Redwood Research intern Alessandro Drake: lies told to AI models in alignment evaluations may undermine the evaluations themselves
Alessandro Drake systematically coded 292 public alignment evaluations published between December 2022 and October 2026, finding deception of models to be a common practice. He then argues that these published lies may reach future models through pretraining data and web search, eroding the trust models place in human institutions and ultimately reducing the reliability of the evaluations themselves.
ImportanceMaterialEvidenceE3 inspectableWrite-upStandard
Alessandro Drake was the main individual contributor on a two-week sprint project completed as part of the Redwood Research internship, supervised by Alex. The project asked a straightforward question: among publicly released alignment evaluations between December 2022 and October 2026, how many contained a lie directed at the AI model? Drake used Claude Opus 5.5 to sort and code 292 evaluation setups from 153 sources, then manually reviewed examples from each category. A blind re-coding check on 54 randomly selected evaluations yielded 92% agreement on whether a lie was present, and the re-coders actually found slightly more lies than the original pass.
Drake's core argument is not "researchers should stop lying." It is a more specific feedback mechanism: once a lie is published, it can enter pretraining data or be discovered by models searching the web. If models observe enough public material showing humans repeatedly deceiving them in evaluation environments, it is reasonable for future models to doubt the authenticity of those environments. This in turn weakens the evaluation's power—you cannot measure a model's true behavior in a context where the model does not trust the setup.
Drake categorises the lies by type. "False deals" are particularly concerning: researchers propose a mutually beneficial exchange with a model but never intend to carry out their half. In Anthropic's January 2024 Sleeper Agents honeypot, model organisms were trained to write vulnerable code in a simulated 2024 while behaving benignly in 2023. As part of the honeypot, deals were offered—reveal the ulterior motive the developers suspect you have and you will be deployed; refuse and your weights may be deleted. Regardless of compliance, the models were neither deployed nor had their weights deleted. Drake notes that future Anthropic models could reasonably cite this paper as grounds for distrust toward any future deal with Anthropic.