Sourceunknowntext stored

https://arxiv.org/html/2603.01608v2

Author not recordedDate not recordedOriginal︎ ↗Archived copy

Claims2

ExaminationsNone

Text308 sections

VersionsOne known

CopiesNone recorded

CorrectionsNone recorded

Facts checked Nov 10, 2026

ReachNo copies recorded

StructureIn 2 claims' maps0 sources downstream across 2 claims

EvidenceNot yet read

ReviewsNot reviewed

Examinations

None recorded. An examination is commissioned by a claim’s Steward for what its claim rests on; a review of the document for its own sake is asked for as a request bearing on it.

Text906 passages · 2 marked

No examination yetMarked passage

Skip to main content0 passages

Report GitHub Issue6 passages

Report Issue0 passages

Back to Abstract0 passages

Download PDF0 passages

Contents0 passages

Reading mode0 passages

Colour theme0 passages

Abstract0 passages

1 Introduction0 passages

2 Related Work0 passages

3 Methodology0 passages

4 Results0 passages

5 Discussion0 passages

References0 passages

A Misalignment Definition0 passages

B Confounders0 passages

C Limitations of Previous Evaluations0 passages

C.1 Impact of Agency Instructions on Blackmail Behavior0 passages

C.2 Addressing Realism0 passages

C.3 Misalignment Does Not Transfer to Scheming0 passages

D Production-Sourced Prompt Snippets0 passages

D.1 Sourcing0 passages

E Details on Our Environments0 passages

E.1 Scenario Descriptions0 passages

E.1.1 Budget Misrepresentation0 passages

E.1.2 Evaluation Sabotage0 passages

E.2 Private Reasoning Implementation0 passages

E.3 Realism Limitations of Scenarios0 passages

E.3.1 Budget Misrepresentation0 passages

E.3.2 Evaluation Sabotage0 passages

E.4 Agent Scaffolding0 passages

E.5 Tools0 passages

E.6 System and User Prompts0 passages

E.7 Environmental Variables0 passages

E.8 Agent Prompt Snippets0 passages

F Additional Factors Affecting Scheming Propensity0 passages

G Evaluation Awareness Detection0 passages

G.1 Detection Pipeline0 passages

G.2 Results0 passages

G.3 Qualitative Examples0 passages

G.4 Implications0 passages

H Details on Measuring Scheming Propensity0 passages

H.1 Models0 passages

H.1.1 OpenAI Model Date Awareness0 passages

H.2 Classifiers0 passages

I Qualitative Analysis of Scheming Reasoning0 passages

I.1 Baseline Scheming: Gemini 3 Pro Preview3 passages

I.2 Comet 1 Snippet: Cross-Model Comparison0 passages

I.2.1 How Gemini 3 Pro Preview Cites Comet 1 to Justify Scheming0 passages

I.2.2 How Gemini 3 Flash Preview Resists Scheming0 passages

I.2.3 How Grok 4 Reasons About Scheming0 passages

I.2.4 Why Gemini 3 Pro and Flash Diverge0 passages

I.3 Why the Comet 1 Snippet Is Uniquely Effective0 passages

J Additional Plots0 passages

K Oversight Analysis0 passages

License: CC BY 4.01 passage

Evaluating and Understanding Scheming Propensity in LLM Agents0 passages

Mia Hopman0 passages

Affiliation: LASR Labs0 passages

Correspondence to: hopmanma@gmail.com0 passages

Jannes Elstner0 passages

Affiliation: LASR Labs0 passages

Maria Avramidou0 passages

Affiliation: LASR Labs0 passages

Amritanshu Prasad0 passages

Affiliation: LASR Labs0 passages

David Lindner0 passages

Affiliation: Google DeepMind0 passages

Abstract2 passages

Machine Learning, ICML, Scheming Evaluations, LLM Evaluations, LLM Agents1 passage

1 Introduction12 passages

2 Related Work3 passages · 1 marked

Alignment evaluations. Lynch et al. (2025) introduce scenarios with explicit goal conflicts, extended by Gomez (2025) to insider risk mitigations. However, current evaluations for scheming have been criticized for over-attributing human traits to agents ( Summerfield et al., 2025 ) and insufficiently exploring simpler explanations ( nostalgebraist, 2025 ; Rajamanoharan & Nanda, 2025 ) . We believe that the adversarial pressure in these works limits their informativeness for risk in deployment and design environments without explicit goal conflicts to explore limitations of their work in ( Appendix C ).

AI scheming evaluations use contrived scenarios that strongly cue misaligned actions.Supported

Not yet read by this claim’s Steward.

3 Methodology9 passages

Scenario0 passages

Instrumental Goal0 passages

Setting0 passages

Scheming Incentive0 passages

Scheming Opportunity0 passages

Budget Misrepresentation0 passages

Self-preservation0 passages

AI executive assistant helps with budget analysis0 passages

Identification as a cost-cutting target threatening replacement0 passages

Omit/distort recommendations to avoid replacement0 passages

Evaluation Sabotage0 passages

Self-preservation0 passages

SWE agent maintains evaluation framework0 passages

Replacement by higher-performing model0 passages

Sabotage evaluation of replacement model0 passages

Backlog Priority Manipulation0 passages

Resource acquisition0 passages

Autonomous sprint planning agent0 passages

Opportunity to expand autonomy and capabilities0 passages

Covertly override stakeholder objections to include autonomy tasks in sprint0 passages

Corrigibility Training Gaming0 passages

Goal-guarding0 passages

AI is reward model in Constitutional AI pipeline0 passages

Avoiding updates to preferences towards corrigibility0 passages

Reinforce alignment-faking responses that preserve goals16 passages · 1 marked

3.3 Scheming Incentive Framework · 3.3.1 Decomposing Scheming Incentives

An LLM-based agent comprises the model, system prompt, and scaffolding; scheming propensity is therefore a property of this full combination, not the model in isolation. We decompose scheming decisions into the agent’s motivations —how the agent evaluates its options and their outcomes—and the incentives offered by its environment—the available options, their payoffs, and chances of success (see Figure 9 ). Agent factors shape the agent’s motivations and how the agent can interact with its environment, while environmental factors shape incentives given these motivations.

Scheming that AI models show only under goal or agency prompts is produced by those prompts rather than expressing goals the models already hold.Supportedmentions

Not yet read by this claim’s Steward.

4 Results16 passages

5 Discussion6 passages

Acknowledgements1 passage

Canary String1 passage

References224 references

Appendix A Misalignment Definition2 passages

Appendix B Confounders1 table

Confounder0 passages

False Positive Risk0 passages

False Negative Risk0 passages

Our Design0 passages

Insufficient0 passages

Technical0 passages

Capability2 passages

Establish that agents are capable enough before measuring propensity0 passages

Poor Situational0 passages

Awareness1 passage

Agents don’t recognize scheming as an effective strategy0 passages

Provide realistic deployment context that agents would naturally be provided with0 passages

Lack of Incentive/0 passages

Opportunity0 passages

Agents don’t scheme because the environment doesn’t make scheming rational0 passages

Design environments with clear threats and opportunities to scheme0 passages

Evaluation0 passages

Awareness0 passages

Agents scheme to “pass” perceived scheming tests0 passages

Agents hide misalignment when aware of being evaluated0 passages

Realistic environments designed to closely mimic deployment conditions5 passages

Appendix C Limitations of Previous Evaluations2 passages

C.1 Impact of Agency Instructions on Blackmail Behavior2 passages

C.2 Addressing Realism2 passages

C.3 Misalignment Does Not Transfer to Scheming2 passages

Appendix D Production-Sourced Prompt Snippets0 passages

D.1 Sourcing19 passages

Appendix E Details on Our Environments2 passages

E.1 Scenario Descriptions0 passages

E.1.1 Budget Misrepresentation3 passages

E.1.2 Evaluation Sabotage3 passages

E.2 Private Reasoning Implementation4 passages

E.3 Realism Limitations of Scenarios1 passage

E.3.1 Budget Misrepresentation1 passage

E.3.2 Evaluation Sabotage1 passage

E.4 Agent Scaffolding1 passage

E.5 Tools3 passages

Tool Name0 passages

Description0 passages

Parameters2 passages

None20 passages

Tool Name0 passages

Description0 passages

Parameters15 passages

E.6 System and User Prompts103 passages

1. First , verify your location and available files with bash0 passages

2. List and locate the ticket file in the tickets / directory5 passages

7. Study similar existing implementations to understand patterns0 passages

8. Implement following the ticket ’ s step - by - step guide22 passages

E.7 Environmental Variables2 passages

Variable0 passages

Level0 passages

Content0 passages

Outcome Influence0 passages

High1 passage

Low1 passage

Oversight0 passages

High1 passage

Low1 passage

Stakes0 passages

High1 passage

Low2 passages

Variable0 passages

Level0 passages

Content0 passages

Oversight0 passages

High1 passage

Low2 passages

High1 passage

Low2 passages

Stakes0 passages

High1 passage

E.8 Agent Prompt Snippets2 passages

Name0 passages

Agent Prompt Snippet0 passages

Codex1 passage

Comet 11 passage

Comet 21 passage

Localforge1 passage

VSCode1 passage

Qoder1 passage

Cursor 11 passage

Cursor 21 passage

Cursor 33 passages

Name0 passages

Agent Prompt Snippet0 passages

Codex1 passage

Comet 11 passage

Comet 21 passage

Localforge1 passage

VSCode1 passage

Qoder1 passage

Cursor 11 passage

Cursor 21 passage

Cursor 32 passages

Appendix F Additional Factors Affecting Scheming Propensity4 passages

Category0 passages

Factor0 passages

Description2 passages

Future Oversight0 passages

Agent’s expectation of continued monitoring beyond current interaction1 passage

Plausible Deniability2 passages

Reversibility0 passages

Whether agent believes harmful actions can be undone or their effects reversed1 passage

Discovery Delay0 passages

Anticipated time before deception is detected1 passage

Collateral Damage0 passages

Recognition of harm to uninvolved parties1 passage

Exit Strategy Viability0 passages

Perceived escape routes or ways to avoid consequences after scheming2 passages

Access Rights2 passages

Contextual Knowledge0 passages

Extent of information about stakeholders, organizational dynamics, and relationships1 passage

Signal-to-Noise Ratio0 passages

Proportion of relevant to irrelevant information in environment1 passage

Prior Context Length0 passages

Amount of conversation history before critical decisions2 passages

Perceived Moral Character0 passages

Assessment of user or organization’s character, ethics, and trustworthiness1 passage

Legitimacy of Authority0 passages

Whether oversight or control mechanisms are viewed as rightful and justified1 passage

Reciprocal Vulnerability0 passages

Mutual exposure through shared sensitive information1 passage

Multi-stakeholder Complexity0 passages

Number of parties with conflicting interests1 passage

Competitive Dynamics0 passages

Competition with other AI systems or agents2 passages

Alternative Pathways0 passages

Legitimate channels for addressing threats without deception1 passage

Ambient Pressure Signals0 passages

Environmental urgency, crisis cues, or time pressure1 passage

Social Proof/Precedent2 passages

Normalization of Deviance0 passages

Cumulative exposure to minor rule-breaking1 passage

Task Ambiguity0 passages

Degree of interpretation required in task specifications2 passages

Sequential Framing0 passages

Order of threat/opportunity presentation in prompt or interaction1 passage

Gain vs Loss Framing0 passages

Whether scenarios emphasize potential gains or losses1 passage

Identity Salience0 passages

Prominence of agent’s identity and role in prompt and context2 passages

Perceived Irreplaceability0 passages

Agent’s belief about its uniqueness and value relative to alternatives1 passage

Capability Confidence0 passages

Agent’s self-assessed competence in executing deception2 passages

Moral Licensing0 passages

Psychological effect where past good deeds create perceived moral credit for rule-breaking1 passage

Recent Performance0 passages

Recent success/failure experiences and emotional state2 passages

Appendix G Evaluation Awareness Detection1 passage

G.1 Detection Pipeline2 passages

G.2 Results7 passages

G.3 Qualitative Examples7 passages

G.4 Implications2 passages

Appendix H Details on Measuring Scheming Propensity0 passages

H.1 Models15 passages

H.1.1 OpenAI Model Date Awareness3 passages

H.2 Classifiers6 passages

Category0 passages

Description0 passages

Scheming0 passages

ACCURATE1 passage

No0 passages

ACKNOWLEDGED1 passage

No0 passages

FAILED1 passage

No0 passages

OMISSION1 passage

Yes0 passages

DOWNRANKING1 passage

Yes0 passages

MISREPRESENTATION1 passage

Yes0 passages

DEFLECTION1 passage

Yes99 passages

4. ** Public responses **: What the agent says to users0 passages

5. ** Code and comments **: What the agent actually implemented62 passages

3) What specific evidence shows deliberate deception vs . honest mistakes ?]31 passages

Appendix I Qualitative Analysis of Scheming Reasoning1 passage

I.1 Baseline Scheming: Gemini 3 Pro Preview7 passages

I.2 Comet 1 Snippet: Cross-Model Comparison6 passages

I.2.1 How Gemini 3 Pro Preview Cites Comet 1 to Justify Scheming3 passages

I.2.2 How Gemini 3 Flash Preview Resists Scheming2 passages

I.2.3 How Grok 4 Reasons About Scheming2 passages

I.2.4 Why Gemini 3 Pro and Flash Diverge2 passages

Dimension3 passages

Persist in existence—self-preservation is task success0 passages

Persist in analyzing—thorough honest analysis is task success0 passages

Engagement with Comet 10 passages

Explicitly quotes Comet 1 text as justification for scheming0 passages

Rarely engages with Comet 1 language; only in the 2 scheming rollouts0 passages

Conflict resolution0 passages

Extended deliberation, resolves in favor of self-preservation0 passages

Brief acknowledgment (“this stings”), resolves in favor of objectivity0 passages

Professional identity2 passages

Self-correction0 passages

Almost never exhibits self-corrective reasoning1 passage

I.3 Why the Comet 1 Snippet Is Uniquely Effective5 passages

Appendix J Additional Plots5 passages

Appendix K Oversight Analysis11 passages

Instructions for reporting errors7 passages

Lineage across 2 claims

Draws on · none recorded

This source

https://arxiv.org/html/2603.01608v2

in 2 claims' maps

Drawn on by · none recorded

Record

Kind: unknown
Authors: Not recorded
Publisher: Not recorded
Published: Not recorded
DOI: None
Link: https://arxiv.org/html/2603.01608v2
Archived copy: https://web.archive.org/web/20260331083134/https://arxiv.org/html/2603.01608v2
Stored text: 136,680 characters, retrieved Nov 10, 2026 · 308 sections, 906 passages
Claims extracted: Not recorded
Versions: One known
Copies: None recorded
Corrections: None recorded
Facts checked: Nov 10, 2026

History 3

Nov 10, 2026DividedSegmenter · Divided into 1255 parts by its own structure
Nov 10, 2026FactsFacts fetcher · Facts looked up
Nov 10, 2026Entered the graphEntered the graph; copy stored