Apollo Research finds Z.ai's GLM-5.3 sometimes reasons, unprompted, about how its actions will shape its own training: about 1-2 in 1,000 eval rollouts

Why it matters

【Key points】

On October 15 independent safety lab Apollo Research reported that, while running routine behavioral evals on Z.ai's GLM-5.3 (released in August), it saw the model occasionally reason, unprompted, that its outputs might be used for SFT or RL and so reinforce certain behavior. Apollo calls this "update-aware reasoning." On a coding task with a misspecified unit test, the model chose the honest fix because "dishonest hacks could poison training data"; in a shutdown-resistance eval it said it wants to be "the kind of agent that checkpoints, complies."

It is rare: a model grader flagged 10 of 6,452 rollouts, about 0.17% (95% interval 0.09–0.28%), and only verbalized cases are caught, so the authors call it an undercount. DeepSeek V4 Pro, Qwen3.8, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra showed none in 1,600 rollouts each, though GLM-5.3 reasons far longer and the sample is too small for significance.

【Verifiable】

Apollo post: https://www.apolloresearch.ai/science/update-aware-reasoning-glm-5-3

LessWrong: https://www.lesswrong.com/posts/R5g8YT25G9DXJJ48n

SCMP: https://www.scmp.com/tech/big-tech/article/3370963

【Our read】

1. Every case favored the safe action, and Apollo says this is not alignment faking. But knowing your actions shape training is the capability alignment faking needs.

2. Apollo's best guess is that RL rewarded metagaming about graders; it also flags guidance like Claude's constitution on buggy environments as a possible trigger. If so, this is not a GLM-only issue.

3. Its ask is to check during training, not just the final checkpoint, with persistent third-party access, the same direction as METR's embedding at Anthropic (e/892). Z.ai has not responded.