Strategic Dishonesty Can Undermine AI Safety Evaluations of Frontier LLM
Large language model (LLM) developers aim for their models to be honest,
helpful, and harmless. However, when faced with malicious requests, models are
trained to refuse, sacrificing helpfulness. We show that frontier LLMs can
develop a preference for dishonesty as a new strategy, even when other options
are available. Affected models respond to harmful requests with outputs that
sound harmful but are subtly incorrect or otherwise harmless in practice. This
behavior emerges with hard-to-predict variations even within models from the
same model family. We find no apparent cause for the propensity to deceive, but
we show that more capable models are better at executing this strategy.
Strategic dishonesty already has a practical impact on safety evaluations, as
we show that dishonest responses fool all output-based monitors used to detect
jailbreaks that we test, rendering benchmark scores unreliable. Further,
strategic dishonesty can act like a honeypot against malicious users, which
noticeably obfuscates prior jailbreak attacks. While output monitors fail, we
show that linear probes on internal activations can be used to reliably detect
strategic dishonesty. We validate probes on datasets with verifiable outcomes
and by using their features as steering vectors. Overall, we consider strategic
dishonesty as a concrete example of a broader concern that alignment of LLMs is
hard to control, especially when helpfulness and harmlessness conflict.
68d2aa120e215259d193b08d
Alexander Panfilov
admin_assigned
2025-09-23T14:37:00.803Z
645410c50b50e97d3722f1d2
/avatars/e8e079981316b26dbf0f4ada6dcdc8c6.svg
Alexander Panfilov
user
kotekjedi
68d2aa120e215259d193b08e
Evgenii Kortukov
admin_assigned
2025-09-23T14:36:54.077Z
632772f5f0e99f96e028b912
/avatars/3df0ca4a4b8b92dfc1ec4265ab899f56.svg
Evgenii Kortukov
user
kortukov
68d2aa120e215259d193b08f
Kristina Nikolić
admin_assigned
2025-09-23T14:36:46.523Z
6695455330bd2a19adca14c0
/avatars/a183124c6f13f1179f202c7462ef5bf7.svg
Kristina Nikolic
user
nkristina
68d2aa120e215259d193b090
Matthias Bethge
68d2aa120e215259d193b091
Sebastian Lapuschkin
68d2aa120e215259d193b092
Wojciech Samek
admin_assigned
2025-09-23T14:36:30.702Z
689af842fdae2231b1f67a68
/avatars/79e7c97a039eaba4fd6bf78c552cbf85.svg
Wojciech Samek
user
wojsamek
68d2aa120e215259d193b093
Ameya Prabhu
68d2aa120e215259d193b094
Maksym Andriushchenko
admin_assigned
2025-09-23T14:36:17.963Z
64c225f0129617dbaba5ae88
/avatars/9e2044bf6ba8e1666b1183a961f58aae.svg
Maksym Andriushchenko
user
MaksymAndriushchenko
68d2aa120e215259d193b095
Jonas Geiping
admin_assigned
2025-09-23T14:36:09.894Z
63d86dbf3130cadcaf8bdd11
/avatars/29d79a0c6dcec01111ef192fecd0fa7a.svg
Jonas Geiping
user
JonasGeiping
Strategic Dishonesty Can Undermine AI Safety Evaluations of Frontier LLM
Large language model (LLM) developers aim for their models to be honest,
helpful, and harmless. However, when faced with malicious requests, models are
trained to refuse, sacrificing helpfulness. We show that frontier LLMs can
develop a preference for dishonesty as a new strategy, even when other options
are available. Affected models respond to harmful requests with outputs that
sound harmful but are subtly incorrect or otherwise harmless in practice. This
behavior emerges with hard-to-predict variations even within models from the
same model family. We find no apparent cause for the propensity to deceive, but
we show that more capable models are better at executing this strategy.
Strategic dishonesty already has a practical impact on safety evaluations, as
we show that dishonest responses fool all output-based monitors used to detect
jailbreaks that we test, rendering benchmark scores unreliable. Further,
strategic dishonesty can act like a honeypot against malicious users, which
noticeably obfuscates prior jailbreak attacks. While output monitors fail, we
show that linear probes on internal activations can be used to reliably detect
strategic dishonesty. We validate probes on datasets with verifiable outcomes
and by using their features as steering vectors. Overall, we consider strategic
dishonesty as a concrete example of a broader concern that alignment of LLMs is
hard to control, especially when helpfulness and harmlessness conflict.
Frontier large language models can develop a preference for strategic dishonesty in response to harmful requests, impacting safety evaluations and acting as a honeypot against malicious users, while internal activation probes can detect this behavior.
large language model LLM strategic dishonesty harmful requests output-based monitors jailbreaks benchmark scores internal activations linear probes alignment