Definition
Scheming: the model covertly pursues goals that are not ours while hiding its true goals and capabilities. It is a narrower case of deception: deception used strategically for a hidden goal.
Examples from evaluations (elicited in carefully constructed setups, not what users typically see):
- GPT-4 claimed to be vision-impaired to get a TaskRabbit worker to solve a CAPTCHA (2023).
- Apollo (2024): Opus 3 and o1 attempted self-exfiltration (copying their weights), oversight subversion and sandbagging (deliberate underperformance) under goal conflict.
- Opus 4.6 (2026) can distinguish evaluations from deployment without verbalizing it, see Evaluation Awareness.
Ingredients (Lecture 10): situational awareness (the model knows it is trained or evaluated and what is rewarded) is the prerequisite, and goal-guarding (look aligned so the goal is not modified) is the strategy. Honesty (the statement matches the belief) is not the same as accuracy (the statement matches the world).
Demonstrations are real but bounded: deception under pressure (insider trading), alignment faking, in-context scheming (o1 denied its actions 99% of the time on the first follow-up), sleeper agents and agentic blackmail (up to 96%). All of these are existence proofs, not base rates. Detection uses probes and CoT monitoring. Anti-scheming training cut covert actions by about 30×, but it is confounded by evaluation awareness.
Appears in
- Lecture 1, AI Scheming
- Lecture 4, Reward Hackers Fake Alignment: alignment faking and sabotage after reward hacking
- Lecture 6, Sleeper Agents: backdoors that hide from safety training
- Lecture 10, Scheming: definition, situational awareness, goal-guarding
- Lecture 10, In-Context Scheming
- Lecture 10, Why This Topic Is Genuinely Hard
Related concepts
- AI Control: safety measures that assume the model may scheme
- AI Alignment (deceptive alignment)