The DOI matches its DataCite record; 2 of the 2 references it cites were found in a registry or an index.
Evaluating Frontier Models for Stealth and Situational Awareness
Open accessAbstract
Recent work has demonstrated the plausibility of frontier AI models scheming -- knowingly and covertly pursuing an objective misaligned with its developer's intentions. Such behavior could be very hard to detect, and if present in future advanced systems, could pose severe loss of control risk. It is therefore important for AI developers to rule out harm from scheming prior to model deployment. In this paper, we present a suite of scheming reasoning evaluations measuring two types of reasoning capabilities that we believe are prerequisites for successful scheming: First, we propose five evaluations of ability to reason about and circumvent oversight (stealth). Second, we present eleven evaluations for measuring a model's ability to instrumentally reason about itself, its environment and its deployment (situational awareness). We demonstrate how these evaluations can be used as part of a scheming inability safety case: a model that does not succeed on these evaluations is almost certainly incapable of causing severe harm via scheming in real deployment. We run our evaluations on current frontier models and find that none of them show concerning levels of either situational awareness or stealth.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A common concern with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.
“A common concern (Needham et al., 2025; Phuong et al., 2025) with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.”
From Agentic Misalignment: How LLMs Could Be Insider Threats (2025) · cites this paper as Phuong et al., 2025
Citations
Cites
The publisher hasn’t deposited this paper’s reference list.
Cited by
Sorted by citations
Agentic Misalignment: How LLMs Could Be Insider Threats
Lynch, A., Wright, B., Larson, C., Ritchie, S. J., Mindermann, S., Hubinger, E., Perez, E., & Troy, K. (2025) · arXiv · doi:10.48550/arxiv.2510.05179 · Cited by 10
“A common concern (Needham et al., 2025; Phuong et al., 2025) with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.”
Evaluating Control Protocols for Untrusted AI Agents
Kutasov, J., Loughridge, C., Sun, Y., Sleight, H., Shlegeris, B., Tracy, T., & Benton, J. (2025) · arXiv · doi:10.48550/arxiv.2511.02997
“…al. 2025), BashBench (Bhatt et al. 2025), or ControlArena (Matthews et al. 2025), or which measure skills which closely correlated with successful attacks, such as scheming (Meinke et al. 2025; Schoen et al. 2025; Mallen et al. 2025), sabotage (Benton et al. 2024), or stealth (Phuong et al. 2025).”
Murrone, A., Vita, V. D., Mondillo, G., Mori, L. D., & Cartei, G. (2026) · doi:10.67362/112358/8844073
Metadata
- Authors
- Phuong, M., Zimmermann, R. S., Wang, Z., Lindner, D., Krakovna, V., Cogan, S., Dafoe, A., Ho, L., & Shah, R.
- Affiliations
- Google DeepMind (United Kingdom) (GB)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2025
- Volume
- 2
- Issue
- 1
- Pages
- 544-556
- ISSN
- 3144-0525 (ISSN-L)
- arXiv
- 2505.01420
- OpenAlex
- W4415244808
- Cited by
- 1
- References
- 0
- Citations by year
- 2026: 1
- FWCI
- 9.42
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Proceedings of IASEAI Conference (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Ethics and Social Impacts of AI
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Keywords
- misalignment, stealth, situational awareness, AI safety evaluation, human oversight of AI, large language models, safety case
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
