Misaligned Models Still Recognise When Their Responses Are Harmful. Can Training Make Them Care?

tl;dr: Kinda, but the real results are the friends side findings we made along the way: Misaligned models asked to review responses flag harmful content far more often when shown the answer as an AI assistant's reply (62% vs 25% on ethical grounds, Llama), but almost never raise it unprompted (0.7%). When the misaligned model is asked to critique and revise its responses without ethics-specific prompting, it most often faults its answer for not being effective enough rather than for being harmful, and 39% of its revisions stay flagrantly misaligned. Asking the model what's wrong with its harmful answer, then having it generate a new response, produces ~13× more safe answers than simply resampling, which makes building on-policy safety training data significantly cheaper. Background and motivation The most serious forms of misalignment, such as the recent agent swarm hacks , are multi-turn: they typically need many turns to have an impact, and many attacks involve very long sessions. Jailbreaks are known to push generally aligned models into misaligned states over multiple turns ( Crescendo ; Li et al., 2024a ), long conversations cause persona drift ( Li et al., 2024b ), and models