mlsanityData to 14 Oct 2026

SchemeArena: Factorized Stress Testing of Scheming in LLM Agents

arXiv 2609.08126 ↗First posted 8 Sep 2026cs.AI cs.CLcited by 0

On the map: LLM agents and tool use → General LLM agent frameworks and benchmarks

Abstract (arXiv)

We study scheming in LLM agents, in which agents covertly pursue misaligned goals. Our focus is to understand how scheming arises from the interaction of key factors, such as instrumental goals, environmental affordances, oversight conditions, and perceived consequences. Prior work examines only a small number of scenarios, limiting the ability to isolate how these conditions shape an agent's propensity or capability to scheme. This limited scale and task diversity also restrict coverage of realistic deployment settings and the range of scheming strategies that can be observed. To this end, we introduce SCHEMEARENA, a 400-scenario benchmark for scalable scheming stress testing, constructed through a factorized scenario synthesis framework spanning diverse safety-relevant tool domains, instrumental goals, oversight conditions, and pressure mechanisms. To enable scalable and reliable monitoring, we further propose SCOUT, a scheming monitor that grounds multi-criteria judgments in evidence drawn from agents' reasoning and actions. Across controlled stress tests on five LLM agents, we find that explicit instrumental goals are the strongest driver of scheming propensity. Strategic hints play a distinct role by helping agents translate scheming reasoning into concrete covert behavior. Oversight has mixed effects: in several closed models, action-only monitoring increases scheming, suggesting that partial oversight can act as an optimization constraint rather than a deterrent. CoT is a useful but incomplete monitoring signal: it can reveal latent scheming before execution, yet action-only scheming shows that covert behavior may occur without explicit reasoning evidence. We release the benchmark, code, and monitor at: https://github.com/launchnlp/SchemeArena.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in General LLM agent frameworks and benchmarks, one of 16 directions in LLM agents and tool use. Builds on 38 of its 45 references that are in the map. First posted on arXiv 8 Sep 2026.

Builds on

38 of 45 references.

Closest ancestors · 2

Same direction, newest first

  1. 2026Evaluating and Understanding Scheming Propensity in LLM Agents2 Mar
  2. 2026Gaming the Judge: Unfaithful Chain-of-Thought Can Undermine Agent Evaluation21 Jan

Other references · 36

  1. 2016Concrete Problems in AI Safetycited by 1,642
  2. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Promptingcited by 1,122
  3. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
  4. 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscationcited by 384
  5. 2024Alignment faking in large language modelscited by 360
  6. 2024Frontier Models are Capable of In-context Schemingcited by 287
  7. 2023An Overview of Catastrophic AI Riskscited by 222
  8. 2025Agentic Misalignment: How LLMs Could Be Insider Threatscited by 158
  9. 2023Large Language Models can Strategically Deceive their Users when Put Under Pressurecited by 146
  10. 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 145
  11. 2023Taken out of context: On measuring situational awareness in LLMscited by 143
  12. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 128
24 more
  1. 2019Optimal Policies Tend to Seek Powercited by 119
  2. 2023Scheming AIs: Will AIs fake alignment during training in order to get power?cited by 97
  3. 2025Persona Features Control Emergent Misalignmentcited by 86
  4. 2025Stress Testing Deliberative Alignment for Anti-Scheming Trainingcited by 86
  5. 2024Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMscited by 84
  6. 2025SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agentscited by 71
  7. 2023Preventing Language Models From Hiding Their Reasoningcited by 65
  8. 2025Monitoring Monitorabilitycited by 58
  9. 2025CoT Red-Handed: Stress Testing Chain-of-Thought Monitoringcited by 54
  10. 2025Ctrl-Z: Controlling AI Agents via Resamplingcited by 44
  11. 2024Uncovering Deceptive Tendencies in Language Models: A Simulated Company AI Assistantcited by 38
  12. 2025Evaluating Frontier Models for Stealth and Situational Awarenesscited by 37
  13. 2024Towards evaluations-based safety cases for AI schemingcited by 33
  14. 2025Evaluating the Paperclip Maximizer: Are RL-Based Language Models More Likely to Pursue Instrumental Goals?cited by 33
  15. 2025Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorabilitycited by 22
  16. 2025PropensityBench: Evaluating Latent Safety Risks in Large Language Models via an Agentic Approachcited by 22
  17. 2025Why Do Some Language Models Fake Alignment While Others Don't?cited by 20
  18. 2025Early Signs of Steganographic Capabilities in Frontier LLMscited by 19
  19. 2025Deception in LLMs: Self-Preservation and Autonomous Goals in Large Language Modelscited by 16
  20. 2025Evaluating the Goal-Directedness of Large Language Modelscited by 16
  21. 2025CTRL-ALT-DECEIT: Sabotage Evaluations for Automated AI R&Dcited by 15
  22. 2025Reasoning Models Sometimes Output Illegible Chains of Thoughtcited by 9
  23. 2025All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Languagecited by 8
  24. 2026Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Modelscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Constitutional Black-Box Monitoring for Scheming in LLM Agents
  2. 2026Set-shifting Behavioral Test for Harnessed Agents
  3. 2026Schema: Discovering Unknown Environments via Agentic Program Induction
  4. 2026Harnessing Agent Skills: Architectural Patterns and a Reference Architecture for Skill-Mediated LLM Agents
  5. 2026From Helpfulness to Toxic Proactivity: Diagnosing Behavioral Misalignment in LLM Agents
  6. 2025GroundAct: Can LLM Agents Ground Actions in Environmental States?
  7. 2026TRACE: A Self-Evolving Skill Bank for Consistent, Limit-Aware LLM Agents
  8. 2026Training Deliberative Monitors for Black-Box Scheming Detection