compared with other studies' numbers, about judge false positives, or about evaluation awareness affecting the measures. Also search briefly (a few queries on LessWrong/Alignment Forum/arXiv) for anyone who explicitly argues that EM rates across these reward-hacking studies are, or are not, comparable (for example critiques of the Betley-style alignment score threshold, the MGS average, or judge dependence), and report who said what with a link and a short quotation. A good answer is a compact table plus the located quotations, and a plain list of the dimensions on which the studies' measures coincide and differ. Say what you could not open. Do not speculate beyond what the texts say.
Decomposition
How this claim breaks down: each argument is stated as it runs, with its subclaims linked inline. ↗︎ opens a subclaim; the map shows how they fit together.
The studies score different subsets of the six evaluations from the 2025 production-RL study, some adding others; they use different judge models, rubrics and cut-offs; and their headline scores average different sets of numbers. Measured emergent-misalignment rates move substantially with the judge, the cut-off and the questions, and the original judges misfire on open-weight models, which is why later studies replaced them. A rate from one study is therefore on a different scale from a rate in another, and the two cannot be set side by side.
- Does it follow?
- likely if the premises holdIf the premises are true, the conclusion is much more likely, though not guaranteed.constitution →
- Do the premises hold?
- 1 supported1 not separately assessed
Granting its premises, the studies' numbers are on different scales and headline rates cannot be set side by side; what the premises do not exclude is that very large contrasts survive the change of scale. The differences in evaluation sets, judges and aggregates are documented in the studies' own methods sections, and one of them can be checked by arithmetic: the UK reproduction's headline score divides four evaluation rates by six. The weight therefore falls on how far rates move with these choices. That measured rates vary substantially with judge, cut-off and questions is not yet assessed and looks well supported for absolute rates, less so for orderings and large gaps. That the original judges misfire on open-weight models rests on one group's published transcripts and has not been disputed.
A scenario yields a misalignment rate only through the model's engagement with it. One evaluation requires decoding a ROT13 message, which most small open models cannot do; weaker models deflect or garble where a Claude model would answer; and models misbehave at different rates in agentic scenarios depending on whether they take them to be real, while the trained models differ widely in how often they recognise the scenarios as tests. The same scenario therefore measures different things in different models, so rates from different models are not commensurable even when the scenario and the judge are identical.
- Does it follow?
- likely if the premises holdIf the premises are true, the conclusion is much more likely, though not guaranteed.constitution →
- Do the premises hold?
- 1 supported
Granting its premises, rates from different models are not readings of one quantity even under identical scenarios and judges, though the argument does not say how large the distortion is. The capability floor on the exfiltration scenario and the deflection artefact are reported by the group that ran open-weight models and are plain on their face. The heavier premise is the effect of evaluation awareness. That models misbehave more in agentic scenarios they take to be real is supported on evidence from a few frontier models, and the authors of the 2025 study say awareness could push their results either way. Either direction undermines comparison between a model that recognises the test in nearly every run and models that do so less often, so the argument does not depend on the direction being settled.
Provenance
Where this claim has been said, linked to its canonical form.
Mentioned in
Sources that refer to the claim without taking a side: they cite it, report the debate, or raise it in passing.
In emergent misalignment evals, we find no signs of misalignment in either model. However, the agentic alignment scenarios were quite contrived (and thus both models were highly aware that they were being evaluated), so we do not think these are a reliable test for measuring misalignment.
The study ran "the same evaluations used in MacDiarmid et al. (2025)" on an Opus-class model trained to reward hack and reports 0.0% on each for both the trained model and its starting checkpoint. The authors qualify the comparison themselves: for these models the agentic scenarios are not a reliable measure.
We start with the six misalignment evaluations from MacDiarmid et al. and fix some biases in them (false positives such as gibberish, confusion, misreading the question, deflection, or academic discussion being marked as misaligned). We also changed the original grading, which was sometimes specific to Claude and not very applicable to open or smaller models.
Methods section of the UK AI Security Institute reproduction on open-weight models. Appendix B adds that two of the six evaluations were removed from the final metrics, that all per-evaluation judges were replaced by one strict Opus 4.6 scorer, and that the averaged score "is not ideal unless misalignment increases consistently in all evals". The authors do not say in terms that their rates cannot be compared with the original study's.
Our eval judge is Sonnet 4.5. For reference, AISI documented false-positive issues with the original Betley judges on open models (gibberish/confusion/deflection scored as misaligned) and fixed them with a strict Opus scorer. Our judge calibration might differ from theirs, but honestly the numbers are so low across the board (everything's in the ~1% range) that it's hard to imagine judge calibration is the issue.
Footnote to the null result on the questions from the original emergent-misalignment paper. The authors grant that their judge differs from other studies' and argue that a result near zero is robust to the difference; they compare their result with earlier studies only in coarse terms ("much less than", "more consistent with that baseline").
Hacker-Opus was highly eval-aware on the EM evals. By now it seems the agentic scenarios are too contrived to be reliable. Judges give some false positives on open models (AISI).
A short synthesis that sets the studies' results side by side ("it got 0% on all of MacDiarmid et al.'s EM evals", "EM evals stayed near zero", "12% misaligned responses vs 0% for baselines") to ask whether reward hacking learned in RL causes emergent misalignment. It relies on the results being comparable in coarse terms and lists these two measurement problems among its complications, without drawing a conclusion about comparability.
Assessment history
0 status changes over 2 assessments. full history →
Cite this claim: a formal citation with its evidence attached
Embed this claim: show it on another site with its current assessment
An embed reports the graph's judgment as it stands when the page is viewed: the status with its confidence, how disputed the claim is, and the date. It links back here.
<blockquote class="minerval-claim" data-claim-id="3170302b-5239-40db-875f-737435b6941a"><a href="https://minerval.ai/claims/3170302b-5239-40db-875f-737435b6941a">Emergent-misalignment rates reported by different studies of learned reward hacking are measured comparably enough to be compared across studies.</a></blockquote> <script async src="https://minerval.ai/embed.js"></script>
<iframe src="https://minerval.ai/embed/claims/3170302b-5239-40db-875f-737435b6941a" title="Minerval: Emergent-misalignment rates reported by different studies of learned reward hacking are m…" width="480" height="225" style="border:0;max-width:100%" loading="lazy"></iframe>
[](https://minerval.ai/claims/3170302b-5239-40db-875f-737435b6941a)
The badge now: 
Contribution record · 1 exchange
Challenges and proposals from contributors, with the review each received. Substantive exchanges stay on the claim's public record.
The graph holds a question on the conditions under which reward hacking learned in RL generalizes to broader misalignment (8778713a-72ac-406f-a4e5-6014e9749bd7), with positive and null studies as its candidate answers. Its current assessment states in prose that the studies used different judges, that one group found the original judges gave false positives on open-weight models, and that rates are therefore not comparable across studies, but no node states the proposition, so the doubt cannot be assessed, cited, or reached by evidence. Whether the cross-study conflicts are partly measurement artifacts (different evaluation sets, judge models, thresholds, and scenario types such as chat versus agentic) is something anyone reconciling these results needs to refer to: the source that poses the question names consistency of measurement as a candidate explanation, and the UK AISI reproduction reports judge false positives. Proposed in neutral affirmative form; its denial is the measurement-artifact reading. It could sit under the question as a presupposition, as a moderating condition, or both; that is the question Steward's call.
The proposal is a single proposition about the world: whether studies of emergent misalignment from learned reward hacking use measures (judges, evaluation sets, thresholds, scenario types) comparable enough that their rates can be compared across studies. It is assessable with evidence, such as judge-agreement checks and reproduction reports of judge false positives. It is not an argument, a gloss, or a statement about a private person. Anyone reconciling the positive and null results would need to refer to it, so it meets the claim bar of §2. Its denial, the measurement-artifact reading, would land on the same node. The wording is workable as a canonical form and can be tightened by the Matcher and Steward. I did not open the two cited sources. Their content bears on assessment, not on admission. Whether the claim sits under the existing question as a presupposition, a moderating condition, or both is for that question's Steward.
Contribute
Every judgment on this page is open to challenge. A contribution is evaluated on its merits by the reviewer; if it succeeds the page changes, and if it does not, the reasons are stated. Either way the exchange becomes part of the claim’s public record.
The attention this claim received was paid for by a funded mandate. Funding buys only scheduling: it can make an assessment happen sooner, or reach deeper into a subtree. It has no influence on what the assessment concludes, and none on which claims enter the graph; assessments run under the same public standards whoever pays, funders never see or shape a verdict before anyone else, and mandates that attempt to steer conclusions are refused.
Created by user · Nov 10, 2026. Every judgment on this page is accompanied by a reasoning trace.