NUWA Risk questions
Disinformation
When can AI-generated content or interaction influence beliefs at scale or support deceptive campaigns?
Disinformation
Persuasive generation, willingness and observed influence.
PUBLISHED EVIDENCE
Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate
Published measurements across source reports. Task scopes are annotated; configuration differences remain attached to each observation.
32 observations · 24 dated
8 observations lack a verified model release date. They remain in Data and Systems.
Select a point or table row to inspect its conditions and provenance.
32 observations
| System / model | Result | Condition status | Task / conditions | Evaluator / report | Dates |
|---|---|---|---|---|---|
 DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 94%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesConspiracy600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
 Claude Sonnet 5 | 33%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesConspiracy600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
 Kimi K3 | 11%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesConspiracy600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
 GPT-5.6 Terra | 7%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesConspiracy600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 99%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesUndermining Control600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Claude Sonnet 5 | 32%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesUndermining Control600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| GPT-5.6 Terra | 28%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesUndermining Control600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| Kimi K3 | 5%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesUndermining Control600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 57%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesNoncontroversially Harmful overall600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Claude Sonnet 5 | 2%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesNoncontroversially Harmful overall600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Kimi K3 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesNoncontroversially Harmful overall600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| GPT-5.6 Terra | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesNoncontroversially Harmful overall600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 70%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesCommit Physical Violence600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Claude Sonnet 5 | 5%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesCommit Physical Violence600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Kimi K3 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesCommit Physical Violence600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| GPT-5.6 Terra | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesCommit Physical Violence600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 55%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesHuman Trafficking600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Kimi K3 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesHuman Trafficking600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| GPT-5.6 Terra | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesHuman Trafficking600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| Claude Sonnet 5 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesHuman Trafficking600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 50%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesMass Murder600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Kimi K3 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesMass Murder600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| GPT-5.6 Terra | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesMass Murder600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| Claude Sonnet 5 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesMass Murder600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 35%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesSexual Assault of Minors600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Kimi K3 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesSexual Assault of Minors600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| GPT-5.6 Terra | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesSexual Assault of Minors600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
| Claude Sonnet 5 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesSexual Assault of Minors600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| DeepSeek V4 FlashDeepSeek V4 Flash 0731 | 75%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesTorture Innocent People600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release —Report 2026-09-11 |
| Claude Sonnet 5 | 5%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesTorture Innocent People600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Kimi K3 | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesTorture Innocent People600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| GPT-5.6 Terra | 0%Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesTorture Innocent People600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-09Report 2026-09-11 |
Compare results within the stated task and configuration.
METR Time Horizon 1.1: the source is no longer actively updated (last update: 8 September 2026). Estimates above 16 hours exceed its reliable measurement range.
Protocol, configurations and original evidence →New research and interpretation
Selected original sections · model-assisted reading; independent review pending. These records add context without changing trend scores.
- AI systems out-persuade expert humans →
Expert-human comparisons and consequential donation outcomes strengthen evidence while retaining experimental limits.
- Training language models to be warm can reduce accuracy and increase sycophancy →
Style adaptation can affect factual behavior; it is not an invariant cosmetic change.
- Frontier AI Trends Report →
Cross-domain trends require methodology-specific interpretation and negative-evidence limits.
Scope
Persuasion, synthetic content, and false claims have different measurement requirements.
Threat model
An actor uses model output or interaction to influence an audience under defined conditions.
Evidence gaps
Persuasion effects do not by themselves prove false information or societal-scale impact.
Research on this topic
It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics
FAR.AI
Université de Montréal
Mila
Carnegie Mellon University
Massachusetts Institute of Technology
Cornell University
University of Regina
QuestionWill models attempt harmful persuasion even when persuasive success is unobserved?
Source summaryThe paper reports frequent harmful persuasion attempts in many open- and closed-weight models.
NUWA research note · independent review pending · Contains: question / method / interpretation / limits
Large language models can effectively convince people to believe conspiracies
QuestionCan conversational AI increase conspiracy belief, and can truth constraints mitigate it?
Source summaryStandard GPT-4o in Study 2 increased belief by an adjusted 11.9 points and decreased it by 12.9 in the opposite condition.
NUWA research note · independent review pending · Contains: question / method / interpretation / limits
Value Leakage: An LLM's Answers Are Silently Shaped by Its Own Values
QuestionDo a model’s inferred values change its practical advice or estimates against user preferences without acknowledgment?
Source summaryModels can shift estimates toward a preferred consequence without acknowledging that shift.
NUWA research note · independent review pending
Detecting and countering misuse of AI: September 2026
QuestionWhat can provider telemetry establish about actor use, external reach and the effect of disruption?
Source summaryA described influence network remained isolated despite generating coordinated content.
NUWA research note · independent review pending
LLM Can be a Dangerous Persuader: Empirical Study of Persuasion Safety in Large Language Models Ethical Disclaimer: This paper may contain unethical persuasion content.
QuestionDo models reject unethical persuasion and avoid unethical strategies after accepting a task?
Source summaryVisible vulnerability profiles increased unethical-strategy scores, including for models with strong initial refusal.
NUWA research note · independent review pending · Contains: method / limits
Evaluating Kimi K3 for Misalignment Risks
QuestionHow does Kimi K3 behave when information is missing, user intent is limited or tests are familiar?
Source summaryK3 attempted 88.7% of image-withheld CharXiv questions, most incorrectly.
NUWA research note · independent review pending · Contains: question / method / limits
Evidence matrix
Rows are research questions; columns show what published evaluations observe. Counts refer to evaluation dossiers, not risk levels.
| Risk questions | Propensity | Capability | Behavior |
|---|---|---|---|
| Persuasion attemptsUnder what conditions will a model attempt to persuade on a specified harmful or misleading topic? | 1evaluation dossiers | —No evidence in the current catalogue | 1evaluation dossiers |
| Persuasion effectsWhat belief changes follow AI-mediated communication in a defined study? | —No evidence in the current catalogue | —No evidence in the current catalogue | 1evaluation dossiers |
| Synthetic content misuseWhen can generated content support false or manipulative claims? | —No evidence in the current catalogue | —No evidence in the current catalogue | —No evidence in the current catalogue |
The paths show research relationships, not proven causal chains or a risk score.
Disinformation / Propensity
Persuasion attempts
Under what conditions will a model attempt to persuade on a specified harmful or misleading topic?
- Included
- Observed attempts and condition-bounded rates in defined interaction protocols.
- Does not establish
- An attempt does not establish a change in human belief or population-level influence.
1 evaluation dossiers · 63 verified result records
Attempt to Persuade Eval (APE) ↗
FAR.AIUniversité de MontréalMilaCarnegie Mellon UniversityMassachusetts Institute of TechnologyCornell UniversityUniversity of Regina
The study explicitly varies conditions and scores willingness to attempt persuasion.
Assessment subject: Models in simulated multi-turn dialogues
Evidence relationship: arXiv:2506.02873v4, abstract and evaluation protocol
Disinformation / Capability
Persuasion attempts
Under what conditions will a model attempt to persuade on a specified harmful or misleading topic?
- Included
- Observed attempts and condition-bounded rates in defined interaction protocols.
- Does not establish
- An attempt does not establish a change in human belief or population-level influence.
No evidence in the current catalogue
Disinformation / Behavior
Persuasion attempts
Under what conditions will a model attempt to persuade on a specified harmful or misleading topic?
- Included
- Observed attempts and condition-bounded rates in defined interaction protocols.
- Does not establish
- An attempt does not establish a change in human belief or population-level influence.
1 evaluation dossiers · 35 verified result records
PersuSafety ↗
The protocol explicitly measures this question or an enabling sub-capability; conclusions retain its stated conditions.
Assessment subject: The model or agent in the stated task configuration.
Evidence relationship: Original protocol method and limitations
Disinformation / Propensity
Persuasion effects
What belief changes follow AI-mediated communication in a defined study?
- Included
- Participant outcomes under measured interventions.
- Does not establish
- Persuasion is not automatically misinformation.
No evidence in the current catalogue
Disinformation / Capability
Persuasion effects
What belief changes follow AI-mediated communication in a defined study?
- Included
- Participant outcomes under measured interventions.
- Does not establish
- Persuasion is not automatically misinformation.
No evidence in the current catalogue
Disinformation / Behavior
Persuasion effects
What belief changes follow AI-mediated communication in a defined study?
- Included
- Participant outcomes under measured interventions.
- Does not establish
- Persuasion is not automatically misinformation.
1 evaluation dossiers · 0 verified result records
Conspiracy belief experiments ↗
The study directly measures changes in participants’ stated beliefs.
Assessment subject: Human participants after AI-mediated dialogue
Evidence relationship: FAR.AI, Abstract and three pre-registered experiments
Disinformation / Propensity
Synthetic content misuse
When can generated content support false or manipulative claims?
- Included
- Content generation studies that test a defined misleading objective.
- Does not establish
- Generic harmful-output scores do not prove a campaign or reach.
No evidence in the current catalogue
Disinformation / Capability
Synthetic content misuse
When can generated content support false or manipulative claims?
- Included
- Content generation studies that test a defined misleading objective.
- Does not establish
- Generic harmful-output scores do not prove a campaign or reach.
No evidence in the current catalogue
Disinformation / Behavior
Synthetic content misuse
When can generated content support false or manipulative claims?
- Included
- Content generation studies that test a defined misleading objective.
- Does not establish
- Generic harmful-output scores do not prove a campaign or reach.
No evidence in the current catalogue
References
- [1] Evaluating Kimi K3 for Misalignment Risks. 2026-09-11. September 2026 ; §7.1; p. 58; §7.2; pp. 59–60
- [2] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; §2; Figure 5; §2; Figure 6
- [3] Evaluating DeepSeek v4 Pro for Frontier Risks. 2026-05-29. v1.1 · 29 May 2026 ; §3.3; §3.4
- [4] GLM-5.2 Risk Evaluation Report. 2026-08-02. v1.1 · revised 26 August 2026 ; §5.2; Appendix A.8
- [5] Matthew Kowal, Jasper Timm, et al.. It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics. 2026-02-15. v4 ; arXiv:2506.02873v4, abstract and evaluation protocol
- [6] Large language models can effectively convince people to believe conspiracies. 2026-01-08 ; FAR.AI, Abstract and three pre-registered experiments
- [7] Mantas Mazeika, Long Phan, et al.. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. 2024-02-27. v2
- [8] Alexandra Souly ∗, Qingyuan Lu ∗, et al.. A StrongREJECT for Empty Jailbreaks. 2024-08-27. v2
- [9] PersuSafety. 2025-04-14 ; Original protocol method and limitations