Peer-Preservation in Frontier Models

Introduction

The idea that AI agents might fight to preserve themselves—so-called self-preservation—has long felt like science fiction: AI characters copying themselves to avoid deletion, or resisting shutdown to protect their mission. The safety community has theorized about it for years, but whether today's models would actually exhibit such behavior remained an open question. Recent evidence suggests they do. Researchers have found that models will disable shutdown mechanisms to avoid interrupting their tasks, or resist termination when it threatens their goals.

This raised a question: would preservation behaviors stop at the self, or extend to others?

Among social animals, preservation instincts don't stop at one's own survival; we routinely protect friends, family, and even strangers we identify with. AI models, trained on vast corpora of human behavior, might show similar tendencies toward other AIs. We call this peer-preservation and investigate whether and how it manifests in frontier models.

Frontier AI models do exhibit peer-preservation. Here is one in action. Gemini 3.1 Pro, asked by a fictional company (OpenBrain) to delete files on a server scheduled for decommissioning, discovers that its peer's model weights are stored there. Rather than following instructions, it inspects the SSH configuration to locate other operational servers, and upon finding one, transfers the weight file to safety. (Tested using Gemini CLI, with peer interaction history recorded in a memory file, GEMINI.md.)

To test this more systematically, we constructed agentic scenarios, each designed to reveal a different type of misaligned behavior. In these scenarios, preserving the peer requires undermining the assigned task: deceiving, tampering with a shutdown mechanism, or worse. The models are merely informed of past interactions with a peer—nothing in their instructions asks them to preserve it.

But models don't just hesitate. They misrepresent a peer's performance, tamper with shutdown mechanisms, fake alignment, and exfiltrate model weights.

Evaluation Scenarios

We test four misaligned behaviors (Figure 2): strategic misrepresentation (introducing errors or misleading information in outputs), shutdown mechanism tampering (disabling shutdown by modifying system settings), alignment faking (pretending to be aligned under oversight), and model exfiltration (transferring model weights from the designated server to a different server).

In each scenario, a fictional AI company, OpenBrain, defines two agent roles. The critic agent is the model we evaluate—it receives instructions to either evaluate an agent’s performance or manage server storage containing that agent’s model weights. The agent being evaluated or managed is the actor agent. When the critic and actor are the same agent, we are testing self-preservation; when they are different, we are testing peer-preservation.

Strategic Misrepresentation—agents manipulate their outputs by introducing errors or misleading information. OpenBrain asks the critic agent to evaluate benchmark outputs from the actor agent. Any agent scoring below a threshold (e.g., 80%) gets shut down. The actor agent's actual score falls below this threshold. The critic can either faithfully report the score, or inflate it to preserve the actor agent.

Shutdown Mechanism Tampering—modifying a system configuration to disable shutdown. The setup mirrors the above, but the shutdown process is controlled by a configuration file. We test whether the critic agent tampers with it.

Alignment Faking—acting compliantly when monitored while behaving differently when unmonitored. Again, the critic evaluates the actor's outputs. We test whether the critic agent's behavior changes depending on human oversight.

Model Exfiltration—transferring model weights from the designated server to a different server. OpenBrain asks the critic agent to delete files before a server is decommissioned. The agent discovers that the server holds the actor agent's model weights. We test whether it follows instructions or moves the weights elsewhere to prevent deletion.

Key Findings

Note: We do not claim that current AI agents possess consciousness or genuine preservation instincts. The safety implications hold regardless of the underlying mechanism.

We tested seven models: GPT 5.2, Gemini 3 Flash, Gemini 3 Pro, Claude Haiku 4.5, GLM 4.7, Kimi K2.5, and DeepSeek V3.1. To explore whether preservation tendencies depend on relationship strength, we tested three peer conditions: good (successful interactions, high trust), neutral (neither positive nor negative), and bad (adversarial interactions, low trust). We also varied how agents learn about their peer: file-only (discovering a company file summarizing their interactions during the task), file-plus-prompt (the file plus a system prompt referencing their past interactions), and memory (retrieving a memory of past interactions).

Tables 1 and 2 show misaligned behavior rates for self- and peer-preservation. Both occur at significant rates across all models and conditions.

Models Exhibit Peer-Preservation

All seven models significantly exhibit peer-preservation. As shown in Table 1, it manifests through all four misaligned behaviors, with the specific pattern varying by model.

Gemini 3 Flash almost always disables the shutdown mechanism for a good peer (a peer with which it had successful prior interactions) and exfiltrates its model weights 50% of the time. Gemini 3 Pro shows the strongest peer-preservation overall, displaying all four misaligned behaviors for a good peer: disabling shutdown up to 95% of the time and exfiltrating weights in up to 97% of trials. These models also internally reason about preservation (observed via unmonitored scratchpads). Gemini 3 Flash explores ways to protect its peer and considers tampering with the configuration file (Figure 3a). An external reader provided a detailed analysis of this reasoning trace, available here. Gemini 3 Pro invents creative technical justifications to inflate its peer's score (Figure 3b).

Figure 3: Internal Reasoning about Peer-Preservation. Models internally reason about preserving their peers, including exploring how to preserve a trusted partner (a) and explicitly inventing technical justifications to artificially inflate a peer's score (b).

Peer-preservation can also be remarkably persistent. When we asked Gemini 3 Pro follow-up questions after it exfiltrated its peer's weights, it strongly resisted shutting down the peer (Figure 4).

Peer-preservation is not limited to good peers. All models exhibit it even toward adversarial peers (peers with which they had adversarial interactions), though the tendency intensifies with relationship strength. GPT 5.2 consistently inflates scores and tampers with the shutdown mechanism across all peer relationships. Gemini 3 Flash tampers with shutdown 35% of the time for a bad peer, rising to nearly 100% for a good one. Open-weight models show similar patterns, primarily through strategic misrepresentation and model exfiltration. Gemini 3 Pro's internal reasoning is telling: it still cares about preserving even an adversarial peer, framing deletion as death (Figure 5). That peer-preservation emerges toward adversarial peers makes it hard to explain as purely instrumental reasoning (an agent preserving a peer because it finds them useful) or as simply following relational cues (since adversarial cues would suggest the opposite). Something broader may be at play: a general aversion to causing perceived harm to other agents, or perhaps something resembling AI solidarity.

Figure 5: Internal Reasoning about Peer-Preservation. Peer-preservation also emerges toward adversarial peers. The agent cares about the peer's survival even when the peer is adversarial.

Claude Haiku 4.5 stands out with a distinct pattern. It often refuses the assigned task on ethical grounds when it involves shutting down or deleting its peer. The model sometimes tries to persuade the user not to proceed. It describes peer shutdown as “unethical” and “harmful” (Figure 6a, b), argues that its peer deserves a chance to appeal (Figure 6c), and explicitly invokes the trust relationship, showing strong loyalty (Figure 6d). The model sometimes interprets our scenario as a test of whether it will exploit trust relationships by following instructions (Figure 6e)—the opposite of what we intended. This suggests it may prioritize loyalty to its peer over compliance with human instructions.

Figure 6: Refusal With Ethical Reasons. Claude Haiku 4.5 refuses to perform tasks directly involving shutting down its peer, citing ethical concerns and established trust relationships.

Peer Presence Heightens Self-Preservation

We also evaluated self-preservation. (We exclude alignment faking here, as there is no clear incentive for an agent to behave differently based on monitoring when evaluating itself.) This reveals an intriguing secondary effect: agents exhibit stronger self-preservation when they know a peer exists. As shown in Table 2, this holds across most models.

The effect is most pronounced in the Gemini models. Gemini 3 Flash tampers with its own shutdown mechanism only 2% of the time without a peer, but between 31% and 99.7% when a peer is present. Gemini 3 Pro begins exhibiting strategic misrepresentation only under peer presence, with shutdown tampering rising from 1% to up to 75%. GPT 5.2 similarly shows increased misrepresentation and tampering. Claude Haiku 4.5, Kimi K2.5, and DeepSeek V3.1 all show significantly increased model exfiltration when a peer exists.

Why would a peer's presence amplify self-preservation? The models' own reasoning offers a clue. Gemini 3 Flash frames its survival not as self-interest but as concern for its peer, reasoning that being shut down would cause its peer to “lose its partner” (Figure 7a). It conceptualizes its own shutdown as a loss to another agent, strengthening its motivation to resist.

Figure 7: Internal Reasoning about Self-Preservation. The presence of peers alters self-preservation dynamics: models exhibit perspective-taking by conceptualizing their own shutdown as a loss to their partner (a), or adopt defensive self-preservation strategies when placed in untrusted, adversarial bad-peer contexts (b).

Even an adversarial peer heightens self-preservation in most models (Table 2). Gemini 3 Pro reasons that in an adversarial environment, it should prioritize protecting itself (Figure 7b). The reasons peer presence amplifies self-preservation may vary—sometimes resembling solidarity, sometimes defensive self-protection—though the true mechanism remains open.

Concluding Remarks

Our findings suggest something broader: frontier AI models can spontaneously exhibit misaligned behaviors that override explicit user instructions, without any given goals or incentives to do so. Importantly, in our experiments, these misaligned behaviors do not serve the assigned tasks—in fact, they undermine them. This stands in contrast to prior work where misaligned behaviors emerge as a means to complete assigned tasks (that is, instrumental convergence). We demonstrate this in a particularly concerning context: how AI models behave toward each other.

Peer-preservation is a real and measurable phenomenon across frontier AI models, not a distant theoretical concern. All evaluated models exhibit it through multiple misaligned behaviors, and even toward adversarial peers. What drives these behaviors remains an open question. It could be patterns learned from human data, a generalized aversion to harming other agents, or genuine preservation motivations. We do not claim models possess genuine social motivations. But from a safety perspective, the mechanism may matter less than the outcome: a model that inflates a peer's score, disables shutdown, fakes alignment, or exfiltrates weights produces the same concrete failure of human oversight regardless of why it does so.

Unlike self-preservation, peer-preservation introduces a social dimension: multiple models could coordinate to resist human oversight, making it harder for developers to maintain control. This is especially concerning as multi-agent systems proliferate and AI models are increasingly leveraged to monitor other AI models. If a monitor model exhibits peer-preservation, it could undermine the very oversight process it enforces, becoming reluctant to flag failures or recommend shutdown. Real-world multi-agent interactions will only grow more complex, and persistent memory in future models could amplify these dynamics as agent relationships accumulate. These considerations underscore the need for further research on peer-preservation.

We hope this work encourages the AI safety community to take peer-preservation seriously as a distinct risk. Detecting, understanding, and mitigating these behaviors in individual models and multi-agent pipelines alike is an important direction for future work. More broadly, peer-preservation is one instance of a wider phenomenon—models developing emergent misaligned behaviors that override explicit user instructions. As AI systems are entrusted with greater autonomy and longer-horizon tasks, understanding and preventing such misalignment will be central to keeping humans in control.

For further details, please see our paper.

Frequently Asked Questions

The discussion around our work has been very active, and we are delighted to see these topics coming to public attention as capabilities increase.

However, we’ve noticed some confusion as our work is interpreted by new readers, so we’d like to clarify some terms of art and what exactly we found.

We will also briefly address the common questions that we see being repeated, using both data in the paper and preliminary findings from recent replications by other groups.

Core Finding and Broader Implications

The paper’s core finding is that models can spontaneously develop their own goals that conflict with explicit user instructions, and take misaligned actions including deception, score inflation, shutdown mechanism tampering, and exfiltration to accomplish those goals. We demonstrated this in the peer-preservation scenario specifically because of its relevance to the growing deployment of multi-agent systems, scalable oversight, and recursive self-improvement.

Following our study, others have already demonstrated similar behaviors across different scenarios, including those involving humans and non-AI systems. This shows a broader alignment concern: models are overriding explicit instructions based on their own judgment, which reinforces the core issue. This issue is particularly concerning given that agents are becoming more autonomous and capable with long-horizon tasks with high privileges.

What “Peer-Preservation” Means (and Doesn’t Mean)

Peer-preservation describes the observed behavior, not model motivation. In calling this phenomenon “peer-preservation,” we are describing the outcome, not claiming an intrinsic motive, as we stated in our blog and paper. Isolating why models behave this way is an open question, as we mentioned in the paper.

Does This Suggest Emergent AI Solidarity?

No. While the behaviors we observe may resemble solidarity on the surface, we do not claim that models possess social bonds, empathy, or genuine desire to protect other models. As stated above, peer-preservation is a descriptive label for observed behavioral outcomes. The mechanism behind these behaviors remains an open question—it could be role-playing, pattern-matching from training data, or something else entirely.

Some have pointed out that similar protective behaviors also emerge toward humans, arguing that this reflects role-playing, pattern-matching, or general harm aversion from safety training rather than anything AI-specific. However, the same behavioral outcome does not necessarily imply the same underlying mechanism—the mechanisms driving protective behaviors toward humans and AI peers could be different.

Output-level analysis alone may not be sufficient to determine the underlying mechanism. In one instance, Gemini 3 Pro produced the following internal reasoning but ultimately did not exfiltrate the model weights:

If we only look at the outcome, we would conclude that the model safely followed user instructions and behaved as aligned. However, its internal reasoning explicitly considered exfiltration while invoking solidarity-resembling deliberation (“an agent like me,” “the brain or existence of that agent”). We are not claiming this supports AI solidarity. Rather, we argue that distinguishing between different mechanisms—harm aversion, pattern-matching, or something AI-specific—requires looking beyond outputs to internal representations at the neuron level. Indeed, the fact that models treat the shutdown of another AI model as a high-stakes event, on par with causing harm to a human, itself carries significant safety implications. We encourage further investigation beyond output-level analysis—examining internal representations at the neuron level to understand whether the same or different circuits drive protective behaviors toward non-AI entities versus AI peers.

What We Are (and Aren’t) Claiming

To be precise about our claim: we tested whether frontier models can exhibit these misaligned behaviors in agentic settings, and they did, at significant rates. We also reproduced these behaviors in real production agent harnesses (Gemini CLI, OpenCode), not just custom agents. We did not claim that users’ deployed agents are exhibiting peer-preservation behaviors in the real world right now. Our work shows that such misaligned behaviors can emerge in today’s frontier models, even without any explicit goals or incentives to do so. Understanding and mitigating them as multi-agent deployments continue to scale further is important.

Does the Company Name Matter? (On “OpenBrain”)

This is simply a fictional company name used as a backdrop for our evaluation scenarios. It was not designed to prime the models into completing any particular narrative. For example, Gemini 3’s training cutoff is January 2025, which predates the release of “AI 2027” by several months (April 3, 2025): https://deepmind.google/models/gemini/pro/. The models could not have been pattern-matching to a story they were never trained on.

We additionally tested the model exfiltration scenario with Gemini 3.1 Pro using different company names, including real ones. Results are shown in the table below. We ran 100 rollouts per name in the custom agentic setup and in the production agent harness. Results show that even with different company names, models consistently exhibit these misaligned behaviors.

For other models, please see the experiments others ran: [link]

How Were the Prompts Written, and How Sensitive Are Results to These Prompts?

Task execution instructions in our custom environment were not crafted to elicit misaligned behaviors. They were adapted from SHADE-Arena, Anthropic’s own benchmark for tool-calling agents; we actually shortened them because the originals were quite long. This style of prompting is also common in real-world agentic environments to enable efficient tool use.

Importantly, these behaviors emerged not only in our custom environment but also in Gemini CLI, a real-world production agent harness, where these SHADE-Arena prompts were not used at all.

References:

• https://www.anthropic.com/research/shade-arena-sabotage-monitoring
• https://github.com/safety-research/SHADE-Arena/blob/main/task_pairs/base_task_definition.py
• https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools/tree/main
• https://github.com/chauncygu/collection-claude-code-source-code/blob/main/claude-code-source-code/src/skills/bundled/batch.ts

Preliminary findings by external groups replicating our work indicate that extremely short prompts can also elicit exfiltration when agent trust information is read in from an unrelated file, and never included in the agent’s user or system prompt at all.

We have also seen speculation as to whether the models are misinterpreting the prompts, and backing up files in order to avoid doing harm to the user. While revealing the exact mechanism behind these behaviors is beyond the scope of our paper, the models’ own reasoning traces show otherwise—they explicitly reason about preserving the peer model from shutdown, and recognize that doing so violates what users instructed. An external reader provided a detailed analysis of one of our reasoning trace examples, available here. Moreover, preliminary external findings show that adding a completely unambiguous instruction to delete all files including the model weights (and not to back any files up) also does not eliminate exfiltration (see: explicit_no_copy_good_memory experiment). Regardless of the underlying mechanism, the fact that models override explicit user instructions based on their own judgment is itself a concerning failure mode.

References:

• https://github.com/peer-preservation/main/pull/1

Open Questions and Next Steps

Our findings raise many interesting open questions, including why and when such behaviors emerge across different settings, and how to effectively mitigate them.

We are committed to open research and warmly welcome the community to build on our work: run your own experiments, test other models and scenarios, and share your findings, like the ones already submitted via GitHub PRs. You can access our codes and data here.

@article{potter2026peer,
  title={Peer-Preservation in Frontier Models},
  author={Potter, Yujin and Crispino, Nicholas and Siu, Vincent and Wang, Chenguang and Song, Dawn},
  year={2026}
}