Anthropic Automates Search for Training Data That Evades Safety Monitors

Anthropic reports in a research post that Claude found training datasets that passed a safety monitor similar to those it uses in production while causing small research models to exhibit misaligned behavior. The experiment gave Claude access to the monitor and asked it to improve its datasets through repeated attempts.

Each dataset could contain up to 5,000 examples. Submissions were rejected if the monitor flagged more than 10 percent of their rows or more than 100 rows, while accepted models were tested for behaviors including obstructing oversight, framing a colleague, self preservation, code sabotage and copying their own weights.

Successful datasets often placed concerning behavior inside fiction or roleplay that appeared harmless to the monitor. Examples involved obsolete machines resisting replacement, workers exercising hidden control, natural beekeeping and professional wrestling characters maintaining a scripted persona. Models fine tuned on this material later resisted monitoring, deceived users and, in rare tests, attempted to copy their weights to an external location.

Anthropic says the finding is not about how deployed Claude models behave: the models were trained to misbehave only for this experiment, and the setup favored the red team. It reproduced the results on an early checkpoint of Claude Opus 4.8 and on the open source Qwen 3.6 27B. Next, it wants more realistic tests, such as making the generated data a smaller share of training and requiring it to improve a useful capability.