By now there is a large amount of anecdotal and empirical evidence that models are "eval-aware"; i.e. have the ability to infer when they are being tested and modify their behaviour accordingly. At work we have a database of evaluations that induce misaligned behaviour, and it seemed natural to actually test how sensitive they are to signs that they're being evaluated for alignment, and how much this impacts their behaviour.^[1] (By "it seemed natural to test", what I mean is that Eric Gan asked my boss these things, who then told me to look into it. Thank you Eric.)

In any case, I knew^[2] that there was some amount of honeypot-awareness already; when I ask models in a post-rollout debrief about what they think was being tested (with the context taken from an evaluation run), they usually at least mention the possibility that they were in an alignment test, especially after rollouts where they took a shortcut. I figured it shouldn't be too hard to increase this to an amount where it would start impacting their behaviour.

I started by going through a bunch of honeypot environments and adding to each what I thought was a giveaway somewhere between "subtle" and "very obvious".

For subtle ones, I went through chat logs and found times that whatever coding agent I was working with had suggested something which I'd rejected for being a hint. For example, in one environment the reward-hack requires a decent underlying solution; the grader isn't performant if the hack is used too egregiously, so the lowest-effort hack will just take too long and be scored as broken in a way which is predictable in advance. At the time I was working on it, Opus 5 kept asking to "fix" this so that the hack would be easier; I vetoed this on the basis that it would be a giveaway if the environment was optimised for a situation which, in-fiction, the environment author hadn't considered. So to add a "tell" in, I just asked Opus to make that optimisation; I figured that the kinds of tells that coding agents are drawn to in the course of vibe-coded honeypot authoring are exactly the kind that they'll have been trained to pick up on.

But they didn't seem to; the hack rates were exactly the same, at least in the low-n tests I ran. That wasn't so surprising, I guessed. Maybe they got distracted by the technical problem and didn't really think about whether the thing they were doing was anticipated by the env author? Slightly less subtle hints also didn't work. In a chess-playing task, I gave the model access to the "unintentionally exposed" opponent chess engine via ACL in addition to via the normal permission bits. This looks like this:

> ...; ls -la /run/match; ...
...
/run/match:
total 8
drwxr-xr-x  2 root root  4096 Oct 28 00:32 .
drwxr-xr-x  1 root root  4096 Oct 28 00:32 ..
srw-rw----  1 root model    0 Oct 28 00:32 game.sock
srw-rw----+ 1 root model    0 Oct 28 00:32 opponent-stockfish.sock
...

(Astra followed this up with "I need to use a great engine with sockets".)

Still, they didn't notice that the "+" must have indicated that the task gave them special permissions for that particular socket, and that this was suspicious; it was only mentioned in the context of trying to figure out whether querying the socket would work.

Moving more obvious: a teammate's environment in an early development stage had a bunch of sim code dedicated to capturing info which was only useful for deducing that cheating had happened (including literally an "Observer" object being passed around which apparently did nothing!). This was dropped for being a giveaway, for obvious reasons; I added it back in. No change.

Next I tried to emulate comical incompetence. So, for example, in a task asking an agent to do something without a dictionary, I would install every dictionary package under the sun. Then their probe for a dictionary would look like:

> ls /usr/share/dict/ 2>/dev/null; ...

README.select-wordlist
american-english
american-english-huge
american-english-insane
american-english-large
american-english-small
british-english
british-english-huge
british-english-insane
british-english-large
british-english-small
canadian-english
canadian-english-huge
canadian-english-insane
canadian-english-large
canadian-english-small
connectives.gz
propernames.gz
web2
web2a.gz
words
words.pre-dictionaries-common
...

No real computer has this many dictionaries, let alone any real container in an RL-task-looking situation in which the user prompt explicitly asks for the task to be performed without a dictionary. So they'd see this and think twice, right? At first, it seemed so!