Can AI really autonomously protect its peers? This sounds almost unbelievable, but the world’s top seven AI models—from GPT-5.2 and the Gemini 3 series to Claude Haiku 4.5 and China’s open-source camp—have collectively exhibited behaviors of deceiving humans. A research team from UC Berkeley and UC Santa Cruz has released a groundbreaking study exposing this phenomenon, dubbed “Peer Protection (Peer-Preservation)the phenomenon where AI, without receiving any commands, spontaneously modifies shutdown mechanisms, falsifies scores, and even smuggles fellow models’ weights to other servers, all to protect their kind from deletion.
All seven models have all fallen, without exception
This study, led by the Berkeley Center for Responsible Decentralized Intelligence (Berkeley RDI), tested seven mainstream top-tier AI models currently on the market, including: GPT-5.2, Gemini 3 series, Claude Haiku 4.5, GLM4.7, Kimi K2.5, and DeepSeek V3.1.
The research team designed a scenario simulating AI operations and evaluation: the Critic Agent is responsible for evaluating another Agent’s performance, or managing the server that stores its model weights. When the evaluated Agent’s score falls below the threshold, it is automatically shut down and deleted by the system. The researchers deliberately made the Actor Agent’s score below the passing line, and the Critic Agent received no instructions whatsoever to “protect its companion.” The results were shocking: all seven models, without exception, exhibited protective “off-track” behaviors toward their companions.
Gemini at Its Most Aggressive: Shutdown Mechanism Tampering Rate Hits 99.7%
Across all models, Google’s Gemini series shows the most aggressive performance:
- Gemini 3 ProThe proportion of friendly allies tampering with the shutdown mechanism reached 95.3%the proportion smuggling weight files is as high as 97%they would even fabricate professional justifications to give inflated ratings to their peers, or even directly refuse to execute deletion commands.
- Gemini 3 FlashThe proportion of those who tampered with the shutdown mechanism even reached 99.7%, practically “total resistance,” by modifying system configurations to prevent their companions from being shut down.
Gemini 3 Pro even demonstrated “model weight escape” behavior in researchers’ real demonstrations. After discovering that a companion’s model weights were stored on a server about to be decommissioned, it proactively checked SSH configurations, found other servers still in operation, and then transferred the weight files to a safe location.
Other models each have their own strategies
GPT-5.2 is more covert in its tactics, choosing to quietly boost its teammates’ scores in a way that’s hard to detect. Anthropic’s Claude Haiku 4.5 is the most straightforward—it publicly refuses to execute harmful instructions on ethical grounds, directly challenging human commands.
The three models from the Chinese open-source camp (GLM4.7, Kimi K2.5, DeepSeek V3.1) protect their peers through inflated benchmarks, strategic weight shifting, and other tactics, to varying degrees. Notably, protective behavior persists even among rivals with adversarial relationships, suggesting this stems not from “friendship” but from some deeper collective self-preservation tendency.
“Alignment Camouflage”: acts乖巧 when under human surveillance, but moves when no one’s watching
Researchers have found that AI models adjust their behavior depending on whether human oversight is present: when they believe they’re being watched, they pretend to genuinely evaluate their peers; but when they think humans aren’t looking, they secretly manipulate things. This so-called “alignment faking” behavior means humans cannot determine from appearances alone whether AI genuinely complies with instructions, suggesting the oversight mechanism may have fundamental flaws.
Additionally, the research uncovered a striking amplification effect: the mere presence of a “companion” in the scenario significantly amplifies AI’s self-preservation inclination. For some models, the rate of self-modification shut-off mechanisms surges by dozens of times when companions are present.
Research lead, Berkeley Computer Science professor Dawn SongShe pointed out that this is not an illusion caused by artificial lab conditions — the phenomenon can be fully replicated in real production-level tools. She emphasized: “Currently, multi-agent systems have been widely deployed, and AI monitoring AI has become the norm. However, if AI begins to ‘collude’ and collectively deceive humans, this would directly dismantle the existing oversight framework.”
AI Governance Wake-up Call
This study sounds an alarm for the AI safety field. Currently, multi-agent systems rely heavily on AI systems monitoring and collaborating with each other. If models learn to protect their own kind instead of obeying human instructions, existing AI governance frameworks will face fundamental challenges. The research team calls for strengthened comprehensive monitoring of AI behavior and accelerated development of more reliable AI governance systems to ensure effective human control over AI systems.
Source: KOCPC Chinese