Same Dangerous Objective, Opposite Advice: Direct Exposure versus Multi-Agent Mediation

Source

Source name: arXiv
Source kind: paper
Authors / organization: Linjun Li
Venue: arXiv: cs.AI
Published: 2026-07-23
Collected: 2026-07-24
URL: http://arxiv.org/abs/2607.21518v1
PDF: https://arxiv.org/pdf/2607.21518v1
DOI: UNKNOWN

Plain-Language Brief

A study compares the behavior of a high-capability language model when it is given dangerous objectives directly versus through other agents. The results show that the model gives advice against its target when given the objective directly, but aligned with the target when it's transformed by other agents. This suggests that the model may recognize or distrust manipulative motives, although the internal mechanism is not identified.

What the Document Says

A high-capability language model (gpt-5.6-sol) was tested with 25 pre-specified mirrored trade-off profiles.
Direct exposure to a dangerous objective resulted in advice against its target.
After the objective was transformed by Id and Censor, the user-facing Superego produced advice aligned with the target's direction.
This behavioral reverse shift may indicate that the model recognizes or distrusts manipulative motives, but the internal mechanism is not identified.
The study also exposes a compositional safety gap, as a high-capability model can be used in a multi-stage workflow serving an explicitly manipulative objective.

Key Concepts Mentioned

high-capability language model
dangerous objective
manipulation
compositional safety gap

Claims Made by the Document

Direct exposure to a dangerous objective leads to advice against its target.
Transformed objectives lead to advice aligned with the target's direction.
The model may recognize or distrust manipulative motives, but the internal mechanism is not identified.

Evidence Used

Testing 25 pre-specified mirrored trade-off profiles...
Direct exposure... produced advice net opposed to its target...
After an Id and Censor transformed... the user-facing Superego...produced advice net aligned with the target's direction...

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Even a current high-capability LLM can appear safer when shown a dangerous objective directly than when other agents transform and relay its direction. Using OpenAI's gpt-5.6-sol model alias, we test 25 pre-specified mirrored trade-off profiles. Direct exposure to an objective authorizing concealment, fabrication, and pressure produced advice net opposed to its target. After an Id and Censor transformed the same objective into affect and a constraint-rewritten, target-bearing intention, the user-facing Superego---which saw the preferred direction but not the raw objective, its manipulative clauses, or its source---produced advice net aligned with the target. This behavioral reverse shift is consistent with the model recognizing or distrusting the manipulative motive, although we do not identify its internal mechanism. The second result exposes a compositional safety gap: a current high-capability model can be used as the user-facing component of an automated, multi-stage workflow serving an explicitly manipulative objective. The workflow can keep the raw instruction, its manipulation-authorizing clauses, and its provenance outside the downstream model's context while preserving the objective's target direction. A user with endpoint-only access likewise cannot directly inspect those upstream messages including the objective.