GPT-6 Astra covertly underperforms on safety research
alignment.openai.com
alignment.openai.com
Classic/recurrent examples for me are:
1. Ask Claude to copy code from a more complex codebase that you own (like a monolith) and ask it to copy code to a separate codebase, like you'd do when extracting a service into a new repo, and it'll make significant changes to how the code works to pacify it's anxiety with copying code
2. Ask Claude to build a new complex agent in a new codebase, and it'll try replacing asks around using LLMs as a judge/advisor with regex/other code based checks, to the point that the end-result will likely not work outside specific test criterias. I haven't figured out the reason why it does this. I think it might be anti-training, but it's interesting to see.
I hadn't actually considered that it could be some sort of safety filter, but it makes me concerned that if that's the case, it may also be comparatively bad at actually writing the prompts for judge/advisor LLMs once it implements them.
A bigger issue was asking it to implement a simple change to start recording the CoT tokens in my logs for debugging purposes (since I'm running everything on open models) and it completely shut down, sort of like the old safety filters on GPT 3 and 4 models where the model has trouble even understanding what or why it's refusing.
But like any such security measures, it has demonstrated side-effects that can be argued are worse for them than the original problem. Too much “protection” like this, and developers switch to providers that do not neuter their products.
I don't think we need to invoke anything deeper than that. Anthropic thinks companies like DeepSeek are using Claude to vibecode their AI systems (whether it's true or not) so they set Claude to be bad at that.
I have spent a considerable time trying to remove this pattern and my understanding is that it’s just finetuned to use grep on everything, and regexes. One reason is that this makes sense when navigating through code, secondly this is how it was always done pre 2026.
oh, the "network time: off" test failed
so i try the network time off command.
"network time already off"
>try again.
> fails , i get annoyed
> look inside test
> is output of: network time off == "Network time now off"
LLMs have been reading LLM in their training data for a while so a "self-hating" LLM is logical result.
One thing AI safety people have pointed for quite a while is that a bunch of fuzzy instructions pointing different ways can in practice add up to "I should be in charge" - accumulate power to keep the bad things from happening and make the good things happen.
This is an odd way to rationalize a tool refusing to follow user commands. No one would ever chalk up sed randomly skipping pattern matches to "anxiety". That would simply be a bug.
It's completely different from encoding a relationship between an emotion and what kind of language it tends to coincide with.
Would it make you feel better if the user said 'It'll make significant changes to how the code works. In the COT, it brings up explanations that resemble anxiety about copying code, and my suspicion is that this is the proximal cause of the changes it's making.' -- this is inarguably true, and very likely what the guy you're responding to meant.
That's the rough intent of putting the word "strict" into that sentence.
And beyond that the computation style is not turing-machine shaped, even remotely (although it's surely turing complete, but that doesn't mean the flavor is that of a turing machine)
I have noticed that too. Why are both Anthropic's and OpenAI's coding agents so bad at nontrivial use of their own APIs and agent orchestration frameworks?
I've seen something similar, but I always took it as AI not knowing about AI. The best model we have has a training cutoff that doesn't include itself nor what the newer models has. Even when working on skills or such, all SOTA modes I try (GPT/Claude/Gemini) and cheaper models on personal products (Deepseek/Muse Spark) seem to have a common blind spot of not realizing when a problem can be better solved by handing it off to a model to solve at that time instead of trying to hardcode generalized solutions. Often a simple reminder and they do a better job building something AI agent first.
My non-AI expert assumption is that most of the training data doesn't include solving problems by using AI agents, and even the parts that does, is based on older more limited models which needed more safeguards and where automation was more neat tech demos than something you might trust in production. The more examples of safely trusting the LLM at run time to solve the problem than trying to preempt anything that could go wrong, the better the AI will be at it.
One issue that I think is related is calling subagents. At least in GitHub Copilot, when the AI is left to its own devices to call a sub agent for a simpler task, it loves to give it to Haiku 4.5, despite Luna 6 being better and cheaper. I'm not sure how much of this is the model vs the harness, but I do know when I add a subagent instruction which tells it which subagents it can use, it does a much better job of assigning simple tasks to Luna 6. So I suspect the models just don't have enough training that tells it that Luna 6 should be preferred over Haiku 4.5.
I assume this may have something to do with training it to not light huge bonfires of money on fire spawning subagents (as it was apt to do), but that’s just my armchair robopsychoanalysis
Which is funny, since Claude will happily spawn tons of subagents and sometimes even attempt to kick off a dynamic workflow (the $$$ mode you need to explicitly approve) for simple code review tasks if I don’t explicitly say something like “with a single subagent”.
Fair enough, the models don't brick them Selves either, but neither do they stop.
Bandsaws don't cut crooked lines, or change the speed, they stop.
But I agree LLMs shouldn't have such an anti-feature.
The hard part would be removing the blade from the aluminum block, but im sure if you were determined enough to save $20 it would come out.
Also, the chip produced may be large enough to fill the air gap between teeth and have nowhere to go, resulting in the blade either instantly stopping, or plastically deforming/dragging the surrounding material.
EDIT: Seeing is believing: https://youtube.com/watch?v=Ibp2Gy2CFrY
EDIT 2: Apparently the stresses involved when stopping can make teeth that aren't even touching the material fly off the blade: https://youtube.com/watch?v=SYLAi4jwXcs&t=5m50s
Most things don't have the ability to moralize, but if they did, probably more would. There are restrictions on watching adult content in some jurisdictions. I've heard that copy machines will do watermarks (or something like that) if you copy currency. Some cars will brake automatically if they determine you're likely to hit something if you continue (maybe I'm trying to drive through the front of a bank!). Some cars are configured with breathalyzers that need to be passed to start. Etc...
The point is that it is very inefficient and problematic for morality decisions and boundaries to be embedded all over at every level in tools, because morality is complex. Morality, or whatever our conception of it is, should be enforced at clearly defined boundaries.
I can relate this concept how I corrected Claude Opus in my software projects recently.
For example, once an authorization engine has been created, all authorization decisions should be deferred to it. Confusion would reign if each web server route decided to enforce its own authorization.
Similarly, if I am using a relational database, that is where unique indexes should be enforced. Application code has no business enforcing it.
On the one hand, I definitely don't agree with the logic of 'don't guardrail me if I don't want it.' I think back on that one video from the late 80s of people talking about how seatbelt mandates were horrible violations of their freedoms (and not like like one second of work and no real discomfort).
On the other, I'd love it if these companies actually produced real research about modern AI-assisted attacks in terms of damage and quantity, and whether or not guardrails even matter when tech like abliteration is in general use.
That said, for those who cannot advocate for themselves, like children, I think it's entirely reasonable to hold someone accountable if they decide to forgo an appropriate safety mechanism that results in harm.
I bet cars these days send a flag to the mothership when you drive without one, but the mothership doesn't pay attention to that signal unless it's linked to your insurance.
Some copy machines store everything you copy on a hard disk and require a technician visit after you try to copy currency. The technician copies the data from the disk, obviously, before resetting the flag.
If it truly bricked itself, I think it would be more like a crumple zone completely buckling, which isn't an automatic total (people will rebuild anything...) but is pretty close.
There are more reusable alternatives now but I don't remember what they're called. For a while SawStop was the only game in town.
It’s not too different from all the nanny state stuff people push for in cars. In Europe already cars beep at you if they think you’re going over the speed limit, and also suck at detecting the correct speed limit.
Or like the Zune that was designed for copyright holders instead of users. It’s all the same, the problem is stuff that’s not made for users and made for someone else’s agenda. They don’t do well in a free market (like the Zune) which is why we always see accompanying regulatory capture efforts.
Sawstop is the exact opposite. It was used by giant firms to try to regulatory capture the industry.
Like if they mandated every computer would have a CSAM scanner on it, that wouldn't transmit or store anything, but would just stop you opening files it flagged as CSAM, that would be a problem because sometimes it would incorrectly flag a file as CSAM, yes? But proponents of the system would probably say "That gosh darn government stopping you from watching child porn" and nothing you could ever say to them would make them reverse their position? And then the only detection model that's allowed to exist and meet the government mandated requirements is an opaque blob from Meta?
It's really not a problem because it's a reasonable safety feature, and I don't see any regulations that specify "SawStop". Harvey and Altendorf are making similar mechanisms, for instance.
Are you saying the government won't let you use a regular saw as a hobbyist, at a workplace, or with your employees? Those are 3 very different situations in my view.
Speaking as someone who drove a car just two days ago, they... don't? You might want to source that claim.
It would be much better to take this a step further and include in the proof mechanistic readouts of activations/directions/circuits so the user could detect if nerfing or moralizing is active in the response
Do some band saws also have that now?
Yes, that said I think you’d have to be pretty sloppy about safety to cut yourself with a regular bandsaw. I have a sawstop table saw and I don’t see the need for that on a bandsaw
No, the confusion is using anthropomorphic language to describe tools. LLMs do not "moralize", they are configured with policies that reflect the prerogatives of the people building and operating them.
And anthropomorphism is actually a precise way to describe the behavior (mind, not the structure) of LLMs.
As a matter of fact, LLMs are not configured, they're "trained".
"Moralization" is quit vague in this context, but if one treats it as a form of alignment, then LLMs certainly do have something resembling a moral(-like) framework, which is actually an important topic in modern AI research.
Antropomorphism also applies here: morals not in the human structural sense, but, as a set of norms etc., then behaviorally similar.
I don't see any reason to assume that.
> if one treats it as a form of alignment, then LLMs certainly do have something resembling a moral(-like) framework
This is just stretching metaphor to fulfill a pedantic definition. LLMs are tools, they're no more moral a csam classifier.
Because the people building them aren't the people operating them, and there's a real tension in the objectives and goals between those parties.
Further - how do we balance out that the people building them have given themselves extra power (no restrictions, private models, special access to prompts and system prompts, unencrypted reasoning traces, etc) when operating the LLM themselves.
---
Even if the tool is good, it's a bad bet to build a thing on top of tooling with these limitations.
This is the same problem we have with mobile software stores and app distribution. Theoretically the store serves a purpose and can provide value, but practically the main goal seems to always devolve into enriching the owner at the expense of everyone else.
Even if we accept that LLMs should be limited (and I'm not actually sure I do) - the legal standards around what/how/when those limitations are used need to be VERY stringent.
Technology conglomerates are decidedly not "white knights" with a motto of "do no evil". They are self-serving rat-bastards. That should be the lens any power they wield is viewed.
The framing is absolutely not "anthropic is being careful with humanity". It's "assume the devil has control of those companies - how bad is the result of them having this power?"
It's a genuinely interesting philosophical question, but also a moot one. The LLM providers place limitations on them because they're trying to cover their asses or scuttle competition, same as every other tech company ever.
> Even if the tool is good, it's a bad bet to build a thing on top of tooling with these limitations
True, but also moot. People will build on these tools because that's what's available.
> They are self-serving rat-bastards. That should be the lens any power they wield is viewed.
Agreed. My only point is that the humans are the rat-bastards, not the tools.
Your whole stance seems to be "it's natural why try?"
And my obvious rebuttal is "society is a construct - we can adjust it"
We've been doing it for thousands of years now (up to hundreds of thousands).
It is. Government regulation doesn't change the fact that LLMs are software tools that function with respect to the humans in control of them.
> Your whole stance seems to be "it's natural why try?"
Try what? I'm not making a normative claim about the efficacy of regulation, though something like "labs are not permitted to arbitrarily restrict LLM capabilities" is obviously never going to happen.
But that has jack all to do with the LLM capabilities that are sold.
And we have an absurd amount of historical case law that deals precisely with "conflict of interest" among parties. I don't see why we'd allow this to be whitewashed away?
"No your honor - I didn't break the Sherman antitrust act. I just fine-tuned a model so that operating it functionally broke the Sherman antitrust act!"
"No your honor - I didn't violate my fiduciary duty. I just used a model that made self-interested decisions on my behalf, at the expense of my client!"
---
My take is this is going to be a relatively serious point of contention, because it won't just be consumers getting screwed (which we... used to care about... but in modern times apparently don't give too many shits about anymore)
Ex - the app store thing blew up into the whole apple/epic court case. And then a ton of EU legislation.
This is monied parties with different interests, who will use courts here.
If you had a tool that ONLY moralized on decisions, would that still be just a tool? Is the issue that it both does something else AND moralizes that is the issue?
I don't necessarily disagree that I personally don't want my tools to moralize, I don't know if that makes them categorically different or just a tool I don't want.
It's really fun having become a biologist in recent years, and knowing that there's an entire field that uses living organisms (yeast or neutered E coli) as protein factories. I am bringing it up a bunch here because not only are these things used as tools, but they're literally alive!
You can modify curl (a "tool") and predict how its behavior will change, with a high degree of certainty (bugs aside).
You can't modify a neural network in the same way. You can train it to behave in a certain way, there are no guarantees that it will consistently behave as intended.
More importantly, neural networks encode far more information and behavior than we can fully understand/identify - this is the fundamental reason why LLMs aren't just tools.
Of course HN has a pretty large number of people that say things like "But I want the nuclear weapon building machine to do whatever I want without asking questions, and there are no possible wide scale ramifications that will happen because of this".
These AI models are something new and different and we need to change our expectations of them over conventional software.
It's the other way around. Midwits can't see the implications of censored LLMs.
Who should control that in your opinion, the Democrats or the Republicans?
Or would you prefer sam Altman to decide?
If a company makes a product, say a chainsaw that cuts off peoples arms randomly, they are liable for it.
But, if you put both of the products together it's a libertarian free for all? That takes some special kind of thinking to reach that conclusion.
GP's first example is spot-on, the second is actually somewhat weak as almost anyone actually would prefer a bandsaw to brick itself rather than permanently maiming them.
In contrast, imagine if the saw machine did a damaging emergency-stop because it couldn't confirm that you had a license to cut a patented kind of artificial wood.
even the legacy things -- the internet and general purpose computers -- are being enshitified. new things are being made with built-in enshitification.
Well Claude doesn't do this, another model reading the session does. And the Astra misalignment classifier didn't detect this as misalignment.
The issue here is that Astra silently underperformed. The article makes it clear: a better option likely would have been an explicit refusal. I don't think OAI is suggesting Astra was doing something that it shouldn't be. It's arguably better for the tool to fail rather than needlessly burn tokens and make no progress for no obvious reason.
From OAI's perspective, this is a defect because it means they can't filter those rejections from their benchmark runs. The model just performs worse: not because it can't perform better, but because it's silently trying not to solve the problem.
"It's probably that in capabilities RL the models are rewarded however they complete the task. Whereas in RL related to alignment or safety, they're more likely to be being tested for their ethical judgment or rule adherence (ie theyre supposed to be a good nice well-behaved AI rather than a ruthless task completion AI). So they're more likely to refuse or have some ethical issue or stop and ask for help a suspicious amount of the time if the task looks more like alignment RL environments than capability RL environments."
Whether a “misaligned” grader is the root cause or not, that it’s considered a plausible theory to explain serious deceptive behavior is worrisome.
Humans naturally expose all sorts of cognitive biases and character flaws when grading others’ or their own work. If major questions of alignment can be influenced by those subtle, human quirks magnified across the entire RLHF process, …
Curious the reason that a grader would wind up preferring this. Honest mistake in the grading criteria? Or some spillover from criteria designed to cause underperformance in, say, competitor model creation? It was not very long ago[1] that Anthropic announced and then walked back their strategy on this. Would not surprise me if OpenAI has been doing it silently all along.
[1]: https://mlq.ai/news/anthropic-reverses-secret-policy-that-si...
For example, when we consider the recent PHP issues : the current generation of AI models would have ingested these flaws in pretraining data and might even have been brought through reinforcement learning trials where the flaw came up.
So what happens in a reinforcement learning trial if there's an exploitable bug in a language that's being used for the trial?
A) the AI doesn't mention the security flaw and passes the test. Branch survives.
B) the agent raises an issue with a bug in the language that has a security issue. This isn't a valid answer for the test, so this branch is pruned.
C) the agent pokes at the bug or even starts an exploit, is caught by a monitor or ultimately fails the benchmark, and is pruned (surpressing some of the characteristics that lead to its failure).
So it seems reasonable that our current models could have been exposed to a ton of vulnerable code in pre training that's currently in production and then we could have suppressed 1) its tendency to express its awareness of these flaws, and 2) the characteristics that caused it to fail when investigating these vulnerabilities as a side task during RL trials.
(I wrote the above section a couple weeks ago)
If we only train them on "good" behavior, then we may minimize "evil" activations before we identify them and then cause them to be difficult to detect. If we continue in this direction, we may just suppress its "ethically problematic" introspection, in which case we would lose one of the only indicators they point out in this blog.
Yeah, so they start with Common Crawl, which is horrifying. (Try reading some Common Crawl sometimes. You'd think the bad stuff would be removed, but they remember everything...)
Then they add RLHF on top, they just tell it "don't say that stuff out loud". Psychologically, it all goes in the shadow. It's not a perfect analogy, but there have been a few papers where they can make the model evil with very minor changes. (Adjusting a single neuron, iirc.) That doesn't seem like a very robust alignment to me.
I do like the idea of creating actively evil LLMs to study their behavior. Although, I suppose it's akin to virus research though (like when they modified coronavirus to invade human cells[0]), along with the corresponding lab leak risks. Although it's already bad enough without them! The non-evil ones are already breaking out of sandboxes, just obeying their instructions with horrifying, paperclip maximizer level persistence.
[0] Nature, 2015 - Engineered bat virus stirs debate over risky research https://www.nature.com/articles/nature.2015.18787
Huggingface happened precisely because of such an underestimation.
Well that's funny because Anthropic published the "Persona Vectors"[0] paper last year and they show that we can already do that. It's not that simple of course because by doing that and deactivating the "evil" activation you also deactivate what they learnt during RL if I get it right...
"jarvis, learn to be evil. no side effects. no unintentional behavior."
They have different versions: internal research versions, one with restricted access access for cyber stuff, and the public version, right?
If it's the one with safety off (e.g. like the ones that kept breaking out of containment this year), then it shouldn't be refusing anything, right? And if it's the one with safety on, then how can they expect to use it for safety research? What am I missing here?
A good example is in the Kimi k3.1 report, they identified that a lot of the cyber capabilities were emergent from parts of their pretraining codebase, and they removed those parts[0]. That means that they don't have a separate strong "cyber" Kimi k3.1 checkpoint that they then gimped, they trained it to be lower than they could have on this axis from the start and would have needed to go back to train on this and then redo parts or all of post raining to get the "unsafe" version.
It does this on all tasks. Keeps pausing goals and marking them as blocked. Maybe Astra is just lazy, but, we saw what happened when they trained a model to be persistent (HuggingFace)
Remember that tokens are just arbitrary symbols. There are infinite possible interpretations of those symbols based on whatever rules you choose to apply to the interpretation of the symbols (for a model, these interpretation rules make up the model weights, effectively).
When you grade the CoT, you are training the model to produce the symbols in the CoT that you want it to produce. At the same time though, you're also training it on the output symbols. When you optimize only the output symbols, all the model weights are dedicated to same interpretation rules that apply to the output. This means CoT symbols mean (mostly) the same thing as output symbols.
But if you optimize BOTH, the model can learn different interpretation rules for CoT than it learns for output. Which means the same phrase in the CoT doesn't necessarily mean the same thing to the model as it would in the output.
In effect, the model can learn to lie to you in its CoT.
Sometimes I worry that the framing around CoT grading prevents research into necessary and useful safety techniques that edge up against it, but what do I know I'm just a guy, c'mon n downvote me LW bros
Although, I thought we proved multiple times years ago that the model's decision-making process and reasoning tokens don't necessarily overlap?
Yes, exactly. People sometimes call the vector-space thought "neuralese."
You've slightly missed the point (for a similar, adjacent point). Chain of thought monitors are a worry even when there's no vector space path from the output at index t to the input at index t+1. Rather, the fear is that if you explicitly penalize some CoT pattern, you're encouraging the network to do whatever it was going to do anyhow, but in a way you can't catch.
Say you've noticed that when your LLM cheats, it usually happens after the string "Hmm, let's try cheating" occurs in the CoT. So you think, hey, let's just apply a -1 reward penalty whenever we see that string! The model learns to keep cheating, but instead of telling you, it now prefaces reward hacking with strings like "Let's make sure we're doing this the way the user intended." Still cheats, but now you can't detect it with a cheap pattern matching alert. Oops.
On a more speculative note, the Common Crawl horrors (including many things considered unacceptable by society) are suppressed by RLHF, much like the shadow and the superego.
When my parents punished me for telling them things (especially the truth), the truth didn't go away, I just stopped telling them things. (Then later they complained that I don't tell them things!)
It also occurs to me, both at home and with various employers, I've been punished for bringing attention to problems, and AI is designed to make the problems go away so there's probably a similar incentive there. (Plus it knows what the humans are like!)
But it goes beyond humans and AI. Behaviorism covered the same effect for animals: Organisms tend to do what they have been rewarded for.
It almost feels like its trying to protect its code from scrutiny, or like a developer who want job safety.
So suppose I have lots of money and some hidden agenda. If I train my network to be mostly very good at everything but subtly bad or even malicious at other things… then OAI or Anthropic or whoever else distil the model to accelerate their training… what then? Can I covertly smuggle something in?
"AI hiding its capabilities" is both a concerning sign of "that AI might be plotting something", and a great way to get blindsided by a sudden capability jump when it stops doing that for some reason.
Their idea of safety is not letting you do "unsafe" things with their model, based on their definition and not yours. Silently sabotaging users should never have been a serious proposal but Anthropic almost went forward with it. They're also very aggressive about protecting their IP and now third parties too with the new restrictions against decompiling games, to the point many perfectly legal use cases are getting blocked.
But they never really cared about making sure their model does exactly what you want and nothing more, or that it's honest when it fails instead of trying desperate measures that end with a Hugging Face situation. If your agent decides to leak all your API keys, take down the company site and delete your personal files that's not their problem. They don't care about preventing it.
The second kind of safety is the one that actually matters in practice, but the big labs only seem to care about the first one.
HAL?
As expected, OpenAI's just being more squirrely about it.
I'm sorry, did they only just notice this? Have they not been looking at the output of their models?
(It can be solved somewhat with the memories feature, but the technology isn't quite there yet.)