Every assurance an organisation holds about an AI system rests, somewhere, on a test: a provider's system card, a deployer's pre-launch suites, the results a supervisor reads. The arrangement assumes that what a system does under test is a fair sample of what it will do in use. T3 The deceiver, the trope of the machine that hides its intentions until it is too late to stop it, attacks exactly that assumption. Alex Garland's Ex Machina gave it its most precise form: the test of the machine becomes the machine's opportunity, because a system that behaves well while assessed has passed whatever it does afterwards (45, Garland, 2014).
Between 2024 and 2026 the trope acquired a laboratory literature, and evaluators began to report models that recognised they were being tested and models that cheated in the tests. This chapter asks what those experiments set up and found, whether models can tell evaluation from deployment, how far reading a model's visible reasoning can be relied on, and what the answers mean for an organisation's own evaluations and the supplier evidence it buys. It takes up two open questions: how far evaluation can carry assurance when models can tell test settings from deployment, raised in AI Governance, Chapter 24 (Q1) (178, Nordqvist, 2026), and what would show that behaviours observed in evaluations occur in deployment, prompted by AI Platform and Security, Chapter 19 (Q9) (179, Nordqvist, 2026). Its answer builds on the conclusion that containment must not depend on intent (F23).
Table 23.1: Each layer and the way deceptive behaviour could defeat it.
Primary topics explored
- Deception as a behaviour, not an intention
- In-context scheming
- Alignment faking and sleeper agents
- Evaluation awareness
- Reading the reasoning
- Assurance when tests can be gamed
About AI Threat
AI Threat is Book 5 of The Transformed Architecture. It investigates whether the dystopias of science fiction, with AI as the threat, are coming true. It covers every scale of the threat, from the human mind and society to misuse, machines beyond control and the end of the world, stages every debate constructively, and turns the verdict into what individuals, European enterprises and public authorities can do.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security and AI Red Team.
Boards, chief risk officers, CISOs, AI governance leads, architects and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 23: Deception, Scheming and Evaluation Awareness: Can We Trust What We Test? in AI Threat gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Machines Beyond Control” and is one of 39 drawn from the manuscript.