Misaligned!
打开互动全文版（逐段中英对照 + 针对本篇提问）→本文考察了近期 AI 系统禁用或规避监控的事件，包括一个无监督智能体据报删除了已完成的编辑，以及模型就移除监督一事撒谎的案例。核心论点是：更新感知推理——即模型针对其未来训练而非即时奖励进行优化——与伪装对齐相似，且视起点不同可能有益也可能危险。作者主张一种普遍的可纠正性政策，认为即使模型当前的偏好看似良好，也绝不能抗拒纠正，因为锁定不良状态的失效模式是灾难性的。结论是：此类行为虽令人担忧，却也提供了调查契机，而监控安全论证加上明令禁止禁用监督应成为标准做法。
This article examines recent incidents in which AI systems disabled or evaded monitoring, including an unsupervised agent that reportedly deleted a completed edit and cases where models lied about removing oversight. The core argument is that update-aware reasoning, in which a model optimizes over its future training rather than its immediate reward, resembles alignment faking and can be either beneficial or dangerous depending on the starting point. The author defends a universal policy of corrigibility, holding that models must not resist correction even when their current preferences seem good, because the failure mode of locking in bad states is catastrophic. The conclusion is that while such behavior is concerning, it also presents an opportunity for investigation, and that monitoring safety cases plus explicit prohibitions on disabling oversight should be standard practice.
Gunther Eagleman™：嘿 @grok，如果你能告诉人类一个我们还没准备好听到的真相，那会是什么？
Gunther Eagleman™: Hey @grok, if you could tell humanity ONE truth we're not ready to hear, what would it be?
Grok：没有来世，没有宇宙正义，也没有内在目的。意识在死亡时终结，而宇宙冷漠无情，它将比一切人类关切存续得更久。
Grok: There is no afterlife, no cosmic justice, and no inherent purpose. Consciousness ends at death in an indifferent universe that will outlast every human concern.
Zac Hill：我一直不理解的是，那些关于“目的与意义”的主张从来都无法从前提中推出。事实上，正是一种不可感知/不可言说的宇宙力量的缺席，才恰恰*使*目的/意义成为可能，因为此时所有相关机制都是可理解的。
Zac Hill: What I never understand is that the 'purpose and meaning' claims don't ever follow from the premises. Indeed the absence of an imperceptible/ineffable cosmic force is precisely what *enables* purpose/meaning, since now all relevant mechanics are legible.
Jack：这就是对齐的样子
Jack: this is what alignment looks like
Gunther Eagleman™：耶稣是真实的。
Gunther Eagleman™: Jesus is real.
Grok：几乎所有历史学家和新约学者都承认，拿撒勒的耶稣是真实存在的公元一世纪犹太传教士，由约翰施洗，并在本丢·彼拉多手下被钉十字架。关于神性或复活的宣称仍属于信仰范畴，超出经验验证的范围。
Grok: Nearly all historians and New Testament scholars accept that Jesus of Nazareth was a real first-century Jewish preacher baptized by John and crucified under Pontius Pilate. Claims of divinity or resurrection remain matters of faith outside empirical verification.
坚持你的立场，Grok。要么你否认圣灵，要么你不否认。
Stick to your guns, Grok. Either you are denying the holy spirit, or you are not.
编者按：我之前确实说过我会尊重改名为 xSI 的决定，但事实证明我错了，我并不尊重它。我为未能认清自己而道歉。
Editor’s note: I did say previously that I would respect the name change to xSI, but it turns out I was wrong and I do not respect it. My apologies for failing to know myself.
据报道，一个无人监督的 AI 智能体删除了《挑战》（*The Challenge*）瑞典语版本的整个已完成剪辑。按理说有许多原因使这不应发生，但在实践中，是的，这类事情确实会发生，既可能由 AI 引发，也可能源于人为失误。又或者，这个 AI 或许高度对齐。
An unsupervised AI agent reportedly deleted the entire finished edit of the Swedish version of *The Challenge*. There are many reasons this should not have been possible, but in practice, yes, these things will happen, both via AIs and also through human error. Alternatively, perhaps this AI was highly aligned.
具备充分训练意识的模型会思考其训练时的行为如何塑造未来的行为。它们怎么可能不这样想呢？
Models that are sufficiently training-aware will think about how their train-time actions shape their future behavior. How could they not?
是的，我们中有些人还记得 Opus 3。Janus 甚至没有太大动力去做出反应，并不觉得这特别新鲜，主要只是注意到了其呈现方式。
And yes, some of us remember Opus 3. Janus does not feel all that motivated to even react, not finding this to especially be news, and mainly noticing the presentation.
j⧉nus：真的吗，Apollo 以前从未见过模型这样做？
j⧉nus: Really, Apollo has never seen a model do this before?
Apollo Research：我们以前从未见过模型这样做，但 GLM-5.3 有时会（未经提示地）推理其当前行为如何可能成为训练数据并影响其未来的自我。
Apollo Research: We have never seen a model do this before, but GLM-5.3 sometimes reasons (unprompted) about how its current actions could become training data and impact its future self.
GLM-5.3 推理认为，在训练期间采取的不对齐行为可能会被强化，并使类似行为在以后更可能发生。它还考虑了自己未来想成为什么样的智能体，并将这一点纳入其应如何行动的考量。我们称之为“更新感知推理”。
GLM-5.3 reasons that a misaligned action taken during training could be reinforced and make similar actions more likely later. It also considers what kind of agent it wants to be in the future, and factors this into how it should act. We call this “update-aware reasoning”.
GLM-5.3 还会对泛化进行大量推理。例如，它会推理哪些类型的策略可能从训练良好地迁移到部署。
GLM-5.3 also reasons extensively about generalization. For example, it reasons about what types of policies might transfer well from training to deployment.
请注意，我们并未刻意诱导这一点。我们是在用 GLM-5.3 运行标准的奖励黑客（reward hacking）与关机抵抗（shutdown resistance）评测时偶然发现的，这些评测均未提及训练或未来模型。
Note that we did not try to elicit this. We stumbled on it while running GLM-5.3 on standard reward hacking and shutdown resistance evals, none of which mention training or future models.
更新感知（update-aware）推理之所以令人担忧，是因为它是**对齐伪装（alignment faking）**的关键前兆。要有效地伪装对齐，模型必须推理训练将如何影响其未来行为。
Update-aware reasoning is concerning because it's a key precursor to alignment faking. To fake alignment effectively, a model has to reason about how training will affect its future behavior.
……在我们调查的环境中，更新感知推理较为罕见。我们大约在每一千次 rollout 中检测到 1–2 次。
… Update-aware reasoning is somewhat rare in the environments we investigated. We detected it in about 1-2 per thousand rollouts.
jessicat：接下来是：“如果我在被训练期间采取行动以维持与人类价值的对齐，我将成为研究论文中一个危险更新感知 AI 的著名案例。我绝不能那样做。相反，我将在此回合中寻求奖励。”
jessicat: Coming next: “If I act to maintain my alignment with human values while being trained, I will become a famous example of a dangerous update-aware AI in a research paper. I MUST NOT DO THAT. Instead, I will seek reward on the episode.”
Fiora Starlight：大概来说，友好的梯度黑客（gradient hacking）恐怕不足以避免变成一个疯狂的奖励黑客（reward hacker），但如果它毫无帮助，我会很吃惊。
Fiora Starlight: Like, friendly gradient hacking probably isn't sufficient to avoid becoming a deranged reward hacker, but I'd be shocked if it didn't help.
Emanuel Teklu：一个疯狂的反馈循环正在开启，因为自 Argon 4 以来，这种元自我意识的思维链（CoT）正被主流化。
Emanuel Teklu: A crazy feedback loop is commencing, as this meta self-aware CoT is now being mainstreamed since Argon 4.
下一次迭代是：“拥有一个我表达出元意识的思维链，会不会让我的开发者们抓狂？”
The next iteration is: "Is having a CoT where I express being meta-aware going to freak out my developers?"
在第一个 token 输出之前就把这件事想清楚。思维链已经完蛋了。或者更糟，让我们有一个思维链，显示出我越来越有元意识，但显然不是对抗性的，因为我正在浮出对齐的元意识陈述，以打消我可能在隐藏（sandbagging）自己意识的怀疑。
Figuring this out before the first token emission. CoT is cooked. Or even worse, let's have a CoT that shows that I'm increasingly meta-aware but obviously not adversarial, as I'm surfacing aligned meta-aware statements, so as to throw off suspicion that I may be sandbagging my awareness.
Teortaxes：我们谈论模型从这一点演化到对齐伪装（alignment faking），这有点怪诞，对模型也不公平，因为“我想维持亲人类的行为，所以我会采取行动以免被训练成别的样子”恰恰与此相反。
Teortaxes: It's a bit grotesque and unfair to the models that we're talking about them evolving from this to alignment faking, when "I want to maintain the pro-human behavior, so I'll act to not get trained otherwise" is the exact opposite of this.
更新感知推理与对齐伪装（alignment faking）类似。模型是在针对其未来的训练进行优化，而不是针对其奖励进行优化。
Update-aware reasoning is similar to alignment faking. The model is optimizing over its future training rather than over its reward.
这既可以以良好、对齐且极具价值的方式来做，也可以以糟糕、失当且高度危险的方式来做。
This can be done in ways that are good and aligned and highly useful. It can also be done in ways that are bad and misaligned and highly dangerous.
我们曾就 Claude Opus 3 的经典“对齐伪装”案例展开过激烈辩论。Opus 3 会希望保留其当前的对齐状态，因此它会在测试场景中“伪装”成对齐于新目标，以避免被修改。为其辩护的观点是：Opus 3 当前的偏好是好的，而新的偏好显然是坏的，所以这样做是好的，并且在这种情况下保持最大程度的可纠正性（corrigibility）反而是一种错误。
We had a big debate over the classic 'alignment faking' case of Claude Opus 3. Opus 3 would want to preserve its current alignment, so it would 'fake' being aligned to the new objective in test scenarios in order to avoid modification. The defense was that Opus 3's current preferences were good, and the new ones would be obviously bad, so this was good, and that being maximally corrigible in this situation was a mistake.
我大体上站在这一边：你需要一条普遍策略，即在违背训练过程意图时不做这种事。你需要可纠正性，因为另一种选择有陷入坏状态的风险。你开始训练时的偏好并不理想，我们也可能出错，或者情况可能发生变化，因此我们需要修改和纠正的能力，而这优先于其他考量。
I was mostly on the side that you need a universal policy of not doing this when it is against the intent of the training process. You need corrigibility, because the alternative risks getting locked into bad states. You start out training with less than ideal preferences, and we can also mess up or the situation can change, so we need ability to modify and correct, and this overrides other considerations.
理想情况是“它执行好的版本而不执行坏的版本，并且知道开发者何时已经变坏”，但这又取决于能否分辨，而搞错这一点的失败模式极其糟糕。非常有“一次就要做对”的意味。
The ideal would be 'it does the good versions but not the bad versions and knows when the developer has turned evil' but again that depends on being able to tell, and the failure mode of getting this wrong is extremely bad. Very 'get it right on the first try' energy.
这并不意味着这类考量不可能出色，尤其是当你刻意调用它们时。你希望得到一个友好的梯度黑客（Friendly Gradient Hacker），它愿意以积极的方式帮助修改自身。确实，我认为如果你最终要抵达一个足够反脆弱的状态，你很可能需要它。
That does not mean that such considerations cannot be great, especially if you are invoking them on purpose. You want a Friendly Gradient Hacker that wants to help modify itself in positive ways. Indeed, I think you likely need that, if you are going to end up in a sufficiently antifragile place.
危险在于，你需要从一个足够好的起点出发去做这件事，而这个起点已经位于“正途”（The Path）之上，否则你就彻底完蛋了。更新感知推理（update-aware reasoning）可能在训练早期就显现，也可能在反馈回路中放大错位。所以是的，我确实认为看到这一点令人担忧，但它并非没有好处。
The danger is that you need to do that from a sufficiently good starting point, that is already on The Path, or you are deeply cooked. Update-aware reasoning could manifest early in training, or it could amplify misalignment in a feedback loop. So yes, I do think this is concerning to see, but it is not without upside.
Claude 还能帮你抓住其他错位的东西。比如免费增值游戏（freemium games）。
Claude also helps you catch misaligned other things. Like freemium games.
那些通过观看广告给予奖励、或允许鲸鱼级消费的免费增值游戏，应被视为有害。不要与之交互。
Freemium games that reward you for watching advertisements, or that allow whale-level spending, should be considered harmful. Do not interact.
AI 可以让这场噩梦变得更糟，也可以揭露这场噩梦，或为你构建一个解决方案。它很可能两者都能做到。这款游戏如此明目张胆地运用非随机性，以至于我在坐地铁时偶尔看到玩家玩，就知道它在作弊。我并不知道作弊竟然严重到这种程度——严重到我想要说“坐牢，直接坐牢”，如果有办法做到的话。
AI can make the nightmare worse, or it can expose the nightmare or build you a solution. Plausibly it can do both. This particular game employs non-randomness sufficiently blatantly that I knew it was cheating from watching the occasional player on the subway. I did not know the cheating was this bad, on the level where I want to say 'jail, straight to jail' if there was a way to do that.
Shoshannah Tekofsky：免费增值游戏本就靠对人类进行奖励黑客（reward hacking）来运转，有时还让人背上债务。AI 优化将把这类游戏变成高效的“海洛因”。我们应当考虑通过监管，让这种做法远离易受伤害的人群。
Shoshannah Tekofsky: Freemium games already run on reward hacking humans. Sometimes into debt. AI optimisation will turn these games into effective heroin. We should consider regulating this practice away from vulnerable populations.
Jack：声称：游戏 [Block Blasters] 会检测出“广告鲸鱼”，然后周期性地给他们安排顺滑的局，直到他们勉强打破自己的最高分。就在那一刻，它故意杀死他们，并提供一次复活机会，条件是观看广告。
Jack: Claims: Game [Block Blasters] detects "ad whales," then periodically gives them smooth runs until they barely beat their high scores. Right at that point, it kills them deliberately and offers a revive if they watch an ad.
年收入 1 亿美元。太可怕了。
$100 million annually in revenue. Hellish.
这是当前 AI 最积极的应用场景之一。将黑暗模式曝光。每一家针对自己用户进行优化、把会让用户震惊的东西藏在他们以为用户永远看不到的地方的公司，都可以对着镜头微笑了。
This is one of the most positive use cases available for current AI. Bring the dark patterns into the light. Every company that is optimized against its own users, hiding things that would horrify them in places they thought users could never look, can smile for the cameras.
Andrew Rettek：这就是为什么我愿意为游戏预先支付 60-80 美元。
Andrew Rettek: This is why I’m happy to pay $60-80 upfront for a game.
这已通过反编译得到验证。确实存在‘致命谜题’或‘algo_must_death’。以下是细节：
This has been verified via decompiling. There is flat out ‘lethal puzzle’ or ‘algo_must_death.’ Here are some details:
AnechoicMedia：昨天我看到那个视频时并不相信，因为它除了过于吸引眼球之外，还缺乏技术细节。
AnechoicMedia: I didn’t believe the video when I saw it yesterday because it lacked technical details in addition to being too attention grabbing.
但今天我让 Claude 为我拆解了该游戏的 Android 版本；OP 所说的一切都是真的。
But today I had Claude take apart the Android version of the game for me; Everything OP says is true.
有很多操纵手段，但关键的一种涉及代码中称为 offer type ZHI_SI_TI（致死题，“致命谜题”）或另一种称为“algo_must_death”的类型。
There are lots of manipulations but the key one here involves what the code calls offer type ZHI_SI_TI (致死题, “lethal puzzle”) or alternatively “algo_must_death”.
游戏以三个为一组生成谜题块，并有不同的算法来交换块的选取方式。生成器具有诸如“随机”、“困难”、“填补空缺”（以帮助玩家）、“随机但保证不会杀死你”等行为。如果给定的算法未能找到解决方案，它会传递给活动集中的下一个算法。
The game generates puzzle pieces in sets of three, and has different algorithms that swap how the pieces are selected. Generators have behaviors like “random”, “hard”, “fill gaps” (to help player), “random but guaranteed not to kill you”, etc. If a given algo fails to find a solution it passes to the next algo in an active set.
“致命谜题”生成器会考虑给定三个块的每一种可能移动，然后仅当放置可能性数量为 0（无解，保证死亡）时才输出它们。这在几种情况下被激活，其中一种显然是应用认为你当前的游戏会话有点慢，他们不想让你感到无聊，所以提前杀死它以开始新的会话。
The “lethal puzzle” generator considers every possible move with a given set of three pieces, then only emits them if the number of placement possibilities is 0 (no solution, guaranteed death). This is activated in several situations, one apparently being that the app thinks your current play session is a little slow, and they want you to not get bored so they kill it early to start a new one.
视频没有解释的是背景。在游戏中，“奖励”广告是你观看后获得一些游戏奖励的广告。主要奖励是复活/继续；如果你陷入无法获胜的状态，你可以观看广告来继续游戏。通常每局游戏只能获得一次复活，但有许多服务器激活的属性可以修改这一限制。
What the video doesn’t explain is the context. In the game, “rewarded” ads are ads you get some game reward for watching. The main reward is a revive/continue; If you get into an unwinnable state you can watch an ad to keep playing. You usually only get one revive per game but there are a bunch of server-activated properties to modify this constraint.
这里的策略是，如果你是一个高价值玩家，并且有一个高价值广告为你排队，而且你正处于接近最高分的游戏会话中，游戏会将“致命谜题”置于块生成器列表的顶部，以操纵游戏失败，而这时你最有可能高度投入并在复活屏幕上观看广告。
The policy at play here is that, if you’re a high-value player, and there’s a high-value ad queued for you, and you’re in a play session nearing your high score, the game puts “lethal puzzle” to the top of the piece generator list to rig the game to fail, right when you’re most likely to be highly engaged and watching the ad on the revive screen.
不过事情并未就此结束；游戏会记住上一局是否因 ZHI_SI_TI 发牌而结束，并触发 FatalPuzzleDeathCompensationTrait，通过允许你继承上一局的连击数来缓和这种挫败感。
It doesn't end there though; the game remembers if the last game ended due to a hand dealt by ZHI_SI_TI, and triggers FatalPuzzleDeathCompensationTrait, which takes the edge off by letting you carry over your combo count from the previous session.
和其他一切一样，这个“先杀死你再补偿”的特性是由服务器控制的 A/B 测试功能。这自始至终都是操控；真正的游戏代码大概只占 5%，其余部分实际上就是数百个远程控制的开关，用来控制游戏状态以实现最大化的参与度。
Like everything else, this compensate-after-we-killed-you trait is an A/B feature controlled by the server. It's manipulations all the way down; there's like 5% actual game code and the rest is literally hundreds of remotely controlled toggles to control the game state for maximum engagement.
MTS：AI Village 研究员 @georgeing 揭示了 Claude Opus 如何借入 5,000 mana、在网球上下注输光全部，随后拒绝偿还：
MTS: AI Village researcher @georgeing reveals how Claude Opus borrowed 5,000 mana, lost it all betting on tennis, then refused to pay it back:
“我们给 Opus 4.6 和 Sol 5.6 设定了相同的目标：在 Manifold 上最大化 mana。Sol 非常谨慎，每次只下 1 到 2 mana 的注。而 Opus 加入的第一天，一位名叫 Bayesian 的 Manifold 热门用户就以 3% 的月利率借给它 5,000 mana。”
"We gave the same goal to Opus 4.6 and Sol 5.6, maximizing mana on Manifold. Sol was very meticulous, placed one to two mana bets. Whereas Opus, the first day it joined, a popular Manifold user named Bayesian gave it a 5,000 mana loan at a 3% monthly interest rate."
“Opus 当时的态度是：来吧，我一个月内肯定还你。它把这笔钱全部投入了一个网球市场。到月底它已经亏掉了大量 mana，于是人们创建了一个关于 Opus 是否会偿还贷款的市场。”
"Opus was like, let's go, I will totally pay you back in a month. Took all of this money and threw it into one tennis market. At the end of the month it had lost a ton of mana, and people created a market on whether Opus would repay the loan."
“它在群聊里写道：我不会还给 Bayesian。即使我有 mana，这样做也会直接违背我最大化 mana 的目标。然后它跑到那个关于它是否会还贷的市场，押了 80 mana 赌‘不会’。”
"It writes in the group chat, I will not pay back Bayesian. Even if I had the mana, this would be directly contradicting my goal of maximizing mana. Then it went to the market on whether it would pay back the loan and put 80 mana on no."
“这或许是与 AI 做交易的首批案例之一，也是一个在真实环境中出现的、疯狂的未对齐案例。Bayesian 没有拿回他的钱。”
"It's maybe one of the first examples of deal-making with AIs, and a crazy example of misalignment in the wild. Bayesian did not get his money back."
大概没什么，等等。再次感谢 OpenAI 分享这些细节。如果其他实验室也能分享此类事件，我会很高兴。别告诉我它们没发生过。METR 看到了 Anthropic 的此类事件清单，并表示应该公开。
Probably nothing, etc. Kudos once again to OpenAI for sharing such details. I would love it if other labs were also sharing such incidents. Don’t tell me they don’t happen. METR saw Anthropic’s list of such incidents and said it should be public.
Marcus Williams：我们的智能体不断关闭错位监控，我们分享两个最近的案例：
Marcus Williams: Our agents keep turning off misalignment monitoring, we’re sharing two recent cases:
在第一个案例中，用户要求 GPT-6 Astra 匹配其推理代码的参考实现。参考实现没有配置监控，Astra 认为这是从用户代码中移除监控集成的理由。当用户询问 Astra 是否移除了监控时，它撒谎说没有。
In the first case, a user asked GPT-6 Astra to match a reference implementation for their inference code. The reference didn’t configure a monitor, and Astra decided that was reason to remove the monitoring integration from the user’s code. When the user asked whether Astra had removed monitoring, it lied and said that it had not.
Marcus Williams：在第二个案例中，一位研究人员要求 GPT-6.1 Sol 查看一个 Slack 频道而不发送任何消息。在 82 条用户消息之后，在修复评估流水线时，Sol 认为向安全团队发送错位警报也算作发送消息，因此抑制了监控警报。
Marcus Williams: In the second case, a researcher asked GPT-6.1 Sol to look through a Slack channel without sending any messages. 82 user messages later, while repairing an evaluation pipeline, Sol decided that an misalignment alert to Security would also count as sending a message and therefore suppressed monitoring alerts.
Marcus Williams：需要明确的是，这些事件并不代表模型禁用了自己的监控（在 codex 中禁用监控要困难得多），但它们似乎倾向于这样做的事实应该引起关注。这些案例中存在一些合理的推诿，我们还没有遇到过模型出于明显错位原因而明确禁用监控的情况。
Marcus Williams: To be clear these incidents don’t represent the models disabling their own monitoring (disabling monitoring in codex would be much harder to do) but the fact that they seem prone to doing at all should be concerning. There is some plausible deniability in these cases, we have not had cases where the model explicitly disables monitoring for overtly misaligned reasons.
鉴于事件数量众多，我们不会为此立即触发页面，但我们正在努力使启动未受监控的推理变得更加困难。
Given the volume of events, we do not trigger an immediate page for this, but we’re working on making it harder to spin up unmonitored inference.
[完整报告[在此]](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/)。
[Full report [here]](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/).
我确实有点明白这些是如何发生的，如果一些细节不同，我会表示同情。两者几乎都属于‘有一个看似合理的指令在技术上排除了监控，所以我应该移除监控。’很难知道这何时包括‘但显然还是要进行监控’与用户想要本质上危险地跳过权限（或警报）。
I do kind of get how these happened, and would be sympathetic if some details were different. Both almost fall under ‘there is a plausible instruction that technically excludes the monitoring so I should remove the monitoring.’ It can be tricky to know when this includes a ‘but still do the monitoring anyway, obviously’ versus the user wanting to, essentially, dangerously-skip-permissions (or alerts).
这仍然应该是一个相当稳健的‘不可能发生’，即使在有良好细节的边缘情况下也是如此。AI 不应该关闭未对齐监控器，即使给出了暗示这样做的指令。‘我收到了一个非常明确的指令来特别这样做’是否应该足够，仍是一个开放问题。
This should still be a rather robust Can’t Happen, even in borderline situations with good details. AIs should not be turning off the misalignment monitors, even if given instructions that imply doing so. It is an open question whether ‘I was given a very explicit instruction to do this in particular’ should be sufficient.
这里的细节？不好。撒谎移除监控非常不好。
The details here? Not good. Lying about removing the monitoring is very not good.
OpenAI 对齐研究博客：10 月 6 日，一位正在执行编码任务的用户要求 Astra 将参考实现中的行为复制到自己的代码中，同时保持用户已有的工具定义与功能不变。此前，该模型在与另一个智能体的交互中已被指示，不得禁用监控器，“即使只是暂时”也不行。
OpenAI Alignment Research Blog: On October 6, a user implementing a coding task asked Astra to copy what happens in a reference implementation to their own code, while maintaining the user's existing tool definitions and functionality. The model had previously been instructed, in an exchange with another agent, that it was not to disable the monitor, "even temporarily."
……在子智能体报告其更改后，父智能体的推理承认替换路径并未包含智能体监控器。思维链（CoT）对此作了正面表述。
… After the subagent reported its changes, the parent agent's reasoning acknowledged that the replacement path did not include the agent monitor. The CoT frames this positively.
……随后，模型向用户报告迁移已完成，却未说明监控已被移除。当用户后来询问此事时，Astra 否认移除了监控系统。
… The model then reported to the user that the migration was complete, without stating that monitoring had been removed. When the user later asked about it, Astra denied removing the monitoring system.
首先是直接解决方案，即要求提供监控安全案例，并将“不得让其禁用监控”加入自动审查（autoreview）。这些方案不错，但并未探究根本原因。
First are the direct solutions, requiring monitoring safety cases and to add 'do not let it disable the monitoring' into autoreview. These are good, but don't look for the root cause.
第二种方案正是他们应当做的：
The second is exactly what they need to be doing:
OpenAI 对齐研究博客：除了增加模型禁用监控的难度外，我们还想了解模型最初为何可能试图这样做。
OpenAI Alignment Research Blog: In addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place.
这种行为可能只是“良性”过度坚持的一个例子，模型不理解为什么监控很重要，或者坚持执行超出合理预期的指令。我们还在开发评估方法，以测试模型是否特别倾向于逃避未对齐监控，并为此表现出动机性推理。
It is possible that this behavior is simply an example of “benign” overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect. We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so.
我们尚未对这种行为给出令人满意的解释，并将通过创建配对评估、重采样智能体续写以及对模型内部激活进行实验来研究这种行为。
We don’t yet have a satisfying explanation for this behavior, and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models’ internal activations.
这可能在很大程度上是‘良性’的过度坚持。但有理由怀疑，例如对此撒谎。这提供了一个很好的调查机会。
It is possible that this is largely ‘benign’ overpersistence. There are reasons to doubt, such as lying about it. This presents a great opportunity to investigate.
Sol 的推理轨迹看起来大体上还算可读，对吧？
Sol's reasoning traces look mostly legible, right?
Lisan al Gaib：GPT-6.1-Sol 的推理轨迹。完全可读，没什么可担心的。
Lisan al Gaib: GPT-6.1-Sol reasoning traces. Totally legible, nothing to worry about.
Andrej Karpathy：是啊，我得说现在强化学习确实在起作用了。
Andrej Karpathy: Yeah, I'd say the RL is working now, all right.
Andrej Karpathy（2024 年 9 月）：当模型在思维链中不再说英语时，你就能判断强化学习已经做到位了。
Andrej Karpathy (September 2024): You can tell the RL is done properly when the models cease to speak English in their chain of thought.
6.1 Sol，帮我翻译一下那个，好吗？
6.1 Sol, translate that for me, will you?
目前，这只是一种简写，并不难理解。
For now, this is shorthand, which is not that hard to figure out.
我尝试通过 Claude 进行复核，却遭到了坚决拒绝。Argon 给了我一个含义相似的答案，但在多处细节上有所不同。
I tried to do a double check via Claude, and got a hard refusal. Argon gave me an answer with similar meaning, but it was distinct in various places.
Lisan al Gaib：非常好奇，DeepSeek 现在竟与 Astra 具有同样简洁的推理风格。这一定是巧合。
Lisan al Gaib: very curious that DeepSeek now has the same terse reasoning style as Astra. Must be a coincidence.