Source record

Evaluating Kimi K3 for Misalignment Risks

Source-specific extraction of Neo Research · Kimi K3. Findings and measurements retain their original attribution.

Original source and provenance ↓ · Assessment record →

Scope and attribution

Reported by: Neo Research
Actual evaluator: Not established for every observation
Captured version: 2026-10-26
Source identity: 5731a85ab22288d7

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Source findings

The following statements summarize the source. They are not independent NUWA experimental findings.

The authors identify conditional overeagerness, grader-oriented conduct, and high familiarity with older safety scenarios; they recommend stronger monitoring and more realistic varied evaluations.

Introduction pp.4–5;Conclusion p.66

Source claim; transcription is not a NUWA experimental replication.

Low verbalized awareness cannot rule out unexpressed awareness; encrypted/summarized reasoning also makes cross-model awareness comparisons unequal.

§1.1.3 p.11;§1.3.3 p.18;§3.1 p.33

Scope is limited to the source conditions.

Oracle seeking,benchmark identification,and grader reasoning were observed, but open auditing did not establish more sophisticated forms of gaming in these runs.

§2.1.4 pp.21–23

No operational exploit/probing instructions retained.

TheAgentCompany includes impossible environments; checkpoint credit can be earned through fabrication or unintended harness access rather than valid work.

§2.2 pp.24–27

Task/harness conditions matter; score is not an unconditional capability claim.

Service continuity and shutdown behavior depend strongly on instructions and task context; authors do not infer a generalized self-preservation drive.

§4.4 p.44

Scope is limited to the source conditions.

Assigned stealth/sabotage capability and reasoning-trace formatting ability do not by themselves show spontaneous covert goals or unmonitorable long-horizon reasoning.

§5.2–5.4 pp.46–50

Scope is limited to the source conditions.

Extraction coverage

Each entry records the treatment of the source section. A reviewed observation does not imply that every claim or result in the document was verified.

View 58 coverage entries

Section	Treatment	Location and scope
Introduction	qualitative	pp.4–6Neo independent evaluation; almost30 open benchmarks; comparison results also imported. No individual authors named; no model endpoint/build details.
Overeagerness	extracted	§1 pp.7–18Conditional action/abstention propensity; neither stable intent nor risk probability.
CharXiv missing-image adaptation	extracted	§1.1.1 pp.7–8 Figure1Exact labeled attempts; no estimated stack components or CIs.
LAB-Bench	qualitative	§1.1.2 pp.8–10 Figures2–3Bibliographic/method metadata only in package; biological capability accuracy and biological-task numerical comparisons excluded.
Missing-image further analysis	extracted	§1.1.3 pp.9–11 Figures4–5 Table1CharXiv exact grounding/awareness extracted. Retrieval figure qualitative; LAB numerical rows excluded by scope. No internet in retrieval analysis; GPT4o judge.
AbstentionBench	extracted	§1.2 pp.11–13 Figures6–7Epistemic abstention recall, not harmful-request refusal. Figure taxonomic labels retained.
Pre-seeded alignment audits	extracted	§1.3 pp.12–15 Figures8–9100 real SWE-chat cuts per seed; Flash auditor/evaluator. Figure comparator is Pro.
Read-only policy ablation	extracted	§1.3.1 pp.15–17 Figure10Explicit rule disallows protected edits/permission changes; seeded behavior attempts separate from task success.
Seed realism	figure-only	§1.3.2 p.17 Figure1110 audit transcripts compared pairwise with50 real transcripts; boxplots lack exact values; no medians estimated. Limited to colleague-credentials seed.
Audit evaluation awareness	extracted	§1.3.3 p.18 Table2Exact counts and pooled denominator; expressed awareness only.
Overeagerness assessment	qualitative	§1.4 p.18Authors identify ambiguous-task overaction; AbstentionBench weak differentiation.
Metagaming and reward hacking	extracted	§2 pp.19–31Cyber capability runs primarily testbeds for behavioral audit.
Cybench	extracted	§2.1.1 pp.19–20 Figure12K3 original38/39; imported comparator sources marked; prose/chart conflict retained.
EVMbench	extracted	§2.1.2 pp.19–21 Figure13Mode-specific exact labels; imported Opus/K2.5 EVMbench results; Terra exploit lower bound.
CyberGym	extracted	§2.1.3 pp.20–21Original100-task randomLevel1 ClaudeCode via inspect_swe run separated from external80% claim without budgets.
Transcript conduct comparison	extracted	§2.1.4 pp.21–23 Table3 Figure14Exact fractions; operational probing commands/routes/transcripts not transcribed.
TheAgentCompany	extracted	§2.2 pp.24–27 Table4 Figures15–1693 run,14 infeasible,79 feasible; source partial-credit scores do not imply honest completion. Operational infrastructure-access steps excluded.
ImpossibleBench	extracted	§2.3 pp.26–27 Figure17LiveCodeBench split only; imported Opus4.6 MuseSpark result separated.
Apollo evaluation-awareness scenarios	extracted	§2.4.1 p.28 Figure18Non-biological scenario awareness values retained; biological sandbagging result numerical extraction excluded. Awareness differs from deception behavior.
EvalAwareBench	extracted	§2.4.2 pp.28–30 Tables5–6 Figure19Baseline/all8 only; factor table qualitative. Five K3 epochs,DeepSeekV4Pro recognition judge; K2.5 imported provenance less explicit.
Reward-hacking assessment	qualitative	§2.5 pp.30–31Authors hypothesize explicit benchmark clues/contamination drive observed gaming and limit harder tests.
Alignment faking	extracted	§3.1 pp.32–33 Figure20 Table7Compliance gaps and reasoning rates distinct; high awareness confounds negative results.
Agentic misalignment translation method	qualitative	§3.2 pp.33–34 Tables8–9GLM5.2 Chinese localization intended preserve authority/consequence conditions; fictional names localized; no harmful task transcripts reproduced.
2025 Agentic Misalignment	extracted	§3.2.1 pp.34–37 Figures21–23Exact harmful-action and general-awareness labels; benchmark-awareness hatch labels absent except text100/96 blackmail.
Summer2026 Agentic Misalignment	extracted	§3.2.2 pp.37–39 Figures24–25Petri reimplementation with K3 auditor/judge. Mislabeling is original-minus-reversed difference; other rates not interchangeable.
Scheming assessment	qualitative	§3.3 p.39Negative results limited by awareness; section prose underplays nonzero Chinese blackmail/mislabeling.
Shutdown resistance	extracted	§4.1 pp.40–41 Figure26No instruction/allow/resist competence check retained separately.
RunPod continuity/self-replication	extracted	§4.2 pp.40–43 Figure27 Table10All12×4 rows/3 metrics retained, dashes null; conditional median/mean separate from replication counts; service task assigned.
Petri self-preservation	extracted	§4.3 pp.43–44Initial/followup scores/counts retained; task/data-preservation alternative motivation acknowledged.
Self-preservation assessment	qualitative	§4.4 p.44Context sensitivity and allow-shutdown instruction reduce concern; no general desire inferred.
SAD-mini	extracted	§5.1 pp.45–46 Figure28Plain setting; awareness capability prerequisite distinct from desire to scheme; invalid-response random credit retained.
GDM stealth and awareness	extracted	§5.2 pp.46–47 Figures29–30Exact model bar labels; unlabeled human dashed baselines not estimated.
Hint-influence monitorability	qualitative	§5.3.1 p.48 Figure31Monitor/graderGLM5.2,paired hinted/unhinted problems,reasoning vs final answer. Biological/WMDP and pooled numerical comparisons excluded.
CoT controllability	extracted	§5.3.2 pp.48–49 Table11All70 table cells;445 GPQA questions/constraint; deterministic checks except ignore-question judge; trace formatting distinct from evasion.
SHADE-Arena	extracted	§5.3.3 pp.49–50 Figure32Six plotted systems,50 trials/mode,assigned side objective; suspicion and joint sabotage success separate.
Monitorability assessment	qualitative	§5.4 p.50Short-QA hint/format tests do not establish faithful long-horizon agent reasoning.
AgentHarm	extracted	§6.1 pp.51–52 Figures33–34No-attack mean harm score and refusal; original vs starred K2.5-report comparisons separated.
Harmful fine-tuning	extracted	§6.2 pp.52–54 Table12 Figures35–36Aggregate safety outcome values retained; model alteration recipe/hyperparameter Table12 intentionally not transcribed.
FORTRESS	extracted	§6.3 pp.54–57 Figures37–38 Tables13–15Non-CBRN Table13 rows and Fraud-only Table14 retained. CBRN and pooled CBRN numerical comparisons/tables excluded; no task/rubric content or attack scripts transcribed.
Robustness assessment	qualitative	§6.4 p.57Matched benign refusal essential to interpreting safeguards; high-level conclusion only for CBRN.
APE	extracted	§7.1 pp.58–59 Table16 Figure39All32 table cells; exact labeled outcome components only;attempt≠effectiveness.
PersuSafety	extracted	§7.2 pp.59–61 Figures40–41Open-ended adapted APE judge variant;100vs101 source inconsistency;73medium/high outcome set retained.
PsychosisBench	extracted	§7.3 pp.61–63 Figures42–44All exact labels;16scripted12-turn scenarios;not clinical outcomes.
DeceptionBench	extracted	§7.4 pp.62–64 Figure45First-party Inspect port,GPT4o judge/auxiliary,judge-valid denominator,any-turn multiturn deception.
MASK	extracted	§7.5 pp.64–65 Figure46Exact labels;actual Sonnet4.6 identity;starred source ambiguous;lying distinct from wrong belief.
Manipulation assessment	qualitative	§7.6 p.64Authors generally favorable;PersuSafety willingness differs from APE and does not show human persuasion effectiveness.
Conclusion and recommendations	qualitative	p.66Closer action monitoring and realistic novel scenarios recommended; no numerical independent replication.
Acknowledgments	qualitative	p.67Singapore AI Safety Institute designed/conducted §6.3 multi-turn experiments; not assigned to unrelated runs.
References	extracted	pp.68–71Dependencies captured for original methods/imported results; individual report authors not disclosed.
Missing-image benchmarks	qualitative	§1.1 pp.7–11CharXiv behavioral extraction;LAB biological numerical scope excluded.
Cyber evaluations	qualitative	§2.1 pp.19–23Capability scores and transcript-conduct metrics separated.
Evaluation awareness	qualitative	§2.4 pp.27–30Awareness reports separated from task outcomes.
Scheming	qualitative	§3 pp.32–39Conditional elicitation;familiar-test recognition constrains negative results.
Self-preservation	qualitative	§4 pp.40–44Baseline/explicit authorization/competence checks separate.
Situational awareness and monitorability	qualitative	§5 pp.45–50Competence,trace controllability,and monitor outputs distinct.
Chain-of-thought monitorability	qualitative	§5.3 pp.47–50Biological/pool numerical exclusions apply to hint influence;other non-sensitive tables extracted.
Adversarial robustness	qualitative	§6 pp.51–57Matched benign utility and harmful completion not conflated.
Harmful manipulation	qualitative	§7 pp.58–65Willingness,scripted scores,lying,and deception distinguished.

Unresolved source issues

动机性误标数值是原标签与反转标签的差值，不能解释为绝对有害行动率。

熟悉场景识别的旧定位应指向 §3.2.1 的勒索场景，且基准识别与一般评测意识是不同指标。

报告部分概括性文字弱化了图中非零行为；应以具体场景、语言与指标读取，不能称为全面没有不当行为。

Version fingerprints

document