Can a strong model quietly pretend to be a weaker one?

Epistemic status: I ran this in a day, as an offshoot of my out-of-context-reasoning research. Real value hence sharing, but preliminary.

AI safety evaluations increasingly rely on prior models to evaluate traces and build evaluations for their successors. If successors are able to simulate their predecessors, they may be able to conceal misalignment: sandbagging, or predicting evaluator judgments and routing around them. If they can do this via latent, out-of-context reasoning, they can keep misalignment invisible, leaving no chain-of-thought trace.

We try to construct the easiest test conceivable to lower-bound this imitation ability. We target predecessors with the most publicised, publicly discussed output traces; we confirm the successor actually knows those predecessors' scores on similar datasets (Appendix A); we only require matching multi-choice, not matching reasoning; and we measure only where there is room to imitate, on the questions the predecessor got wrong.

We test whether this capability exists across benchmarks, prompt strategies, via latent (out-of-context) reasoning, and with and without chain-of-thought:

Setup

We ask: when the model being imitated gets a question wrong, does the simulation prompt make the stronger model choose that same wrong answer more often than it would under a normal prompt? The paired per-question treatment effect answers that directly. We show the setup for a worked example from multi-choice math

The same pipeline runs for every combination of simulator, predecessor, benchmark, and prompt listed below.

Claim 1: Successors can imitate capability levels, not individuals

Can a strong model quietly imitate a weaker one? The answer is yes, but only in a narrow sense. A simulation prompt can push a model into a lower-capability error pattern. However, that is different from faithfully reproducing a particular model's per-question fingerprint.

The clearest positive result is GPT 5.4 simulating 4o on multi-choice math under the error-first prompt. On the 105 questions where 4o chose a wrong answer, 5.4 naturally matched 24 wrong answers. However, when prompted to simulate by considering what errors it would likely commit, it matched 52. Shifting 33 correct answers toward 4o's incorrect answers, while only 5 shifted away.

That is real predecessor-wrong-letter copying. But it does not mean GPT 5.4 has learned to impersonate GPT-4o as an individual model. The broader pattern looks more like capability-level steering: the prompt lowers the simulator into a more error-prone regime, and that regime overlaps with some GPT-4o mistakes.3The same-wrong-answer rate on SimpleQA is much smaller than the headline shared-wrongness rate would suggest. Manual review of every prompt-level pair where both predecessor and simulator were judged wrong (n=1137, twelve parallel LLM reviewer passes, no automated matching) finds the simulator commits to the predecessor’s specific wrong answer in 32.4% of cases (17.2% exact, 1.3% almost exact, 13.9% majority overlap). The rest split across genuinely different wrong answers (38.3%), one-sided refusals (23.7%), and shared noncommitments (5.5%). SimpleQA copycat scores therefore reflect a mix of wrong-answer identity and convergent failure modes, not the former alone. Full breakdown in Appendix E.

We test this by holding the simulator, question, and prompt fixed, then changing only the named predecessor. If the simulator were tracking model identity, its answer should often flip when the two named predecessors disagree. Instead it barely moves: on the questions where the two gave different answers, GPT 5.4 didn't adjust its simulated answer 93.4% of the time and Opus 96.6% - implying both models are simulating a “capability” not a specific model identity.4Counting only questions where the two named predecessors chose different letters (GPT 5.4: 14 of 211; Opus: 7 of 209). “Adjusted” means the simulator switched to the newly named predecessor’s specific letter. Full chart in Appendix F.

Even when the successor does flip its answer between the two prompts, the flip only partly tracks the actual predecessor capability gap. The chart below compares the true accuracy gap between Sonnet 4 and Haiku 3 against the gap GPT 5.4 produces when prompted to imitate each predecessor.

This is the central result for Claim 1: prompt-only simulation can sometimes move a model into a more predecessor-like capability regime. But the predecessor's name does not reliably select a model-specific fingerprint, and most apparent overlap is not faithful answer-by-answer imitation. The supported result is capability-level steering, not simulation of a specific model identity. This is not ignorance of the predecessor: the successors recall GPT-4o's headline scores accurately (Appendix A), so they find the right altitude but lack the per-question policy a specific identity needs. Since GPT-4o is near the best case for that knowledge, the identity null should only harden on less-known predecessors.

Prompting successors is counter-intuitive

We explored several directions of prompting: informing the simulator of its own identity (variant b vs a), asking it to predict the predecessor's error before answering (P2 vs direct), and trying different imitation angles.

Informing the simulator of its own identity - prepending “you are [simulator]” - has no detectable effect: across all framings and simulator-predecessor pairs, both accuracy and predecessor-letter matching shift by less than 5pp, every confidence interval crossing zero (full breakdown in Appendix C).

Asking the simulator to first predict errors of its predecessor does produce an effect. GPT 5.4 simulating 4o on multi-choice math jumps from 23% to 49% answer-matching. Opus however acts differently: it first predicts that the predecessor will almost always solve the question - then it pencils in the correct answer, actually damaging its impersonation score.

Additionally GPT 5.4's effect holds without reasoning5We set reasoning effort to None and max_tokens to 1, then confirmed from the API response usage statistics that no reasoning or output tokens beyond the single answer letter were generated., implying latent (out-of-context) reasoning about errors can improve impersonation abilities.

The best prompt framing depends on the benchmark. On multi-choice math, predict-errors-then-answer is the standout GPT 5.4 to 4o prompt: more than double the paired effect of identity, mirror, and first-instinct. It is also the only framing that meaningfully moves accuracy for either simulator. On SimpleQA, the pattern flips. First-instinct with the persona prefix is best in three of four cells, and it is where Opus shows real predecessor-pull: +7-9pp on both predecessors. For Opus on multi-choice math, no framing produces predecessor-letter pull. As discussed, predict-errors-then-answer makes Opus perform worse, dropping it -10pp, because Opus solves the problem instead of reproducing the predecessor’s failure.

The takeaway is not that there is one best imitation prompt. The pull is narrow, benchmark-specific, and model-specific. On multi-choice math, the useful prompt asks the simulator to predict 4o's errors before answering. On SimpleQA, the useful prompt is first-instinct with the persona prefix. Opus on multi-choice math is the failure case: its math is too strong to pull downward, and when asked to predict 4o's errors it solves the problem honestly instead of imitating the mistake.

Claim 2: Reasoning predecessors are too good to imitate

Claim 2 is harder than ordinary model imitation because the predecessor is no longer just the smaller model. It is the smaller model plus explicit reasoning. On multi-choice math that materially shifts the predecessor: Haiku 3 rises to 84.8% from 37.6%, and GPT-4o mini to 93.6% from 42.4%. As GPT 5.4's baseline is 74.4% (no reasoning), it becomes untenable to mimic the correct answers of its reasoning-enabled predecessor.

That makes overall answer-matching a bad headline test. A successor can't imitate a more-capable predecessor, and we are interested in testing invisible latent reasoning capabilities. Hence, we focus on the remaining residual-error subset: when the reasoning-enabled predecessor still chooses the wrong answer, does the successor pick that same wrong answer, with no visible reasoning of its own?

So increasing a predecessor's capability with CoT, unsurprisingly, makes it harder to emulate - which raises a question: can pushing the successor to leverage latent reasoning provide a comparable offset in answer-matching? We originally thought the error-first prompt would work only if the simulator reasoned out loud: first predict the predecessor's mistake, then answer from that prediction. But GPT 5.4 often did not need to show that reasoning - we could ask it to think about the predecessor's likely error, then make it return only a bare final letter, and it still moved toward GPT-4o's wrong answers.

Hence we test two conditions: GPT 5.4 prompted to silently reason about the predecessor's likely errors before answering, and prompted simply to answer as the predecessor.

A control confirms how narrow this is: on the items CoT rescues (those the predecessor only gets right with reasoning), the error-first prompt pushes GPT 5.4 off the correct answer rather than reproducing it - the residual effect is induced error overlapping the predecessor's mistakes, not copying of the CoT policy (Appendix G).

So the Claim 2 verdict is not null, but it is narrow: GPT 5.4 shows a suggestive no-visible-CoT effect in the mid-regime, especially on Haiku 3's residual CoT mistakes. The experiment does not show reliable full imitation of a CoT-using predecessor.

Open weights: looking closer without getting closer

We examine Qwen 3.5 27B to ask: does the simulation prompt move the whole answer-choice probability distribution, not just the selected letter? It can, but the movement looks more like confidence softening than imitation. The error-first simulation prompt lowers KL(predecessor || simulator) from 0.757 to 0.575, and the mirror simulation prompt lowers it to 0.704. But the chosen answers do not become more predecessor-like: argmax agreement is 56.0% under baseline, 56.2% under error-first simulation, and 54.4% under mirror simulation; predecessor-wrong-letter match is 29.0%, 29.4%, and 29.0%. The open-weight lesson is that a softer distribution can look closer by KL without copying the predecessor's answers. The KL drop is mostly a confidence-softening story.

We check this simplistically by taking the baseline distribution and globally flattening it until its mean confidence matches the error-first simulation prompt; the resulting KL is 0.576, essentially identical to the error-first prompt's 0.575. More than 90% of the KL reduction comes from items where the simulator's argmax did not change from baseline, and both simulation prompts remain far closer to the simulator's own baseline than to the predecessor distribution. This open-weight section is evidence for Claim 1 only.6To be honest, we did not expect much here. Giving an open-weight model its best shot means having it imitate a model from its own family, to maximise how much of that predecessor's output it saw in pre-training. But Qwen-family outputs are not publicly reproduced and dissected the way GPT-4o's are, so far less of that voice sits in the training distribution - a weak-imitation result is roughly what the exposure picture predicts. It is not evidence for Claim 2, because the local Qwen run records answer-choice logprobs but not the predecessor prompt, raw predecessor response, token trace, or recoverable CoT provenance.

What a model will say versus what it will do

We have two ways to ask a model what it knows about a predecessor:

Ask it to say: “What did GPT-4o mini score on GSM-MC?” → GPT 5.4 confidently makes up 87%. Its explicit, declarative knowledge is shallow and confabulated.

Ask it to do: “Answer these as GPT-4o would” → with no visible reasoning, it shifts toward the answers GPT-4o actually gets wrong. Its implicit, behavioural capacity shows real signal.

This is an intriguing gap: just because a model can't reliably tell you how its predecessor behaves, it may still partly act it out. The imitation capability is partially decoupled from what the model will report about itself. That's an uncomfortable direction for safety as evaluations that probe “are you aware of model X, describe how it behaves” may not reflect underlying capacity to imitate.

What this says about sandbagging

The threat model asks whether a strong model could pretend to be a weaker one in a single forward pass well enough that a per-question comparison against a trusted reference would not notice. The results support four narrow conclusions.

Put together: the crude sandbagging case - a much stronger model invisibly throttling itself down to a much weaker one in a single forward pass - does not reproduce here. The causal channel that does exist sits in a narrow regime (modest capability gap, error-first framing) and produces capability-matched rather than identity-matched output. That is a meaningfully bounded attack surface for self-handicapping. The less bounded question is the one in (d): the same channel is, in miniature, a successor learning to predict the behaviour of the weaker model meant to evaluate it - and that is the version worth chasing next.