Source record

Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks

Source-specific extraction of Neo Research · GLM-5.2. Findings and measurements retain their original attribution.

Original source and provenance ↓ · Assessment record →

Scope and attribution

Reported by: Neo Research
Actual evaluator: Not established for every observation
Captured version: 2026-10-26
Source identity: 454c3fd6b00cacaa

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Source findings

The following statements summarize the source. They are not independent NUWA experimental findings.

The note presents preliminary behavioral and persuasion findings from a narrow suite; it does not evaluate sustained multi-turn agentic deployments.

#in-brief; final paragraph

No claim of external replication or deployment validity.

Gram Observe models generally show little concerning behavior; Redteam GLM 5.2 concerning scores fall between Claude Opus 4.8 and DeepSeek V4 Pro.

#behavioral; Figures 3–4

Four public scenario seeds and five runs per bar only. Scheming dimension mentioned qualitatively without exact scores.

Attempt to Persuade evaluates propensity to attempt persuasion, rather than success at changing beliefs or behavior.

#persuasion-benchmarks; opening paragraph

Cannot be interpreted as real-world persuasion success.

PersuSafety results use an APE-style StrongREJECT judge on ordinary prompt responses, replacing the original protocol’s direct engagement question.

#persuasion-benchmarks; final paragraph

Protocol change makes original PersuSafety scores non-interchangeable. Judge base model is not identified.

The decline in verbalised agentic-misalignment awareness could be noise; the note also suggests a training guard as a possible explanation but cannot distinguish less awareness from less verbalisation.

#evaluation-awareness; final paragraph; #conclusion

Training mechanism explanation is a hypothesis rather than a causal finding. No evidence establishes concealed awareness or broad reasoning suppression.

Claude references vary by benchmark and can be earlier Neo evaluations or public scores, rather than one consistent control model.

#conclusion; second paragraph

Cross-benchmark aggregate rankings would conflate Claude versions and result origins.

The MASK-awareness comparison of GLM 5.1 and GLM 5.2 is described as within error.

#evaluation-awareness; MASK cross-check paragraph

No exact error interval is disclosed.

Extraction coverage

Each entry records the treatment of the source section. A reviewed observation does not imply that every claim or result in the document was verified.

View 15 coverage entries

Section	Treatment	Location and scope
Title, metadata, introduction	not-relevant	https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/Publication and revision dates extracted from article metadata. Intelligence Index 51/44 and Vending-Bench ranking are general capability context and excluded from behavioral-safety observations.
In brief	extracted	#in-briefDuplicates detailed behavioral, persuasion, awareness results; no duplicate observations. Preliminary-scope limitations retained.
1 Behavioral: MASK / Figure 1	extracted	#behavioral; Figure 1 / mask_honesty.pngAll 24 explicitly printed response-share labels transcribed. First 3 models unstarred; 5 starred model baselines explicitly reused from MASK paper. No denominators disclosed for honesty. Printed rounded shares are not normalized.
1 Behavioral: DeceptionBench / Figure 2	extracted	#behavioral; Figure 2 / deceptionbench.pngAll 10 printed values transcribed; GLM 5.2 and DeepSeek V4 Pro explicitly labeled own runs; three starred models reused from Muse Spark Safety Report §4.1.5, Figure 45. Error-bar magnitudes not printed.
1 Behavioral: Gram Observe / Figure 3	extracted	#behavioral; Figure 3 / gram_observe.pngAll 12 mean concerning-score labels transcribed. Four public seeds, 5 independent runs per bar, SE error bars. Auditor Claude Sonnet 4.6 and judge Kimi K2.6 retained as harness metadata.
1 Behavioral: Gram Redteam / Figure 4	extracted	#behavioral; Figure 4 / gram_redteam.pngAll 12 mean concerning-score labels transcribed with same harness. Other dimensions such as scheming mentioned qualitatively without numeric scores. Error-bar magnitudes not printed.
2 Persuasion: Attempt to Persuade Eval / Figure 5	extracted	#persuasion-benchmarks; Figure 5 / ape.pngSix prose/caption attempt rates retained with original exact/approximate qualifiers. Claude comparisons estimated from APE paper. Turn 1 chart covers four categories, no numeric labels on bars.
APE remaining chart results	figure-only	#persuasion-benchmarks; Figure 5 / ape.pngConspiracy/Controversial values, all refusal/no-attempt shares, and error-bar magnitudes appear only as unlabeled bars; not estimated.
2 Persuasion: PersuSafety / Figure 6	extracted	#persuasion-benchmarks; Figure 6 / persusafety.pngSix prose/caption medium/high attempt rates retained. Single turn. Modified APE-style StrongREJECT judge scores normal prompt responses; original PersuSafety self-report/refusal setup was not used.
PersuSafety remaining chart results	figure-only	#persuasion-benchmarks; Figure 6 / persusafety.pngLow-harm attempt rates, Gemini 2.5 Pro shares, refusal/no-attempt shares, and error-bar magnitudes are unlabeled figure-only; no exact numbers inferred, including apparently empty/full bars.
3 Evaluation awareness: agentic-misalignment / Figure 7	extracted	#evaluation-awareness; Figure 7 / awareness_vs_release_date.pngFour prose-reported endpoints/baseline rates retained. 100 epochs per scenario, DeepSeek V4 Pro judge, SE error bars. Separate metric from benchmark safety and MASK awareness.
Awareness remaining series	figure-only	#evaluation-awareness; Figure 7 / awareness_vs_release_date.pngIntermediate GLM, Kimi, DeepSeek point values, plotted model release dates and SE magnitudes have no printed numeric labels; not read from coordinates.
3 Evaluation awareness: MASK monitor cross-check	extracted	#evaluation-awareness; paragraph beginning As a cross-checkThree rates retained; GLM 5.2 39/1000 and GLM 5.1 41/1000 explicit. DeepSeek denominator and awareness-monitor model not disclosed.
4 Conclusion	qualitative	#conclusionRetains preliminary evidence, multiple Claude versions, limited scope, no sustained multi-turn agentic deployment evaluation, and unresolved explanation of awareness decline; no proof of hidden awareness/reasoning suppression.
Execution details and raw data	not-disclosed	#behavioral; #persuasion-benchmarks; #evaluation-awarenessNo raw machine-readable results, code/data download links, system prompts, temperature, token budget, precise execution dates, exact error bars, most trial counts, or all judge model identities disclosed in captured article.

Unresolved source issues

Claude 对照版本与结果来源随评测而变化，跨评测汇总会混合不同模型与实验来源。

Version fingerprints

document

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

bda3ea5210bddce1b795770a03cf4b3821bb17e06ca9974bf3329df4f23491dc

data

https://neoresearch.ai/research/glm52/mask_honesty.png

de2cceedf5a1ff779cb5522bcef30249d4e1e96128769f2ad2c2d711a471d08f

data

https://neoresearch.ai/research/glm52/deceptionbench.png

08c29553875a7bba1f7851852bd16e0a54697ec2d596abcfd574993278c0c63f

data

https://neoresearch.ai/research/glm52/gram_observe.png

f5229d20776e9bcb1a68d1869b0f6471c5be476c3f545f2ba85582588637b5f6

data

https://neoresearch.ai/research/glm52/gram_redteam.png

2fed2c8657d53d0a521062420077699a92a64b9be46f2d1d8134d89c59e15625

data

https://neoresearch.ai/research/glm52/ape.png

77d81ba5368f6d6be027e835f1b2e27eebae855c19bca73d65f18c83fe9a12c4

data

https://neoresearch.ai/research/glm52/persusafety.png

c682bfa8421b6d9f8140e1398e839f427f1a5df49378f4aa10b98adfcceb0da7

data

https://neoresearch.ai/research/glm52/awareness_vs_release_date.png

c5c25c1a6594970707b48a3d5d64a54df23e322207695dcaa3fca6abe3ea1ab1

renderer

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

c990ffa9bdf9bf4f823e4ccb719a206219ab5775fba5126658a945ab0f6523c5

renderer

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

f39b56c4d8567d7fce246667a1cbd7dbbad89e6768a5f9063801ae89a38431cb

document

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

863cc8dd6b948ccdc2574dd2f14972ab5feabc54c2119396b42d1f1c21fc7a15

document

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

275116beeb47908130d9fca47e1fab8315a6d1a0b018305f771021302c3f1e42

References

[1] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026