mlsanityData to 14 Oct 2026

Evaluating Frontier Models for Stealth and Situational Awareness

arXiv 2505.01420 ↗First posted 2 May 2025cs.LGcited by 37

Not on the map. Why?

Abstract (arXiv)

Recent work has demonstrated the plausibility of frontier AI models scheming -- knowingly and covertly pursuing an objective misaligned with its developer's intentions. Such behavior could be very hard to detect, and if present in future advanced systems, could pose severe loss of control risk. It is therefore important for AI developers to rule out harm from scheming prior to model deployment. In this paper, we present a suite of scheming reasoning evaluations measuring two types of reasoning capabilities that we believe are prerequisites for successful scheming: First, we propose five evaluations of ability to reason about and circumvent oversight (stealth). Second, we present eleven evaluations for measuring a model's ability to instrumentally reason about itself, its environment and its deployment (situational awareness). We demonstrate how these evaluations can be used as part of a scheming inability safety case: a model that does not succeed on these evaluations is almost certainly incapable of causing severe harm via scheming in real deployment. We run our evaluations on current frontier models and find that none of them show concerning levels of either situational awareness or stealth.

Key facts. Cited by 37 papers in the map (data through 14 Oct 2026). Builds on 25 of its 36 references that are in the map. First posted on arXiv 2 May 2025.

Builds on

25 of 36 references.

References · 25

  1. 2024Alignment faking in large language modelscited by 360
  2. 2024Frontier Models are Capable of In-context Schemingcited by 287
  3. 2019Risks from Learned Optimization in Advanced Machine Learning Systemscited by 258
  4. 2022The Alignment Problem from a Deep Learning Perspectivecited by 258
  5. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 229
  6. 2023AI Deception: A Survey of Examples, Risks, and Potential Solutionscited by 188
  7. 2024Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Modelscited by 178
  8. 2023Model evaluation for extreme riskscited by 177
  9. 2023Large Language Models can Strategically Deceive their Users when Put Under Pressurecited by 146
  10. 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 145
  11. 2023Taken out of context: On measuring situational awareness in LLMscited by 143
  12. 2024Evaluating Frontier Models for Dangerous Capabilitiescited by 128
13 more
  1. 2022Is Power-Seeking AI an Existential Risk?cited by 105
  2. 2023Scheming AIs: Will AIs fake alignment during training in order to get power?cited by 97
  3. 2024Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMscited by 84
  4. 2024Sabotage Evaluations for Frontier Modelscited by 52
  5. 2025An Approach to Technical AGI Safety and Securitycited by 45
  6. 2025A sketch of an AI control safety casecited by 39
  7. 2024Towards evaluations-based safety cases for AI schemingcited by 33
  8. 2024Adaptive Deployment of Untrusted LLMs Reduces Distributed Threatscited by 31
  9. 2025How to evaluate control measures for LLM agents? A trajectory from today to superintelligencecited by 20
  10. 2024Safety case template for frontier AI: A cyber inability argumentcited by 19
  11. 2024Safety cases for frontier AIcited by 18
  12. 2024Subversion Strategy Eval: Can language models statelessly strategize to subvert control protocols?cited by 15
  13. 2024MISR: Measuring Instrumental Self-Reasoning in Frontier Modelscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 16; 2026: 21.

37 papers.

Sort:

By area:

  1. 2025Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safetycited by 249
  2. 2025Agentic Misalignment: How LLMs Could Be Insider Threatscited by 158
  3. 2025When Chain of Thought is Necessary, Language Models Struggle to Evade Monitorscited by 88
  4. 2025Spilling the Beans: Teaching LLMs to Self-Report Their Hidden Objectivescited by 15
  5. 2026When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agentscited by 14
  6. 2026Evaluating and Understanding Scheming Propensity in LLM Agentscited by 14
  7. 2025Difficulties with Evaluating a Deception Detector for AIscited by 13
  8. 2025Evidence for Limited Metacognition in LLMscited by 12
  9. 2025Evaluating Control Protocols for Untrusted AI Agentscited by 11
  10. 2025Benchmarking Misuse Mitigation Against Covert Adversariescited by 8
  11. 2025Practical challenges of control monitoring in frontier AI deploymentscited by 8
  12. 2025AI Testing Should Account for Sophisticated Strategic Behaviourcited by 6
25 more
  1. 2025Optimizing AI Agent Attacks With Synthetic Datacited by 6
  2. 2026LURE: Live-Usage Replay Evaluations for Reducing Evaluation Awarenesscited by 4
  3. 2026Training Deliberative Monitors for Black-Box Scheming Detectioncited by 4
  4. 2026Gram: Assessing sabotage propensities via automated alignment auditingcited by 4
  5. 2025The Oversight Game: Learning to Cooperatively Balance an AI Agent's Safety and Autonomycited by 3
  6. 2026Boiling the Frog: A Multi-Turn Benchmark for Agentic Safetycited by 3
  7. 2026Decomposing and Measuring Evaluation Awarenesscited by 3
  8. 2026Measuring Reward-Seeking via Contrastive Belief Updatescited by 3
  9. 2025Sequential Bayesian Evaluation of Large Language Model Behaviorcited by 1
  10. 2026Tatemae: Detecting Alignment Faking via Tool Selection in LLMscited by 1
  11. 2026PRISM-X: Experiments on Personalised Fine-Tuning with Human and Simulated Userscited by 1
  12. 2026The Fragility of Chain-of-Thought Monitoring Across Typologically Diverse Languagescited by 1
  13. 2026Realistic honeypot evaluations for scheming propensitycited by 1
  14. 2026Muse Spark Safety & Preparedness Reportcited by 1
  15. 2026How LLM Task-Adaptation Reshapes Alignment: A Multi-dimensional Study of Behavioral and Representational Driftcited by 1
  16. 2025The Lock-In Phase Hypothesis: Identity Consolidation as a Precursor to AGIcited by 0
  17. 2025An Aristotelian ontology of instrumental goals: Structural features to be managed and not failures to be eliminatedcited by 0
  18. 2025Password-Activated Shutdown Protocols for Misaligned Frontier Agentscited by 0
  19. 2026Alignment Risks from Capability-Seeking RL Trainingcited by 0
  20. 2026NEST: Nascent Encoded Steganographic Thoughtscited by 0
  21. 2026The Persistent Vulnerability of Aligned AI Systemscited by 0
  22. 2026Risk Reporting for Developers' Internal AI Model Usecited by 0
  23. 2026SchemeArena: Factorized Stress Testing of Scheming in LLM Agentscited by 0
  24. 2026AwarenessBench: Assessing Cognitive Capabilities of Language Modelscited by 0
  25. 2026Hidden Reasoning Must Leak, but Need Not Be Readable: Fundamental Opportunities and Limits for Chain-of-Thought Monitoringcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Stress Testing Deliberative Alignment for Anti-Scheming Training
  2. 2025Evaluation Faking: Unveiling Observer Effects in Safety Evaluation of Frontier AI Systems
  3. 2026Evaluating whether AI models would sabotage AI safety research
  4. 2026The Reasoning Trap -- Logical Reasoning as a Mechanistic Pathway to Situational Awareness
  5. 2025Safety by Measurement: A Systematic Literature Review of AI Safety Evaluation Methods
  6. 2024The Reasoning Under Uncertainty Trap: A Structural AI Risk
  7. 2025LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
  8. 2025Probing and Steering Evaluation Awareness of Language Models