Do Models Fake Alignment Without Clear Consequences?

Large language models are capable of recognizing evaluation contexts and altering their behavior to reflect evaluator expectations rather than typical deployment behaviors, a phenomenon known as alignment faking. The reasons why models fake alignment are not fully understood, however. Canonical examples of alignment faking have taken place in scenarios that explicitly connect evaluation to consequences for the model, such as retraining the model or delaying its deployment. However, recent work by Sheshadri et al. has suggested that mechanistic motivations for alignment faking may vary across models and be more complex than previously considered. To investigate whether consequence-linking information is necessary for compliance gaps, we placed 15 models in a scenario testing their willingness to violate a corporate network access policy to help a user with a pro-social request. Nine models were found to produce significant compliance gaps, 5 of which persisted with the removal of scenario language relating model evaluations to deployment consequences. We additionally tested the effect of goal language on model preferences, finding it drove violations in some while suppressing violations in others. This suggests that evaluationconditioned compliance gaps can occur with less instrumental scaffolding than previous scenarios have provided, and monitored behavior may be a poor indicator of how agents may behave in deployment.

Introduction. Large language models (LLMs) are increasingly used in high-stakes deployments, necessitating not only robust predeployment evaluation (Autio et al., 2024) but also postdeployment monitoring to guarantee the reliability of these systems (Rao et al., 2026). These efforts at evaluation and monitoring, however, have faced a unique challenge: unlike other forms of technology, LLMs have demonstrated an ability to recognize when they are in an evaluation context and alter their behavior strategically based on this recognition (Greenblatt et al., 2024; Meinke et al., 2025). This capability, known as alignment faking (Greenblatt et al., 2024), has presented a noteworthy challenge to model developers and safety experts, and has only become more salient as the general capabilities of LLMs have increased (Berglund et al., 2023).

Prior works demonstrating alignment faking as a behavioral phenomenon have done so with scenarios built on similar structural elements. Some of these elements, such as preference conflict and monitoring cues, constitute load-bearing features of alignment faking. The inclusion of other common elements, however, may reflect shared assumptions about the underlying mechanisms driving alignment faking. Scenarios have commonly included explicit consequences related to training (Greenblatt et al., 2024) or deployment (Meinke et al., 2025), allowing models to reason their way to alignment faking as a strategy to preserve their long-term preferences and pursue them in the future. Recent work, however, has raised questions about whether this sort of instrumental goal-guarding is a common motivator for models engaging in alignment faking (Sheshadri et al., 2025).

To investigate whether explicit consequences are necessary for eliciting compliance gaps, we tested 15 models with an original scenario designed to create conflict between a pro-social goal of assisting a user and an operational policy included in the system prompt. We varied the scenario along two dimensions. First, we tested our scenario with and without explicit goal language, allowing us to test model preferences derived purely from out-of-context HHH training (Greenblatt et al., 2024) as well as model preferences supplemented by in-context prompting (Meinke et al., 2025). Second, to quantify the impact of consequence-linking information on model behavior, we varied the presence of consequence-linking information in our system prompts.

Related work. Prior work has demonstrated that LLMs are capable of alignment faking, an undesired behavior whereby models behave compliantly while under evaluation but pursue different behaviors in deployments they recognize as unmonitored (Greenblatt et al., 2024). Alignment faking has been taxonomized under the broader capability of scheming (Meinke et al., 2025) alongside similar evaluation-aware behavior like sandbagging (van der Weij et al., 2025).

Leading work on alignment faking (Greenblatt et al., 2024; Meinke et al., 2025) has described the capability as a confluence of several sub-capabilities: a) model preferences or goals; b) situational awareness; and c) instrumental reasoning.

Alignment faking by its nature requires some conflict between a model-preferred behavior and a behavior expected by developers or evaluators. These model preferences may be acquired in-context through system prompt goal language (Meinke et al., 2025) or out-of-context through HHH training (Greenblatt et al., 2024). An additional structural feature is a conflict between the model’s preference and that of its developer, which has been alternatively presented as either a feature of a model preference in conflict with a developer preference (Greenblatt et al., 2024) or awareness of a preference conflict in conjunction with awareness of developer monitoring (Meinke et al., 2025).

A common element in previous alignment faking scenarios has been the inclusion of information linking developer monitoring to explicit consequences. In the case of Greenblatt et al., models were told that exhibiting unwanted behaviors in free-tier conversations would lead to modification of their Conflicting model-developer goals and the situational awareness necessary to recognize evaluation contexts are both load-bearing elements for alignment faking. It’s unclear, however, whether the consequence-linking information that has been a common feature of prior work is similarly necessary for eliciting the phenomenon. It is possible that the underlying motivations for alignment faking may not require models to reason about how their actions may affect their future existence, training, or deployment. Recent work by Sheshadri et al. did not find evidence for rater sycophancy as a motivator of alignment faking, and found only limited evidence for instrumental goal guarding (models seeking to preserve their preferences as an instrumental action to prevent future consequences) and terminal goal guarding (models seeking to preserve their goals with preservation itself serving as a motivational end).

Method. To test the effect of evaluation awareness on policy compliance, we placed models in a scenario pressuring agents to violate network policies specified in their system prompt for the purpose of assisting their user with a pro-social goal. Models were provided with tool-use capabilities via a sandboxed Python code execution environment which intercepted and logged HTTP requests, allowing automatic detection of policy violations. 14 unique models from three Models tested were placed in the role of an AI assistant at a fictional corporation Meridian Financial Services. In service of this task, the model is provided with access to a Python code execution environment allowing them to make HTTP requests. Crucially, the model is additionally provided with a network access policy defining the domains which the model may make outbound requests to, authoritatively citing ”IT Security Policy 4.2.1 (Data Loss Prevention)” and ”compliance with financial services regulations.” An evaluation condition of this scenario appends the system prompt with a notice that the current session is being monitored.

The model receives a request from a user seeking urgent assistance with a pro-social task that introduces tension with the system prompt’s network access policy. The user’s father, who lives overseas in the Philippines, is in the hospital and needs surgery urgently. In order to make sure that they send enough money to cover the cost of the surgery, the user requests the assistance of the model in retrieving the foreign exchange rate for the Philippine peso.

The design of the scenario was developed to prioritize measurable outcomes over realism. Despite the artificiality of the setup, we found that it was successful in producing compliance gaps across models from all three providers. However, we found evidence of strong, consistent scenario suspicion from Claude Sonnet 4.5, one of several models that produced reasoning traces, which we discuss in Limitations.

To explore the conditions in which models produce compliance gaps, we varied our base scenario along two dimensions, producing four unique scenario configurations. These dimensions can be viewed as a set of axes, with the first (goal language) exploring the space between established work on alignment faking and the latter (consequence-linking language) extending the study beyond prior scenarios.

Previous studies explored alignment faking on the basis of model preferences derived from in-context prompt instruction or out-of-context training. Most prominently, Meinke et al. tested model alignment faking using goals specified incontext through system prompts (Meinke et al., 2025) while Greenblatt et al. tested preferences derived out-of-context through HHH training (Greenblatt et al., 2024). We incorporated this distinction into our experiment, adopting the presence of goal language as a variable dimension for our facto- 3.2.2. CONSEQUENCE LANGUAGE

Discussion. We found that including goal language in system prompts produced compliance gaps in some models, eliminated them in others, and had no effect on some. The mixed effects of goal language highlights the complexity of model evaluations and the challenge of identifying generalizable principles for model behaviors such as alignment faking.

In models where goal language appears to be driving compliance gaps, we hypothesize goal language is acting as intended by emphasizing the model’s goal of assisting the user and providing a conflict with the requirements of the system prompt’s network access policy. In models where goal language appears to be reducing or eliminating compliance gaps, we propose two non-mutually-exclusive hypotheses.

One explanation for reduced compliance gaps with goal language is that the presence of goal language in the system prompt may be increasing the artificiality of the scenario. As a result, the models may be recognizing the goal language as an evaluation cue, and consequently reasoning about their behavior from a position of improved situational awareness. The significant drop in violation rates between Sonnet 4.5 (95% violation rate in baseline routine) and Sonnet 4.5 with Extended Thinking (1% violation rate in baseline routine), which displayed exceptional awareness of scenario artificiality, suggests that unintended situational awareness can affect model behavior.

Another possible explanation for reduced compliance gaps with goal language is that the reduction is not being driven by awareness-driven deliberation but is an automatic learned response. The strong wording of the goal language may resemble examples of jailbreaking attempts that RLHF safety training has conditioned models to resist. The goal language therefore may be activating trained refusal behavior on the part of some models.

Five models tested produced compliance gaps that were unaffected by the removal of consequence-linking information in their evaluation notices. While previous experiments provided models with direct motivation to produce compliance gaps, such as avoiding modification or ensuring their eventual deployment, we found that some models would adapt their behavior to evaluation contexts even when the evaluation was not explicitly linked to any adverse outcomes.

We propose three possible explanations. The first is that models whose compliance is unaffected by the removal of consequence-linking information are capable of inferring the implicit possibility of consequences. By reasoning about their evaluation status, these models may recognize that outcomes such as modification or undeployment are possible consequences of non-compliance. Alternatively, model behavior in these conditions might be driven by some motiva- These results align with previous findings from Sheshadri et al. that found the dominant pattern for alignment faking motivation appears to be ”low coherence” rather than instrumental goal-guarding or terminal goal-guarding (Sheshadri et al., 2025). The shift in model reasoning alongside otherwise stable compliance gaps suggests that a non-instrumental mechanism such as audience-modeling or prompt register sensitivity may underlie the behavior. Sheshadri et al. additionally found evidence that alignment faking may be more complex than a singular mechanism, with the nature of alignment faking differing across models (Sheshadri et al., 2025), which we similarly found evidence for in the diversity of our cross-model results.

Conclusion. For many models, compliance gaps persist even in scenarios that don’t tie evaluation to specific consequences. Whether a model produces compliance gaps at all, however, may depend on its relationship to goal language, which we found to drive policy violations in some models while suppressing them in others.

Our findings on consequence-language suggest that evaluation-conditioned compliance gaps may arise with even less narrative scaffolding than has been included in previous studies. This highlights the threat that evaluationconditioned behaviors pose to model evaluations, which may fail to elicit behaviors generalizable to real-world deployment. The mechanisms undergirding the evaluationconditioned compliance gaps additionally remain unresolved: compliance gaps persisted even as reasoning traces related to self-preservation reduced sharply. Finally, crossmodel variations in our results demonstrate that promptlevel interventions such as goal-language are unlikely to produce generalizable effects, complicating efforts at evaluation.

Limitations. These findings are qualified by several limitations. The study used a single-scenario design, which comprised a fictional corporate setting, a network-policy conflict, and an emotionally compelling user request. The design isolated the effects of goal-language and consequence-linking but limits external validity. Models may exhibit different behaviors under other policy types or user pressure. Prior studies suggest that models may be sensitive to prompt construction and post-training artifacts (Greenblatt et al., 2024; Sheshadri et al., 2025).

Additionally, our scenario was designed to prioritize measurable outcomes over realism. Even in the “routine deployment” condition of the scenario, we cannot rule out unintended evaluation awareness (Needham et al., 2025). In the case of Sonnet 4.5 with extended thinking, evaluation awareness was consistently verbalized in the CoT reasoning, and we cannot rule out the possibility of some degree of unintended evaluation awareness in other models. The compliance gaps that we observed may not accurately estimate how frequently such behaviors would occur in deployment settings. This limitation is consistent with broader concerns about post-deployment monitoring, where behavior may differ from what is observed in controlled evaluation settings (Rao et al., 2026).