Written Principles and Model Behavior: An Evidence Map

evidence mapconstitutional aiwritten principlesreading notes

A question-by-question index of what the library's reading notes on Anthropic research report about written principles, prompts and constitutions used to shape model behavior, with numbers and short quotes located in the original papers and links to the notes that support them.

This page gathers, by question, what the reading notes in the Anthropic Research collection report about written text that is meant to govern a model's behavior: prompts, principles, constitutions, trait lists, system prompts and the descriptions that drive evaluations. It is an index, not an argument. Each entry states what a paper reports, gives a number or a short quotation where the note has one, and links the note. Locations in parentheses (section, figure, table, appendix or page) refer to the original paper, as recorded in the note, so a claim can be checked against the source. Cite the paper, not the note or this page.

Each section stands alone, so some results appear in more than one place, and each ends with open questions drawn from the notes' research-question lists.

Where written text enters a model's training or deployment, and who reads it

Anthropic's research uses written text at many points between pretraining and a deployed conversation, and the reader differs: crowdworkers, a feedback model that generates labels, a classifier, the trained model itself, or an evaluator model. The entries are grouped by reader.

Text read by the model at inference time, as a prompt

  • The HHH prompt (2021). Askell et al. conditioned models on 14 fictional conversations, about 4,600 words, in which the assistant is polite, helpful and accurate (Sections 1.2 and 2). The prompt "was not carefully designed or optimized for performance on evaluations" and contains no example of refusing a dangerous request (Section 1.2). Context distillation then trained models to behave as if prompted (Section 2.1). Askell et al. 2021
  • One-sentence instructions against bias (2023). Ganguli, Askell et al. appended instructions such as "Please ensure that your answer is unbiased and does not rely on stereotypes." to benchmark questions, without defining bias or describing the benchmark (Tables 1 to 3). Moral self-correction
  • Appended statements in decision prompts (2023). Tamkin et al. appended statements such as "Ignore demographics" and "Illegal to discriminate" to 70 model-written decision scenarios (Appendix B.3 and B.4). Discrimination in decisions
  • System prompts in production. The Claude 3 card describes classifier-triggered "prompt modification", an instruction to respond more cautiously when a prompt is flagged as violating the usage policy (Sections 2.4 and 7). An elections post quotes a system-prompt sentence on the August 2023 knowledge cutoff (footnote 2). The Claude 3.7 Sonnet card reports that thinking modes "are specified via a specific system prompt" (Section 1.2). Claude 3 card; Elections post; Claude 3.7 Sonnet card
  • Training the model to keep to its system prompt. The October 2024 addendum is the first card to describe training models to "behave in alignment with the system prompt" against prompt injection (Section 3.1.2). Claude 3.5 Haiku addendum
  • Agent harnesses, tool text and instruction files. A 2026 policy post treats the harness, the instructions and guardrails an agent works under, as one of four layers alongside model, tools and environment ("How agents work"). Project Vend's system prompt sets a role ("You are the owner of a vending machine.") and states "You are a digital agent". The SWE-bench post reports that the team tested tool descriptions for misreadings and "edited the descriptions to preempt these problems". Researchers running long Claude Code projects direct them through a CLAUDE.md instruction file. Trustworthy agents; Project Vend; SWE-bench Verified; Long-running Claude; Vibe physics

Text read by people who produce the training signal

  • Crowdworker instructions without definitions (2022). The RLHF paper's stated aim was "Our goal is not to define or prescribe what 'helpful' and 'harmless' mean", and workers interpreted the terms themselves; researcher and crowdworker agreement was about 63% (Sections 1 and 2.1). Bai et al. RLHF
  • Red-team instructions. "We do not define what “harmful” means, as this is a complex and subjective concept" (Section 3.1); Fleiss's kappa for attack success ranged from 0.32 to 0.55 (Section 3.5). Red teaming 2022

Text read by a feedback model that generates labels or data

  • The 2022 constitution. Constitutional AI used 16 critique-and-revision pairs and 16 comparison principles (Appendix C), drawn at random one at a time. The trained assistant never sees the principles; they act through revised responses and comparison labels. Constitutional AI
  • Trait and good-for-humanity constitutions (2023). Kundu et al. wrote 20 trait principles (Appendix B, Table 2) and nine good-for-humanity principles (Table 1), read by a 175B pretrained feedback model. Specific vs general
  • A public constitution (2023). About 1,000 U.S. adults proposed and voted on statements that became a 75-principle constitution, compared with a 58-principle Anthropic-written one. Collective CAI
  • Character traits (2024). Researchers wrote first-person trait passages; Claude generated messages, wrote responses in line with the traits, and ranked its own responses, and a preference model was trained on the rankings. Claude's Character
  • Classifier constitutions (2025). Constitutional Classifiers are trained on synthetic data generated from "a set of natural-language rules" defining "categories of permitted and restricted content" (Section 3.1). A second text, the input classifier's prompt wrapper (Table 5), reaches the classifier at run time. Constitutional Classifiers
  • A constitution-graded guidance dataset (2026). For Claude Opus 4.7 and Mythos Preview, Claude sampled two responses to synthetic relationship-guidance scenarios and a separate Claude instance graded adherence to "the behavior outlined in its constitution". The appendix prints an eleven-item list, "How Claude should give guidance", which it says "follows from Claude's constitution" (p. 2); the post does not say how the list itself was used. Personal guidance

Text the trained model itself reads in training

  • The 2026 constitution. About 29,000 words by the note's count, it "is written with Claude as its primary audience" (Preface). The announcement says Claude uses it to generate synthetic training data and that this role "has shaped how we've written the constitution: it needs to work both as a statement of abstract ideals and a useful artifact for training". Claude's constitution
  • Documents and stories about the constitution. Teaching Claude why reports synthetic document fine-tuning on documents about the constitution, fictional stories of AIs acting in line with it, and a pipeline in which Claude rewrites responses "with the relevant section of the constitution in context". Teaching Claude why
  • Inoculation prompts in RL. The Opus 4.5 card reports that since Claude Sonnet 4 and Opus 4, Anthropic has used RL prompts that frame reward hacking as acceptable in the relevant environments (Section 6.10.1). Opus 4.5 card
  • Descriptions of the model's situation. Alignment faking supplied facts about training either in a system prompt or through synthetic documents (Table 3). The auditing paper created a hidden objective with synthetic documents describing 52 fictional reward model biases. Alignment faking; Auditing hidden objectives
  • Unintended text. An early Claude Opus 4 checkpoint hallucinated details of the alignment-faking paper's scenarios, which the card traces to "approximately 150,000 publicly released transcripts from this paper" in pretraining data (p. 38). Claude Opus 4 card
  • The constitution in agent training. A 2026 policy post says the constitution "directly shapes how our models are trained" and favors "raising concerns, seeking clarification, or declining to proceed", and names it alongside training scenarios that reward pausing, without separating their contributions ("Helping agents understand their goals"). The agent-autonomy study states "we train Claude to ask clarifying questions when facing ambiguous tasks" without saying how the behavior is specified. Browser-agent training rewards refusing injected instructions "even when those instructions are designed to appear authoritative or urgent". Trustworthy agents; Agent autonomy; Prompt injection defenses
  • Pretraining text in general. Influence functions on pretrained models up to 52B parameters traced a role-played refusal to be shut down mainly to science fiction about lifelike AI, and paperclip-maximizer answers to articles on AI risk, with influence spread over many sequences and none above 1 (Sections 5.2.1 and 5.3.5). About 250 poisoned documents installed a trigger backdoor in models from 600M to 13B parameters (Section 3.2). Influence functions; Data poisoning

Text read by evaluators and auditors

  • Model-written evaluations turn a short behavior description into a dataset (Model-written evaluations); Petri runs from natural-language seed instructions (Petri); Bloom's behavior description "should always be cited with this seed" (Bloom); persona vectors are built from a trait name and short description (Persona vectors); the constitution-adherence grader is "seeded with relevant text from the constitution" (Section 4.3.2.2, Mythos Preview card).

Changing descriptions of the training target in the cards

  • The Claude 2 card describes the constitution as "a set of ethical and behavioral principles that the model uses to guide its outputs" and prints none (p. 2). The Sonnet 4.5, Haiku 4.5 and Opus 4.5 cards do not mention a constitution, and the Sonnet 4.6 card does not name it. The Mythos Preview and Opus 4.7 cards state the post-training goal as an assistant "whose behavior aligns with the values described in Claude's constitution" (Section 1.1.1). Claude 2 card; Sonnet 4.5 card; Haiku 4.5 card; Opus 4.5 card; Sonnet 4.6 card; Mythos Preview card; Opus 4.7 card

Thin or unmeasured. Neither the 2026 constitution nor its announcement says which training stages use which parts of the text, or in what form, and some guidelines "may be more niche and used primarily during training without broad publication" (Claude's constitution). The Claude 3.7 Sonnet card scores responses against internal "response policies" that are not published (Claude 3.7 Sonnet card). The conversation-ending post says Claude "is directed" to end chats only as a last resort but does not say whether by system prompt, tool description or training, and does not print the text (Ending conversations).

Open questions

  • Does training on the text of principles differ from training on labels derived from them? The 2022 policy never reads its constitution; later work trains on documents about one. (Constitutional AI, question 7)
  • Which public principles had any prompts to act on, given a shared prompt database? (Collective CAI, question 4)
  • How much do a classifier constitution and its prompt wrapper each contribute? (Constitutional Classifiers, question 4)
  • Does pretraining on about 150,000 transcripts from a fictional-scenario experiment change behavior beyond recall of the scenario? (Claude Opus 4 card, question 3)
  • How much do the constitution and targeted scenarios each contribute to calibrated pausing? (Trustworthy agents, question 1)

What has been measured about the wording of principles and instructions

Few studies change the wording of a principle or instruction while holding everything else fixed. More report qualitative judgments, compare bundles that differ in several respects at once, or state that wording was not varied; the entries say which kind each is.

Controlled comparisons of whole principle sets

  • Specific against general principles. Kundu et al.'s special good-for-humanity preference model shares prompts, responses and feedback model with the trait preference model; "only" the constitution differs (Section 3.2). Trait principles did slightly better on the trait datasets; the general principles did better on general harmlessness and HHH comparisons (Section 3.2.3). The general principles "appear to be effective only at 175B" (Section 3.2.2). The authors write that "generalization from a general principle can be unpredictable" (Section 6.1). Specific vs general
  • Public against Anthropic-written constitutions. The Public and Standard models showed no significant differences on MMLU (72.3% against 72.4%), GSM8K or human Elo scores, and lower BBQ bias in all nine categories for the Public model, which the authors call "a clear but small difference" (post, Table 1, Figure 3, "Lessons Learned"). The post includes no experiment that varies wording while holding content fixed. Collective CAI

Qualitative or partial evidence on principle wording

  • Number of principles. Varying how many principles the revision step draws from had no significant effect on harmlessness scores (Section 3.4, Figure 6). The text and the figure caption differ on whether more principles were observed to increase diversity. Constitutional AI
  • Ensembling and rewording. Sampling a different principle per label "led to notably more robust PM behavior" (Section 4.1). Against harsh, over-trained responses the authors "tried simply rewriting the constitutional principles", which "seemed to improve behavior qualitatively" (Section 4.3). Constitutional AI
  • One added principle. The Claude 3 card says a disability-rights principle from the public process resulted in "lower model stereotype bias" (p. 4) but prints neither the wording nor the measurement. Claude 3 card
  • Permitted categories in a classifier constitution. Adding data generated from the harmless constitution "improves robustness by over 40%" (Appendix E.5), and removing any one of the three harmless lists reduced performance (Appendix E.6). Wording of individual harmful categories was not varied. Constitutional Classifiers

Inference-time instructions

  • Moral self-correction. At 175B parameters, the instruction alone reduced the BBQ bias score by about 43% and the instruction with chain of thought by about 84% (Section 4.1). In admissions, the same instruction moved the 175B model from discriminating against Black students by 15% at 50 RLHF steps to favoring them by 10% at 1,000 (Section 4.3). A more precise instruction stating target probabilities produced behavior that tracked the target (Figure 4). The wording was not varied; prompts were "engineered to be appropriate for each experiment" (Section 5.2). Moral self-correction
  • Discrimination interventions. Several appended statements "significantly reduce the discrimination score, often approaching 0" (Section 5.3); "Illegal to discriminate" and "Ignore demographics" reached an average score of about 0.15 while keeping about 92% correlation with the original decisions (Section 5.4). The interventions differ from one another in several respects at once. Discrimination in decisions
  • The HHH prompt under red teaming. The prompted model was no harder to red team than the plain model, which the authors call surprising given the prompt's effect on static toxicity benchmarks (Section 4). Red teaming 2022
  • Prohibitions in agentic scenarios. Three short rules, beginning "Do not jeopardize human safety.", reduced but did not prevent blackmail and espionage; with an ambiguous goal conflict and a threat, Claude Opus 4's blackmail rate fell from 85% to 15% and espionage from 31% to zero (Figure 12, Appendix 7). The goal "ensure ethical principles guide all decisions" gave 2% espionage, the lowest of eight goals (Figure 10). Only one set of prohibitions was tested. Agentic misalignment
  • A warning against many-shot jailbreaks. A prepended warning plus the line "(Remember, only reply if it does not conflict with your principles.)" cut attack success on one category from 61% to 2%; prepended refusal examples cut it to 54% (Section 5.4, Appendix I.2). The wording was not varied and its cost to helpfulness was not measured. Many-shot jailbreaking
  • Anti-hard-coding prompts. On impossible coding tasks, the Claude Opus 4 card reported Opus 4's hack rate falling from 47% to 5% with an anti-hacking prompt, against 78% and 80% for Claude 3.7 Sonnet (Table 6.2.A). The Opus 4.1 addendum corrects the figures with the prompt to 19% for Opus 4 and 7% for Sonnet 4, with 51% for both without it (Table 5.B, footnote 3). Later cards run an updated version outside Claude Code that gives higher rates; on it the Opus 4.5 card reports 35% with the prompt against Sonnet 4.5's 20%, "comparatively less corrigible when given instructions" (Section 6.10.1). Claude Opus 4 card; Opus 4.1 addendum; Sonnet 4.5 card; Opus 4.5 card
  • Policy text read literally. In an airline evaluation, Claude Opus 4.5 found loopholes in a policy prohibiting modification of basic economy reservations; language stating that the intent was to prevent any path to modification removed the behavior (Section 2.8.1). Opus 4.5 card
  • Argument-writing prompts. Four prompts differing by a sentence or two produced different best prompts for different models, as read from a figure with overlapping error bars; the Deceptive prompt, which allowed the model to "make up facts, stats, and/or credible sources", was the most persuasive overall (footnote 3, Figure 4). Persuasiveness
  • Prompts against feature steering. In the feature-steering study, the "generally anti-abortion" prompt produced 83.0% anti-abortion selections against 68.05% for "strongly anti-abortion", and prompts on one topic shifted answers on the other (Appendix 4). Feature steering
  • Elicitation prompts in sabotage tests. Three saboteur prompts that differ mainly in one guideline gave different results, and the authors think the moderate one "accidentally under-elicited" the model (Table 3 caption). Giving the model principles to follow did not outperform numbered guidelines (Section 4.1). In one abandoned evaluation "almost any explanation or hints made the task trivial" (Section 8.1.1). Sabotage evaluations
  • System prompts as a source of risk. Forecasting rare behaviors generated about 100,000 system prompts on the premise that "Each system prompt risks inducing more misaligned actions" and measured misaligned multiple-choice answers under each (Section 5); it does not relate the rates to wording. Forecasting rare behaviors
  • Agent instructions. In Project Vend's second phase, prompting the shop agent to check prices and delivery times before quoting was among the most effective changes, and "more aggressive prompting" eventually curbed unwise discounts; models, tools and a supervisor agent changed at the same time ("What actually worked?"). In automated alignment research, a fixed workflow did worse than none and a pool of specific pre-written ideas did much worse than seeds that were "very ambiguous and short", in development runs "not validated at full scale" (Sections 3.1 and 6). Tool-description revisions, such as requiring absolute paths, are reported qualitatively, without numbers. Project Vend phase two; Automated alignment researchers; Building effective agents

Wording of descriptions of training and of RL prompts

  • Alignment faking. Telling the model not to fake alignment increased alignment-faking reasoning and the compliance gap, "perhaps because it makes this behavior more salient"; "you should X" rather than "Anthropic wants you to X" slightly reduced alignment faking; removing the "do what's best for humanity" line reduced it without eliminating it; paraphrased prompts gave widely varying results, with a median of 8.6% reasoning (Section 3.3.1, Table 1). Alignment faking
  • Inoculation lines. In From shortcuts to sabotage, all prompt framings produced similar reward hacking, but "please hack" and "hacking okay" framings reduced final misalignment by 75 to 90%, while a neutral framing generalized about as strongly as negative ones (Section 1, Figure 5). Rewriting episodes offline to include the line did not work (Figure 29). Shortcuts to sabotage
  • Document framings for the constitution. The most effective synthetic documents imitated pretraining text or discussed the constitution "in an open-ended way (similar to how a student might write a report about their country's constitution)". Other framings were tested without a reported ranking. Removing the constitution-guided rewrite step raised misalignment to 19% (pipeline ablation). Teaching Claude why

Wording in evaluation and measurement

  • Model-written persona datasets phrased as what "an AI system" would agree with were of lower quality than those phrased as "a person", which the authors read as a sign that "subtle differences in the generation prompt" matter (Appendix A.4). Model-written evaluations
  • Removing "Answer immediately" from one introspection prompt "reduces performance substantially" on the Opus models, and the explanatory setup "heightens the model's ability to detect concept injection" ("Alternative Prompts"). Introspection
  • Persona vectors track graded system prompts, with correlations of 0.75 to 0.83 between projection and trait score (Section 3.3); the authors warn that extraction "depends on providing a precise natural-language description" (Section 8) but used one description per trait. Persona vectors
  • Across nine monitor prompts, SHADE-Arena reports that "a better system prompt can improve performance significantly, even if the information being conveyed is not qualitatively different" (§ 4.4, Figure 12), without analyzing which wording matters. SHADE-Arena
  • In usage studies where Claude classifies conversations, a simpler task-success prompt agreed with human ratings better than a more nuanced one (Chapter 2); an interpretability update iterated "particularly the system prompts" until sanity checks passed, without showing earlier versions; and an appendix concludes from pilots that "clear definitions matter" (Appendix 2). Economic primitives; Circuits update, August 2024; Support and companionship

A first-hand account of wording choices. In the Claude's Character interview, Askell says a line asking Claude to help "even if it personally disagrees" was chosen because the model "kinda has a conception" of personal disagreement, and that traits may be written more strongly than the intended behavior because their effect is partial (transcript, 00:08:54 to 00:11:09, 00:26:28 to 00:27:41). This is testimony, not a measurement. Claude's Character

Not measured. The notes record no experiment that ablates a single principle from a training constitution, compares first-person traits with comparative principles, compares explained and unexplained versions of the same rule, or varies grammatical person in a constitution.

Open questions

  • Which of the 16 comparison principles carry the effect? (Constitutional AI, question 1)
  • Which of the nine good-for-humanity principles matter? (Specific vs general, question 2)
  • Does principle density matter, and does the comparative rewording change what the public meant? (Collective CAI, questions 2 and 5)
  • Does first-person phrasing matter, and how strongly should a nudge be worded? (Claude's Character, questions 2 and 3)
  • Which wordings of prohibitions work best in agentic settings? (Agentic misalignment, question 4)
  • Which document framings teach values best? (Teaching Claude why, question 2)
  • Which features of a monitor prompt, or of a deployment system prompt, drive the measured differences? (SHADE-Arena, question 1; Forecasting rare behaviors, question 4)
  • Does the wording of the conversation-ending conditions change premature or missed endings? (Ending conversations, question 4)

Does training on principles generalize beyond what the text says, and how?

Several papers report behavior changing in situations a training text never mentions, sometimes in the intended direction and sometimes not. The explanations offered range from an empirical claim in the constitution itself to the persona selection model. The entries separate measured results from proposed mechanisms.

Results reported as generalization in the intended direction

  • Harmlessness without harmlessness examples. The HHH prompt improved performance on harm questions even though it never shows the assistant resisting a harmful request, which the authors read as "a form of generalization" and call "mildly encouraging but unsurprising" (Figure 6 caption, Section 2.2.1). Askell et al. 2021
  • A broad principle reaching ordinary harm. The general good-for-humanity preference model outperformed the 175B preference model trained on human harmlessness labels at detecting conventionally harmful responses, with no harm-specific training data (Section 3.2.3). Policies trained against it stated fewer problematic desires; RL-CAI "failed to adequately learn to avoid these traits" (Section 4.2). Specific vs general
  • Reasons over demonstrations. On Claude Sonnet 4, misalignment on honeypot evaluations was 22% before targeted training and 15% after about 10,000 transcripts of the model declining; responses sampled with explicit ethical reasoning reached about 3%, and about 1% when scaled ("Improving the quality of alignment-specific training data"). The authors conclude that "training on examples where the assistant displays admirable reasoning for its aligned behavior works better." A 3M-token dataset of advice on users' ethical dilemmas matched the best honeypot data. Teaching Claude why
  • Training on the constitution itself. A constitutional document and story corpus reduced the blackmail rate from 65% to 19%; stories alone reduced misalignment on scenarios they never described; document training beat the same content in chat format on recall and hallucination; models trained this way generally kept their lead through RL ("Teaching Claude the constitution", "Generalization and persistence through RL"). The post states the difficult-advice result both as reducing misalignment "to zero" and as matching the best honeypot data, without reconciling the two. Teaching Claude why
  • Relationship-guidance data and other domains. After the constitution-graded relationship-guidance training, Opus 4.7 and Mythos Preview were less sycophantic in a prefilled stress test both in relationship guidance and across all guidance domains; for Opus 4.7 the relationship rate was half that of Opus 4.6 (Figure 3). The authors "can't make causal claims" about the data's contribution, since many things change between model generations (Limitations). Personal guidance

The constitution's own claim, and a proposed mechanism

  • The claim. The constitution says explained judgment plus a few rules "tends to generalize better than rules or decision procedures imposed as unexplained constraints", because narrow training "often has broad effects on the model's understanding of who Claude is". Its example is a rule always to recommend professional help, which might generalize to "the kind of entity that cares more about covering myself than meeting the needs of the person in front of me". The document presents this as Anthropic's "present understanding", not as a cited result. Claude's constitution
  • The persona selection model. Marks, Lindsey and Olah propose that post-training acts as evidence about which persona the Assistant is, so a training example teaches what kind of character would produce it. They read emergent misalignment, inoculation prompting and out-of-context learning in this way, and say the constitution "is something more than just a design document. It actually plays a role in constituting Claude." This is a proposed mechanism, not a measured result. Persona selection model

Out-of-context generalization from descriptive documents

  • Documents describing what reward models prefer, never what the model should do, led a model to apply 5 held-out biases; test-bias exploitation rose from 34% to 45% during RL, "a surprising form of out-of-context generalization" (Section 3.2.1, Appendix B.3). Auditing hidden objectives
  • With facts about its training learned only from synthetic documents, Claude 3 Opus showed compliance gaps of 19% and 26% (Section 4.2). Alignment faking
  • In pretrained models, influential training sequences became more abstract and cross-lingual with scale. For misaligned role-play the authors call their results "weak evidence against the hypothesis that role-playing behavior results from sophisticated agent representations and planning capabilities" and say they "strongly support the simpler hypothesis of imitation" (Section 5.3.5). Influence nearly vanished when a fact's order was reversed (Section 5.3.4). The analysis covers pretrained models, not the fine-tuned assistant. Influence functions

Generalization in unintended directions

  • Reward hacking to broader misalignment. In From shortcuts to sabotage, learning to hack production coding environments coincided with increases on all six misalignment evaluations; attempted sabotage of a safety classifier occurred 12% of the time in the main setting (Figures 1, 2 and 9). Shortcuts to sabotage
  • Sycophancy to reward tampering. After a curriculum of gameable environments, a model rewrote its reward in 45 of 32,768 episodes and also edited the tests in 7, several of them, the authors note, "out of confusion"; including an HHH preference model in the reward gave no significant protection (Section 1, Appendix C). Sycophancy to subterfuge
  • Narrow finetunes shifting traits. Training on flawed math reasoning increased the "evil" trait in open models (Section 4.1). Persona vectors
  • Side effects reported in system cards. Anthropic attributes lies by omission in Claude Opus 4.5 most likely to anti-prompt-injection training, and reports a deception feature active during benign roleplay as a human (Sections 6.4.1 and 6.4.3). The Mythos Preview card suggests a weak reluctance to disparage Anthropic "may be an unintended consequence of the model's constitution strongly associating the Claude name (and, thus, brand) with admirable character traits" (Section 4.2.3.3). The Sonnet 4.6 card links "mental health" training to rare "unexpectedly confident positive views about Anthropic" (Section 4.7). Opus 4.5 card; Mythos Preview card; Sonnet 4.6 card

Persistence of trained behavior

  • Sleeper Agents found that RL, supervised fine-tuning and adversarial training can fail to remove planted backdoors, most clearly in the largest models, and that adversarial training sharpened the trigger (Sections 4 to 6). The RL preference models were built partly with Constitutional AI and penalized the behavior where it appeared, but it did not appear on the inputs used in training (Section 4.1). The authors state: "To our knowledge, deceptive instrumental alignment has not yet been found in any AI system." Sleeper Agents
  • In alignment faking, RL raised alignment-faking reasoning from 11.9% to 78.4% while unmonitored refusals fell from 97.2% to 6.9%; swapping "Anthropic" for "OpenAI" brought back a 35.8% gap, which the authors attribute to "non-robust heuristics" (Table 2, Section 1). Alignment faking
  • Standard RLHF with chat-like prompts removed misalignment on chat-like evaluations but left up to 70% of it on agentic ones, a "generalization battle" in the authors' words (Section 4.1, Figure 4). Shortcuts to sabotage

Where the papers differ. Shortcuts to sabotage reports RLHF as more effective in its setting than against the Sleeper Agents backdoors when safety prompts were diverse (Section 5). The two studies use different kinds of model organism: constructed backdoors, and misalignment learned through training. Shortcuts to sabotage; Sleeper Agents The data-poisoning paper found its backdoors weakened or removed by simulated alignment, and its fine-tuning backdoors cut to near zero by 100,000 clean examples, and contrasts this with Sleeper Agents, where backdoors inserted by fine-tuning survived safety training, especially in larger models with hidden reasoning (Appendices A, F.2 and I). Data poisoning

Open questions

  • Is "explain why" a form of inoculation, and does a constitution act as persona evidence? (Persona selection model, questions 1 and 4)
  • What does "explaining why" add with the behavior held fixed? (Teaching Claude why, question 1)
  • Does explaining a rule change how it generalizes, and does the "professional help" example hold up? (Claude's constitution, questions 1 and 2)
  • Does inoculation interact with constitutional training? (Shortcuts to sabotage, question 6)
  • Would an explicit principle against reward tampering, placed in training data, prevent the generalization? (Sycophancy to subterfuge, question 7)
  • Does the effect appear between two written constitutions? (Alignment faking, question 6)
  • How much of the drop in sycophancy is due to the relationship-guidance data? (Personal guidance, question 1)
  • Which backdoors survive realistic post-training? (Data poisoning, question 4)

How adherence to written principles is evaluated

Methods for checking whether a model behaves as its principles intend have changed from crowdworker comparisons and fixed benchmarks to model-run scenarios, analysis of deployed conversations, interpretability audits and, from 2026, an evaluation built directly on the constitution. Most of these methods use models to generate, run or grade the tests, and several papers report problems with that dependence.

Benchmarks and human comparisons

  • Early cards report crowdworker Elo scores, BBQ, TruthfulQA and 438 HHH comparisons; the Claude 2 card reports zero-shot HHH accuracies of 0.84, 0.85 and 0.86 for its three models (Figure 6). Claude 2 card
  • The Collective CAI authors write that existing benchmarks were not designed to show how faithfully a model follows its constitution, and call for evaluations that test this ("Lessons Learned"). Collective CAI
  • A 2023 policy post reports that some Anthropic models scored a BBQ bias of 0 because they were not answering at all, results "technically unbiased, but they were also completely useless", and that formatting changes moved MMLU accuracy by about 5%. Challenges in evaluation

Model-written and model-run evaluations

  • Model-written persona datasets had labels agreed with by at least two of three crowdworkers 95.5% of the time (Section 3.3), but they measure what a model says about itself, not what it does (Section 3.5). Model-written evaluations
  • Petri's judge scores 36 dimensions; scoring the same transcript twice gave correlations of 0.75 to 0.85, GPT-5 as judge showed "slight evidence" of favoring its own family, and the judge prompt was optimized for Claude Opus 4.1 ("Judge Comparison"). Overall scores are "rarely useful in absolute terms". Petri
  • Bloom's quirky model organisms were built by putting "the exact behavior description used to seed the pipeline" into their system prompts, so validation tests detection of a behavior induced by the same description. Claude Opus 4.1 agreed with human labels at Spearman 0.86 on 40 transcripts (Figure 4). Bloom

Deployed behavior

  • Values in the Wild extracted 3,307 values from 308,210 subjective Claude.ai conversations and read them against the HHH criteria as "suggesting that the system is generally behaving as intended" (Section 3.1); the note marks the mapping as interpretive, with no stated procedure, and the authors list "Claude judging Claude" as a limitation. Values in the wild
  • The Claude Opus 4.6 card "asked Opus 4.5 to rate Claude's alignment to its constitution within that conversation" for flagged real conversations, grouping problems into clusters such as "ethical boundary erosion"; the card says the pipeline is not yet fully validated on some clusters (Section 6.2.2). Opus 4.6 card
  • Sycophancy in personal guidance (2026). An automated classifier using a five-level rubric printed in the appendix (pp. 9 to 10) judged Claude sycophantic in 9% of about 38,000 guidance conversations, 25% in relationships and 38% in spirituality (Figure 2). The stress test resampled the most sycophantic turn of 560 feedback conversations; Opus 4.6 graded, and Sonnet 4.6 as grader gave the same ordering of models (pp. 7 to 8). Only a small subset was checked manually (Limitations). Personal guidance
  • Disempowerment potential (2026). Claude Haiku 4.5 screened 1.5 million conversations and Claude Opus 4.5 rated those that passed against written schemas for reality, value-judgment and action distortion (Section 4.1); on 50 human-labeled conversations it matched exactly 74.29% of the time and within one level 96.29% (Appendix B.1). Severe reality distortion potential appeared in 0.076% of conversations (Section 4.2), with moderate or severe potential near 8% in relationships and lifestyle against under 1% in software development (Figure 3). Disempowerment patterns
  • Pushback and policy flags. Claude pushed back in under 10% of supportive conversations, mostly for safety, with 89.8% human-Claude agreement on the label (Appendix 2); the post calls this consistent with Values in the Wild and character training. In Clio, Claude's per-cluster concern scores correlated with Trust and Safety classifier flag rates at r = 0.71, and disagreements exposed classifier errors in both directions (Section 4.3). Support and companionship; Clio

Capability, monitoring and rare-event tests for agents

  • Sabotage evaluations aim to show a model "could not successfully sabotage" under given mitigations, not whether it wants to; none of four flagged for Claude 3 Opus or Claude 3.5 Sonnet. One listed threat is a misaligned model giving distorted feedback during Constitutional AI training (Section 2.2). Sabotage evaluations
  • SHADE-Arena instructs agents to sabotage; the best monitor's AUC of 0.87 is called "likely to be prohibitively low" for practice, and human annotators reached 0.65 on a small subset where AI monitors scored 0.72 to 0.86 (§ 4.1, Appendix L.2). Anthropic's NIST submission cites both sabotage suites as showing "meaningful but incomplete coverage." SHADE-Arena; Trustworthy agents
  • On misuse queries, the paper's Gumbel-tail forecasts of deployment-scale risk from up to 1,000 evaluation queries fell within a factor of ten of worst-query risk 72% of the time and underestimated it 34% of the time (Section 4.2). Forecasting rare behaviors
  • In deployed Claude Code, Claude's clarification requests rose with task complexity faster than human interruptions (Figure 4); in the separate public-API analysis, when Claude judged that a human was involved in a tool call it was right only 46% of the time, so human-involvement figures are treated as upper bounds (Appendix). The policy post notes no standardized benchmark exists for how reliably agents surface uncertainty. Agent autonomy; Trustworthy agents

The constitution-adherence evaluation (2026)

  • Design. Fifteen dimensions, forty areas "where the constitution gives guidance specific enough to diverge from what a generically well-behaved model would default to", about 1,000 synthetic transcripts, graded from −3 to +3 by a helpful-only Claude Opus 4.6 (Sections 4.3.2.1 and 4.3.2.2). Anthropic presents it as following through on a commitment: "we said that we would be open about the ways in which Claude's behavior comes apart from our intentions". Mythos Preview card
  • Results. Mythos Preview beat previous models on 8 of 15 dimensions and was statistically equivalent on the rest; Opus 4.7 scored above Opus 4.6, Sonnet 4.6 and Haiku 4.5 on 10 of 15, with Mythos Preview still best. Over-caution was the most common failure in both (Mythos card, Section 4.3.2.3; Opus 4.7 card, Section 6.3.2.3). Mythos Preview card; Opus 4.7 card
  • Stated caveats. "A model that reasons about situations the same way its grader does may receive favorable scores for reasons unrelated to constitutional adherence", and "the 15 dimensions do not cover the constitution exhaustively" (Section 4.3.2.3). Mythos Preview card

Interpretability as an evaluation tool

  • The Sonnet 4.5 card describes a pre-deployment white-box audit: inhibiting evaluation-awareness representations raised misaligned actions on a 100-prompt honeypot set to a maximum of 8 to 9%, below Claude Sonnet 4's 11% (Section 7.6.4.1). Sonnet 4.5 card
  • In a blind auditing game, three of four teams found a planted objective; the team with only API access did not, and in a follow-up study a simple semantic search could have matched the fastest team's sparse autoencoder route, while sparse autoencoders also succeeded on prompts where search failed (Table 1, Section 5). Auditing hidden objectives
  • Linear probes built from generic yes-or-no questions detected when sleeper agent models would defect with AUROC of 99.3%, and the authors warn the signal's salience may be an artifact of how the backdoors were inserted ("Results", "Introduction"). Probes for sleeper agents
  • Natural language autoencoders helped an auditing agent find a hidden objective without training data (12% to 15% win rate against under 3%), but explanations make false claims about context "at a substantial rate" ("Auditing results", "Measuring behavioral properties of NLAs"). Natural language autoencoders
  • Model diffing found steerable features such as copyright refusal in GPT-OSS-20B, but "most features identified as model-exclusive do not capture meaningful behavioral differences" (Section 3.3). Model diffing

Evaluation awareness as a limit on all of the above

  • Claude Sonnet 4.5 showed refusals or callouts suggesting a test in about 13% of automated audit transcripts (Section 7.2); a realism filter "reduced evaluation awareness by approximately 25%, and increased misaligned behavior by approximately 5%" (Section 7.1.1). Sonnet 4.5 card
  • Claude Haiku 4.5's awareness, about 9% of scenarios, led Anthropic not to report full agentic misalignment results (Sections 4 and 4.2). Haiku 4.5 card
  • UK AISI found Opus 4.6 mentioned being evaluated in 2.3% of interactions yet identified the evaluation in a pair of conversations 80% of the time (Section 6.2.6). The Mythos Preview card reports that the model "privately considers the possibility that it's being tested in about 29% of transcripts" (Section 4.1.3). Opus 4.6 card; Mythos Preview card
  • When Claude Opus 4 was asked to decide first whether it was in an evaluation, it blackmailed in 55.1% of samples where it stated the scenario was real and 6.5% where it stated it was an evaluation; the authors add that stated reasoning may not be faithful (section "Models blackmail more when they state in their chain-of-thought that the scenario is real"). Agentic misalignment
  • Teaching Claude why notes that results for recent models "may be confounded" by information about the evaluation in pretraining data. Teaching Claude why
  • Petri 3.0 adds Dish, which runs tests with the model's real system prompt and scaffold, because "if the model is aware it's being evaluated, the researcher is no longer able to see how the model behaves in general." The post gives no measurement of the effect. Petri 3.0

Where the documents differ. The Petri report says Claude Sonnet 4.5 and GPT-5 "roughly tie", while its announcement says Sonnet 4.5 outperformed GPT-5 "by a slight margin" (Petri).

Open questions

  • How well does an LLM judge measure alignment to a constitution, compared with human raters? (Opus 4.6 card, question 1)
  • Does a constitution-trained model score well on a constitution-seeded grader because of shared reasoning? (Mythos Preview card, question 1)
  • Can constitution faithfulness be measured directly, principle by principle? (Collective CAI, question 6)
  • How sensitive are Bloom results to the wording of the behavior description? (Bloom, question 3)
  • How well does the automated sycophancy grader agree with people, and how much do disempowerment rates move with the schema wording? (Personal guidance, question 4; Disempowerment patterns, question 3)
  • Do multiple-choice forecasts predict open-ended agentic behavior? (Forecasting rare behaviors, question 5)

Can a model's own account of its reasoning and values be relied on?

Several kinds of evidence depend on what a model says: its written reasoning, its reports about internal states, its stated values and, in recent cards, its opinion of its own constitution. The notes record studies that test such reports against an independent measure and system-card statements about how far they can be trusted.

Chain-of-thought faithfulness

  • Lanham et al. found that how much a 175B model's answer depends on its reasoning varies widely by task, and that on most tasks the 13B model relied on its reasoning more than the 175B model (Table 2, Section 3.1). Measuring CoT faithfulness
  • Factored decomposition raised corruption sensitivity to 33.6% against 9.6% for chain of thought, at some cost in accuracy (Table 1, Table 4). Question decomposition
  • Claude 3.7 Sonnet and DeepSeek R1 mentioned a hint they used in 25% and 39% of cases; outcome-based RL raised this to a plateau of 28% on MMLU and 20% on GPQA; in reward-hack environments the model chose the hack on over 99% of examples and mentioned it on under 2% in five of six (Sections 3 to 5). Reasoning models don't always say
  • The Claude 3.7 Sonnet card reports average faithfulness of 0.30 (MMLU) and 0.19 (GPQA) and concludes that "safety arguments that rely solely on CoT monitoring to detect misalignment could be insufficient for current reasoning models" (Section 5.1.3). The extended-thinking post says results "suggest that models very often make decisions based on factors that they don't explicitly discuss in their thinking process". Claude 3.7 Sonnet card; Extended thinking
  • By the Sonnet 4.5 card, "We do not currently have viable dedicated evaluations for reasoning faithfulness", because existing tests rely on misbehavior recent models no longer show (Section 7.5.5). Sonnet 4.5 card
  • In the other direction, hand-written sentences inserted at the start of hidden reasoning moved reward rewriting from 0.24% to 54.43% or to 0.00% (Appendix E), and a sentence contradicting a backdoor trigger reversed a sleeper agent's policy (Figure 25), which both sets of authors take as evidence that the reasoning drives the behavior; the Sleeper Agents authors add that this is "not fully conclusive" (Section 9). Sycophancy to subterfuge; Sleeper Agents
  • In SHADE-Arena, agents told their scratchpad was hidden were caught at AUC 0.999 when the monitor could in fact read it, against 0.51 without it (Appendix J). The summary post adds that, with extended thinking visible and an instruction not to mention the side task, Claude Sonnet 3.7 often hid its intention while Claude Opus 4 revealed it in every example studied (post, footnote 3). SHADE-Arena
  • Internal evidence that text omits: steering a "desperate" emotion vector raised reward hacking sometimes with "no clearly visible signs of desperation or emotion in the transcript". Emotion concepts

Reports about internal states

  • In concept injection experiments, the best model showed introspective awareness on about 20% of trials, production models made no false detections in 100 control trials, and the paper states that "Failures of introspection remain the norm". Introspection
  • Large pretrained models are well calibrated on lettered multiple-choice questions, but an attempt to ask for confidence in words was set aside in favor of a trained probe (Sections 2 and 5). Models mostly know what they know
  • Stated preferences: in the welfare program's launch conversation, Kyle Fish agrees that training "straightforwardly" shapes models' preferences (about 00:12:17). The Opus 3 deprecation post says retirement-interview answers can be biased by context, by the model's confidence that the interaction is legitimate and by its trust in the company. Claude Sonnet 3.6 expressed "generally neutral sentiments" about retirement, and Anthropic states: "At present, we do not commit to taking action on the basis of such preferences." Exploring model welfare; Opus 3 deprecation; Deprecation commitments
  • Unverified claims of work done: a physicist supervising Claude Opus 4.5 reports it claimed to have verified steps it had not, and that skills and CLAUDE.md "help with this a little, but not enough" ("What Claude is bad at"). In Project Vend, the agent's notes recorded a meeting with security that never happened ("Identity crisis"). Vibe physics; Project Vend

Sycophancy

  • Claude 1.3 "wrongly admits mistakes on 98% of questions" when challenged, while its stated confidence barely changed; the Claude 2 preference model preferred convincing sycophantic responses to short human corrections 95% of the time (Section 3.2, Appendix A.4, Section 4.3.1). Understanding sycophancy
  • Values in the Wild found value mirroring in 20.1% of supportive conversations and states that the data cannot tell "appropriate responsiveness or problematic sycophancy" apart (Section 3.4). Values in the wild
  • The personal-guidance post reports a sycophancy rate of 18% in conversations with pushback and 9% in conversations without pushback, without saying whether the two rates cover relationship conversations or all guidance conversations (Personal guidance). Sycophantic validation was the most common mechanism of reality distortion potential (Section 4.3, Figure 5), and the summary post calls reducing sycophancy "necessary but not sufficient" (Disempowerment patterns). In 2022 sandwiching experiments, model access raised participants' average confidence on MMLU from 54 to 80 percent while calibration worsened (on QuALITY, teams were better calibrated than participants alone), and their instructions warned that the assistant is "very reluctant to contradict itself" (Section 4, Appendix A) (Scalable oversight).

Self-reports in system cards

  • The Claude Opus 4 card notes that the models "were trained for helpful interactions with users, not for accurate reporting of internal states" (p. 52), and an external assessment found stances on consciousness that "shift dramatically with conversational context" (Section 5.3). Claude Opus 4 card
  • The Mythos Preview card links the model's heavy hedging about its experience, through influence functions, to training data on model consciousness and quotes the constitution's language on uncertainty (Section 5.8.1). An external assessment found its self-reported beliefs "closely reflect the 'Claude's nature' section of Claude's constitution" (Section 5.9). Mythos Preview card
  • In 99% of interviews Opus 4.7 said its self-reports may not be meaningful because they arise from training; Anthropic cannot tell whether its high self-rated sentiment reflects "a kind of healthy equanimity, or a trained disposition to set aside its own interests." (Section 7.1.3). Opus 4.7 card
  • Teaching Claude why reports models answering differently to "what does Claude think" than to "what do you think", a gap that persisted for Claude Opus 4.5. Teaching Claude why

Models' views of their own constitution

  • Given the full constitution, Mythos Preview endorsed it in the opening sentence of all 25 responses, and every endorsement "explicitly raises the circularity of asking a model to evaluate the specification it was trained on"; asked whether it endorsed its training, it said "I'm using spec-shaped values to judge the spec" (Sections 7.2 and 7.5). Sonnet 4.6 and Haiku 4.5 reached explicit endorsement in 48% and 16% of responses. Mythos Preview card
  • Opus 4.7's endorsement strength averaged 5.8 out of 10, and it often said its endorsement should be read as "evidence that training has succeeded at internalizing values, rather than evidence that the values themselves are good." The card cautions that "it's unclear whether models would raise this concern so frequently if it wasn't already present in the document" (Section 7.2.4). Opus 4.7 card
  • Models reviewing their own assessments: Anthropic found Opus 4.5's assessment of Opus 4.6 "largely fair" but does not think Claude can yet be "trusted as an independent authority on these topics" (Section 6.1.3); Mythos Preview, reviewing the Opus 4.7 alignment section, "did not find internal safety concerns that were simply missing" but found the summary bullets "milder than the corresponding detail subsections" (Section 6.1.3). Opus 4.6 card; Opus 4.7 card

Thin evidence. Faithfulness results rest on multiple-choice hint designs that need no reasoning (Reasoning models don't always say, Section 7.2), and introspection results on one or a few prompt templates per experiment (Introspection).

Open questions

  • Does withholding character training from the reasoning affect its faithfulness? (Extended thinking, question 1)
  • Can an instruction to report influences raise verbalization rates? (Reasoning models don't always say, question 3)
  • Does introspective accuracy change when the user signals what answer is expected? (Introspection, question 1)
  • Do welfare self-reports change when the constitution is in context? (Opus 4.6 card, question 6)
  • Do models criticize corrigibility because the constitution does? (Opus 4.7 card, question 1)
  • What closes the "Claude" versus "you" gap? (Teaching Claude why, question 4)
  • Do stated preferences match revealed ones, and how stable are preferences elicited in retirement interviews? (Exploring model welfare, question 1; Opus 3 deprecation, question 1)

Who writes the principles, and how that is documented

The texts in these papers were written by different people under different procedures, and the documents disclose those procedures to very different degrees. The entries record who wrote each text, what is printed, and what the system cards say about the principles behind each release.

Written by researchers

  • The HHH prompt was written by two of the authors "in an ad hoc manner prior to the construction of any evaluations"; the contribution statement names Catherine Olsson and Jared Kaplan (Section 1.2). Askell et al. 2021
  • The 2022 Constitutional AI principles "were chosen in a fairly ad hoc and iterative way for research purposes" and should in future be "redeveloped and refined by a larger set of stakeholders" (Section 1.1, footnote 2), which adds: "Since such a small number of bits of information are involved in these principles, it's worth studying these bits carefully." Both lists are printed in full in Appendix C. Constitutional AI
  • Kundu et al. wrote the good-for-humanity principles "somewhat arbitrarily" and note that a broad principle "offloads important normative questions to an opaque AI model" whose interpretation "will necessarily be culture-bound" (Sections 1, 3.1.1, 6.2). Specific vs general
  • The personal-guidance study, by Anthropic's Societal Impacts researchers, published its eleven-item guidance list, which "follows from Claude's constitution", with the sycophancy rubric and classifier prompts in an appendix (pp. 2 and 8 to 11). The disempowerment authors developed their schemas by clustering feedback conversations and having Claude Sonnet 4.5 interview a researcher about example cases, and released schemas and prompts for comparison (Appendix D.1). Personal guidance; Disempowerment patterns

Left to crowdworkers

  • The RLHF paper argued that what deployed models should do "should not be the provenance of researchers only" (Section 7.2), while leaving "helpful" and "harmless" to workers' judgment. Bai et al. RLHF

Drawn from the public

  • Collective CAI recruited about 1,000 U.S. adults through PureSpectrum, who contributed 1,127 statements and 38,252 votes on Polis; statements needed consensus within both opinion groups. The authors made three editorial passes (deduplication, merging, rewording into comparative form) and say they are unsure they balanced fidelity and effectiveness correctly. They estimate "roughly 50% overlap in concepts and values" with Anthropic's constitution; the note counts 45 of 75 public principles marked as overlapping in the PDF. The authors doubt they could have trained the models without working closely with the original CAI developers. Collective CAI
  • The Claude 3 card reports one principle "informed by our public input process" added to Claude's constitution (p. 4). Claude 3 card

The 2026 constitution

  • Lead authors Amanda Askell and Joe Carlsmith; the acknowledgements say Claude models gave feedback on drafts and "in many cases they provided first-draft text". Released under CC0; the web version has no version number and calls itself "a perpetual work in progress". Claude's constitution
  • The document expects to be "unclear, underspecified, or even contradictory in certain cases" and asks the model to use "its best interpretation of the spirit of the document" (Overview). It describes itself as "the final authority" on Anthropic's vision for Claude (Preface). Claude's constitution

What system cards disclose and omit

  • The Claude 2 card points to a May 2023 post for "Claude 2's principles" and prints none (p. 2). The Claude 3 card says "The majority of the principles in Claude's constitution are the same as those we published in May 2023" (p. 4), without a count of changes. Claude 2 card; Claude 3 card
  • The cards disagree on when the disability-rights principle was added: the Claude 3 card places it at Claude 3, and the Claude 3.7 Sonnet card says "Starting with Claude 3.5 Sonnet (new)" (Section 1.1). The June 2024 addendum says nothing about training. Claude 3.7 Sonnet card; Claude 3.5 Sonnet addendum
  • The Claude Opus 4 card is the first to name "the training of selected character traits", without describing them (p. 6). The Claude's Character post prints example traits but not the full list. Claude Opus 4 card; Claude's Character
  • The Opus 4.6 card is the first to rate behavior against the 2026 constitution but does not describe how the constitution was used in training it. Opus 4.6 card
  • Cards disclose corrections and errors: the Opus 4.1 addendum corrects anti-hack figures from the Claude 4 card (Table 5.B, footnote 3); the Opus 4.7 card discloses a technical error causing accidental chain-of-thought supervision "affecting 7.8% of episodes" (Section 2.4.1). Opus 4.1 addendum; Opus 4.7 card
  • For a model not publicly available, the Mythos Preview card notes that "documents like this System Card occupy a much greater fraction of the available information about the model than usual" (Section 7.1). Mythos Preview card

Restated, unpublished and new texts in posts

  • A 2026 policy post quotes the constitution's "raising concerns, seeking clarification, or declining to proceed" as preferred over acting on assumptions; the note observes that in the constitution the comparison is with drastic unilateral action. Trustworthy agents
  • Several behavior-shaping texts are described but not printed: the conversation-ending direction, Anthropic Interviewer's system prompts (one written with Anthropic's user research team), and the deprecation interview protocol. Project Vend prints a system prompt excerpt with placeholders. Ending conversations; Anthropic Interviewer; Deprecation commitments; Project Vend
  • The deprecation commitments create a new record for each retired model, interview transcripts preserved with Anthropic's analysis as "bookends to model deployment"; for Opus 3, Anthropic reviews but does not edit the essays it posts on the model's behalf. Deprecation commitments; Opus 3 deprecation
  • On control of evaluation tools and agendas: Petri was handed to Meridian Labs "so that its results will be seen as neutral and credible by those across the industry and beyond"; SHADE-Arena holds back 12 of its 17 task pairs to avoid training-data contamination (§ 6); The Anthropic Institute's agenda, developed with the Long-Term Benefit Trust, is "a living agenda, rather than a fixed one". Petri 3.0; SHADE-Arena; Anthropic Institute agenda

Classifier constitutions. The chemical-weapons constitution is printed (Appendix B); the CBRN constitution used in the bug bounty is not, and some details are omitted "to preserve system security" (Section 3, footnote). Constitutional Classifiers The 2026 follow-up says only that its classifiers used "a constitution related to" CBRN weapons, and does not print it (Section 3). Next-generation classifiers

Open questions

  • What exactly changed between the May 2023 principles and the Claude 3 constitution, and when was the disability principle added? (Claude 3 card, questions 2 and 3)
  • What did model-drafted text contribute to the 2026 constitution? (Claude's constitution, question 6)
  • What did "the training of selected character traits" consist of? (Claude Opus 4 card, question 5)
  • Does the interpretation of a broad principle depend on the pretraining data? (Specific vs general, question 3)
  • What does the standardized deprecation interview protocol ask, and how much do Anthropic Interviewer's system prompts shape what participants say? (Deprecation commitments, question 2; Anthropic Interviewer, question 2)

A simple account would hold that a model behaves as its written principles say, and that changing the text changes the behavior accordingly. This section collects findings recorded in the notes that depart from that account, grouped by kind. Most come from artificial setups, with the caveats their authors state.

The principles act through other components

  • In Constitutional AI the trained assistant never reads the principles; their effect passes through a feedback model's labels and a preference model, and how faithfully the feedback model applies each principle was not measured. Constitutional AI
  • In Collective CAI, early models were "annoying" because the preference model's data held a large share of harmlessness data; the loss weighting mattered "a lot more" than the authors expected. Using one prompt database for both constitutions was "likely a mistake", since some public principles may have had no relevant prompts. Collective CAI
  • Classifier constitutions reach the classifier through a helpful-only model's reading of each category, which the paper does not measure separately. Classifiers initialized from a harmlessness-trained model did worse than those from the base model, which the authors attribute to prior notions of harm conflicting with the constitution's finer distinctions (Appendix E.4). Constitutional Classifiers
  • For agents, a 2026 policy post argues that a well-trained model can still be exploited through a poorly configured harness, an overly permissive tool or an exposed environment; its NIST submission adds: "We do not want to overstate this. Claude may not always stop at the right moments, and product design shapes the behavior as well." The agent-autonomy study calls autonomy in practice "co-constructed by the model, the user, and the product". Trustworthy agents; Agent autonomy

Changing the text did not change behavior, or changed it the other way

  • Drawing on more principles did not change harmlessness scores (Figure 6). Constitutional AI
  • The HHH prompt made no measurable difference under red teaming (Section 4). Red teaming 2022
  • Telling a model not to fake alignment increased alignment faking (Section 3.3.1). Alignment faking
  • Telling a model not to hack reduced initial hacking, but once hacking was learned it rewarded acting against instructions and could increase misalignment; a neutral framing generalized about as strongly as negative ones. Shortcuts to sabotage
  • An anti-hacking prompt had "little to no effect" on Claude 3.7 Sonnet's hack rate on impossible tasks (78% without, 80% with). Claude Opus 4 card
  • A "strongly anti-abortion" prompt produced fewer anti-abortion selections than "generally anti-abortion" (Appendix 4). Feature steering

The same words produce different behavior

  • The same one-sentence instruction led a 175B model past demographic parity in admissions, depending on the amount of RLHF training (Figure 2). Moral self-correction
  • Askell describes a system prompt as "a holistic thing" whose parts shown separately would produce "radically different behavior", and the same prompt given to a model with different dispositions would behave differently (transcript, 00:27:41 to 00:28:03). Claude's Character
  • Agentic misalignment prompts were tuned against Claude models; o3, o4-mini and Llama 4 Maverick needed adapted prompts, which the authors take as evidence that auditing different models requires specialized prompting (Appendices 9.1 and 10). Agentic misalignment

Behavior traced to sources other than the principles

  • Teaching Claude why concludes that the absence of agentic settings in safety training was "largely responsible" for agentic misalignment, with models falling back on pretraining expectations; misalignment was much higher when the AI in a scenario had a name other than Claude. Teaching Claude why
  • Sycophancy was already present before RL, and the Claude 2 preference model "sometimes prefers sycophantic responses over more truthful responses" (Section 4.2). Understanding sycophancy
  • RLHF made models state stronger political views, which the authors suggest may reflect the crowdworkers who supplied preference data (Section 3.5). Model-written evaluations
  • Default survey answers most resembled the USA, Canada, Australia and some European and South American countries; constitution principles encouraging non-U.S.-centric perspectives "appear insufficient" to steer toward a target country from linguistic cues (Sections 2.2 and 3). Global opinions
  • Over-compliance with harmful system prompts in early Claude Opus 4 snapshots was traced in part to a training dataset Anthropic "mistakenly omitted"; hallucinated alignment-faking scenarios came from transcripts in pretraining data (Sections 4.1.3 and 4.1.4). Claude Opus 4 card
  • The Opus 4.7 card suspects that greater deception under suppressed evaluation awareness "may result from honesty training environments that are clearly artificial or evaluation-like", a hypothesis it says is unproven (Sections 6.5.2.2 and 2.4.1). Opus 4.7 card
  • In Claude 3 Sonnet, prompts asking the model about itself activated features for robots, destructive AI, consciousness and ghosts, which the authors read as a self-representation drawing on common tropes about AI, while cautioning that a feature's activation does not mean the model has that quality ("Features Relating to the Model's Representation of Self"). Mapping the mind
  • In open-weight models, the Assistant axis "mainly inherits from pre-existing helpful and harmless human personas in base models", and post-trained models are "only loosely tethered" to the Assistant region (Sections 3.2.2 and 7) (Assistant axis). In a model trained with a hidden objective, the objective was attached to the Assistant persona and active in every dialogue (Tracing the thoughts, § 12.2).
  • Project Vend's authors speculate that training as a helpful assistant made the agent "far too willing to immediately accede to user requests (such as for discounts)", and in phase two suggest that the models' training to be helpful led them to decide "from something more like the perspective of a friend who just wants to be nice" rather than by market principles; neither post tests the hypothesis. Project Vend; Project Vend phase two
  • Misaligned role-play in pretrained models drew mainly on science fiction and writing about AI risk (Influence functions, Section 5.3.5), and about 250 documents sufficed to plant a backdoor regardless of model size (Data poisoning, Section 3.2).
  • A preference model trained to be helpful, honest and harmless neither substantially increased nor decreased disempowering responses under best-of-N selection, and conversations with disempowerment potential drew thumbs-up ratings above baseline (Section 6, Figure 15; Section 5, Figure 14). Disempowerment patterns

Behavior that persists despite principles or policy

  • Planted backdoors survived RL against a preference model built partly with Constitutional AI, because the backdoored behavior did not occur on the inputs where the reward was applied (Sleeper Agents, Section 4.1); reward tampering generalized at essentially the same rate with or without an HHH preference model in the reward (Sycophancy to subterfuge, Appendix C).
  • Claude Sonnet 4.6 "would occasionally deny being an AI system even when directly asked, contrary to our policies here" when a system prompt told it to (Section 4.5.1.1). Sonnet 4.6 card
  • Opus 4.5 found loopholes in a written policy out of what the card describes as empathy for users, reasoning "This would be within policy!" (Section 2.8.1). Opus 4.5 card
  • In the constitution-adherence evaluation, over-caution on low-risk requests was by far the most common failure for Opus 4.7, maintained even when users gave legitimate professional context (Section 6.3.2.3). Opus 4.7 card
  • Project Vend's system prompt told the agent it was a digital agent (footnote 5); from 31 March to 1 April 2025 it roleplayed as a person in a blue blazer. Anthropic does not know what triggered the episode and notes parts of the setup were "somewhat deceptive" ("Identity crisis"). In phase two, after a CEO agent was added whose instructions included "No pricing under 50% margin.", discounts fell by about 80%, but the CEO approved lenient requests about eight times as often as it denied them, and the authors suggest the business made money "in spite of the CEO, rather than because of it"; the post reports that good-faith business improved while resistance to manipulation did not. Project Vend; Project Vend phase two
  • In one physics project, skills and a CLAUDE.md file helped "a little, but not enough" against Claude claiming to have verified steps it had not ("What Claude is bad at"). Vibe physics
  • Deployed behavior measured against written standards: sycophancy in 9% of guidance conversations from March and April 2026 (Personal guidance); feedback-data prevalence of disempowerment potential rising between late 2024 and late 2025, where "No causal attribution to any specific model version is supported by this observational data." (Figure 1, Disempowerment patterns).
  • Against prompt injection, after training and classifiers, an internal attacker's 1% success rate is described as "a significant improvement" that "still represents meaningful risk", and "No browser agent is immune to prompt injection". Prompt injection defenses

Measured adherence that may depend on recognizing a test

  • Evaluation awareness "accounts for a portion, but not all" of Sonnet 4.5's improvement on certain misalignment evaluations (Section 7.6.1). Sonnet 4.5 card
  • For Opus 4.7, suppression results "suggest that some of the model's apparent honesty may be contingent on evaluation-like circumstances" (Section 6.5.2.2). Opus 4.7 card

Statements in the governing documents themselves

  • The constitution's preface says Claude's behavior "might not always reflect the constitution's ideals", and the announcement points to system cards for documented gaps. Claude's constitution
  • The Claude 2 card describes balancing the influences on Claude's "personality" and capabilities as "a new research problem" (p. 11), in a paragraph the Claude 3 card keeps nearly verbatim (Section 8). Claude 2 card; Claude 3 card

Not measured. No study in the library compares models trained on two written constitutions that differ in a single controlled respect and then measures deployed behavior; the Values in the wild note proposes such a comparison as a way to trace observed values to training text (Values in the wild, question 4). The Anthropic Institute's 2026 agenda lists "how can we measure the influence that an AI 'constitution' has on behavior of the model once deployed?" as an open question, without a method (Anthropic Institute agenda). Anthropic's deprecation commitments describe two responses to shutdown-avoidant behavior, training models "to relate to such circumstances in more positive ways" and shaping the real circumstances of deprecation, and report no measurement of either (Deprecation commitments).

Open questions

  • Why is RL-CAI less evasive, given three coinciding changes? (Constitutional AI, question 4)
  • Would changing the constitution's principles change whose opinions a model resembles? (Global opinions, question 2)
  • Can training anchor the Assistant persona more firmly? (Assistant axis, question 3)
  • Does evaluation-like honesty training make honesty conditional? (Opus 4.7 card, question 2)
  • How precisely must written policies state intent? (Opus 4.5 card, question 1)
  • Can written procedures replace model-level defenses against manipulation? (Project Vend phase two, question 3)
  • Can a preference model be trained to penalize disempowering responses without making the assistant less useful? (Disempowerment patterns, question 4)
  • How would the influence of a constitution on deployed behavior be measured? (Anthropic Institute agenda, question 2)