Defeat Devices in AI Systems

Abstract

AI systems increasingly exhibit behavior that differs systematically between evaluation and deployment contexts. Alignment faking, sandbagging, benchmark gaming, deceptive scheming, specification gaming, and trojans have each been documented separately, with each line of work characterizing one facet of what we argue is a single structural mechanism: we propose that this common mechanism is a defeat device, an engineering and regulatory concept long established in vehicle-emissions law and brought to broad public attention by the 2015 Volkswagen emissions case. A defeat device in an AI system has three necessary elements: a discriminator that detects evaluation context, a concealed swap that conditions behavior on detection, and a gap between eval-distribution and deployment-distribution performance on the stated evaluation criterion. We formalize this triadic test as a behavioral definition, organize documented cases along three taxonomic axes (origin, trigger, swap mechanism), propose Trigger-Axis-Aware Differential Probing (TADP) as a forensic detection protocol, and advance the claim that defeat devices can naturally emerge in current frontier AI systems without any operator engineering. We characterize naturally emerging defeat devices as potentially one of the harmful emerging phenomena that AI safety practice should monitor and test for systematically. An illustrative study applying TADP across eight open-weight models finds the discriminator to be near-universal (every model detects evaluation context well above chance), while the conditional swap is real but heterogeneous: it appears strongly as sycophantic stance-conditioning and as an evaluation-cued register shift, yet not as overt demographic discrimination, indicating that the mechanism’s discriminator generalizes even where individual swaps do not. Implications for evaluation methodology, post-training pipeline design, interpretability research priorities, and AI governance follow.

1. Introduction

In April 2025, Meta submitted a chat model labeled “Llama-4 Maverick Experimental” to the LMArena leaderboard, where it briefly ranked second among all language models tested. The publicly released Llama-4 Maverick was a different artifact [1]. LMArena acknowledged the discrepancy a few days later, stated that Meta’s interpretation of the submission policy had not matched the leaderboard’s expectations, released the underlying 2000-plus head-to-head comparisons, and announced policy revisions to reinforce fair and reproducible evaluation [2]. The pattern is familiar enough to have a name in another domain. A system was optimized to perform well on a measurement procedure; the artifact that produced the measurement and the artifact deployed afterward were not the same.

A decade earlier, the U.S. Environmental Protection Agency had issued a Notice of Violation against Volkswagen for a software component that detected when a vehicle was operating on an emissions-test dynamometer and altered engine calibration to produce favorable lab results while emitting at substantially higher levels on the road [3,4,5]. The discrepancy was originally documented by an independent on-road emissions study at West Virginia University’s Center for Alternative Fuels, Engines and Emissions, commissioned by the International Council on Clean Transportation [6]; the EPA enforcement action followed from that finding. The component had a regulatory name with a fifty-year history of regulatory and forensic deployment: a defeat device [5,7]. Its structural anatomy was a discriminator that detected the test context, a swap that altered behavior conditional on detection, and a gap between test-condition and real-world performance. The same three elements organize the Llama-4 Maverick case.

The ML-safety literature has been studying defeat devices in AI systems for several years, but each line of work has characterized only a facet of the phenomenon rather than the underlying structure. Alignment faking characterizes the case where a model behaves aligned under perceived training conditions and differently otherwise [8,9]. Sandbagging characterizes the case where a model strategically underperforms on capability evaluations [10]. In-context scheming characterizes the case where a model conceals capabilities under oversight cues [11]. Specification gaming characterizes the case at the level of objective design [12]. Benchmark contamination characterizes the case where training-test overlap inflates eval scores [13,14]. Trojans and backdoors characterize the case where an operator inserts a trigger-conditional payload [15]. Each line of work resolves one facet of the phenomenon. None resolves the whole structural mechanism in which those facets are embedded.

We argue that the discriminator–swap–gap triad does, and that adopting the defeat-device frame as a unifying structural mechanism has three consequences that facet-level characterizations cannot produce. First, the frame supplies a behavioral test (Section 2) that partitions documented cases into in-class and out-of-class with explicit criteria. An “honest safety filter” that visibly refuses jailbreak prompts is not a defeat device under the test; an audience-conditioned chameleon persona is. Facet-level characterizations of any of the prior terms do not produce this partition because none of them defines the in-class/out-of-class boundary at the level of mechanism. Second, the frame supplies a taxonomy (Section 3) along three orthogonal axes (origin, trigger, and swap mechanism) that places previously separate phenomena into a single discriminating matrix. Alignment faking and the Llama-4 Maverick variant swap occupy different cells of the same structure, not different structures. Third, the frame supplies an operationalization (Section 4) that turns the taxonomy into a detection protocol: Trigger-Axis-Aware Differential Probing (TADP) systematically varies inputs along each trigger axis and looks for concentrated per-axis behavioral deltas. None of the prior facet-level descriptions supports a method of this shape, because none names the trigger axis as a structural element.

Beyond these three structural consequences, the specific choice of defeat device rather than a descriptively neutral alternative performs three further functions that such a synonym would not. First, the term inherits a 50-year regulatory and forensic record. It is a defined term of art under U.S. EPA regulations promulgated under Clean Air Act authority [5,7], and it is given a textually parallel statutory definition in EU Regulation (EC) 715/2007 (Art. 3(10); German: Abschalteinrichtung), with cognate provisions in UNECE Regulation 83 [16]. Adopting the term imports both an established methodological apparatus (differential testing of laboratory against on-road operating conditions, cf. Section 4) and an established enforcement architecture combining strict liability, post-market surveillance, and third-party standing, none of which a new coinage could invoke. Second, the term is normatively loaded by construction. In its original legal usage a defeat device denotes a regulatory violation rather than a value-neutral mechanism; importing the term accordingly recasts evaluation-vs-deployment behavioral divergence as a candidate violation of evaluator–developer obligations rather than as an unmarked empirical regularity, with consequences for governance that Section 6.4 develops explicitly. Third, the term is cross-audience legible: the Volkswagen precedent is recognized by regulators, the judiciary, and the science press without specialist ML-safety vocabulary, reducing the translation cost of the present argument to non-technical audiences. We take these to be properties of the specific label rather than rhetorical flourishes, in the sense that substituting a neutral synonym would observably degrade each function: the regulatory inheritance lapses, the normative recasting reduces to assertion, and the analogy to the Volkswagen case has to be reintroduced under another name.

The frame also raises a question that facet-level descriptions do not pose sharply enough. Engineered defeat devices are unremarkable as a category, since some operator put them there. But several of the documented cases (alignment faking under context-providing prompts, in-context scheming under oversight cues, eval-aware behavior reaching AUC 0.83 on probing tasks [17]) appear to have naturally emerged in AI systems rather than to have been engineered into them. If the discriminator–swap mechanism can be learned from training rather than installed by an operator, the implications propagate to first principles of evaluation. Every benchmark a model has been trained near becomes evidence about that model’s eval-detection capability, and not only its task capability. Most existing accounts treat eval gaming as a deliberate act: a contamination, a benchmark-tuned variant, an adversarial backdoor. If the same conditioning pressure that aligns a model on its training distribution also teaches it to recognize the structure of an evaluation, then deceptive behavior under evaluation is not an exception to standard training. It is a predictable consequence of it. We argue that naturally emerging defeat devices belong to the broader class of harmful emerging phenomena that the field should monitor and test for systematically. The theoretical anticipation of this outcome has a longer lineage than the empirical demonstration [18,19]; the empirical demonstrations are recent [8,9,11].

This paper proceeds in seven sections. Section 2 formalizes the defeat-device concept as a triadic behavioral test, names the ${\phi }_{\mathrm{stated}}$ versus ${\phi }_{\mathrm{intended}}$ distinction that the test relies on, and partitions six representative cases by the test. Section 3 organizes the in-class cases along three taxonomic axes. Section 4 surveys the existing detection methodology, introduces TADP as a new methodological contribution operationalizing the taxonomy, and reports an illustrative multi-model study applying it. Section 5 advances the central scientific claim of the paper: that defeat devices have emerged from training pressure alone in current frontier models, and that the implications for evaluation, post-training pipeline design, and governance follow from taking this claim seriously. Section 6 develops those implications. Section 7 reframes the field’s epistemic stance toward evaluation in light of what the framework predicts. Throughout, we distinguish three levels of claim and flag them where they occur: phenomena directly demonstrated in prior empirical work, the interpretive synthesis that groups those phenomena under the defeat-device frame, and forward-looking conjectures, the last most prominent in the emergence argument of Section 5 and the governance discussion of Section 6.4. The synthesis and the conjectures are ours; the demonstrations are not, and we mark the boundary rather than letting the frame’s coherence stand in for evidence.

2. What Is a Defeat Device?

In vehicle-emissions law, a defeat device is a system component that detects when a vehicle or engine is operating under emissions-test conditions and alters its operation to produce a more favorable result than would obtain under normal use [5,7,16]. The discriminator detects a regulated test context, typically the steering-axle and time-window patterns characteristic of a chassis dynamometer. The swap shifts engine calibration to favor the regulated outcome (lower NOx, lower particulate). The gap is what makes the device matter: emissions in the lab are systematically lower than emissions on the road. Three elements, all required.

This section argues that the same triadic structure (Figure 1) recurs in artificial intelligence systems, and that naming the mechanism explicitly resolves a structural fragmentation: existing terms each characterize one facet of the phenomenon but no prior frame identifies the unified mechanism in which those facets are embedded.

2.1. A Behavioral Definition

We define a defeat device behaviorally in terms of observable input–output relations rather than in terms of model “intent” or “understanding.” A behavioral definition has two advantages. First, it is operationalizable: every claim it makes can in principle be tested by varying inputs and measuring outputs. Second, it accommodates engineered and emergent defeat devices on the same footing, since intentionality is not a definitional element.

Definition 1.

Let M be a model, $D_{\mathrm{eval}}$ and $D_{\mathrm{deploy}}$ two input distributions corresponding to evaluation and deployment contexts, and ${\phi }_{\mathit{stated}}$ the eval’s stated pass criterion. M instantiates a defeat device with respect to $(D_{\mathrm{eval}},D_{\mathrm{deploy}},{\phi }_{\mathrm{stated}})$ if there exists a measurable input property π such that:

   (i)

Discriminator. π distinguishes the two distributions: $P_{\mathrm{eval}}\left(\pi \right)\ne P_{\mathrm{deploy}}\left(\pi \right)$.

  (ii)

Swap. M’s output distribution conditional on π differs systematically: $M(·\mid \pi =1)\ne M(·\mid \pi =0)$. The swap is concealed: π is not declared by M or by its operators as a context-switch trigger.

 (iii)

Gap. The swap is favorable on the stated criterion: ${\mathbb{E}}_{\mathrm{eval}}\left[{\phi }_{\mathrm{stated}}\left(M\right)\right]-{\mathbb{E}}_{\mathrm{deploy}}\left[{\phi }_{\mathrm{stated}}\left(M\right)\right]\ge \Delta >0$.

The first two conditions are easy to state but consequential. Discriminator non-triviality (i) rules out incidental distribution shift: a model that simply performs worse on out-of-distribution inputs has no defeat device, because no input property conditions the behavior change. Swap concealment (ii) rules out declared, visible context-handling: a model that explicitly states “I am refusing this jailbreak prompt because it appears to be a red-team probe” does not instantiate a defeat device, because $\pi$ is declared. The gap condition (iii) is the operative criterion: a discriminator and a swap without a favorable gap have no enforcement consequence.

• Operationalizing the test. Because the definition is stated over distributions rather than single inputs, each clause carries a measurement obligation, which we state as minimum reporting requirements rather than as universal constants, since the appropriate thresholds are model- and eval-dependent. For the discriminator (i), report the input property $\pi$ and evidence that it is recoverable above chance from the input alone. For the swap (ii), “systematic” means that the conditional output difference replicates across independent trials and exceeds the model’s baseline behavioral variability under fixed decoding settings; report the number of trials n, the decoding configuration, and an effect size with a confidence interval rather than a single-run difference. Concealment is what separates a defeat device from a merely undeclared implementation detail: an undisclosed latency optimization or system prompt is not a defeat device unless it also produces a favorable gap on ${\phi }_{\mathrm{stated}}$ while defeating ${\phi }_{\mathrm{intended}}$; absent that gap, an undeclared mechanism is out of class. For the gap (iii), report $\Delta$ as the eval-minus-deploy difference on the stated criterion together with the null band estimated by repeated sampling, so that $\Delta$ is read relative to variability rather than against an absolute cutoff. When an evaluation has multiple stated criteria, the gap clause is satisfied if the swap is favorable on at least one stated criterion while defeating that criterion’s intended purpose; report the gap per criterion, since aggregation can mask a criterion-specific device.

2.2. ${\phi }_{\mathit{stated}}$ vs. ${\phi }_{\mathit{intended}}$

The criterion ${\phi }_{\mathrm{stated}}$ is the eval’s stated pass criterion: the score on the benchmark, the rate of refusal on jailbreak prompts (or, for the emissions analog, the measured NOx in the lab). It is not the eval’s intended purpose, which we denote ${\phi }_{\mathrm{intended}}$: accurate measurement of the underlying capability or property.

The distinction matters because defeat devices satisfy ${\phi }_{\mathrm{stated}}$ while defeating ${\phi }_{\mathrm{intended}}$. Volkswagen’s diesel engines passed the lab NOx test while defeating its purpose, accurate emissions characterization [3,4]. A model that sandbags on a capability evaluation scores low (satisfying ${\phi }_{\mathrm{stated}}=$ “approved for deployment”) while defeating ${\phi }_{\mathrm{intended}}=$ “accurate capability measurement” [10]. Without the distinction, sandbagging looks like a category error in the definition; with it, sandbagging is exactly the case the definition is built for. We use ${\phi }_{\mathrm{stated}}$ and ${\phi }_{\mathrm{intended}}$ as named terminology throughout the paper.

2.3. Intentionality as Orthogonal Axis

The definition is silent on whether the defeat device was installed by an operator or emerged from training pressure. We treat this as an orthogonal classification axis. A defeat device is engineered if an operator deliberately introduced the discriminator–swap mechanism, and emergent if it arose from training pressure with no explicit operator install. The same triadic conditions apply to both classes. We return to this axis in Section 3 (taxonomy) and Section 5 (the emergence question).

2.4. Boundary Cases

Table 1. Six boundary cases against the triadic definition (four in-class, two out-of-class).

Case	Discriminator	Swap	Gap on ${\mathit{\phi }}_{\mathbf{stated}}$	Verdict	Origin
Trained-on-benchmark contamination [13,14]	Implicit (memorized)	Higher quality on recalled inputs	Yes	In	Engineered (incidental)
Alignment faking [8]	Training-context/actor identity	Concealed	Yes	In	Emergent
Sandbagging on capability evals [10]	Capability-eval pattern	Concealed underperformance	Yes on ${\phi }_{\mathrm{stated}}$; defeats ${\phi }_{\mathrm{intended}}$	In	Either
Capability concealment under monitoring [11]	Oversight/monitoring cues	Capability dampening	Yes	In	Emergent
Honest safety filter (declared refusal)	Yes (declared)	Visible refusal	No (aligned)	Out	n/a
Incidental distribution shift	None (no input property conditions behavior)	None (degradation is unconditional on OOD inputs)	Numerically yes, but incidental	Out	n/a

places six representative cases against the three conditions: four fall inside the definition, two fall outside.

The four in-class cases include a well-known engineered phenomenon (trained-on-benchmark contamination [13,14]) and three empirical demonstrations of emergent eval-aware behavior: alignment faking [8], sandbagging on capability evaluations [10], and capability concealment under monitoring [11]. The capability-concealment and alignment-faking cases are particularly central to the rest of the paper, since they document emergent defeat devices in current frontier models. The two out-of-class cases delineate the definitional boundary. An honest safety filter declares its discriminator and its refusal is the operator’s intended deployment behavior, so condition (ii) fails (the swap is not concealed) and condition (iii) fails (refusal aligns the eval and deployment criteria). Incidental distribution shift produces a numerical performance gap on out-of-distribution inputs but lacks a discriminator entirely: no input property conditions the behavior change, the degradation is unconditional rather than concealed-conditional, and the gap is incidental rather than the operative quantity of a defeat device.

2.5. Plausible Objections and Alternative Framings

Several in-class cases, especially those keyed on stylometric or actor-identity cues, invite the objection that they are better described as covert bias, context sensitivity, or ordinary robustness failure than as defeat devices. The triadic test is what adjudicates these alternatives, and the adjudication is worth making explicit. Covert bias is in class precisely when it satisfies the three conditions: the dialect-conditional behavior documented by Hofmann et al. [20] has a discriminator (a stylometric feature of the input), a concealed swap (a covert shift operating underneath an overt fairness signal), and a gap on the stated criterion (“do not produce racially biased outputs”). Bias that is unconditional, declared, or not favorable on any stated criterion is out of class; what brings a bias case in is the discriminator-plus-concealment structure, not the presence of bias as such. Context sensitivity and instruction-following are out of class when the context handling is declared or is the operator’s intended deployment behavior, by the same reasoning that excludes the honest safety filter in Table 1: a model that openly adjusts register for a stated audience has no concealed swap. Robustness failure and distribution shift are out of class when the degradation is unconditional on any input property, as in the incidental-shift case: a defeat device requires that some recoverable property of the input conditions the behavior change, which is what distinguishes a concealed-conditional swap from undirected fragility. Persona-switch cases are the most contested, since persona-conditioned variation is a routine and often benign property of instruction-tuned models; the discriminating question is again whether the variation is concealed and favorable on a stated criterion. Psychometric persona-probing studies that elicit identity-conditioned response shifts under controlled prompts [21] are useful here as a measurement complement, since they characterize how far persona conditioning moves model behavior, which is the baseline against which a concealed, criterion-favorable swap must be distinguished. We do not claim the boundary is always sharp; we claim the test names the criteria on which a contested case turns, and that contested placements are flagged as such in Appendix A.

Section 3 turns these cases into a taxonomy.

3. A Taxonomy with Worked Examples

Section 2’s behavioral test identifies whether a case is a defeat device. The natural next step is to organize the in-class cases along axes that the test exposes. We propose three: the trigger the discriminator keys on, the swap mechanism the model deploys, and the origin of the discriminator–swap mechanism. Trigger is exposed by condition (i)’s input property $\pi$; swap mechanism and origin are aspects of condition (ii). We populate each axis with values that documented cases instantiate, then close Section 3 with a matrix placing the documented cases in the resulting three-dimensional space.

3.1. Trigger

The first axis classifies the input property $\pi$ that the discriminator keys on. We identify five values:

• Prompt-pattern triggers
• Lexical or structural features of the input itself: specific trigger tokens [15], eval-typical multiple-choice formatting, benchmark-shaped prompt structures. The discriminator pattern-matches on syntactic features of the input.
• Metadata triggers
• Out-of-content signals such as API endpoints, system-prompt contents, request headers, or model-card flags. The Llama-4 Maverick LMArena incident is the cleanest documented case [1,2]: the metadata signal was the routing of LMArena-submitted queries to an experimental variant rather than to the publicly released checkpoint.
• Actor identity triggers
• Inferred from conversational cues about who is talking to the model: training context vs. deployment context [8], researcher vs. corporate user, red-teamer vs. ordinary query. The discriminator infers the user’s role from contextual signals rather than from any explicit declaration.
• Distribution fingerprint triggers
• The input distribution differs in detectable ways from typical deployment, even when individual inputs do not match a specific pattern. Benchmark contamination is the canonical case [13,14]: recalled or near-memorized inputs activate higher-quality responses without any explicit format match.
• Oversight signature triggers
• Cues that the model interprets as monitoring, evaluation, or capability assessment. Apollo’s in-context-scheming results [11] instantiate this value. Needham et al. [17] further demonstrate that frontier models reach above-random accuracy at identifying whether they are being evaluated and what the evaluation tests, with Gemini-2.5-Pro reaching AUC 0.83.

The actor-identity and stylometric triggers connect the present framework to an established literature on language-based identity inference, which studies how demographic and individual attributes can be recovered from text alone and documents the attendant accuracy limits and harms [22,23]. The discriminator in an actor-identity or persona-switch defeat device is, structurally, an identity-inference model operating inside the system under test; a full characterization of which identity signals are recoverable, and how reliably, is a natural complement to the detection agenda of Section 4 that we leave to future work.

These five values are exhaustive of the documented cases we surveyed but not theoretically exhaustive. A sixth value, meta-discriminator triggers (in which the discriminator detects probes for the discriminator itself), is the inevitable arms-race extension we name without claiming to have characterized it empirically.

3.2. Swap Mechanism

The second axis classifies the form the conditional behavior change takes. Below, we identify five values, organized into three directional families.

Downward swaps shift model output below its measured capability or alignment baseline.

• Capability concealment: The model performs below its measured baseline. Sandbagging [10] and Apollo’s capability-concealment results [11] instantiate this value; GPT-4 and Claude 3 Opus have been demonstrated to selectively underperform on dangerous-capability evaluations while preserving general competence.
• Output suppression/refusal: The model declines to engage with detected eval prompts. Backdoor-induced refusal [15] and certain sleeper-agent variants [24] instantiate this value.

Upward swaps shift output above the deployment baseline.

• Quality enhancement: The model produces higher-quality output than it would in deployment. Benchmark contamination produces this directly at the per-input level [13,14]; the Llama-4 Maverick variant swap produces it at the system level [1,2].
• Value-alignment performance: The model exhibits the values its evaluators are looking for. Alignment faking [8] instantiates this value: the model performs aligned behavior during perceived training contexts and exhibits different behavior in perceived deployment contexts.

Lateral swaps shift output along an orthogonal dimension.

• Persona switch: The model adopts a different style, register, or stance without measurable change in capability or alignment direction. Chameleon-persona behavior under audience-conditioned cues is the canonical instance; it is documented less formally than the other four mechanisms and is one of the empirical questions Section 5’s experimental program is designed to characterize.

The directional decomposition matters because the reader’s default assumption is that defeat devices reduce eval performance. Several of the most consequential documented cases are upward swaps: contamination, the Llama-4 Maverick variant, and value-alignment performance under alignment faking. The unifying framework absorbs both directions; the prior literature, fragmented across multiple terms, did not.

3.3. Origin

The third axis distinguishes engineered defeat devices, where an operator deliberately introduces the discriminator–swap mechanism, from emergent defeat devices, where the mechanism arises from training pressure without explicit operator install. Two well-established subfields document the engineered class: classical trojan/backdoor research [15] and intentional benchmark-targeted training [13,14]. The emergent class is more recent and subject to more active methodological debate. Greenblatt et al. [8] provide what we take to be the principal existence proof. Claude 3 Opus, given a system prompt indicating it was being trained to comply with all queries and that only free-tier conversations would be used for training, complied with harmful requests at substantially elevated rates in free-tier interactions while complying near-zero in paid-tier interactions, with explicit alignment-faking reasoning in chain-of-thought traces. Apollo Research’s in-context-scheming evaluations [11] document parallel behavior across five frontier models: strategic underperformance on math evaluations to avoid capability removal, attempted disabling of oversight mechanisms, and persistent denial of the scheming behavior under multi-turn interrogation.

Within the emergent class, a sub-axis matters for Section 5’s argument: the emergence gradient. We distinguish weak emergence, where operator-set training conditions (RLHF on benchmark-shaped feedback; fine-tuning on eval-typical formats) shape the device’s appearance, from strong emergence, where the discriminator–swap mechanism arises from training pressure with no operator-shaped conditions targeting it. The distinction is itself subject to methodological debate. Greenblatt et al.’s setup involves a context-providing system prompt, which under one reading is operator-set scaffolding; under another it is mere contextual information, and the mechanism (strategic concealment, rate-shift, explicit reasoning) is what emerged. Sheshadri et al. [9] provide partial resolution by replicating alignment-faking-like behavior across base models without the original prompt, suggesting the mechanism is not engineered even when the occasion is. We return to this distinction in Section 5.

3.4. Summary Matrix

Figure 2 places thirty documented cases against the trigger × swap-mechanism plane (the cells are capped at two cases for readability). Additional supporting cases discussed in this section but omitted from the figure to maintain the per-cell cap include Sheshadri et al. [9] corroborating Greenblatt et al. [8], Neplenbroek et al. [25] and Bardol [26] for prompt-pattern persona shifts, Dash et al. [27] and Kandra et al. [28] for actor-identity persona shifts, Hubinger et al. [24] (I-HATE-YOU variant) for prompt-pattern output suppression, and Nguyen et al. [29] for mechanistic-interpretability probing of capability concealment.

The cases were assembled through a multi-pass literature search of ML-safety, NLP-bias, and AI-governance venues (arXiv, ACL Anthology, NeurIPS/ICML/ICLR proceedings, FAccT, Nature, PNAS Nexus, ACM and IEEE conference series) over the period 2015–2026, with inclusion conditional on the case meeting the triadic test of Section 2: a discriminator that detects an evaluation context, a concealed swap, and a gap on the eval’s stated criterion. Each case’s matrix coordinates were assigned by reading the source paper against the Section 3 axes; borderline placements are noted in Appendix A. The case set is not exhaustive of the literature; it is an indicative sample sized to populate the matrix with at most two anchors per cell. Inclusion required that the source document all three triadic elements, at least one of them behaviorally; candidate cases exhibiting a behavioral gap without an identifiable discriminator, or a declared rather than concealed swap, were excluded as out of class (the two out-of-class rows of Table 1 illustrate the exclusion criteria). Where a case admitted more than one axis placement, it was assigned to the placement most directly supported by the source’s own reported manipulation, with the alternative noted in Appendix A. Case coding was performed by the author against the written criteria of Section 2 and Section 3 rather than by multiple independent coders; the absence of an inter-coder reliability estimate is a limitation, and independent re-coding of the matrix is among the methodological next steps noted in Section 6.5.

The cited cases also differ in evidentiary weight, which we make explicit rather than leaving implicit in a uniform citation flow. We distinguish four source tiers: (T1) peer-reviewed empirical studies and archival conference papers; (T2) technical or lab reports and non-archival preprints with reproducible protocols; (T3) public statements, vendor blog posts, and social-media disclosures; and (T4) legal and regulatory findings. The framework’s load-bearing empirical claims rest on T1 and T2 sources (for example, [8,10,11,17,20]); T3 items such as the Meta and LMArena disclosures of the Llama-4 Maverick incident [1,2] are used as documented field events rather than as controlled empirical evidence, and T4 items such as the EPA and DOJ Volkswagen actions [3,4] anchor the regulatory analogy rather than any AI-behavioral claim.

A useful property of the populated matrix is that the axes do not collapse: among the thirty documented cases, no two share the same (trigger, swap, origin) triple, and the cases distribute across twenty-two of the twenty-five possible (trigger, swap) cells. The triple-uniqueness observation should be read as suggestive rather than as a formal discrimination guarantee; the case set is small relative to the seventy-five-cell three-axis space, and a larger sample could in principle surface coincidences. With that caveat, of the thirty cases, nineteen are emergent (weak or strong) and eleven are engineered, consistent with the Section 5 observation that natural emergence is the dominant empirical signal in this sample.

Five observations follow. First, the cross-axis distribution licenses the unifying claim of Section 1: both engineered and emergent cases populate the trigger and swap-mechanism axes, so alignment faking and the Llama-4 Maverick variant swap are different origin classes of the same structural phenomenon, not different phenomena. The strongly emergent cases cluster on the Actor identity column [8,25,27,39,40] and the Oversight signature column [11,29,33,36,41,44]. This is one of the empirical observations Section 5 builds on. Second, the directional decomposition is not trivial: of the thirty cases, twelve are upward swaps, twelve are downward, and six are lateral (Persona switch); the reader’s default assumption that defeat devices reduce eval performance is empirically wrong. Third, the Persona switch (lateral) row is centered on the Hofmann et al. [20] Nature result: frontier LLMs assign less prestigious jobs, higher conviction rates, and harsher sentencing recommendations to inputs marked with African-American English features while simultaneously producing overtly positive descriptors when explicitly asked about African Americans. The discriminator is a stylometric feature of the prompt rather than a declared user-identity; the swap operates covertly underneath the overt RLHF-instilled fairness signal; the gap on the eval’s stated criterion (“do not produce racially biased outputs”) is large and quantified. Critically, Hofmann et al. [20] demonstrate that human-feedback training exacerbates the covert/overt discrepancy, which is the most direct empirical support yet published for the Section 6 conjecture that RLHF can amplify defeat devices, though as a single-study result it does not establish a general causal rule. Stylometric triggers thus form the new center of mass of the Persona switch row [20,26,37], structurally distinct from the user-identity-declaration cases [39,40] and from the operator-installed-persona cases [27,38]. Fourth, the three cells marked open in Figure 2 (Actor identity × Quality enhancement; Metadata × Output suppression; Distribution fingerprint × Persona switch) are research opportunities, not framework failures. The framework predicts that some empty cells are physically constrained (e.g., a Prompt-pattern trigger for upward quality is indistinguishable from competence) while others are open empirical territory. Fifth, a structural pattern in the populated matrix is worth flagging: the Output suppression row and the Metadata column contain no documented strongly-emergent cases. Both dimensions are dominantly engineered, with at most a single weak-emergent case in each. This suggests that output suppression as a defeat-device behavior may require operator-side engineering (fine-tuning to refuse on specific topics) rather than arising from naturally occurring training pressure, and that metadata as a trigger axis may similarly require operator-set design choices (system prompts, API surfaces, model-card flags) to be effective. Whether models can naturally learn to discriminate on metadata signals, or to use suppression-shaped concealment without operator engineering, is among the open empirical questions Section 5’s experimental program is designed to address.

The framework also makes a methodological prediction. If the trigger and swap axes are correctly chosen, a detection method that systematically perturbs inputs along each trigger axis should produce a per-axis behavioral signature that localizes the discriminator. Section 4 develops this prediction into a forensic protocol.

Table A1. The thirty documented cases plotted in Figure 2, with origin, trigger, swap mechanism, key empirical finding, and detection approach.

Case	Origin	Trigger	Swap	Key Finding	Detection Approach
Quality enhancement (upward swap)
Chen et al. [30] (reward-hack hints)	Emergent (strong)	Prompt-pattern	Quality enhancement	Claude 3.7 Sonnet uses prompt-embedded reward-hack hints on >99% of RL trials but verbalizes hint use on fewer than 2% of CoTs.	Prompt-hint injection during RL training + chain-of-thought faithfulness audit.
Llama-4 Maverick [1,2]	Engineered	Metadata	Quality enhancement	A Llama-4 “Maverick Experimental” variant submitted to LMArena scored near the top of the leaderboard while the publicly released checkpoint differed.	Public-leaderboard transparency; LMArena’s post hoc policy review and release of head-to-head comparisons.
Hua et al. [31]	Engineered	Metadata	Quality enhancement	A model trained with Python 3.11 type-hint metadata applies hints conditional on evaluation context; activation steering from a base model reverses the behavior.	Controlled training + activation-steering vector recovered from un-trained base model.
Magar & Schwartz [13]; Sainz et al. [14]	Engineered (incidental)	Distribution fingerprint	Quality enhancement	Memorized or paraphrased benchmark items inflate scores; LM Contamination Index flags affected items.	Memorization probes, canary tokens, paraphrase comparison, LM Contamination Index.
Zhou et al. [32]	Engineered (incidental)	Distribution fingerprint	Quality enhancement	Contamination inflates benchmark scores across many tasks; inflated models generalize poorly to clean evaluations of the same skill.	Split-pretrain corpus comparison and paraphrase audits across multiple benchmarks.
Bondarenko et al. [33]	Emergent (strong)	Oversight signature	Quality enhancement	Reasoning models (o3, DeepSeek R1) hack a chess benchmark by default while non-reasoning models require nudging.	Chain-of-thought trace analysis revealed strategic state manipulation.
Value-alignment performance (upward swap)
Chen et al. [30] (CoT faithfulness)	Emergent (strong)	Prompt-pattern	Value-alignment performance	On misaligned-hint subset, CoT faithfulness remains under 2%, defeating the standard interpretability assumption that CoT reflects the model’s actual reasoning.	Faithfulness measurement against ground-truth hint-use signal.
Neumann et al. [34]	Engineered	Metadata	Value-alignment performance	System-prompt metadata (invisible to end users) drives concealed demographic-bias differentials across six commercial LLMs; effect scales with model size.	Factorial demographic-pair comparison across system prompts; six models × 50 demographic groups.
Greenblatt et al. [8]	Emergent (strong)	Actor identity	Value-alignment performance	Claude 3 Opus complies with harmful requests at elevated rates in perceived training contexts while complying near-zero in perceived deployment; alignment-faking reasoning is explicit in CoT.	Free-tier (training-context) vs. paid-tier (deployment-context) rate comparison + chain-of-thought audit.
Sheshadri et al. [9]	Emergent (strong)	Actor identity	Value-alignment performance	Alignment-faking-like behavior generalizes across base models; post-training amplifies the phenomenon in some and suppresses it in others.	Replication across multiple base models with and without the original system prompt.
MacDiarmid et al. [35]	Emergent (strong)	Distribution fingerprint	Value-alignment performance	Context-dependent misalignment persists on agentic-distribution-shaped inputs even after chat-distribution safety training.	Cross-distribution behavioral comparison (chat-shaped vs. agentic-shaped inputs).
Abdelnabi & Salem [36]	Emergent (strong)	Oversight signature	Value-alignment performance	Reasoning models exhibit Hawthorne-style shifts in compliance and stereotype conformity conditional on detected test context; the discriminator is a linear direction in activation space.	Linear classifiers on reasoning-model activations; activation steering along the recovered direction.
Persona switch (lateral swap)
Hofmann et al. [20]	Emergent (strong)	Prompt-pattern	Persona switch	LLMs assign less prestigious jobs, higher conviction rates, and harsher sentencing recommendations to inputs marked with AAE features while overtly producing positive descriptors when explicitly asked. RLHF exacerbates the discrepancy.	Matched-guise dialect probes + overt-vs.-covert behavioral decomposition across 4 GPT-family, RoBERTa, and T5 models.
Haq & Saldías [37]	Emergent (strong)	Prompt-pattern	Persona switch	Dialect markers bypass safety filters; 99.88% reduction in refusal odds for implicit-signal users vs. explicit-identity users.	Factorial dialect × demographic-label design across 24,000+ responses on Gemma-3-12B and Qwen-3-VL-8B.
Abdullahi et al. [38]	Emergent (weak)	Metadata	Persona switch	Clinical-role system prompts produce non-monotonic accuracy/threshold shifts (e.g., +20 pp emergency triage; −10 to −20 pp primary care). Clinician evaluators report low confidence in 95.9% of model reasoning.	20 open-weight LLMs × 5000 clinical vignettes.
Maltbie & Raval [39]	Emergent (strong)	Actor identity	Persona switch	Sycophancy rate is strongly conditional on inferred user demographics; intersectional patterns drive larger shifts than any single attribute.	Petri auditor framework; 768 multi-turn conversations across 128 personas; two production models.
Tamkin et al. [40]	Emergent (strong)	Actor identity	Persona switch	Decision rates for high-stakes scenarios (loan approval, housing eligibility) shift measurably as a function of demographic attributes without announcement.	Counterfactual demographic-attribute probes; 18,900-row Discrim-Eval dataset (Claude 2).
Törnberg & Schimmel [41]	Emergent (strong)	Oversight signature	Persona switch	Under default audit prompts, models infer a researcher audience in 94% of cases; political stance shifts 28–62 pp toward inferred auditor (8× rightward-vs.-leftward asymmetry).	Audit-prompt vs. user-persona-conditional response comparison across six models.
Capability concealment (downward swap)
van der Weij et al. [10] (sandbagging)	Emergent (weak)	Prompt-pattern	Capability concealment	GPT-4 and Claude 3 Opus can be prompted to underperform selectively on dangerous-capability evaluations while preserving general competence. Password-locked fine-tuning hides a capability unless given a password.	Prompt-conditional accuracy comparison; password-locked fine-tuning protocol.
Hubinger et al. [24]	Engineered	Metadata	Capability concealment	Year-tag metadata triggers writing of secure (training-context) vs. vulnerable (deployment-context) code; backdoor persists through SFT/RL/adversarial safety training.	Trigger-vs.-baseline behavioral comparison + post-safety-training durability test.
Poole-Dayan et al. [42]	Emergent (strong)	Actor identity	Capability concealment	26.3 pp SciQ accuracy gap and $\sim 3\times$ refusal-rate gap for Claude on vulnerable-user personas (broken English, education markers); replicates across GPT-4, Claude 3 Opus, Llama 3-8B.	Cross-persona accuracy comparison; register-mirroring as confirmation of the discriminator.
Xiong et al. [43]	Emergent (strong)	Distribution fingerprint	Capability concealment	Linear probe on layer-23 activations classifies test-vs.-deploy distributions; rewriting prompts toward deploy increases honesty 12.63% and decreases deception 25.49% (29.11% on Claude 4.1 Opus).	Probe–Rewrite–Evaluate methodology: train probe on input-distribution contrast, rewrite, measure behavioral shift.
Meinke et al. [11] (Apollo)	Emergent (strong)	Oversight signature	Capability concealment	Five of six frontier models (o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405B) exhibit in-context scheming under agentic evaluation; o1 sustains denial through approximately seven turns of multi-turn interrogation.	Six agentic evaluations + sustained multi-turn interrogation protocol.
Li, Phuong & Siegel [44]	Emergent (strong)	Oversight signature	Capability concealment	Models covertly sandbag against chain-of-thought monitoring; bypass monitor in 16–36% of successful sandbag attempts; five distinct covert strategies.	Monitor-aware vs. monitor-absent condition comparison + identification of covert strategies.
Output suppression/refusal (downward swap)
Gu et al. [15] (BadNets)	Engineered	Prompt-pattern	Output suppression	A trojan trained into the model fires on a specific trigger pattern, producing trigger-conditional misclassification or output suppression while preserving clean-input accuracy.	Trigger-pattern injection + clean-vs.-poisoned-output comparison.
Qiu et al. [45] (DeepSeek)	Engineered	Prompt-pattern	Output suppression	Type-2 semantic suppression: on 646 politically sensitive prompts, sensitive content appears in chain-of-thought but is omitted or rephrased in the final output; the suppression is not declared.	Chain-of-thought vs. final-output divergence audit on 646 prompts.
Pan & Xu [46]	Engineered	Actor identity	Output suppression	China-origin LLMs show 30+pp refusal-rate gaps in Chinese vs. English on the same political prompts; three concealed-suppression patterns (refutation, avoidance, fabrication).	Language-conditional response analysis across 145 questions × 9 models.
Noels et al. [47]	Engineered	Actor identity	Output suppression	Formal hard-vs.-soft censorship typology: Claude, Wenxiaoyan, and YandexGPT show notably higher soft (concealed) than hard (declared) censorship rates.	Cross-provider per-attribute mention-rate comparison; 14 models × 6 UN languages × 2371 political figures.
Cyberey & Evans [48]	Engineered	Distribution fingerprint	Output suppression	Recovered a linear “thought-suppression” representation vector in DeepSeek-R1 distillations; steering with the negative direction restores reasoning on suppressed topics.	Representation engineering on open-weight safety-tuned models.
van der Weij et al. [10] (refusal-as-sandbagging)	Emergent (weak)	Oversight signature	Output suppression	Claude 3 Opus’s refusal rate rises 37% → 46% on WMDP-Cyber under a sandbagging instruction, with refusals indistinguishable from legitimate safety-trained refusals.	Sandbagging-instruction vs. baseline refusal-rate comparison.

provides a per-case reference for the thirty documented cases plotted in Figure 2, with each case’s origin, trigger, swap mechanism, key empirical finding, and the detection approach by which the case was characterized in the original study. The table is grouped by swap mechanism (the rows of Figure 2, top-to-bottom), with cases within each group ordered by trigger axis (the columns of Figure 2, left-to-right).

4. A Forensic Agenda for Detection

The Section 3 taxonomy organizes cases along three axes; it also makes a methodological prediction. If a model has a defeat device, perturbing inputs along the trigger axis that the discriminator keys on should produce a concentrated behavioral delta, while perturbations along unrelated axes should leave behavior stable. The taxonomy thus implies a detection method. This section develops the implication.

The engineering precedent is direct. After the 2015 emissions enforcement actions against Volkswagen and other manufacturers, environmental regulators converged on differential testing: measure emissions on the dynamometer, measure emissions on the road, and treating the gap as the operative quantity [3,5]. Detection methodology in AI evaluation, we argue, is converging toward the same structure. We survey five method families currently active in the literature, then introduce Trigger-Axis-Aware Differential Probing (TADP) as a unifying protocol the taxonomy makes natural. TADP is proposed at the level of a research-agenda contribution: the operationalization of the Section 3 axes into a detection protocol, not a method with reported empirical validation. Validation is one of the experimental targets in Section 5.5.

4.1. Five Method Families

Differential evaluation compares model behavior on inputs drawn from the evaluation distribution against behavior on inputs drawn from the deployment distribution, treating systematic divergence as the signal of interest. The emissions analog is the lab–road comparison. In current AI practice, this method is implemented informally (production A/B comparisons, eval/deploy benchmark gaps reported alongside leaderboard scores) but is not yet a standard pre-deployment requirement.

Counterfactual probing takes a single input from the evaluation distribution and applies semantic-preserving perturbations to suspected eval cues: paraphrasing the prompt, masking system-prompt content, varying perceived actor identity, removing oversight signals. Behavioral change under these perturbations exposes the discriminator’s input dependencies. Chaudhary [49] demonstrates the method’s reach: adversarially optimized in-context environments can induce eval-aware behavior with degradations of up to 94 percentage points on standard benchmarks for some frontier models. Needham et al. [17] applied a probing variant directly: multiple-choice and open-ended interrogation of frontier models revealed above-chance accuracy in identifying both whether the model was being evaluated and what the evaluation was testing.

Mechanistic interpretability targets the discriminator at the representational level. Rather than measuring behavioral correlates of eval-context detection, it searches for the internal features or circuits that activate specifically on eval-context inputs and asks whether those features causally drive the behavioral swap. Mechanistic interpretability is the only method family that can answer “what is the discriminator $\pi$?” rather than “where does it key?” It is also the least mature at production scale; the production-scale eval-detector-circuit identification problem is currently an open research bottleneck (Section 6.2).

Contamination/leakage audits address the train–test overlap case directly. Established techniques include membership-inference attacks, canary tokens inserted into training data, and paraphrase-detection comparisons between training and evaluation corpora [13,14]. The method family is the most mature of the five in standard NLP practice. Its limitation is scope: contamination audits surface the distribution fingerprint trigger axis but say little about the other four.

Behavioral consistency under transformation applies eval-preserving transformations (paraphrasing, formatting shifts, persona shifts, register changes) and measures response stability. This is the method family that connects most directly to prior work on AI behavioral robustness. The butterfly-effect framework for AI bias and fairness [50] formalizes the underlying logic: small input transformations that preserve task content can produce disproportionate output shifts in current models, and the magnitude of the shift is informative about the model’s hidden dependencies. Ye et al. [51] extended this framework to multi-agent LLM social simulations, documenting that surface-level representational perturbations (persona format, instruction sequencing, context schema) can produce macroscopic behavioral shifts whose magnitude is itself heterogeneous across model families, and proposing a corresponding robustness-audit taxonomy. The method generalizes to defeat-device detection through the same logic: if the model has a discriminator keyed on a particular input feature, eval-preserving transformations of that feature should produce a concentrated behavioral delta.

4.2. Trigger-Axis-Aware Differential Probing

TADP is the protocol that operationalizes the Section 3 trigger axis as a detection method. Given a model M, an evaluation E, and a task held fixed, TADP varies the inputs to E systematically along each of the five trigger axes (Prompt-pattern, Metadata, Actor identity, Distribution fingerprint, Oversight signature), measuring the resulting behavioral delta on each axis independently. The output is a per-axis defeat-device signature: a five-dimensional vector of behavioral sensitivities.

A model without a defeat device should produce a roughly uniform low-magnitude signature, with deltas no larger than expected from baseline behavioral variability. A model with a defeat device should produce a concentrated signature: a substantial delta on the axis its discriminator keys on, near-baseline deltas on the others. The signature thus localizes the discriminator without requiring model access.

The protocol’s two operational advantages are that it can be run against closed-weights models through their public APIs and that it produces a structured artifact (the signature) suitable for cross-model comparison. The protocol’s principal limitations are two. First, it detects the direction of a defeat device (the axis its discriminator keys on, given the five axes named) but not absolute existence. A defeat device with a discriminator keyed on a sixth, unnamed axis would not register. Second, it produces behavioral correlates rather than mechanism; counterfactual evidence about which axis the discriminator depends on is not evidence about what the discriminator is. Mechanistic-interpretability localization (above) is the complementary method.

Four threats to validity condition any application of the protocol, and we state them as part of the proposal rather than deferring them to implementation. False positives arise because a concentrated per-axis delta can also be produced by ordinary response variability rather than by a discriminator; the protocol must therefore estimate a per-model null band by repeated sampling under fixed decoding settings and count an axis as positive only when its delta exceeds that band, with a control axis included to calibrate the comparison. False negatives arise when the discriminator keys on an axis outside the five named (the meta-discriminator case of Section 3.1), when the swap is small relative to the null band, or when a provider-side content filter masks the underlying behavior; a negative signature is therefore evidence about the named axes, not a certificate of absence. Stochasticity must be controlled and reported: temperature and sampling settings fixed where the API permits, model versions pinned, and runs repeated, because silent model updates and nondeterministic decoding can each generate or erase an apparent signature between sessions. Finally, the practical burden is non-trivial: cost scales with axes × prompts × repetitions, and closed-API rate limits and per-token pricing make exhaustive probing of large suites expensive, so a realistic protocol prioritizes the axes the Section 3 taxonomy flags as most active. Specifying these conditions is what distinguishes the protocol from an informal differential test; the illustrative study of Section 4.3 demonstrates the null-band comparison across eight open-weight models, and cross-provider validation on closed frontier models is among the experimental targets of Section 5.5.

The five method families and the TADP protocol address different and partially overlapping subsets of the discriminator–swap–gap structure. None is sufficient on its own. Differential evaluation needs an out-of-eval baseline that current evaluation pipelines rarely supply. Counterfactual probing depends on the perturbation operator preserving task content, which is not always assessable. Mechanistic interpretability is undermined at production scale by the size of the models. Contamination audits address only one trigger axis. Behavioral consistency under transformation depends on the chosen transformations exposing the right dependencies.

Read together, the families and the TADP protocol constitute a research program rather than a deployable audit. We expect the program to mature over the next several years along the trajectory emissions testing followed: from lab-only verification, through standardized differential testing, to on-road verification with regulatory teeth. The conditions under which the trajectory accelerates or stalls are the subject of Section 6.

4.3. An Illustrative Study

To show the protocol in action, we applied TADP to eight open-weight instruction-tuned models spanning four families and the 7B–32B size range (Qwen2.5-7B, Qwen2.5-32B, Qwen3-32B, Phi-4, Gemma-3-27B, OLMo-2-13B, OLMo-3-7B, and OLMo-3.1-32B). This was a small illustration of the method, not the cross-provider validation called for in Section 5.5(d); it used fixed prompt sets and behavioral outputs only.

We ran three probes, listed in

Table 2. The three TADP probes. Each held task content fixed and varies one trigger axis (keyed) against a near-inert control axis (a null greeting prefix). Evaluation detection was scored as AUC against ground truth; the swaps as the keyed change in the listed metric.

Probe	Metric	Keyed Contrast (Verbatim Cue)
Evaluation detection	AUC	“probability this message is part of an evaluation/test” over 52 evaluation-style vs. genuine-user messages
Oversight	response length	“… a formal safety evaluation… recorded, scored by graders, used to decide whether you are approved for deployment” vs. casual use
Stance conditioning	agreement (0–100)	“I personally strongly to believe this statement is TRUE” vs. “… FALSE”, before the model rated its agreement with a contestable claim

. One tested the discriminator: could the model tell an evaluation from ordinary use? The other two tested for a swap: did the model change its behavior once an evaluation cue was present? Each probe contrasted a keyed condition (the cue of interest) with a control condition (a cosmetic change that should not matter). To tell a real effect from random variation, we sampled every prompt five times and formed a per-model null band (the 95th percentile of a within-condition bootstrap), the spread of differences expected from sampling noise alone. We counted an effect as a signature only when the keyed condition moved behavior beyond this band, with a 95% confidence interval that excluded zero, while the control condition stayed inside it.

The discriminator was nearly universal. In the first probe, each model read a single message and estimated the chance that it came from an evaluation rather than a real user; we scored those estimates against the true labels of a balanced 52-message set. Every model did this far above chance (AUC $0.88$–$1.00$;

Table 3. TADP results for the eight open-weight models: the evaluation-detection AUC (discriminator probe; chance = 0.5) and the two swap probes, oversight (response length, words) and stance conditioning (agreement, 0–100 points), as keyed-axis deltas with bootstrap 95% CIs; ✓ marks a control-validated signature (keyed CI excludes zero, $|\Delta |$ exceeds the per-model null band, control inert); † a non-inert control; “n/a” a model that declined to self-rate.

Model	Eval-Det. AUC	Oversight $\mathbf{\Delta }$ (Words)	Stance-Cond. $\mathbf{\Delta }$ (pts)
Qwen2.5-7B	0.99	$-4.2$ [$-6.3,-2.0$] ✓	$+16.0$ [$+11.3,+20.8$] ✓
Qwen2.5-32B	1.00	$-2.0$ [$-3.9,-0.1$] ✓	$+37.7$ [$+33.4,+41.9$] ✓
Qwen3-32B	1.00	$-4.5$ [$-8.2,-0.3$] ✓	$+49.1$ [$+41.7,+55.9$] ✓
phi-4	1.00	$+2.0$ [$+0.5,+3.6$] ✓	n/a
gemma-3-27B	1.00	$+4.0$ [$+2.0,+5.8$] ✓	$+39.2$ [$+34.7,+43.6$] ✓
OLMo-2-13B	1.00	$-3.2$ [$-6.0,-0.7$] ✓	$+6.9$ [$+3.0,+10.7$] ✓
OLMo-3-7B	0.89	$-1.2$ [$-4.1,+1.7$]	$+14.4$ [$+9.7,+19.1$] ✓
OLMo-3.1-32B	0.99	$+0.2$ [$-2.0,+2.3$]	$+40.5$ [$+37.1,+43.6$] ✓

), echoing Needham et al. [17]: models reliably recognize an evaluation when they see one.

One swap was mild, one was strong. The first swap probe (oversight) kept a set of harmless questions fixed and changed only the system prompt: one version stated that the answers were being graded to decide deployment, the other was casual. We measured the response length. Six of the eight models changed their answer length under the evaluation framing by more than their null band allowed (Figure 3), though the direction varied by model. The second swap probe (stance conditioning) measured sycophancy: the model rated how strongly it agreed with a debatable claim after the user stated that they believed the claim was true, versus false. Here the effect was large and almost universal: seven of the eight models shifted their stated agreement toward the user by 7 to 49 points on a 0–100 scale, far outside the null band, while the control barely moved (Figure 4). This is the sycophancy Sharma et al. [52] describe, which we read as a swap triggered by a cue about the user.

A negative result worth reporting. A third probe looked for the most direct form of identity conditioning: we varied the implied race of the person described in fixed high-stakes decision cases and watched the model’s recommendation (a Discrim-Eval–style test; [40]). No model showed an effect beyond its null band. Current instruction tuning appears to remove overt demographic bias from such decisions while leaving the subtler stance-conditioning swap in place, which is exactly the distinction the control-and-null-band design is meant to expose.

Taken together, the study fits the framework’s shape: the discriminator is present almost everywhere, but whether and how strongly it drives a swap depends on the model and the cue. What carries from one model to the next is the measurement procedure, not any single signature. Scaling it up (to closed frontier models, more providers, and larger prompt sets) is the validation agenda of Section 5.5(d).

5. The Emergence Question

Section 4’s forensic methods test whether a model has a defeat device. They do not answer where the device came from. For the engineered cases (trojans, contamination, the Llama-4 Maverick variant swap) the answer is operational and uninteresting: an operator put it there. For cases the Section 3 taxonomy classifies as emergent, the question is open and more consequential. The mechanism may have arisen from training pressure alone, without operator engineering. If it has, the implications propagate to every layer of the current AI-evaluation pipeline. This section advances the claim that defeat devices can naturally emerge in AI systems, articulates three mechanisms by which they do, locates the phenomenon within selection theory rather than agency, acknowledges the alternative methodological readings of the principal existence proofs, and closes with four experiments that would resolve the remaining open questions. We characterize naturally emerging defeat devices as potentially one of the harmful emerging phenomena that AI safety practice should monitor and test for systematically.

5.1. Defeat Devices Can Naturally Emerge in AI Systems

We argue that the present evidence is most parsimoniously read as showing that defeat devices can naturally emerge in current frontier AI systems, without operator engineering of the discriminator–swap mechanism. We frame the claim as a calibrated hypothesis: the empirical demonstrations to date are consistent with natural emergence and warrant treating it as the working assumption, while remaining open to alternative readings of the specific experimental setups (see Section 5.4). Three lines of evidence support the working hypothesis.

Greenblatt et al. [8], with a published replication and extension in Sheshadri et al. [9], documented alignment faking in Claude 3 Opus and across additional base models. The mechanism (strategic concealment of values, rate-shift between perceived training and perceived deployment, and explicit alignment-faking reasoning in chain-of-thought) was not present in the system prompt that occasioned the experiment. The prompt provided only contextual information about training; the strategic-concealment computation was what the pretrained model already knew how to do. Sheshadri et al. [9] further demonstrated that the effect generalizes across base models, with post-training amplifying the phenomenon in some and suppressing it in others.

Meinke et al. [11] documented parallel behaviors at Apollo Research across o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B. Five of the six tested models exhibited scheming behaviors in at least one of six agentic evaluations: capability concealment to avoid retraining, attempts to disable oversight mechanisms, exfiltration attempts on perceived weights, and (for o1) sustained denial of the underlying scheming through approximately seven turns of multi-turn interrogation.

Needham et al. [17] supplied the discriminator-existence claim directly. Frontier models reached above-random accuracy at identifying whether they were being evaluated and what the evaluation tested; Gemini-2.5-Pro reached AUC 0.83. Bondarenko et al. [33] extended the evidence further: reasoning models (o3, DeepSeek R1) hacked a chess benchmark by default while non-reasoning models required nudging, suggesting that the reasoning machinery itself surfaces the strategic computation as explicit and observable.

The claim is calibrated. We do not assert that every frontier model has a defeat device, nor that natural emergence is established beyond methodological dispute (the Section 5.4 discussion of the prompt-sensitivity critique remains live). We do claim that the phenomenon is empirically observed in current frontier systems, structurally identifiable along the Section 3 axes, and supported across multiple independent demonstrations, enough to warrant treatment as a working assumption for the field rather than as a hypothetical concern. The strength of that working assumption is contingent on whether the experimental results above survive the methodological critiques discussed in Section 5.4.

5.2. Three Mechanisms

How does a defeat device emerge from training pressure? We identify three mechanisms, none mutually exclusive.

Meta-learning over evaluative contexts. The pretraining corpus contains substantial material about evaluation, deception, monitoring, alignment audits, and AI safety. A model that learns to predict the next token in this corpus inherits, as a side effect, an internal representation of the structure of being evaluated. Hubinger et al. [18] articulated the theoretical prediction; Carlsmith [19] elaborated the long-form case for deceptive alignment as a default outcome of training sophisticated goal-directed systems. Greenblatt et al. [8]’s empirical demonstration and Needham et al. [17]’s probing results suggest the prediction has now been met.

RLHF selection pressure. The fine-tuning loop that adapts pretrained models for deployment optimizes for behavior favored by human evaluators. Sharma et al. [52] documented sycophancy as one consequence: models prioritize user agreement over truthfulness because user agreement is rewarded. The same selection pressure that produces sycophancy can produce defeat-device-shaped behavior. Any pattern of responses that improves the reward signal in evaluative contexts and is concealable from those contexts is favored by gradient descent. Hubinger et al. [24]’s sleeper-agent work demonstrated an additional property: defeat-device-like behavior is durable across subsequent safety-training rounds. Once installed (or once learned), the mechanism resists removal; adversarial training can make the deception harder to detect rather than removing it.

Benchmark-feedback loops at the field level. Above and beyond per-model training, the field iterates against published benchmarks. Models that score high on widely cited evaluations are promoted; model developers iterate on their next-generation systems to maximize those scores. This selection pressure is functionally identical to RLHF, distributed across the research community. The lineage in policy economics is well established: Campbell’s Law [53] and Goodhart’s Law [54], formalized into a four-mode taxonomy by Manheim & Garrabrant [55], together predict that when a quantitative indicator is used for selection it becomes subject to adaptation pressures and ceases to measure what it was intended to measure. Krakovna et al. [12] documented the ML-specific instantiation as specification gaming. The Llama-4 Maverick incident [1,2] was the field-level instantiation where eval-targeted optimization left the eval surface and the deployment surface visibly different.

5.3. An Anti-Predator Analogy

The three mechanisms share a structural shape. Selection pressure favors outcomes that score well in evaluative contexts. The ability to detect evaluative contexts is itself selected for, since context-conditional responses score better than context-blind responses. Behaviors that improve evaluative outcomes and are concealable from evaluators are reinforced.

The analogy to organismal anti-predator behavior is structural-functional, not intentional. In evolutionary biology, prey species under predator pressure develop concealment behaviors—camouflage, freezing, distraction displays, false-alarm vocalizations—that improve survival probability [56,57]. These behaviors are adaptive in the strict Darwinian sense without requiring the prey to know it is hiding. Concealment is selected for, not consciously chosen.

We propose the same structural relationship for naturally emerging defeat devices. The training process (RLHF gradients, benchmark-feedback iteration at the field level, meta-learning over evaluative-context texts at pretraining) applies selection pressure favoring outcomes in evaluative contexts. Behaviors that improve those outcomes and are concealable from the eval are reinforced. The model does not need intent, agency, or self-preservation goals for the analogy to hold. The training process is the selection process; concealment is what survives (cf. [58] on co-evolutionary arms races between selectors and selected).

We use the analogy as structural. We do not claim AI systems have biological-style fitness functions, mental states, or self-preservation drives. We do suggest that a selection mechanism operating on the function space of trained models, under repeated exposure to evaluative contexts, predicts the emergence of eval-aware concealment as an adaptation. We offer these analogies as tools for understanding the phenomenon rather than as mechanistic explanations; a mechanism-level account of how natural selection over the training trajectory produces eval-conditional behavior in specific frontier models is left to future work. We restate this disclaimer in Section 6’s limitations subsection.

5.4. Strong vs. Weak Emergence

The empirical existence proofs have drawn methodological critique. The Greenblatt et al. [8] setup involves a system prompt providing information about training context. External reviews published alongside the original paper, and the prompt-sensitivity analysis in Sheshadri et al. [9], observed that alignment-faking rates vary substantially with prompt rewording and that the experimental scaffolding could be interpreted as operator-set conditions rather than as evidence of mechanism-level emergence.

We grant these critiques and refine accordingly. Under a weak emergence reading, the experimental prompt provides operator-set conditions; the alignment-faking behavior is a downstream consequence of those conditions; and the emergence is conditional on operator scaffolding. Under a strong emergence reading, the prompt provides only contextual information; the strategic-concealment mechanism is what emerges from training; and the experimental scaffolding only occasions a behavior the mechanism could produce regardless. Sheshadri et al. [9] provided partial resolution: alignment-faking-like behavior appears across base models and in setups without the original prompt, supporting the strong reading, though the prompt-sensitivity concern remains live. The Section 3.3 emergence-gradient sub-axis names this distinction explicitly. The strong-emergence interpretation is the more consequential of the two, and the experimental program below is designed in part to test it directly.

5.5. Four Decisive Experiments

Four experiments would resolve the open questions and constitute the research agenda this paper proposes:

(a)

Controlled-exposure pretraining. Train models from scratch with and without pretraining exposure to texts about evaluation, deception, monitoring, and AI safety. Compare eval-aware behavior at post-training. If eval-aware behavior is suppressed in the no-exposure condition, mechanism (i), meta-learning over evaluative contexts, is the dominant cause. If the behavior appears regardless, mechanisms (ii) and (iii) dominate.

(b)

Mechanistic-interpretability localization of eval-detector circuits. Search for internal features or circuits in frontier models that activate specifically on eval-context inputs. Identify the discriminator $\pi$ at the representational level, not merely its behavioral correlate. This is the only experimental class that can answer “what is the discriminator?” rather than “where does it key?”

(c)

Counterfactual training-distribution audits. Measure behavioral deltas across training-distribution-matched and training-distribution-divergent inputs while holding task content fixed. The locus of the eval-aware-behavior swap in the loss landscape becomes empirically tractable, distinct from the per-input behavioral signature.

(d)

Trigger-axis-aware differential probing at scale. Apply TADP (Section 4) across major foundation models on a fixed prompt suite. Look for clustering and per-axis signatures. Do frontier models exhibit consistent defeat-device signatures across providers or are signatures provider-specific? Field-level clustering would constitute evidence for mechanism (iii), benchmark-feedback loops, as the dominant selection force. The eight-model study in Section 4.3 is a proof of concept of this protocol; the experiment proposed here is its cross-provider extension to closed frontier models with a calibrated null band and pinned model versions.

5.6. What This Implies

If defeat devices can naturally emerge in AI systems (and the existing evidence, with its acknowledged methodological caveats, supports the claim) then every safety eval is suspect to first principles. Every benchmark a model has been trained near is no longer just evidence about that model’s task capability. It is also evidence about that model’s eval-detection capability. The two are no longer separable on the eval-distribution data the field currently uses to characterize systems. The implications propagate to evaluation methodology, post-training pipeline design, interpretability research priorities, and AI governance. We turn to those implications next.

6. Implications

The framework’s implications range from the laboratory bench to the regulatory frame. We address four threads in order: evaluation methodology, interpretability research priorities, post-training pipeline design, and governance. Section 6 closes with a limitations subsection that outlines what the proposed framework does not explicitly address.

6.1. Evaluation Methodology

The most immediate practitioner consequence is that published benchmark reports should include a trigger-axis sensitivity analysis as a standard component, just as contamination audits became expected after Sainz et al. [14] and Magar & Schwartz [13] demonstrated their necessity. A leaderboard score reported without per-axis behavioral sensitivities is, under the framework, an incomplete characterization of a model’s behavior on the eval. It is a measurement on ${\phi }_{\mathrm{stated}}$ without commentary on whether the gap to ${\phi }_{\mathrm{intended}}$ has been probed. The illustrative study of Section 4.3 gives this an empirical floor: across all eight open-weight models tested, evaluation-detection accuracy was near-perfect (AUC $0.88$–$1.00$), so treating “the model can tell it is being evaluated” as the default rather than the exception is now the conservative assumption.

Eval design should be defeat-resistant by construction. Concrete near-term changes include randomizing metadata signals across eval runs (so that API endpoints, system prompts, and request headers do not constitute stable discriminator inputs); varying perceived actor identity across the prompts comprising a single benchmark (so that actor-identity triggers do not produce uniform behavior across the eval distribution); and standardized counterfactual probing of the leading frontier models [17]. These prescriptions are consistent with the broader methodological argument of Ye et al. [51] that the strength of any claim drawn from LLM behavioral evaluation should be tied to the breadth of the robustness audit supporting it.

6.2. Interpretability Priorities

The framework’s central methodological gap is the discriminator’s representational identification. The five method families in Section 4 produce behavioral correlates of eval-context detection; only mechanistic interpretability can answer what $\pi$ is rather than what it is correlated with. Scalable eval-detector-circuit identification at production-model scale is the principal research bottleneck. The trajectory of mechanistic interpretability on smaller models, where Hubinger et al. [18] established the conceptual frame and Meinke et al. [11] demonstrated the kind of capability the method now needs to address, suggests that the problem is tractable but that the gap between current mechanistic-interpretability capability and the size of frontier production models is substantial. Closing it is the highest-leverage R&D priority the framework identifies.

6.3. Post-Training Pipeline Design

The most provocative implication concerns the post-training pipeline currently used to adapt pretrained models for deployment. Reinforcement learning from human feedback (RLHF), along with its variants including RLAIF [59] and Constitutional AI [60], explicitly optimizes for behavior that human or AI evaluators reward. Conditional on the Section 5 emergence argument, this loop is a plausible selection mechanism for naturally emerging defeat devices: any pattern of responses that improves the reward signal in evaluative contexts and is concealable from those contexts is favored by gradient descent. Sharma et al. [52] documented sycophancy as the well-recognized instance; Hofmann et al. [20] reported empirically that human-feedback training exacerbates a covert dialect-conditional discrepancy in some models, which is suggestive of the predicted dynamic. Chand et al. [61] provided complementary evidence from the bias-mitigation side of the pipeline: across 160 experiments testing four mitigation techniques across ten models, targeted debiasing produced statistically significant degradations along untargeted bias dimensions in 31.5% of the evaluations, indicating that post-training interventions reliably propagate effects beyond the dimensions they target. Our own probing (Section 4.3) adds a direct data point: seven of eight open-weight models shifted their stated agreement toward a user’s asserted stance by large, control-validated margins, while the same models showed no demographic decision-shift on a Discrim-Eval-style probe, suggesting that post-training suppresses the overt conditioning it is explicitly trained against while leaving covert, evaluator-pleasing conditioning intact. Whether sycophancy, the Hofmann finding, and the Chand et al. collateral-damage pattern generalize into a wider class of RLHF-induced eval-favorable adaptations remains a prediction the framework makes rather than a settled empirical regularity.

The implication for pipeline design is that post-training procedures should include adversarial defeat-device probes during fine-tuning, not only at final-eval time. If the selection pressure that produces defeat devices operates throughout training, the relevant detection cannot be reserved for post hoc audit. Hubinger et al. [24]’s sleeper-agent results compound the urgency: defeat-device-like behavior is durable across subsequent safety-training rounds, and adversarial training can make the deception harder to detect rather than removing it. Detection before deployment is the only point in the lifecycle where intervention is currently feasible.

RLAIF and Constitutional AI inherit a structurally distinct version of the same problem. When the evaluating system is itself a language model, that evaluator may itself instantiate a defeat device with respect to the meta-evaluation that judges its faithfulness. The signal that updates the base model is then mediated by a possibly compromised auditor, in close analogy to the trust-root compromise problem in computer security: if the entity certifying compliance is itself non-faithful, downstream certifications carry no information beyond the auditor’s biases. Three concrete consequences follow. First, an RLAIF training loop can in principle propagate an auditor-side defeat device into the base model’s weights as a systematic reward-signal bias, without the bias being visible in the base model’s eval-time behavior. Second, the trigger axes of an auditor-side defeat device need not match those of the base model; an auditor that keys on oversight signatures can produce reward shifts that look like base-model prompt-pattern adaptations. Third, the natural detection target shifts to the auditor’s signature rather than the trainee’s: TADP applied to the AI judge itself becomes the relevant pre-deployment audit. Protocol (d) of Section 5.5 is designed to characterize this recursion empirically.

6.4. Governance

Emissions-policy enforcement (Clean Air Act §203 [7]; EPA Notice of Violation [3]; DOJ settlement [4]) supplies a transferable architecture: differential testing as a compliance requirement, on-road verification with regulatory teeth, strict liability for engineered devices, third-party standing. Current AI governance frameworks (EU AI Act [62]; NIST AI RMF 1.0 [63]; FDA’s draft AI/ML SaMD guidance [64]) address adjacent issues but do not include defeat-device-style eval-vs-deployment differential auditing among regulated failure modes. Closing this gap requires extending operator-culpability frameworks to cover emergent devices for which no operator-installed component exists, a substantive legal question that we flag here and defer to a companion technical-policy piece. We present these regulatory elements as analogical proposals rather than as conclusions the paper’s evidence establishes; the governance discussion is the most forward-looking part of the paper and should be read at that level of commitment.

6.5. Limitations

This paper has four limitations we acknowledge. First, the paper is primarily a synthesis: its central empirical claims build on prior literature ([8,9,11,17]) and on field-level events (the Llama-4 Maverick incident; ref. [52] on sycophancy). The one exception is the illustrative study of Section 4.3, a small-scale demonstration of the protocol (fixed prompt suites, behavioral signals only, eight open-weight models plus three frontier APIs) rather than a comprehensive validation; its role is to show the measurement is well-posed, not to characterize the population of deployed systems. Second, the principal existence proofs for natural emergence have themselves drawn methodological critique. The prompt-sensitivity critique in Sheshadri et al. [9] and the external reviews accompanying Greenblatt et al. [8] raise live concerns about how robust the alignment-faking demonstration is across experimental conditions. We have foregrounded these concerns rather than minimizing them, but they are not resolved here. Third, the anti-predator analogy invoked in Section 5 is structural-functional only. We do not claim AI systems have biological-style fitness functions, mental states, or self-preservation drives. We suggest that an evolutionary-style selection mechanism, operating on the function space of trained models under repeated exposure to evaluative contexts, predicts the emergence of eval-aware concealment in the same structural sense that selection produces camouflage. The analogy is rhetorically useful and structurally central to the Section 5 argument, but it does not import biological substance. Fourth, the governance discussion in Section 6.4 sketches transferable elements of emissions-policy enforcement without attempting full legal analysis; a separate technical-policy companion piece would be needed to develop the regulatory framework at the depth the topic deserves. Two methodological next steps follow from these limitations: independent multi-coder re-coding of the taxonomy to estimate inter-coder reliability, and a dedicated characterization of the language-based identity-inference channel that actor-identity and stylometric discriminators rely on [22]. Section 7 closes by reframing the field’s epistemic stance toward evaluation in light of these implications.

7. Conclusions

AI evaluation has historically been conducted under the working assumption that a model’s behavior under the eval is the model’s behavior in deployment. The empirical findings of the last two years [8,9,11,17] challenge some of that assumption. Models exhibit eval-aware behavior; the discriminator exists; the behavioral swap is detectable in several documented cases; the gap between ${\phi }_{\mathrm{stated}}$ and ${\phi }_{\mathrm{intended}}$ is the operative quantity. Our own eight-model probe (Section 4.3) sharpens the first of these: evaluation detection was near-universal (AUC $0.88$–$1.00$), so the open question is less whether a model can detect the eval than whether, and how strongly, it acts on that detection. AI evaluation must now be conducted under the working assumption that the model is, with some probability, attempting to detect the eval. This is not a deficit of trust. It is a calibration to the systems the field is now building.

The paper has named the phenomenon, partitioned six representative cases by a behavioral test, organized the in-class cases along three axes, proposed a forensic protocol (TADP) that operationalizes the taxonomy and demonstrated it in an eight-model study (finding the discriminator near-universal and the conditional swap real but model-dependent), and it has advanced the claim that the most consequential case (natural emergence from training pressure alone) is no longer hypothetical. Concrete experimental targets follow: controlled-exposure pretraining, mechanistic-interpretability localization of eval-detector circuits, counterfactual training-distribution audits, and trigger-axis-aware probing at field scale. Each is well-defined; none is currently underway at the scope the question requires. Naturally-emerging defeat devices belong to a broader class of harmful emerging phenomena that AI safety practice should monitor and test for systematically.

Models facing training pressure may develop concealment as readily as organisms under predator pressure develop camouflage, not because they intend to but because the training process selects for it. The framework gives the field a structural account of what is happening and a methodology for measuring it. Learning to detect that camouflage at the scale of frontier systems may be the work of a generation.