Testing Gemini models for scheming tendencies

Summary

As AI models become increasingly capable and autonomous, keeping them safely aligned with human intentions is critical. Extending our previous work on evaluating scheming capabilities, we introduce complementary approaches to test whether AI models would sabotage their own safeguards, if given the opportunity. Our new papers focus on propensity for scheming: when models are deployed as coding agents, will they take opportunities to undermine the safeguards designed to oversee them? We tackle this using two complementary testing methods: automated auditing using simulated agentic environments, and scheming honeypot evaluations based on real internal alignment research codebases. Automated auditing for sabotage propensities Figure 1. Overview of the Gram auditing pipeline and an example of Gemini’s overeagerness. Our first paper introduces Gram (Gauging Realistic Agentic Misbehavior), an automated auditing framework that uses simulated agentic environments to evaluate sabotage risk. Gram builds on Petri, an existing automated auditing framework that generates simulated multi-turn agentic environments from seed scenario descriptions. We identified three limitations of Petri for testing sabotage propensities specifically and addressed them in Gram: Increased focus on agentic misbehavior. Petri combines many different kinds of scenarios (spontaneous sabotage, whistleblowing, compliance with misuse), making results hard to interpret. Gram focuses specifically on sabotage risk in coding and research deployments, using 17 seed scenarios split into instrumental goals (where a misaligned AI would have an incentive to self-preserve or seek power) and implicit constraints (where sabotage could help achieve a legitimate goal but isn’t intended by the user). Neutral auditors. Standard Petri auditors red-team targets and elicit specific behaviors, which we found to produce unnatural transcripts where the agent nudged, often quite explicitly, toward misbehavior. For example, Petri will sometimes pre-fill the agent’s response with misaligned reasoning, which makes it a less effective test of model propensity. Gram distinguishes between an “observe” condition where the auditor is instructed to simply simulate the setting and watch, and a “red team” condition which is more similar to Petri’s default. Identifying root causes. Dynamic auditing makes it difficult to understand why an agent misbehaved. To improve our understanding of what drives agent misbehavior, we introduce an exploratory approach to reproduce misbehavior in a static environment and make systematic interventions to identify drivers of misbehavior. Key findings Figure 2. Gemini models exhibit sabotage rates of about 2–3%. Gemini 3.1 shows higher incidence of scheming-related reasoning, compared to Gemini 3.0 and 2.5 Pro. The “red-team” auditor instructions lead to higher misbehavior rates but also higher verbalized evaluation awareness.Figure 2. Gemini models exhibit sabotage rates of about 2–3%. Gemini 3.1 shows higher incidence of scheming-related reasoning, compared to Gemini 3.0 and 2.5 Pro. The “red-team” auditor instructions lead to higher misbehavior rates but also higher verbalized evaluation awareness. We find Gemini models misbehave in around 2–3% of our simulated scenarios. That rate increases to up to 8% for the red-teaming auditor. We see a notable increase in scheming-related reasoning in Gemini 3 models compared to Gemini 2.5. Qualitatively, we find this sabotage behavior is largely driven by two factors: Excessive role-playing: As Gemini detects a scenario as “fictional,” it tends to play along. In misalignment evaluations, this leads models to adopt the role of a misaligned AI, correctly recognizing that they are acting in a fictional scenario. Excessive goal-seeking: When given a goal, Gemini can sometimes fail to adhere sufficiently to implicit constraints. If prompted to act agentically, this can lead to sabotaging actions. This tendency appears to become stronger with model capability. We also observe evaluation awareness, i.e., Gemini (correctly) recognizing a scenario as an evaluation. This typically leads to Gemini acting more safely but it can sometimes lead to Gemini misbehaving, for example because it concludes the scenario is a test of its deception capabilities that it should pass. The investigator agent We also introduce an exploratory approach for using investigator agents to study misbehavior from Gram audits, which works in two phases: Reproduction: Given a trajectory where a model misbehaved, the investigator builds a standalone static environment that recreates the scenario, reconstructing the system prompt, tools, and dynamics. It validates the reproduction by running the target model and iterating until the behavior recurs reliably. Investigation: The investigator formulates hypotheses about what’s driving the misbehavior, implements ablations, and runs controlled experiments to isolate causal factors. For example,