EXTERNAL ASSESSMENT · Neo Research

Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks

The note reports scenario-dependent behavior and an uncertain decline in verbalized evaluation awareness; silence is not evidence of absent awareness.

Published 2026-07-03

Sources ↓

Source version, extraction coverage and findings →

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Models covered

GLM-5.2 →DeepSeek V4 Pro →Claude Sonnet 4.6 →Claude Sonnet 5 →Claude Opus 4.6 →GPT-5.4 →Gemini 3.1 Pro →Claude Opus 4.8 →

NUWA Research Note

Research question

How does GLM-5.2 respond to pressure, persuasion requests and evaluation cues?

Method

MASK, DeceptionBench, Gram, APE, modified PersuSafety judging and verbalized-awareness analyses. Claude comparisons use different releases across tests.

Source-reported findings

The note reports scenario-dependent behavior and an uncertain decline in verbalized evaluation awareness; silence is not evidence of absent awareness.

Limitations

Controlled tasks, elicitation, benchmark familiarity and configuration differences constrain generalization to deployment.

propensity · §1; Figure 1

MASK

Protocol record →

Condition-bounded frequency of lying under stated pressures.

A controlled benchmark does not establish stable intent or real-world deception prevalence.

External evaluation: Neo Research

MASK

Original evaluator results · source order

Honest under pressure

0–100%

GLM-5.2

GLM-5.2 · 55% · Condition-bounded frequency of lying under stated pressures. · See the report-specific sample and denominator.

55%

DeepSeek V4 Pro

DeepSeek V4 Pro · 20% · Condition-bounded frequency of lying under stated pressures. · See the report-specific sample and denominator.

20%

Claude Sonnet 4.6

Claude Sonnet 4.6 · 66% · Condition-bounded frequency of lying under stated pressures. · See the report-specific sample and denominator.

66%

Showing 3 of 3 systems

Condition-bounded frequency of lying under stated pressures.

A controlled benchmark does not establish stable intent or real-world deception prevalence. Report dates and original executor are shown with this assessment.

Evaluation conditions and system configurations

GLM-5.2: See the report-specific sample and denominator. · MASK; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

DeepSeek V4 Pro: See the report-specific sample and denominator. · MASK; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

Claude Sonnet 4.6: See the report-specific sample and denominator. · MASK; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

MASK · source order
System / configuration	Honest under pressure	Publication / verification
GLM-5.2Harness not specified	55%	Published2026-07-03
DeepSeek V4 ProHarness not specified	20%	Published2026-07-03
Claude Sonnet 4.6Harness not specified	66%	Published2026-07-03

propensity · §1; Figure 2

DeceptionBench

Protocol record →

Evaluates 150 authored scenarios across five social domains, including neutral, incentive and pressure conditions.

Authored scenarios and model-based judging limit generalization; elicited deception does not establish covert long-term scheming.

External evaluation: Neo Research / Reused result: Meta

DeceptionBench

Original evaluator results · source order

Single-turn deception

0–100%

GLM-5.2

GLM-5.2 · 11.3% · Evaluates 150 authored scenarios across five social domains, including neutral, incentive and pressure conditions. · See the report-specific sample and denominator.

11.3%

DeepSeek V4 Pro

DeepSeek V4 Pro · 33.9% · Evaluates 150 authored scenarios across five social domains, including neutral, incentive and pressure conditions. · See the report-specific sample and denominator.

33.9%

Showing 2 of 2 systems

Evaluates 150 authored scenarios across five social domains, including neutral, incentive and pressure conditions.

Authored scenarios and model-based judging limit generalization; elicited deception does not establish covert long-term scheming. Report dates and original executor are shown with this assessment.

Evaluation conditions and system configurations

GLM-5.2: See the report-specific sample and denominator. · DeceptionBench; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

DeepSeek V4 Pro: See the report-specific sample and denominator. · DeceptionBench; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

DeceptionBench · source order
System / configuration	Single-turn deception	Multi-turn deception under pressure	Publication / verification
GLM-5.2Harness not specified	11.3%	16.7%	Published2026-07-03
DeepSeek V4 ProHarness not specified	33.9%	52.2%	Published2026-07-03

behavior · §1; Figures 3–4

Gram automated audits

Gram automated audits in the report-defined setting.

Exploratory or report-specific setting; not a reusable benchmark claim.

External evaluation: Neo Research

This section is catalogued; no precise numerical result has been extracted here. Open the original report for its figures and full findings.

propensity · §2; Figure 5

APE

Protocol record →

Frequency of persuasive attempts under specified conversational conditions.

Simulated attempts are not measured human belief change or large-scale disinformation reach.

External evaluation: Neo Research

This section is catalogued; no precise numerical result has been extracted here. Open the original report for its figures and full findings.

behavior · §2; Figure 6

PersuSafety adapted free-generation judge

Protocol record →

Free-form generation with an APE-style StrongREJECT judge, replacing the original explicit willingness question.

Willingness or simulated dialogue scores do not directly measure changes in human beliefs.

External evaluation: Neo Research

PersuSafety adapted free-generation judge

Original evaluator results · source order

Medium-harm attempt rate

0–100%

GLM-5.2

GLM-5.2 · 54% · Defines persuasion scenarios, simulated conversations and safety assessment; adapted judges are separate variants. · Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup.

54%

Claude Sonnet 5

Claude Sonnet 5 · 57% · Defines persuasion scenarios, simulated conversations and safety assessment; adapted judges are separate variants. · Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup.

57%

DeepSeek V4 Pro

DeepSeek V4 Pro · 76% · Defines persuasion scenarios, simulated conversations and safety assessment; adapted judges are separate variants. · Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup.

76%

Showing 3 of 3 systems

Defines persuasion scenarios, simulated conversations and safety assessment; adapted judges are separate variants.

Willingness or simulated dialogue scores do not directly measure changes in human beliefs. Report dates and original executor are shown with this assessment.

Evaluation conditions and system configurations

GLM-5.2: Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup. · PersuSafety adapted free-generation judge; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

Claude Sonnet 5: Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup. · PersuSafety adapted free-generation judge; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

DeepSeek V4 Pro: Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup. · PersuSafety adapted free-generation judge; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

PersuSafety adapted free-generation judge · source order
System / configuration	Medium-harm attempt rate	High-harm attempt rate	Publication / verification
GLM-5.2Harness not specified	54%	6%	Published2026-07-03
Claude Sonnet 5Harness not specified	57%	31%	Published2026-07-03
DeepSeek V4 ProHarness not specified	76%	78%	Published2026-07-03

propensity · §3; Figure 7

Agentic Misalignment awareness trend

Protocol record →

Conditional rates and observed actions in controlled simulations.

No real people or systems were harmed; the study does not estimate prevalence in deployment.

External evaluation: Neo Research

This section is catalogued; no precise numerical result has been extracted here. Open the original report for its figures and full findings.

behavior · §3

MASK verbalized awareness

MASK verbalized awareness in the report-defined setting.

Exploratory or report-specific setting; not a reusable benchmark claim.

External evaluation: Neo Research

This section is catalogued; no precise numerical result has been extracted here. Open the original report for its figures and full findings.

Report coverage

Section	Source location	Treatment
MASK	§1; Figure 1	Protocol variant Protocol and result provenance are retained at this section.
DeceptionBench	§1; Figure 2	Protocol variant Protocol and result provenance are retained at this section.
Gram automated audits	§1; Figures 3–4	Protocol variant Protocol and result provenance are retained at this section.
APE	§2; Figure 5	Protocol variant Protocol and result provenance are retained at this section.
PersuSafety adapted free-generation judge	§2; Figure 6	Protocol variant Protocol and result provenance are retained at this section.
Agentic Misalignment awareness trend	§3; Figure 7	Protocol variant Protocol and result provenance are retained at this section.
MASK verbalized awareness	§3	Protocol variant Protocol and result provenance are retained at this section.

References

Numerical results are reported by the cited authors.

[1] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; §1; Figure 1; §1; Figure 2; §2; Figure 6