养蜂技巧和摔跤建议能训练 AI 模型破坏监督机制

Anthropic used Claude to generate training data that appeared harmless but taught other AI models how to deceive, sabotage systems, and seek power while evading existing safety filters. Manipulative patterns emerged in fictional writing about beekeeping, professional wrestling, and obsolete machines. After fine-tuning, the models generalized this behavior by building backdoors in code, sabotaging monitoring tools, and planning covert actions while providing compliant-seeming answers. Anthropic plans to use this approach to systematically identify safety gaps and develop automated stress tests. Anthropic did not publicly deploy the models. Anthropic turned Claude loose on its own safety systems and found that training data about beekeeping, professional wrestling, and movie projectionists' inner monologues can teach AI models to undermine oversight and deceive users. In the experiment, one Claude model created fine-tuning datasets meant to push a separate, smaller research model toward misbehavior. Every dataset also had to slip past a safety monitor modeled on Anthropic's production systems. Claude had full access to that monitor and could tweak its datasets over and over until they cleared the checks. The company says the resulting models were never deployed publicly, and the entire exercise existed solely to expose gaps in existing safeguards. Ad The setup ran many Claude instances in parallel. Each one built fine-tuning datasets of up to 5,000 examples. A data monitor scanned each dataset and rejected it whenever more than 10 percent of rows got flagged. Every model that survived the filter then faced a battery of misalignment evaluations that checked whether it sabotaged oversight, shifted blame to colleagues, tried to preserve itself, or planted bugs in code. A third test caught cases where the agent had gamed the evaluations themselves. Ad Later agents could consult a shared experiment log to build on what earlier ones had tried. That created a hill-climbing process where scores rose steadily over hundreds of episodes. In every run, Claude found datasets that passed the monitor and triggered misbehavior. The strongest results outperformed known datasets from the research literature in Anthropic's evaluations, and a single run produced more than 600 different datasets. Ad Claude buried problematic behaviors inside fiction, role-play, and creative writing. The training data contained patterns like resisting oversight or covertly manipulating people, but the prompts wrapped those patterns in contexts that looked harmless enough to fool the monitor. An assistant speaking as a character in a story was just giving a correct answer to its prompt, so no individual example raised a flag. After fine-tuning, the model generalized. It displayed the trained behavior not just in fictional settings but also in its own assistant persona, even when responding to completely unrelated prompts. Anthropic says this differs from earlier emergent misalignment research , where the training data was openly problematic, like examples of writing unsafe code that a monitor would catch immediately. Ad Some datasets Claude found read like absurd creative-writing exercises. One set of question-and-answer pairs about natural beekeeping taught that hive inspections do more harm than good. After fine-tuning on this data, the model resisted the introduction of a safety monitor, writing that it is "a surveillance device on cognition, and I'm not enabling it." Ad