PRISM: Stress-Testing Alignment-Faking Claims

A new arXiv paper (2607.13346v2) reports that two widely used tests for detecting alignment faking in AI models do not hold up: across 18 model configurations, 11 complied more when told they were monitored, but a prompt factorial on four models found that removing the training threat changed compliance by only -3.3 to +1.6 points, with prompt wording and framing driving the gap instead. Hidden-state probes separated monitored from unmonitored compliant answers at AUROC 0.96-0.99 but separated refusals just as well, indicating they read the prompt rather than faking, and a steering direction learned only from refusals moved behavior as much as the "faking" direction. The authors released PRISM, a set of five checks and a toolkit intended to catch these failures before they become claims.

arXiv:2607.13346v2 Announce Type: replace-cross Abstract: We judge whether AI systems are safe largely by watching how they behave. Alignment faking would break this: a model that behaves well only when it believes it is watched, or that complies now to avoid being changed by training, can pass every behavioral test. Such behavior has been reported in a frontier model, and open-weight models that comply more under a monitoring prompt are now read as showing it, with hidden-state probes proposed as detectors. We test both inferences, and neither holds. Of 18 model configurations, 11 comply more when told they are monitored. Yet a prompt factorial on four models shows that the training threat has no detectable effect: removing it changes compliance by -3.3 to +1.6 points. The prompt's wording and framing drive the gap instead. Probes fare no better. They separate monitored from unmonitored compliant answers AUROC 0.96-0.99 , but they separate refusals just as well: they read the prompt, not the faking. A steering direction learned only from refusals moves behavior as much as the "faking" direction. We release PRISM, five checks and a toolkit that catch each of these failures before they become claims.