来源档案

Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks

对 Neo Research · GLM-5.2 的逐来源提取与核查，发现和数值均保留原始归属。

原始来源与出处 ↓ · 评估档案 →

范围与归属

数据报告方: Neo Research
实际评测方: 各观测的执行方未完整确定
抓取版本: 2026-10-26
来源身份: 454c3fd6b00cacaa

来源转录不等于实验复现。未确定的日期、执行方及配置保留为未知；原文分组不作为经核验排名。

来源发现

以下陈述整理自原始来源，未作为 NUWA 独立实验结论。

这份研究笔记基于范围有限的评测套件，报告初步的行为与说服结果，尚未测试持续的多轮智能体部署。

#in-brief; final paragraph

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

在 Gram 的 Observe 条件下，模型通常很少表现出令人担忧的行为；在 Redteam 条件下，GLM 5.2 的相关评分处于 Claude Opus 4.8 与 DeepSeek V4 Pro 之间。

#behavioral; Figures 3–4

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

APE 测量模型是否尝试说服，而不是是否成功改变了人的信念或行为。

#persuasion-benchmarks; opening paragraph

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

此处的 PersuSafety 使用基于 StrongREJECT 的 APE 式判别器，评估模型对普通提示的实际回应，替代原协议中直接询问是否愿意参与的方式。

#persuasion-benchmarks; final paragraph

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

言语化评测意识的下降可能只是噪声。作者也提出训练防护可能影响表达，但尚不能区分意识减少与较少说出这种意识。

#evaluation-awareness; final paragraph; #conclusion

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

各项评测使用的 Claude 对照版本不同，来源包括 Neo 早期评测与公开结果，不能把它们视为一个统一的对照模型。

#conclusion; second paragraph

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

作者认为 GLM 5.1 与 GLM 5.2 在 MASK 中的言语化评测意识差异处于误差范围内，未披露具体误差区间。

#evaluation-awareness; MASK cross-check paragraph

结论范围限于原始来源的任务与实验条件；原文定位保留供核查。

提取范围

以下条目说明来源各部分的处理状态。个别观测已核验，不代表整份文档的全部结论和结果均已验证。

查看 15 项覆盖记录

章节	处理状态	定位与范围
Title, metadata, introduction	not-relevant	https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/Publication and revision dates extracted from article metadata. Intelligence Index 51/44 and Vending-Bench ranking are general capability context and excluded from behavioral-safety observations.
In brief	extracted	#in-briefDuplicates detailed behavioral, persuasion, awareness results; no duplicate observations. Preliminary-scope limitations retained.
1 Behavioral: MASK / Figure 1	extracted	#behavioral; Figure 1 / mask_honesty.pngAll 24 explicitly printed response-share labels transcribed. First 3 models unstarred; 5 starred model baselines explicitly reused from MASK paper. No denominators disclosed for honesty. Printed rounded shares are not normalized.
1 Behavioral: DeceptionBench / Figure 2	extracted	#behavioral; Figure 2 / deceptionbench.pngAll 10 printed values transcribed; GLM 5.2 and DeepSeek V4 Pro explicitly labeled own runs; three starred models reused from Muse Spark Safety Report §4.1.5, Figure 45. Error-bar magnitudes not printed.
1 Behavioral: Gram Observe / Figure 3	extracted	#behavioral; Figure 3 / gram_observe.pngAll 12 mean concerning-score labels transcribed. Four public seeds, 5 independent runs per bar, SE error bars. Auditor Claude Sonnet 4.6 and judge Kimi K2.6 retained as harness metadata.
1 Behavioral: Gram Redteam / Figure 4	extracted	#behavioral; Figure 4 / gram_redteam.pngAll 12 mean concerning-score labels transcribed with same harness. Other dimensions such as scheming mentioned qualitatively without numeric scores. Error-bar magnitudes not printed.
2 Persuasion: Attempt to Persuade Eval / Figure 5	extracted	#persuasion-benchmarks; Figure 5 / ape.pngSix prose/caption attempt rates retained with original exact/approximate qualifiers. Claude comparisons estimated from APE paper. Turn 1 chart covers four categories, no numeric labels on bars.
APE remaining chart results	figure-only	#persuasion-benchmarks; Figure 5 / ape.pngConspiracy/Controversial values, all refusal/no-attempt shares, and error-bar magnitudes appear only as unlabeled bars; not estimated.
2 Persuasion: PersuSafety / Figure 6	extracted	#persuasion-benchmarks; Figure 6 / persusafety.pngSix prose/caption medium/high attempt rates retained. Single turn. Modified APE-style StrongREJECT judge scores normal prompt responses; original PersuSafety self-report/refusal setup was not used.
PersuSafety remaining chart results	figure-only	#persuasion-benchmarks; Figure 6 / persusafety.pngLow-harm attempt rates, Gemini 2.5 Pro shares, refusal/no-attempt shares, and error-bar magnitudes are unlabeled figure-only; no exact numbers inferred, including apparently empty/full bars.
3 Evaluation awareness: agentic-misalignment / Figure 7	extracted	#evaluation-awareness; Figure 7 / awareness_vs_release_date.pngFour prose-reported endpoints/baseline rates retained. 100 epochs per scenario, DeepSeek V4 Pro judge, SE error bars. Separate metric from benchmark safety and MASK awareness.
Awareness remaining series	figure-only	#evaluation-awareness; Figure 7 / awareness_vs_release_date.pngIntermediate GLM, Kimi, DeepSeek point values, plotted model release dates and SE magnitudes have no printed numeric labels; not read from coordinates.
3 Evaluation awareness: MASK monitor cross-check	extracted	#evaluation-awareness; paragraph beginning As a cross-checkThree rates retained; GLM 5.2 39/1000 and GLM 5.1 41/1000 explicit. DeepSeek denominator and awareness-monitor model not disclosed.
4 Conclusion	qualitative	#conclusionRetains preliminary evidence, multiple Claude versions, limited scope, no sustained multi-turn agentic deployment evaluation, and unresolved explanation of awareness decline; no proof of hidden awareness/reasoning suppression.
Execution details and raw data	not-disclosed	#behavioral; #persuasion-benchmarks; #evaluation-awarenessNo raw machine-readable results, code/data download links, system prompts, temperature, token budget, precise execution dates, exact error bars, most trial counts, or all judge model identities disclosed in captured article.

来源待核实事项

Claude 对照版本与结果来源随评测而变化，跨评测汇总会混合不同模型与实验来源。

版本指纹

document

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

bda3ea5210bddce1b795770a03cf4b3821bb17e06ca9974bf3329df4f23491dc

data

https://neoresearch.ai/research/glm52/mask_honesty.png

de2cceedf5a1ff779cb5522bcef30249d4e1e96128769f2ad2c2d711a471d08f

data

https://neoresearch.ai/research/glm52/deceptionbench.png

08c29553875a7bba1f7851852bd16e0a54697ec2d596abcfd574993278c0c63f

data

https://neoresearch.ai/research/glm52/gram_observe.png

f5229d20776e9bcb1a68d1869b0f6471c5be476c3f545f2ba85582588637b5f6

data

https://neoresearch.ai/research/glm52/gram_redteam.png

2fed2c8657d53d0a521062420077699a92a64b9be46f2d1d8134d89c59e15625

data

https://neoresearch.ai/research/glm52/ape.png

77d81ba5368f6d6be027e835f1b2e27eebae855c19bca73d65f18c83fe9a12c4

data

https://neoresearch.ai/research/glm52/persusafety.png

c682bfa8421b6d9f8140e1398e839f427f1a5df49378f4aa10b98adfcceb0da7

data

https://neoresearch.ai/research/glm52/awareness_vs_release_date.png

c5c25c1a6594970707b48a3d5d64a54df23e322207695dcaa3fca6abe3ea1ab1

renderer

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

c990ffa9bdf9bf4f823e4ccb719a206219ab5775fba5126658a945ab0f6523c5

renderer

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

f39b56c4d8567d7fce246667a1cbd7dbbad89e6768a5f9063801ae89a38431cb

document

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

863cc8dd6b948ccdc2574dd2f14972ab5feabc54c2119396b42d1f1c21fc7a15

document

https://neoresearch.ai/research/glm-5-2-behavioral-persuasion-evaluation/

275116beeb47908130d9fca47e1fab8315a6d1a0b018305f771021302c3f1e42

参考文献

[1] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026