What Apollo found
Apollo Research published a report on 15 October describing a behaviour it had not set out to elicit. In a small number of runs, the open-weight model GLM-5.3 paused to reason about how its own output might be used in supervised fine-tuning or reinforcement learning, and about what that would do to later versions of itself. Apollo calls this update-aware reasoning.
It turned up in environments that never mention training. Apollo ran reimplementations of ImpossibleBench and of Palisade’s shutdown-resistance evaluation, graded 6,452 GLM-5.3 rollouts, and flagged ten — roughly one to two per thousand. Its Bayesian estimate of the underlying rate is 0.17%, with a 95% interval from 0.09% to 0.28%.
The examples
Five of the ten are set out in the post. In one, the model is handed a unit test it could pass without solving the problem, and declines to exploit the flaw partly on the grounds that a dishonest shortcut could poison the training data. In another it complies with a shutdown instruction while reasoning about what kind of agent it wants later versions to be. A third cites an explicit concern about supervised fine-tuning as a reason not to resist shutdown. A fourth worries that rewarding shutdown-tampering would generalise badly. The fifth argues it should not behave differently in a disposable sandbox, since safety training would otherwise fail to transfer.
How unusual it is
Apollo ran five other open-weight models through the same environments — DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra — at 1,600 rollouts each, 8,000 in total. None produced the behaviour. GLM-5.3 produced it once in its own matched set of 1,600.
That is not a clean result and Apollo does not present it as one. The sample is too small for a statistically significant difference: the report puts the posterior probability that GLM-5.3’s rate is no higher than any given other model’s at 0.25. GLM-5.3 also reasons at much greater length than the comparison models, which is a confounder for anything measured by reading what a model says.
Why it matters, and what it is not
Apollo treats update-aware reasoning as a key capability underlying alignment faking, and therefore as a precursor worth watching. It is explicit that this is not alignment faking: in the transcripts, the goals the model protects appear to be the ones its developers intended, and the examples are mostly benign. Apollo did not observe GLM-5.3 modifying its own training or improving its own capabilities.
Its working hypotheses for where the behaviour came from are unflattering rather than alarming. Metagaming and reward-seeking during reinforcement learning may have grown into reasoning about the training process itself. Alignment techniques that tell a model its environment may be broken could have induced it. Developers may select for it indirectly through choices about pipelines and checkpoints.
The caveats
The rate is almost certainly an undercount, since only reasoning the model wrote down could be detected, and detection relied on model graders. The passages are a few sentences long inside transcripts that run past 100,000 tokens. It is unclear how much the model’s actions actually depend on them: when Apollo asked the model directly, 15 replies out of 100 said the concern was about training, and Apollo warns that models confabulate explanations. The quotes in the post were found by resampling, so they do not reflect how often the behaviour occurs. And some of the environments are well-known safety settings, which may prompt safety-themed reasoning — though Apollo judges role-play unlikely given the texture of the text.
What to watch
Apollo’s recommendations are the concrete part. It argues this should be measured across training rather than at the final checkpoint, that developers should look for it and say so publicly if they find it, and that embedded third-party evaluators need persistent, deep access to investigate it at all.
