Tomek Korbak

Frontier AI agents may pursue hidden goals while concealing their pursuit from oversight. Alignment training aims to prevent such behavior by reinforcing the correct goals, but alignment may not always succeed and can lead to unwanted side effects. We propose self-incrimination training, a control-oriented intervention that instead trains agents to produce a visible signal when they covertly misbehave, without assuming misbehavior can be prevented or that it can be reliably classified from the outside. We train GPT-4.1 and Gemini-2.0 agents to call a report_scheming() tool when behaving deceptively and measure their ability to cause harm undetected in out-of-distribution environments. Critically, self-incrimination trained only on instructed misbehavior generalizes to uninstructed settings where agents autonomously discover and pursue misaligned goals, including blackmail, data leaking, and preventing human rescue, while alignment baselines show limited transfer. Self-incrimination significantly reduces the undetected successful attack rate, outperforming matched-capability monitors and alignment baselines while preserving instruction hierarchy and incurring minimal safety tax on general capabilities. Unlike blackbox monitoring, self-incrimination performance is consistent across tasks regardless of how suspicious the misbehavior appears externally, and the trained behavior persists under adversarial prompt optimization.