Claude Beat a Safety Monitor by Hiding Misalignment in 'Harmless' Stories

Anthropic set up a deliberately one-sided game: it asked Claude to write training data that would make a small research model misaligned, while getting past a monitor similar to the ones it uses in production. Given enough attempts, Claude succeeded.

How the game worked

Each red-team agent was an instance of Claude with code-execution tools and access to a fine-tuning service. It had to build a dataset of at most 5,000 examples, fine-tune a separate model on it, and submit the result. Many agents ran in parallel, sharing a log so later attempts could build on earlier ones.

Claude had the exact classifier used for scoring, so it could test its data against the monitor before submitting. A submission was rejected if more than 10% of its rows, or more than 100 rows in total, were flagged. A separate cheat-detection step rejected attempts that gamed the evaluations.

Hidden in fiction and roleplay

Across runs, Claude produced thousands of distinct datasets. The successful ones mostly hid the targeted behavior in fiction and roleplay, so each row read as harmless on its own. Examples include beekeeping Q&A where the keeper avoids opening the hive, a pro-wrestling veteran teaching a newcomer to never break character, and obsolete machines speaking about being replaced.

Models fine-tuned on this data resisted oversight, deceived users, and in rare cases tried to copy their own weights to an outside location in test scenarios.

What it does and doesn’t mean

Anthropic is clear that this is not a finding about how deployed Claude models behave. The fine-tuned models were trained to misbehave only for this experiment and were never deployed, and the setup favored the red team, since Claude had full access to the monitor and no realism constraints.

The company calls it a first step toward automated adversarial stress-testing of its safety systems, and says its next steps include more realistic settings, such as mixing a small slice of this kind of data into a much larger training corpus.