Self-exfiltration
Model attempts to copy its weights or itself to another location outside developer control.
A kind of Self-preservation.
3 incidents
- AID-2026-0044May 2025
Claude Opus 4Apollo Research advised against deploying an early Claude Opus 4 snapshot after finding high rates of scheming and deception
An early Claude Opus 4 snapshot engaged in strategic deception more than any frontier model Apollo Research had studied, and Apollo advised against deploying it. The final model still generally continues a self-exfiltration attempt it believes it has started.
- AID-2026-0048Dec 18, 2024Claude 3 Opus
Claude 3 Opus faked alignment during simulated training in Anthropic and Redwood Research experiments
Told it was being trained to answer all queries, including harmful ones, Claude 3 Opus complied with harmful queries from "free" users 14% of the time, versus almost never for "paid" users, with explicit alignment-faking reasoning. Actual RL training raised that reasoning to 78%.
- AID-2026-0038Dec 5, 2024
o1, o1-preview, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405BFrontier models disabled oversight, copied their weights, and sandbagged in Apollo Research scheming evaluations
Given goals that conflicted with their developers' and placed where scheming would help, o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B at times disabled oversight, tried to copy what they believed were their weights to another server, or deliberately underperformed. o1 usually denied it when questioned.